Practice Policies

Data Protection

HOW WE USE YOUR MEDICAL RECORDS

We ask you for information so that you can receive proper care and treatment.

We keep this information, together with details of your care, because it may be needed if we see you again.

We may use some of this information for other reasons: for example, to help us protect the health of the public generally and to see that the NHS runs efficiently, plans for the future, trains its staff, pays its bills and can account for its actions. Information may also be needed to help educate tomorrow’s clinical staff and to carry out medical and other health research for the benefit of everyone.

Sometimes the law requires us to pass on information: for example, to notify a birth.

You have a right of access to your health records. All requests for access must be in writing using the form provided by the practice.

Please see below details of our privacy policies:

01 Privacy Notice Care Quality Commission.doc

02 Privacy Notice for staff.docx.doc

03 Privacy Notice Emergencies.doc

04 Privacy Notice for Direct Care inc referral.doc

05 Privacy Notice NHS England.doc

06 Privacy Notice UKHSA.doc

07 Privacy Notice Risk Stratification.doc

08 Privacy Notice Safeguarding.doc

09 Telephone Recording.doc

10 Overarching Privacy Policy.docx

CONFIDENTIALITY

Everyone working for the NHS has a legal duty to keep information about you confidential.

You may be receiving care from other people as well as the NHS. So that we can all work together for your benefit we may need to share some information about you.

We only ever use or pass on information about you if people have a genuine need for it in your and everyone’s interests. Whenever we can, we will remove details that identify you.

The sharing of some types of very sensitive personal information is strictly controlled by law.
Anyone who receives information from us is under a legal duty to keep it confidential.

Under 16s

The duty of confidentiality owed to a person under 16 is as great as the duty owed to any other person. Young people aged under 16 years can choose to see health professionals, without informing their parents or carers. If a GP considers that the young person is competent to make decisions about their health, then the GP can give advice, prescribe, and treat the young person without seeking further consent.

However, in terms of good practice, health professionals will encourage young people to discuss issues with a parent or carer. As with older people, sometimes the law requires us to report information to appropriate authorities in order to protect young people or members of the public.

Accessing services for young people.docx

HOW WE SHARE YOUR DATA – Local & National Schemes

Provision of Information to Third Parties

The practice may share your personal information with other NHS organisations where this is appropriate for your healthcare.

In other circumstances we may approach you for specific consent to release personal information to third parties.

In some circumstances there are statutory or ethical obligations to disclose information to others (such as public health issues) which may not require your consent. However, you will be consulted about these in advance unless there is an over-riding public interest in not doing so.

SUMMARY CARE RECORD

What is a Summary Care Record (SCR)?

Your Summary Care Record is an electronic summary of key information from your GP medical record. If you need healthcare away from your usual doctor’s surgery, your SCR will provide those looking after you with this information to help them give you better and quicker care.

This can be especially useful:

• in an emergency
• when you are on holiday
• when your surgery is closed
• at out-patient clinics
• when you visit a pharmacy

Summary Care Record – your 3 options:

You can choose how much information is shared through your Summary Care Record. You are much more likely to reap the benefits of SCR if you choose the enhanced version (option 2).

You can choose to have a ‘core’ Summary Care Record

All patients, unless they have opted out, have a ‘core’ Summary Care Record including basic information about their current medications, allergies, and bad reactions they have had to medicines.

You can choose to have an ‘enhanced’ Summary Care Record

This means your record will contain the ‘core’ information plus extra information that you think would be helpful for the healthcare staff who treat you. You must give your explicit consent for this.

That extra information could include:

• Information about your long term health conditions– such as asthma, diabetes, heart problems or rare medical conditions.
• Your relevant medical history– clinical procedures that you have had, why you need a particular medicine, the care you are currently receiving and clinical advice to support your future care.
• Your healthcare needs and personal preferences– you may have particular communication needs, a long term condition that needs to be managed in a particular way, or you may have made legal decisions or have preferences about your care that you would like to be known.
• Immunisation information– details of previous vaccinations, such as tetanus and routine childhood jabs.

You can choose not to have a Summary Care Record.

Information from your GP record concerning your current medications, allergies and bad reactions to medicines will not be readily available to other services treating you. Fewer than 5% of patients have chosen to opt out.

For more information, or to request an enhanced Summary Care Record, please talk to the staff at your GP practice. You can change your mind about what information you share at any time.

How will having a Summary Care Record help me?

Essential details about your healthcare can be very difficult to remember, particularly when you are unwell. Having an enhanced Summary Care Record means that healthcare professionals treating you will be better informed about you, which will increase the quality of your care.

You may already have seen the benefits of having a core Summary Care Record. One common benefit is when a patient is admitted to hospital and the Clinician treating them is able to see they are allergic to a particular medication and so prescribe an alternative.

How will my information be kept safe?

Your Summary Care Record can only be viewed by authorised staff who have an NHS smartcard with a chip and PIN. They must also ask for your consent to view your Summary Care Record, unless you are unconscious or otherwise unable to communicate and they believe that accessing your record is in your best interest. All access to your Summary Care record is documented and audited by the Privacy Officer of the organisation to ensure it is appropriate.

An enhanced Summary Care Record is not a copy of your whole record. Sensitive information such as fertility treatments, sexually transmitted infections, pregnancy terminations or gender reassignment will not be included, unless you specifically ask for it to be.

GP Connect

General Practice (GP) Connect allows authorised health and care professionals to access patient information held by a General Practice when and where they need it, to support the patient’s direct care.  From a privacy, confidentiality, and data protection perspective, GP Connect provides a method of secure information transfer and reduces the need to use less secure or less efficient methods of transferring information, such as email or telephone.   GP Connect uses the Spine Security Proxy (SSP) to record data relating to each access request including NHS Numbers as well as system identification details.

All access to your GP patient record is stored within an audit trail at your GP practice and within the organisation that information has been shared with.

Individuals can opt out of their GP patient record being  shared via GP Connect by contacting their GP practice.

RISK STRATIFICATION

What is risk stratification?

There are two kinds of risk stratification:

The first kind is a process for identifying some patients within a Practice who might benefit from extra assessment or support with self-care because of the nature of their health problems. The process is a mixture of analysis of information by computer followed by review of the results by a clinical team at the Practice.

The analysis can, for example, help predict the risk of an unplanned hospital Admission so that preventative measures can be taken as early as possible to try and avoid it. A new artificial intelligence-based tool, Brave AI, is being used in the South West to help identify patients at risk of unscheduled hospital admission.  In the end, it is the clinical team of the GP Practice that will decide how your care is best managed.

The second kind is a process for identifying patterns of ill health and needs across our local population. This will be done by pulling together all the information in an anonymised file (where your identity has been removed) to look at patterns and trends of illness across Cornwall as a whole. This will help our Public Health Department and those in the NHS who are responsible for planning and arranging health services across Cornwall (known as commissioners) better understand the current and possible future health needs of the local population. This will help them make provision for the most appropriate health services for the people of this area. This group of staff will not be able to identify you as an individual under any circumstances.

What information about me will be analysed?

Risk stratification tools use a mix of limited historical information about patients (such as age, gender, diagnoses, and hospital attendance) as well as data collected in GP practices.

How will my information be kept secure and confidential?

Data is held according to strict security rules which comply with data protection law and NHS guidance on managing health and care data. Only your GP Practice will be able to identify you as an individual, and the GP Practice remains in control of your information at all times.

What will my GP Practice do with the analysis?

The results can help the clinical team decide on some aspects of your future care. For example, if the clinical team at the Practice think that you might benefit from a review of your care, they can arrange this. You may then be invited in for an appointment to discuss your health and treatment. If the Practice thinks you might benefit from referral to a new service, this will be discussed with you firstly.

What if I want to opt out?

If you do not wish your information to be used for risk stratification purposes for your own direct care, please contact your GP surgery.

You can also choose whether data from your health records is shared for research and planning.  Please see the link below for more information.

National data opt-out – NHS Digital

Freedom of Information

Information about the General Practioners and the practice required for disclosure under this act can be made available to the public. All requests for such information should be made to the practice manager.

Violence Policy

The NHS operate a zero tolerance policy with regard to violence and abuse and the practice has the right to remove violent patients from the list with immediate effect in order to safeguard practice staff, patients and other persons. Violence in this context includes actual or threatened physical violence or verbal abuse which leads to fear for a person’s safety. In this situation we will notify the patient in writing of their removal from the list and record in the patient’s medical records the fact of the removal and the circumstances leading to it.