Practice Policies & Patient Information
Access to medical records
Patients can access their medical records by filling in a patient consent form, which will be reviewed by the GPs & Senior medical Secretary.
Please note, you can now have online access to your medical records. Please speak to Reception staff for details.
You have the right to see your health records written after 1st November 1991, subject to any limitations in the law.
Access to Records Policy
Subject Access Requests (SAR)
A request by a patient, or a request by a third party who has been authorised by the patient, for access under the GDPR (and DPA 2018) is called a Subject Access Request (SAR). If you want to see your health records, or wish a copy, please complete a Practice Subject Access Request Form which you can complete online or please contact the Practice and we will provide you with our paper format.
Contact will, subsequently, be made by the Practice to arrange a time for you to come in and collect or read them. You don’t have to give a reason for wanting to see your records and there is no charge for this service. You will however be required to produce proof of identity before being allowed to read them.
Complete a Subject Access Request online
The Practice has up to 28 days to respond to your request. If additional information is needed before copies can be supplied, the 28-day time limit will begin as soon as the additional information has been received.
The 28 day time limit can be extended for two months for complex or numerous requests where the data controller (usually your Practice) needs more time to collate and supply the data. You will be informed about this within 28 days and provided with an explanation of why the extension is necessary.
When writing / calling, you should say if you:
- want a copy of your healthcare records as well as to see them (if you wish to see them your Doctor or member of staff will be present to assist you and explain any medical terms to you)
- want all or just part of them
- would like your records to be given to you in a specific format that meets your needs, and we will endeavour to accommodate your request
If you request your records to be emailed, then we will secure you or your representative’s agreement (in writing or by email) that they accept the risk of sending unencrypted information to a non-NHS email address
You may also need to fill in an Application Form and give proof of your identity. The Practice has an obligation under the GDPR and DPA2018 to ensure that any information provided for the patient can be verified.
Please note we never send original medical records because of the potential detriment to patient care should these be lost.
Who may apply for access?
1(1) Patients with capacity
Subject to the exemptions listed in paragraph 1(6) (below) patients with capacity have a right to access their own health records via a SAR. You may also authorise a third party such as a Solicitor to do so on your behalf. Competent young people may also seek access to their own records. It is not necessary for them to give reasons as to why they wish to access their records.
1(2) Children and young people under 18
Where a child is competent, they are entitled to make or consent to a SAR to access their record.
Children aged over 16 years are presumed to be competent. Children under 16 in England, Wales and Northern Ireland must demonstrate that they have sufficient understanding of what is proposed in order to be entitled to make or consent to an SAR.However, children who are aged 12 or over are generally expected to have the competence to give or withhold their consent to the release of information from their health records. In Scotland, anyone aged 12 or over is legally presumed to have such competence. Where, in the view of the appropriate health professional, a child lacks competency to understand the nature of his or her SAR application, the holder of the record is entitled to refuse to comply with the SAR. Where a child is considered capable of making decisions about access to his or her medical record, the consent of the child must be sought before a parent or other third party can be given access via a SAR (see paragraph 1 (3) below)
1(3) Next of kin
Despite the widespread use of the phrase ‘next of kin’, this is not defined, nor does it have formal legal status. A next of kin cannot give or withhold their consent to the sharing of information on a patient’s behalf. As next of kin they have no rights of access to medical records. For parental rights of access, see the information above.
1(4) Solicitors
You can authorise a Solicitor acting on your behalf to make a SAR. We must have your written consent before releasing your medical records to your acting Solicitors. The consent must cover the nature and extent of the information to be disclosed under the SAR (for example, past medical history), and who might have access to it as part of the legal proceedings. Where there is any doubt, we may contact you before disclosing the information. (England and Wales only – should you refuse, your Solicitor may apply for a court order requiring disclosure of the information. A standard consent form has been issued by the BMA and the Law Society of England and Wales. While it is not compulsory for Solicitors to use the form, it is hoped it will improve the process of seeking consent).
The Practice may also contact you to let you know when your medical records are ready. If your Solicitor is based within our area, then we may ask you to uplift them and deliver them to your Solicitor. This is because we can no longer charge for copying and postage, so we would appreciate your help if you can do this, or alternatively ask your Solicitor if they can uplift your medical records.
1(5) Supplementary Information under SAR requests
The purposes for processing data
The purpose for which data is processed is for the delivery of healthcare to individual patients. In addition, the data is also processed for other non-direct healthcare purposes such as medical research, public health or health planning purposes when the law allows.
The categories of personal data
The category of your personal data is healthcare data.
The organisations with which the data has been shared
Your health records are shared with the appropriate organisations which are involved in the provision of healthcare and treatment to the individual. Other organisations will receive your confidential health information, for example Digital or the Scottish Primary Care Information Resource (SPIRE) or research bodies such as the Secure Anonymised Linkage Databank (SAIL). (This information is already available to patients in our Practice privacy notices).
The existence of rights to have inaccurate data corrected and any rights of objection
For example, a national ‘opt-out’ model such as SPIRE etc.
Any automated decision including the significance and envisaged consequences for the data subject
For example, risk stratification.
The right to make a complaint to the Information Commissioner’s Office (ICO)
1(6) Information that should not be disclosed
The GDPR and Data Protection Act 2018 provides for a number of exemptions in respect of information falling within the scope of a SAR. If we are unable to disclose information to you, we will inform you and discuss this with you.
1(7) Individuals on behalf of adults who lack capacity
Both the Mental Capacity Act in England and Wales and the Adults with Incapacity (Scotland) Act contain powers to nominate individuals to make health and welfare decisions on behalf of incapacitated adults. The Court of Protection in England and Wales, and the Sheriff’s Court in Scotland, can also appoint Deputies to do so. This may entail giving access to relevant parts of the incapacitated person’s medical record, unless health professionals can demonstrate that it would not be in the patient’s best interests. These individuals can also be asked to consent to requests for access to records from third parties.
Where there are no nominated individuals, requests for access to information relating to incapacitated adults should be granted if it is in the best interests of the patient. In all cases, only information relevant to the purposes for which it is requested should be provided.
1(8) Deceased records
The law allows you to see records of a patient that has died as long as they were made after 1st November 1991.
Records are usually only kept for three years after death (in England and Wales GP records are generally retained for 10 years after the patient’s death before they are destroyed).
Who can access deceased records?
You can only see that person’s records if you are their personal representative, administrator or executor.
You won’t be able to see the records of someone who made it clear that they didn’t want other people to see their records after their death.
Accessing deceased records
Before you get access to these records, you may be asked for:
- proof of your identity
- proof of your relationship to the person who has died
Viewing deceased records
You won’t be able to see information that could:
- cause serious harm to your or someone else’s physical or mental health
- identify another person (except members of NHS staff who have treated the patient), unless that person gives their permission
- If you have a claim as a result of that person’s death, you can only see information that is relevant to the claim.
GP health records for un-registered or deceased individuals
NHS England is only the data controller for GP health records where an individual is currently not registered with a GP or is deceased. These records are held by Primary Care Support England (PCSE) on behalf of NHS England. To request access to GP health records in these circumstances please visit the PCSE website.
You can find more information about accessing health records on the NHS website.
1(9) Hospital Records
To see your Hospital records, you will have to contact your local Hospital.
1(10) Power of attorney
Your health records are confidential, and members of your family are not allowed to see them, unless you give them written permission, or they have power of attorney.
A lasting power of attorney is a legal document that allows you to appoint someone to make decisions for you, should you become incapable of making decisions yourself.
The person you appoint is known as your attorney. An attorney can make decisions about your finances, property, and welfare. It is very important that you trust the person you appoint so that they do not abuse their responsibility. A legal power of attorney must be registered with the Office of the Public Guardian before it can be used.
If you wish to see the health records of someone who has died, you will have to apply under the Access to Medical Records Act 1990. You can only apply if you:
- are that person’s next of kin, are their legal executor (the person named in a will who is in charge of dealing with the property and finances of the deceased person),
- have the permission of the next of kin or have obtained written permission from the deceased person before they died.
- to access the records of a deceased person, you must go through the same process as a living patient. This means either contacting the Practice or the Hospital where the records are stored.
If you think that information in your health records is incorrect, or you need to update your personal details (name, address, phone number), approach the relevant health professional informally and ask to have the record amended. Some Hospitals and GP Surgeries have online forms for updating your details. If this doesn’t work, you can formally request that the information be amended under the NHS complaints procedure.
All NHS trusts, NHS England, CCGs, GPs, Dentists, Opticians and Pharmacists have a complaints procedure. If you want to make a complaint, go to the organisation concerned and ask for a copy of their complaints procedure.
Alternatively, you can complain to the Information Commissioner (the person responsible for regulating and enforcing the Data Protection Act), at:
The Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 01625 545745
If your request to have your records amended is refused, the record holder must attach a statement of your views to the record.
Chaperones
All patients may have a chaperone present for any consultation, examination or procedure.
This chaperone may be a family member or friend. On occasions you may prefer a formal chaperone to be present, for example a trained member of staff.
If you wish to have a chaperone, please tell us when you book your appointment so that arrangements can be made, and your appointment is not delayed in any way.
Where this is not possible, we will try to provide a formal chaperone.
However occasionally it may be necessary to re-schedule your appointment.
Children & Young Adults Privacy Notice
How we use your personal information
This notice explains why the practice collects information about you and how that information may be used.
The health care professionals, who provide you with care will keep records about your health and any treatment or care you have received (e.g. Hospital, GP Surgery, Walk-in Centre etc.). These records help to give you the best possible healthcare.
From the age of 13 years, the ICO (Information Commissioner’s Office) regards you as having the competence to consent to your own health care and the processing of the information that we hold about you at this practice which form what is known as your ‘Health Record’.
This is in line with what is called the ‘Gillick Competence’ which is a medical law that decides whether a child under 16 years is able to consent to his/her own medical treatment without the need for consent from a parent/carer/legal guardian.
These records may be electronic (information kept on our computers), on paper (letters that we may have or that we receive) or a mixture of both, and we take every care to make sure that your information is kept confidential and secure.
Records which this GP Practice holds about you may include the following:
- Details about you, such as your address, legal representative, emergency contact details
- Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
- Notes and reports about your health
- Details about any treatment you have had or are having.
- Results of any tests that you may have such as blood tests, x-rays etc.
- Important information from other health professionals, relatives or those who care for you
- Important information from your school that may be to do with your health or wellbeing (eg. behaviour reports, concerns from teachers, vaccinations you have had)
- Information from Child Health about any Health assessments or vaccinations you have had, you have missed or you may need.
Your records will be stored in line with the NHS Code of Practice for Records Management.
It is our job to give you the best care possible and so your records are used to make sure that this happens. We may sometimes need to share your information with other people in the NHS to help us to make things in the NHS better.
Most of the time, this information will not have your personal details (name. date of birth) so you cannot be identified. In cases where we do need to give your personal details, we will always ask if this is okay with you. Information may be used within the GP practice for clinical audits to help us monitor the quality of the care that you receive.
Sometimes your information may be requested to be used for research purposes – the surgery will always ask you before giving any information for this purpose.
How we keep your records confidential
We have to keep your personal information and records private so we will only use or share your information in line with the following guidelines and laws:
- General Data Protection Regulation 2018
- Human Rights Act 1998
- Common Law Duty of Confidentiality
- Health and Social Care Act 2012
- NHS Codes of Confidentiality and Information Security
- Information: To Share or Not to Share Review
Every member of staff who works for the Practice or another NHS organisation has a legal obligation to keep information about you confidential. Staff at this practice have to sign a ‘Confidentiality Agreement’.
We will only ever use or pass on information about you if others involved in your care if this is important for your treatment. We will not give your information to anyone else without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on, for example Child Protection and Serious Criminal Activity.
Organisations that we may share your information with
We may also have to share or receive your information, under strict agreements on how it will be used, with the following organisations:
- NHS Organisations
- Doctor, Dentist, Optician or Pharmacist
- Ambulance Service
- Social Care & Safeguarding Services
- Child Health
- County Council
- Schools
- Fire and Rescue Services
- Police & Court Services (if we are asked by law)
We will always tell you who we are sharing your information with and may even have to ask for your consent to do this (ask if it is okay with you) and you may be asked to sign a form for this.
Access to your information
Under the new General Data Protection Regulation (GDPR) you have the right to ask to see your medical records whenever you like and this is free. Also, if you think that any of the information you see is not correct, you can ask for this information to be taken out. This can only be done if we are 100% sure that the information is not correct.
To be able to see your records, this is what you will need to do:
- Write a letter to the doctor here to ask to look at your records. You will need to include your full name, date of birth, NHS number (if you know it) and your address. This is so that we can make sure that we are giving this information to the right person.
- The doctor will use the Gillick Competence rules (that we talked about above) to make sure that you are able to have that consent
- We will not charge for this (unless you ask a lot of times then we may put on a charge)
- If the doctor agrees that it is okay for you to have access, we will give you the information within 30 days
Data Processor
This is the person/people or organisation that is responsible for using and recording your information. All staff at Greengate Medical Practice are individual Data Processors.
Data Controller
The Data Controller is the person/organisation responsible for keeping your information secure and confidential.
Data Protection Officer (DPO)
The Data Protection Officer has overall responsibility for GDPR within this area. Our designated DPO is: Salma Ali
Objections / Complaints
If you need to know anything else about how we use or keep your information, you can ask to speak to our Practice Manager and she will be happy to explain. If you have access to the internet, you can also read more about this on the ICO website.
Change of Details
It is important that you tell us or any other person treating you if any of your details such as your name, address or contact details have changed.
Notification
Under the General Data Protection Regulations we have to register this surgery with the Information Commissioner to describe the purposes for which we process personal and sensitive information.
This information is available for everyone on the Information Commissioners Office website. This practice is registered with the Information Commissioners Office (ICO).
Compliments and Complaints
We try to provide a friendly and quality service to our community. If you have any helpful comments or suggestions to make, please put them in writing to the practice manager. A comments and suggestions box is available in the waiting area and it is easily accessible for wheelchair users.
Complaints Policy
We endeavour to give you the best service possible at all times; but there may be occasions when you feel you wish to express your dissatisfaction. If you have any comments or suggestions please let us know. We offer an in-house procedure to deal with your concerns. This procedure does not deal with matters of legal liability or compensation, but we hope you will use it to give us an opportunity for looking into, and if necessary correcting, any problems that may have arisen or mistakes that have been made. Please note that we respect our duty of confidentiality to patients, and patient’s consent will be necessary if a complaint is not made by the patient directly.
If you have a complaint or concern about the service you have received from the doctors or any of the staff working in this practice please let us know. We operate a practice complaints procedure as part of an NHS system for dealing with complaints. Our complaints system meets nationally agreed criteria.
Most problems can be sorted out quickly and easily, often at the time they arise, with the person concerned and this may be the approach you try first.
How to complain
If your problem cannot be sorted out in this way and you wish to make a formal complaint, please do so as soon as possible, ideally within a matter of a few days. This will enable us to establish what happened more easily. If you are unable to do this, your complaint should be submitted within 12 months of the incident that caused the problem; or within 12 months of discovering that you have a problem. Complaints will be considered outside this time limit if the complainant has good reason for the delay and where it is still possible to investigate the complaint fairly.
Complaints should be addressed to Salma Ali – Practice Manager, or to the doctor. Alternatively, you may ask for an appointment with the Practice Manager in order to discuss your concerns.
She will explain the complaints procedure to you and ensure that your concerns are dealt promptly. The Practice Manager will take full details of your complaint and inform the outcome of the complaint after the investigation. We hope to address your concerns fully, provide you with an explanation and discuss any action that may be taken. We trust that you will feel satisfied the matter has been resolved.
Making a complaint will not adversely affect the care you receive from the practice.
Please send your written complaint to the Practice Manager at:
Plaistow,
London,
E13 8PS
Complaining on behalf of someone else
We keep strictly to the rules of medical confidentiality. If you are not the patient, but are complaining on their behalf, you must have their permission to do so. An authority signed by the person concerned will be needed, unless they are incapable (because of illness or infirmity) of providing this.
What we will do
We will usually acknowledge your complaint within 3 working days and aim to have fully investigated within 28 days of the date it was received. If we expect it to take longer we will explain the reason for the delay and tell you when we expect to finish. When we look into your complaint, we will investigate the circumstances and/or make it possible for you to discuss the problem with those concerned; make sure you receive an apology where appropriate, and take steps to make sure any identified problem does not arise again.
You will receive a final response letter that will include details of the result of the investigation into your complaint and also your right to take matters further if you remain dissatisfied with the response.
If you remain dissatisfied with the responses to your complaint, you have the right to ask the Parliamentary and Health Service Ombudsman to review your case. The Ombudsman is an independent body established to promote improvements in healthcare through the assessment of the performance of those who provide the service.
For further information or if you need any help from an independent body you may wish to contact the following regarding complaints:
Contact the Practice
Please make your complaint to:
- Complaints Manager: Salma Ali (Practice Manager)
Plaistow,
London,
E13 8PS
Parliamentary and Health Service Ombudsman
Millbank Tower
Millbank
London SW1P 4QP
North East London Integrated Care Board
NHS North East London ICB
Unex Tower
5 Station Street
London, E15 1DA
NHS England
PO Box 16738
Redditch B97 9PT
- Telephone: 0300 311 2233
- Visit the NHS England website
Independent Complaints Advocacy Service
Healthwatch Newham
The Care Quality Commission (CQC)
Confidentiality
We are registered under the Data Protection Act and have robust systems in place to protect your confidentiality. Personal health information is used to monitor the practices screening activities.
Occasionally, anonymised health information is sent to NHS England to monitor quality standards and for post-payment verification purposes.
Did Not Attend Policy
A large number of appointments each month are wasted due to cancelling too close to the appointment time or due to ‘Did Not Attend’ (DNA), i.e. the patient does not turn up for the appointment and does not contact the surgery in advance to cancel/change appointment. The effects of these are:
Disability Access Policy
If you have any additional needs please let our staff know so that we can help you, and also ensure you get the same support in the future.
Wheelchair Access
The Practice has been specially designed to make it easier for disabled patients to visit; patients also have access to a disabled toilet.
Disabled Parking – Blue Badge Scheme
Important
The Practice has very limited parking space for disabled patients and you may not find one when you visit the practice.
The Blue Badge Scheme is for people with severe mobility problems. It allows Blue Badge holders to park close to where they need to go.
For more information and an Application Form visit your local council office.
Interpreters
Interpreter for chosen language or British Sign Language.
Please speak to our Staff member or mention on the online form when requesting an appointment.
Loop System
We have a loop induction system at Reception to assist the hearing impaired. For more information on the loop hearing system visit the Hearing Link website.
Blind/Partially Sighted
If you or your family members are blind or partially sighted we can give you a CD or large print of our Practice leaflet upon request. Please ask our staff for further information.
For more advice and support for blind people please visit the following websites:
Guide Dogs
Guide dogs are welcome at the Practice but we ask that you be aware of other patients and staff who may have an allergy or fear of dogs.
Please visit the Guide Dog website for further information.
Freedom of Information Policy
Freedom of Information
Anyone has a right to request information from a public authority. We have two separate duties when responding to these requests:
- to tell the applicant (you or your representative) whether we hold any information falling within the scope of their request; and
- to provide that information
We normally have 20 working days to respond to a request.
For a request to be valid under the Freedom of Information Act it must be made in writing and should be submitted to the Practice Manager and must include the name and address of the applicant, for the reply; the applicant does not need to say why they want the information. Any letter or email to a public authority asking for information is a request for recorded information under the Act.
GDPR
What is GDPR?
GDPR stands for General Data Protection Regulations and is a new piece of legislation that will supersede the Data Protection Act. It will not only apply to the UK and EU; it covers anywhere in the world in which data about EU citizens is processed.
The GDPR is similar to the Data Protection Act (DPA) 1998 (which the practice already complies with), but strengthens many of the DPA’s principles. The main changes are:
- Practices must comply with subject access requests
- Where we need your consent to process data, this consent must be freely given, specific, informed and unambiguous
- There are new, special protections for patient data
- The Information Commissioner’s Office must be notified within 72 hours of a data breach
- Higher fines for data breaches – up to 20 million euros
What is ‘patient data’?
Patient data is information that relates to a single person, such as his/her diagnosis, name, age, earlier medical history etc.
What is consent?
Consent is permission from a patient – an individual’s consent is defined as “any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed.”
The changes in GDPR mean that we must get explicit permission from patients when using their data. This is to protect your right to privacy, and we may ask you to provide consent to do certain things, like contact you or record certain information about you for your clinical records.
Individuals also have the right to withdraw their consent at any time.
Privacy Information
How we use your medical records
Important information for patients:
- This practice handles medical records in-line with laws on data protection and confidentiality.
- We share medical records with those who are involved in providing you with care and treatment including services that send out invitations for national screening programmes such as smear tests, children immunisations, breast and bowel screening, etc.
- In some circumstances we will also share medical records for medical research, for example to find out more about why people get ill, only with informed patient consent.
- We share information when the law requires us to do so, for example, to prevent infectious diseases from spreading or to check the care being provided to you is safe.
- You have the right to be given a copy of your medical record.
- You have the right to object to your medical records being shared with those who provide you with care.
- You have the right to object to your information being used for medical research and to plan health services.
- You have the right to have any mistakes corrected and to complain to the Information Commissioner’s Office. Please see the practice privacy notice on the website or speak to a member of staff for more information about your rights.
For more information ask at reception for a leaflet.
Help us to help you
You will be treated as an individual and will be given courtesy and respect at all times irrespective of your ethnic origin, religious belief, personal attributes or the nature of your health problems. In return we ask you to appreciate that we are all trying to satisfy the needs of all our patients and need your co-operation to achieve this.
Medical staff will advise you of the treatment they think appropriate which you may discuss if you wish. No care or treatment will be given without your informed consent.
Important – Notify us of any changes of name, address & telephone numbers. Please note that if you move out of our practice area, it will be necessary for you to register with another GP locally.
It is our job to give you treatment and advice. In the interest of your health it is important for you to understand all the information. Please ask if you are unsure of anything.
If a doctor agrees that a routine referral is necessary, this will be completed and sent within one week. Urgent referrals will be made within 24 hours.
Keep it or cancel it
If you have made an appointment to see any member of the health care team and you no longer require it, please inform us immediately.
Infection Control
Named GP
All patients at the surgery have a named, accountable doctor who is responsible for coordinating their care.
Your named doctor will be allocated to you by the practice. You can still talk to or make appointments to see any of our doctors or nurses, not just your named GP.
If you have a preference and would like to request a particular doctor at the practice to be your named GP, please talk to one of our receptionists.
Practice Charter
Patient’s Responsibilities
We ask that you treat our doctors and all practice staff with courtesy and respect.
The first hour of the morning can be extremely busy. Please keep telephone calls brief. If possible, leave routine calls until later in the day.
You are responsible for your own health and that of your children. Please take the advice given to you at the practice. Let us know immediately if you change your address or name and remember to give your phone number and postcode.
Please speak to a member of the practice staff if you wish to see your medical records. This can then be arranged with your doctor. There may be a fee payable. if you have signed up for online access you can also view your records this way.
Please use the out-of-hours service in a responsible manner.
If tests are ordered for you, please ask your doctor or a member of staff about receiving the results.
Please refer to the rest of this website to get the best out of the services available including details of our repeat prescription procedure.
You can discuss any medical matter with the doctor, including asking for a second opinion.
Text reminders are sent for your appointments. Please let us know if you are unable to keep an appointment. You can text to cancel your appointment. We can then offer that appointment to someone else.
Where an appointment or acknowledgement of a routine referral for a hospital appointment is not received within six weeks, contact the hospital concerned.
GP’s Responsibilities
You will be treated as an individual and will be given courtesy and respect at all times. You have the right to be treated confidentially.
Respect for religious and cultural beliefs will be honoured.
You have the right to information about your own health (illness and treatment, possible side effects, prevention of recurring illness etc). We will offer medical advice and information for promotion of good health. You have the right to see your own medical records subject to the limitations of the law.
Home visits will be made when requested. These visits are then triaged by the doctor who will make a decision on whether a visit is appropriate or not.
We may give you test results when you telephone the surgery for them, or you may be asked to make an appointment with the doctor to discuss them.
On registering as a new patient, you will be offered a health check with the Healthcare Assistant or Nurse.
If your doctor believes that you need a second opinion, then they will arrange this.
You will be given a time to see the doctor in accordance with the system used in the practice. If there is a substantial delay for any reason, you will be given an explanation.
Repeat prescriptions will normally be ready within 48 working hours from the surgery or for collection from a local pharmacy, following your written request arriving at the surgery.
Routine referral letters for hospital appointments will normally be dispatched from the surgery. Urgent referrals for hospital appointments may be faxed, telephoned or provided as a handwritten note for the patient to take to the hospital.
Privacy Notice
Table of contents
2.3 Communicating privacy information 2
2.4 What data will be collected? 3
2.5 Data for planning and research 3
Annex A – UK nation specifics 4
Annex B – Easy read privacy notice 6
1 Introduction
1.1 Policy statement
This policy has been created as an easy read guide to understand how this organisation deals with patient data in accordance with the Data Protection Act 2018 and especially Part 2, Chapter 2 of the legislation that is the UK GDPR.
This document is predominantly a guide for both children and those who may have a learning disability. It can also be used as a quick read for all as it provides the information to patients regarding how patient data is processed for the provision of direct care, research, audit and screening programmes.
It can be read in conjunction with the organisation’s UK General Data Protection Regulation (UK GDPR) Policy.
UK General Data Protection Regulation (UK GDPR) and GDPR – The Perfect Practice eLearning courses are available in the HUB
1.2 Status
The organisation aims to design and implement policies and procedures that meet the diverse needs of our service and workforce, ensuring that none are placed at a disadvantage over others, in accordance with the Equality Act 2010. Consideration has been given to the impact this policy might have regarding the individual protected characteristics of those to whom it applies.
2 Compliance
2.1 UK GDPR
This organisation will ensure that any personal data is processed in accordance with Article 5 of the UK GDPR and information about how this is done will be provided to patients in a format that is compliant with Article 12 of the UK GDPR.
2.2 UK specifics
The information specific to a UK nation can be found at Annex A.
2.3 Communicating privacy information
The BMA advises that this organisation must provide information to patients about how their data is processed in the form of a practice privacy notice. This organisation will display a privacy notice in the waiting room and on its website.
An easy read privacy notice template is available at Annex B. Furthermore, the Information Commissioner’s Office (ICO) has provided a Privacy Notice Checklist.
2.4 What data will be collected?
The following data will be collected:
- Patient details (name, date of birth, NHS number)
- Address and NOK information
- Medical notes (paper and electronic)
- Details of treatment and care, including medications
- Results of tests (pathology, X-ray, etc.)
- Any other pertinent information
2.5 Data for planning and research
The organisation may also share data for research and other purposes, for example when required by law for public health reasons, or anonymised for clinical research, e.g., through the Clinical Practice Research Datalink.
Patients can decide as to whether data is used for research or planning and, be it a child under 13 years or a child over 13 who has capacity, all have the right to opt-out of such arrangements. No patient identifiable information will ever be shared for research without the consent of the patient.
Further information can be found in the NHS E guidance titled Choose if data from your health records is shared for research and planning.
Annex A – UK nation specifics
England
National Data Opt Out
This organisation will ensure patients are compliant with the national data opt-out policy by following the NHS England guidance tilted National Data Opt-Out. Patient information from NHS E can be found in the guidance titled Supporting your patients – information and resources.
NHS E has provided a NDO-O data protection impact assessment and further reading can be sought from the National Data Guardian guidance titled Review of Data Security, Consent and Opt-Outs.
Privacy notice
Question | Answer |
What is a privacy notice?
|
A privacy notice helps this surgery to tell you how we use the information it has about you. The data could be name, address, date of birth and, importantly, the clinical records that a clinician may write about you in your healthcare record. |
Why do we need one?
|
By law, this practice needs a privacy notice. This is detailed within the Data Protection Act 2018 and is part of the UK General Data Protection Regulation (or UK GDPR for short) |
What is the UK GDPR?
|
The UK GDPR is part of a law that states that the information about you must remain secure. All staff at the surgery must follow these rules and keep your information safe. |
How can I learn more about the privacy notice?
|
This surgery has lots of information about privacy on our website telling you how we use the information we have about you. You can also ask a member of the staff should you have any questions about your data.
The UK GDPR details what needs to be provided within the privacy notice, this is: · What information we hold about you · How we keep this especially important information safe and secure and where we keep it · How we use your information · Who we share your information with · What your rights are · When the law gives us permission to use your information |
What information do we collect about you? | Personal information is anything that identifies you as a person and we all have personal information. Personal information that tells us something about you includes:
· Your name · Address · Mobile and/or home telephone number · Information about your parent(s) or person with parental responsibility · All your health records · Appointment records · Treatments you have had · Medicines prescribed for you and any other information to help us to look after you |
How do we use your information?
|
Your information is taken to help us to provide your care. We might need to share this information with other medical teams. We only usually use your information to help us to care for you. That means we might need to share your information with other people who are concerned and involved with looking after your health, such as hospitals if you need to be seen there.
We might also need to share your information with the police, courts, social services, solicitors and other people who have a right to your information, but we always make sure that they have a legal right to see it (or have a copy of it) before we provide it to them. The law gives us permission to use your information in situations when we need it to take care of you. Because information about your health is very personal, sensitive and private to you, the law is very strict about how we use it. So, before we can use your information in the ways we have set out in this privacy notice, we have to have a good reason in law which is called a ‘lawful basis’. Not only do we have to do that, but we also have to show that your information falls into a special group or category because it is very sensitive. By doing this, the law makes sure we only use your information to look after you and that we do not use it for any other reason. If you would like more information about this, please ask to speak to our Data Protection Officer (DPO) who is mentioned in this privacy notice who will explain this in more detail. |
How do we keep your information safe? | We know that it is really important to protect the information we have about you. Therefore, we will follow the rules that are written in the Data Protection Act and the Chapter that details the UK GDPR. The law says that we must do all we can to keep your information private, safe and secure.
We use secure computer systems and we make sure that any written information held about you is kept securely and we train our staff to respect your privacy and deal with your information in a manner that makes sure it is always kept and dealt with in a safe way. |
What if I have a long-term medical problem? | If you have a long-term medical problem then we know it is important to make sure your information is shared with other healthcare workers to help them to help you, making sure you get the care you need when you need it. |
Who else will see my information? | Usually, only staff at this practice are allowed to see your information. Should you need to go to the hospital then we may be asked to share your information with them, but this is only so that we can take care of you.
Sometimes we might be asked to take part in medical research that could help you in the future. We will always ask you or your parent(s) or an adult with parental responsibility if we can share your information if this happens. Possibly the police, social services, the courts or other organisations may have a legal right to see your information. |
What if I don’t want to opt out of sharing my medical information?
|
England
All our patients, no matter what their age, can say that they don’t want to share their information. If you’re under 13 this is something that your parents or an adult with parental responsibility will have to decide. If you’re over 13 and need help, then it may make sense to discuss this with those who care for you. Should you want to discuss this further, then you can discuss any concerns that you have with a member of staff at the surgery. You have a right to ask us not to share your information. Should you want to talk to us about not sharing your information, even if this means you do not want us to share your information with your parent(s) or an adult with parental responsibility, please let us know. |
How to access my records? | If you want to see what is written about you, you have a right to access the information we hold about you, but you will need to complete a Subject Access Request (SAR). There are some rules on this.
· If you are under 16, your parents or adults with parental responsibility can do this on your behalf. · If you are over 12, you may be classed as being competent and may be able to do this yourself. · If you are over 16 and need help in understanding what to do, then you can still ask the person who cares for you to do it on your behalf. You may also be able to access your records online and you can discuss this with a member of staff at the surgery. |
What if there is something wrong in my record? | If you believe that there are any errors in the information that we hold about you, then you can ask us to correct it. |
Can I get anything removed from my record? | Legally, we cannot remove any of the information we hold about you as we need all this information to take care of you. |
What to do if I have a question? | If you have any questions, please ask a member of staff, or your parents or adults with parental responsibility, or the person who cares for you to either contact the Data Protection Officer (DPO) at the surgery by:
· Asking to speak to the Practice Manager. This person is normally the Data Controller · Writing to the DPO · Emailing either the Data Controller or the Data Protection Officer Please note that the DPO is specially trained in data management |
What if I have a complaint about how my information is being managed? | If you are unhappy with any element of our data processing methods, contact the Practice Manager in the first instance. If you feel that we have not addressed your concern appropriately, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).
To contact the ICO: · Visit https://ico.org.uk which explains various methods to raise a complaint including a live chat service · Telephone: 0303 123 1113 (Monday to Friday 9am to 5pm) The ICO is the regulator for data protection and offers independent advice and guidance on the law and personal data including your rights and how to access your personal information. |
This privacy notice will be regularly reviewed.
Your NHS Data Matters
Choose if data from your health records is shared for research and planning
Find out how data from your health records can help with research and planning, and choose if you want to share your data.
Zero tolerance
The NHS operate a Zero Tolerance Policy with regard to violence and abuse and the Practice has the right to remove violent patients from their list with immediate effect, in order to safeguard practice staff, patients and other persons. Violence in this context includes actual or threatened physical violence or verbal abuse which leads to fear for a person’s safety. In this situation we will notify the patient in writing of their removal from the list and record in the patient’s medical records the fact of the removal and the circumstances leading to it.
Important
Where patients are disruptive and display aggressive and/or intimidating behaviour and refuse to leave the premises, staff are instructed to dial 999 for Police assistance, and charges may then be brought against these individuals.
Violent Behaviour Policy
As an employer, the practice has a duty to care for the health and safety of its staff. The practice also has a legal responsibility to provide a safe and secure working environment for staff. All patients are expected to behave in an acceptable manner and violent or abusive behaviour towards staff or patients may result in removal from our practice list or even criminal proceedings. The practice follows the NHS guidance concerning Zero Tolerance.
The Practice has a policy of “zero tolerance” of verbal and physical violence towards GP’s, staff or other patients.
The practice will request the removal of any patient from the practice list who is aggressive or abusive towards a doctor, member of staff, other patient, or who damages property.
All instances of actual physical abuse on any doctor or member of staff, by a patient or their relatives will be reported to the police as an assault.
We expect all patients to be responsible and avoid attending the surgery under the influence of alcohol or illegal drugs. Any alteration of prescriptions is illegal and will not be tolerated.
If you are seriously unhappy with the quality of service you have the right to register with another practice without notifying us. Similarly, on the very rare occasions when a patient repeatedly ignores their responsibilities to the Practice, we have the right to remove the patient from our Practice list.
Examples of Unacceptable Standards of Behaviour:
- Violence.
- Excessive noise e.g recurrent loud or intrusive conversation or shouting.
- Threatening or abusive language involving swearing or offence remarks.
- Derogatory racial or sexual remarks.
- Malicious allegations relating to members of staff, other patients or visitors.
- Offensive sexual gestures or behaviours.
- Abusing alcohol or drugs on practice premises.
- Drug dealing on practice premises.
- Wilful damage to practice property.
- Threats or threatening behaviour.
- Theft