This guidance explains

Why the organisation collects information about you and how it is used
Who we may share information with
Your right to see your health records and how we keep your records confidential

Further detailed information regarding privacy information is available within the organisation privacy notice which can be found on our website.

What is a privacy notice?

A privacy notice is a statement that discloses some or all of the ways in which the organisation gathers, uses, discloses and manages a patient’s data. It fulfils a legal requirement to protect a patient’s privacy.

Why do we need one?

To ensure compliance with the UK General Data Protection Regulation (UK GDPR), the practice must ensure that information is provided to patients about how their personal data is processed in a manner which is:

Concise, transparent, intelligible and easily accessible;
Written in clear and plain language, particularly if addressed to a child
Free of charge

What is the GDPR?

The UK GDPR and the Data Protection Act 2018 (DPA 2018) became law on 25th May 2018 and 1^st January 2021 when the UK exited the EU.

For the purpose of applicable data protection legislation (including but not limited to the UK General Data Protection Regulation (Regulation (EU) 2016/679) (the “UKGDPR”), and the Data Protection Act 2018, the practice is responsible for your personal data.

How do we communicate our privacy notice?

At Uppingham Surgery the organisation privacy notice is displayed on our website and in writing (by means of this leaflet).

We will:

Inform patients how their data will be used and for what purpose
Allow patients to opt out of sharing their data, should they so wish

Who is the Data Controller?

Uppingham Surgery is registered as a Data Controller under the Data Protection Act 2018.

The registration number is Z5748933 and this can be viewed online on the public register at ico.org.uk. This means we are responsible for collecting, storing and handling your personal and healthcare information when you are seen by us as a patient.

There may be times when we also process your information. That means we use it for a particular purpose and, therefore, on those occasions we may also be Data Processors. The purposes for which we use your information are set out fully in our privacy notice.

Fair processing

Personal data must be processed in a fair manner – the GDPR says that information should be treated as being obtained fairly if it is provided by a person who is legally authorised or required to provide it. Fair processing means that the organisation must be clear and open with people about how their information is used.

Uppingham Surgery manages patient information in accordance with existing laws and with guidance from organisations that govern the provision of healthcare in England such as the Department of Health and Social Care (DHSC) and the General Medical Council (GMC).

NHS health records may be managed in several ways, which could be electronically, via paper or a mixture of both. A combination of working practices and technology are used to ensure that your information is kept confidential and secure.

What information do we collect about you?

At this organisation, we aim to provide you with the highest quality of healthcare. To do this, we must keep records about you, your health and the care we have provided or plan to provide for you.

These records may include:

Basic details about you, such as address, date of birth, next of kin
Contact we have had with you such as appointments and consultations
Notes and reports about your health, details of diagnosis and consultations with our GPs and other health professionals within the healthcare environment involved in your direct healthcare
Details and records about your treatment and care
Results of investigations such as laboratory tests, x-rays etc.
Relevant information from people who care for you and know you well, such as health professionals and relatives
Recordings of telephone conversations between yourself and the organisation, including clinical consultations, and these may be used for training, quality and dispute resolution purposes

It is good practice for people in the NHS who provide care to:

Discuss and agree with you what they are going to record about you
Give you a copy of letters they are writing about you
Show you what they have recorded about you if you ask

We will only store your information in identifiable form for as long as is necessary and in accordance with NHS England’s rules.

Sharing information about you with others

This organisation collects and holds data for the sole purpose of providing healthcare services to our patients and we will ensure that this information is kept confidential. However, we can disclose personal information if:

It is required by law
You provide consent – either implicitly or for the sake of your own care, or explicitly for other purposes
It is justified to be in the public interest

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help to protect the health of the public and to help us to manage the NHS.

Data may well be used for clinical monitoring purposes to examine the quality of service provided and/or may be held centrally and used for statistical purposes. Where this happens, we ensure that patient records cannot be identified.

A patient can object to their personal information being shared with other healthcare providers but if this limits the treatment that you can receive then the doctor will explain this to you at the time.

How do we use your information?

The people who care for you use your records to:

Provide a good basis for all health decisions made by you and care professionals
Allow you to work with those providing care
Make sure your care is safe and effective
Work effectively with others providing you with care

Others may also need to use records about you to:

Check the quality of care (such as clinical audit)
Protect the health of the public
Keep track of NHS spending
Manage the health service
Help investigate any concerns or complaints you or your family have about your healthcare
Teach health workers
Help with research

Some information will be held centrally to be used for statistical purposes. In these instances, we take strict measures to ensure that individual patients cannot be identified.

We use anonymous information, wherever possible but on occasions we may use personal confidential information for essential NHS purposes such as research and auditing. However, this information will only be used with your consent, unless the law requires us to pass on the information.

Where do we store your information electronically?

All the personal data we process is processed by our staff in the UK. However, for the purposes of IT hosting and maintenance, this information may be located on servers within the European Union.

No third parties have the right to access your personal data unless the law allows this and appropriate protections have been put in place. We have a data protection regime in place to oversee the appropriate and secure processing of your personal and or special category (sensitive, confidential) data.

This organisation uses a clinical system provided by a Data Processor called TPP SystmOne.

The data will always remain in the UK and will be fully encrypted both in transit and at rest. In doing this, there will be no change to the control of access to your data and the hosted service provider will not have any access to the decryption keys.

How long do we keep your personal information?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records Management Code of Practice for health and social care and national archives requirements.

More information on records retention can be found online at NHSX – Records Management Code of Practice.

Maintaining confidentiality

Everyone working for the NHS has a legal duty to keep information about you confidential. All of our staff, contractors and locums receive appropriate and regular training to ensure they are aware of their personal responsibilities and that they have legal and contractual obligations to uphold confidentiality, enforceable through disciplinary procedures. Only a limited number of authorised staff have access to personal information where it is appropriate to their role and this is strictly on a need-to-know basis.

If the practice requires a third party to act as a data processor on a subcontracting basis, an appropriate contract (Article 24-28) will be established for the processing of your information.

We always maintain our duty of confidence to you. We will only ever use or pass on information about you if others involved in your care have a genuine need for it (i.e., clinical emergency or where the law requires information to be passed on).

We have a duty to:

Maintain full and accurate records of the care we provide to you
Keep records about you confidential, secure and accurate
Provide information in a format that is accessible to you (e.g., in large type if you are partially sighted)

We will not share information that identifies you for any reason, unless:

You ask us to do so
We ask, and you give us specific permission
We must do this by law
We have special permission for health or research purposes
We have special permission because the interests of the public are thought to be of greater importance than your confidentiality

Our guiding principle is that we are holding your records in strict confidence.

Who are our partner organisations?

We may pass your personal information on to the following people or organisations because they may require your information to assist them in the provision of your direct healthcare needs. It therefore may be important for them to be able to access your information to ensure they can properly deliver their services to you:

Hospital professionals (such as doctors, consultants, nurses etc.)
Other GPs/doctors
Specialist trusts
NHS Commissioning Support Units
Primary care networks
Independent contractors such as dentists, opticians, pharmacists
Any other person who is involved in providing services related to your general healthcare, including mental health professionals
Private sector providers including pharmaceutical companies to allow for the provision of medical equipment, dressings, hosiery etc.
Voluntary sector providers
Ambulance Trusts
Integrated Care Boards (ICBs)
Local authorities
Social care services
Education services

NHS England (NHSE)
Multi-Agency Safeguarding Hub (MASH)
Fire and rescue services
Police and judicial services
Other Data Processors, e.g., Diabetes UK

Other people who we may provide your information to

Anyone you have given your consent to, to view or receive your record, or part of your record – please note, if you give another person or organisation consent to access your record, we will need to contact you to verify your consent before we release that record. It is important that you are clear and understand how much and what aspects of your record you give consent to be disclosed.

Extended access – we provide extended access services to our patients, which means you can access medical services outside of our normal working hours. To provide you with this service, we have formal arrangements in place with the Integrated Care Board (ICB) whereby certain key ‘hub’ practices offer this service for you as a patient to access outside of our opening hours. This means those key hub practices will have to have access to your medical record to be able to offer you the service. Please note to ensure that those practices comply with the law and to protect the use of your information, we have very robust data sharing agreements and other clear arrangements in place to ensure your data is always protected and used for those purposes only.

The key hub practices are: Empingham Medical Centre, Market Overton an Somerby Surgeries and Oakham Medical Practice.

Data extraction by the ICB – the ICB, at times, extracts medical information about you, but the information we pass to them via our computer systems cannot identify you to them. This information only refers to you by way of a code that only your own practice can identify (it is pseudo-anonymised).

This therefore protects you from anyone who may have access to this information at the ICB from ever identifying you because of seeing the medical information and we will never give them the information that would enable them to do this.

Anyone who receives information from us also has a legal duty to keep it confidential.

Summary care records

All patients registered with a GP have a summary care record unless they have chosen not to have one. The information held in your summary care record gives registered and regulated healthcare professionals, away from your usual GP practice, access to information to provide you with safer care, reduce the risk of prescribing errors and improve your patient experience.

Your summary care record contains basic (core) information about allergies and medications and any reactions that you have had to medication in the past. Some patients, including many with long term health conditions, have previously agreed to have additional information shared as part of their summary care record. This additional information includes information about significant medical history (past and present), reasons for medications, care plan information and immunisations.

The Department of Health and Social Care has removed the requirement for a patient’s prior explicit consent to share additional information as part of the summary care record. If you have previously expressed a preference to only have core information shared in your summary care record, or to opt out completely from having a summary care record, these preferences will continue to be respected and this change will not apply to you. For everyone else, the summary care record will be updated to include the additional information.

You have a right to opt out of having a summary care record, and you can also opt back in to having a summary care record or opt back in to allow the sharing of additional information. You can exercise these rights by doing the following:

Choose to have a summary care record with all information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a detailed summary care record, including core and additional information, if they need to provide you with direct care.

Choose to have a summary care record with core information only. This means that any authorised, registered and regulated health and care professionals will be able to see limited information about allergies and medications in your summary care record if they need to provide you with direct care.

Choose to opt-out of having a summary care record completely. This means that you do not want any information to be shared with other authorised, registered and regulated health and care professionals involved in your direct care. You will not be able to change this preference at the time if you require direct care away from your GP practice. This means that no authorised, registered or regulated health and care professionals will be able to see information held in your GP records if they need to provide you with direct care, including in an emergency.

To make these changes, you should inform this organisation or complete this form and return it to us.

Opt outs

You can choose to opt out of sharing your confidential patient information for research and planning purposes. There may still be times when your confidential patient information is used, for example during an epidemic where there might be a risk to you or to other people’s health. You can also still consent to take part in a specific research project.

Your confidential patient information will still be used for your individual care. Choosing to opt out will not affect your care and treatment. You will still be invited for screening services, such as screening for bowel cancer. You do not need to do anything if you are happy with how your confidential patient information is used.

If you do not want your confidential patient information to be used for research and planning, you can choose to opt out by using one of the following:

Online service (Your Data Matters) – Patients registering need to know their NHS number or their postcode as registered at their GP practice

Telephone service 0300 303 5678 which is open Monday to Friday between 0900 and 1700

NHS App – For use by patients aged 13 and over (95% of surgeries are now connected to the NHS App). The app can be downloaded from the App Store or Google Play

‘Print and post’ registration form, Manage Your Choice Form

Photocopies of proof of the applicant’s name (e.g., passport, UK driving licence etc.) and address (e.g., utility bill, payslip etc.) need to be sent with the application. It can take up to 14 days to process the form once it arrives at NHS, PO Box 884, Leeds, LS1 9TZ

Getting a healthcare professional to assist patients in prison or other secure settings to register an opt out choice. For patients detained in such settings, guidance is available at NHS Digital and a proxy form is available to assist with registration.

Text messaging and contacting you

Because we are obliged to protect any confidential information we hold about you, and we take this very seriously, it is imperative that you let us know immediately if you change any of your contact details.

We may contact you using SMS texting to your mobile phone if we need to notify you about appointments and other services that we provide to you involving your direct care.

As such, you must ensure that we have your correct contact details so that we can be satisfied that we are contacting you and not someone else.

GP Connect service

The GP Connect service allows authorised clinical staff at NHS 111 to seamlessly access our clinical system and book directly on behalf of a patient. This means that should you call NHS 111, and the clinician believes you need an appointment, the clinician will access available appointment slots only (through GP Connect) and book you in. This will save you time as you will not need to contact the organisation directly for an appointment.

Uppingham Surgery will not be sharing any of your data and the organisation will only allow NHS 111 to see available appointment slots. It will not even have access to your record. However, NHS 111 will share any relevant data with us, but you will be made aware of this. This will help in knowing what treatment/service/help you may require.

Please note, if you no longer require the appointment or need to change the date and time for any reason, you will need to speak to one of our reception staff and not NHS 111.

Primary Care Networks

The objective of primary care networks (PCNs) is to group practices together to create more collaborative workforces that ease the pressure on GPs, leaving them better able to focus on patient care. All areas within England are covered by a PCN.

PCNs bring general practices together to work at scale allowing the organisations to expand the ability of practices to recruit and retain staff, manage economic and estates pressures, provide a wider range of services to patients and to integrate with the wider health and care system more easily.

All GP practices have come together in geographical networks covering populations of approximately 30,000 – 50,000 patients to take advantage of additional funding attached to the GP contract. Therefore, this means that Uppingham Surgery may share your information with other practices within the PCN to provide you with your care and treatment.

NHS health checks

NHS health checks are for people who are aged 40 to 74 who do not have a range of pre-existing conditions as detailed here. Any patient between these ages and without any pre-existing condition should receive a letter from this organisation inviting you for a free NHS Health Check every five years. Should you wish, you can also call this organisation to book a health check.

Nobody outside the healthcare team at Uppingham Surgery will see confidential information about you during the invitation process.

Medical examiner checks

Following the death of any patients, we are obliged to inform the Medical Examiner Service. Medical examiner offices now provide independent scrutiny of non-coronial deaths occurring in the community.

Medical examiner offices are led by medical examiners, senior doctors from a range of specialties including general practice, who provide independent scrutiny of deaths not taken at the outset for coroner investigation. They put the bereaved at the centre of processes after the death of a patient by giving families and next of kin an opportunity to ask questions and raise concerns. Medical examiners carry out a proportionate review of medical records and liaise with doctors completing the Medical Certificate of Cause of Death (MCCD).

Uppingham Surgery will share any patient information with the service upon request.

Audit

Auditing of clinical notes is done by Uppingham Sugrery as part of its commitment to the effective management of healthcare.

The Information Commissioner’s Office (ICO) provides detailed guidance in its Guide to GDPR, What are the conditions for processing and Article 9.2.h is applicable to the management of healthcare services and ‘permits processing necessary for the purposes of medical diagnosis, provision of healthcare and treatment, provision of social care and the management of healthcare systems or services or social care systems or services.’

No consent is required to audit clinical notes for this purpose.

Furthermore, compliance with Article 9.2.h requires that certain safeguards are met. The processing must be undertaken by or under the responsibility of a professional subject to the obligation of professional secrecy, or by another person who is subject to an obligation of secrecy.

Auditing clinical management is no different to a multi-disciplinary team meeting discussion whereby management is reviewed and agreed. It would be realistically impossible to require consent for every patient reviewed, which is unnecessary.

It is also prudent to audit under Health and Social Care Act 2008 (Regulated Activities) Regulations 2014: Regulation 17: Good Governance.

Safeguarding

The organisation is committed to ensuring that the values and obligations of safeguarding adults and children are holistically, constantly and thoroughly applied to the wellbeing of all, at the centre of what we do.

Safeguarding information such as referrals to safeguarding teams is retained by Uppingham Surgery when handling a safeguarding concern or incident. We may share information accordingly to ensure duty of care and investigation as required with other partners such as local authorities, the police or healthcare professionals.

Accessing your records

You have a right to access the information we hold about you and, if you would like to access this information, you will need to make a request, ideally by completing a Subject Access Request (SAR) form and provide the relevant personal photographic identification.

Please ask for an SAR form or download this from our website and you will be given further information. Furthermore, should you identify any inaccuracies, you have a right to have the inaccurate data corrected.

You have a right to privacy under the UK General Data Protection Regulation 2016 (UK GDPR) and the Data Protection Act. The organisation needs your personal, sensitive and confidential data in order to perform our statutory health duties, in the public interest or in the exercise of official authority vested in the controller in compliance with Article 6 (e) of the GDPR and for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services in compliance with Article 9 (h) of the GDPR.

You have the right to ask for a copy of all records about you
Your request should be made to the organisation holding your information
We are required to respond to you within one month
You will need to give adequate information (for example full name, address, date of birth, NHS number etc.)

Should you have any questions about our privacy policy or the information we hold about you, you can:

Contact or write to Uppingham Surgery as we are the Data Controller for the data we hold about you

If you think anything is inaccurate or incorrect, please inform the organisation as soon as possible. For other rights about the use of your information please see our website.

Objections and/or complaints

Should you have any concerns about how your information is managed at Uppingham Surgery please contact the Practice Manager via email to [email protected]. Should you remain unhappy, you can then complain to the ICO via its website (www.ico.org.uk) or telephone 0303 123 1113.

The ICO is the regulator for the GDPR and offers independent advice and guidance on the law and personal data, including your rights and how to access your personal information.

Data Protection Officer

The organisation’s Data Protection Officer is Midlands and Lancashire CSU. Any queries regarding data protection issues should be addressed to them at:

Email: [email protected]

Postal: Heron House, 120 Grove Road, Fenton, Stoke on Trent, Staffordshire ST4 4LX

Where to find our privacy notice

You may find a copy of our privacy notice at [email protected] or a copy may be provided on request.

We regularly review our privacy policy and any updates will be published on our website to reflect the changes. The policy is reviewed on an annual basis.

Version: 1.0

Published: 5 May 2023

Review date: 4 May 2023