St Paul’s Medical Centre is committed to delivering the best possible care to our patients. To enhance the quality and efficiency of our consultations, clinicians (your GP or a member of the multidisciplinary team within practice) may use Heidi Health AI Scribe during your appointment. This section provides information about what Heidi Health AI Scribe is and how your consent is managed.

What is Heidi Health AI Scribe?

Heidi Health AI Scribe is an advanced, secure digital assistant designed to support clinicians during consultations. It uses artificial intelligence to document medical note, ensuring your clinician can focus on actively listening to your concerns and delivering personalised care, rather than spending time manually recording the notes. Clinicians review and approve the notes that have been captured prior to adding to the patient record.

• Improved Interaction: Allows clinicians to focus solely on the patient during the consultation.
• Accurate Documentation: Helps create precise, clear, and detailed medical notes for the patient record.
• Time Efficiency: Streamlines administrative tasks, giving clinicians more time to spend with their patients.

Patient Consent

Your privacy and comfort are our top priorities. Heidi Health AI Scribe only processes information discussed during your appointment and operates within strict privacy and data protection regulations. Before using Heidi Health AI Scribe, your clinician will explain its role and seek your verbal consent. You have the right to decline its use at any time.

• Data Security: Heidi Health AI Scribe complies with UK data protection laws, including GDPR, ensuring that your information is handled securely and confidentially.
• Data Protection Officer: The Heidi Health Data Protection Impact Assessment has been reviewed and approved by the Data Protection Officer for Nuneaton and Bedworth Primary Care Network, on behalf of your GP Practice.
• Your Control: If you prefer not to have Heidi Health AI Scribe involved, please do let your clinician know. This will not affect the quality of care you receive.

Whatever in connection with my professional practice or not in connection with it I see or hear in the life of men which should not be spoken of abroad I will not divulge as reckoning that all such should be kept secret (Hippocratic Oath, C5 BC)

ALL PERSONAL AND MEDICAL INFORMATION RELATING TO PATIENTS AND STAFF IS STRICTLY CONFIDENTIAL

BREACH OF CONFIDENTIAL INFORMATION MAY CONSTITUTE GROSS MISCONDUCT AND CAN LEAD TO SUMMARY (IMMEDIATE) DISMISSAL

THE GUARDIAN OF CONFIDENTIALITY (CALDICOTT GUARDIAN) FOR THIS PRACTICE IS DR ROBERT STRAKER-BENNETT

GPs and practice staff have a legal, professional and moral duty to ensure that confidentiality of patient information is maintained.  Any information held about patients must be factual, consistent and accurate, and recorded in line with the Recording of Patient Information Policy.

At St Paul’s we aim to follow the NHS Confidentiality Model, which is to:

• PROTECT – keep patient information secure
• INFORM – ensure patients know how information held about them is used
• PROVIDE CHOICE – allow patients to decide whether their information can be disclosed or used in particular ways within the restrictions of the law
• IMPROVE – on all of the above

Patients should be able to:

• Understand the reasons for processing personal information about them
• Give consent for the disclosure and use of personal information
• Gain trust in the way the NHS handles information, and
• Understand their rights to access information held about them.

The following precautions and procedures must be observed by all St Paul’s GPs and employees, locums, contractors, attached, visiting, community, Trust and voluntary workers, students, trainees and work-experience placements.  The policy must be read in conjunction with the:

• Subject Access Request policy
• IMT & IG policy

1 – DISCLOSURE OF CONFIDENTIAL INFORMATION TO THE PATIENT

1:1 – Disclosure of information to the patient

1:1:1    Patients have a legal right to view and have copies of entries in their paper-based and/or computer held records, and to have these explained to them.  The process for dealing with such requests is given in the Subject Access Request policy.

1:1:2    Patients may ring or call in to find out the results of investigations etc.  Staff members may give the result to the patient AS INDICATED BY THE DOCTOR’S NOTES ON THE SCREEN, provided they have first confirmed the patient’s date of birth and are satisfied that they are speaking to the patient personally (or appropriate representative – see 1:3).

1:1:3    If a staff member needs to contact a patient to inform them of test results or arrange an appointment and is unable to do so by ‘text message or telephone, a letter must be sent to the patient’s home address, clearly marked with the patient’s name and annotated ‘Private and Confidential’.

1:1:4    Staff must be mindful of potential communication difficulties for example if the patient has little English, has a learning disability or a sight or hearing deficiency.  Every effort must be made to ensure the patient can fully understand the information being disclosed to them, and it may be appropriate on occasion to recommend the assistance of an interpreter, representative or advocate.  A loop system is in operation for patients with hearing aids.

1:1:5    If a patient wishes to speak to an admin staff member privately, the staff member should inform a manager so that cover can be arranged, and take the patient to a vacant consulting room, provided also that is no indication that this could cause a safety risk to the staff member.  The staff member must ensure that he/she knows the location of the panic alarm within the consulting room and that the manager knows which room is to be used and the name of the patient.  If there is a risk to the staff member, he/she must not see the patient alone.

1:1:6    Access is available for patients to view their problems, medications and investigations online.  They must register for online access via one of the available applications and provide a form of photographic identification (unless using the NHS App as their identification has already been verified) for admin to grant permission on EMIS Web.   If the patient wants full access to all their medical records a manager will be informed and the records checked to redact any information that could breach another person’s confidentiality, cause harm to the patient or risk leading to harm to others.  Permission to give access to redacted notes will be sought from the patient’s GP and if granted patient access will be opened for access to all records.

1:2 – Disclosure of information to other healthcare workers

1:2:1    There is a legal basis under GDPR to share information with healthcare providers who are CURRENTLY and DIRECTLY involved in that’s patient’s care.

1:2:2    Local data-sharing agreement allow services such as Extensive Care and Out of Hours services (111 via FCMS) to access the patient record when required to provide health care or advice to the patient.

1:2:3    Patients may prohibit information being disclosed to other healthcare professionals.  Their wishes must be respected wherever possible, but they must be informed about and understand the implications of their decision for the provision of care or treatment.  The same considerations relating to communication difficulties as listed in 1:1:3 must be made.

1:2:4    It may be necessary to give information about a patient to healthcare workers without consent if they are likely to be at particular risk in dealing with the patient, for example if the patient is mentally unstable, violent, or a carrier of a serious contagious disease.

1:2:5    There is a legal basis under GDPR to share about a patient with health and social care staff or the police without consent if there is a risk to or from the patient under child and adult safeguarding procedures or in the interests of serious crime investigation.

1:2:6    Passing confidential information to a healthcare worker about a patient when there is NO risk to the worker and they are NOT directly involved in the patient’s care is NOT permissible.

1:2:7    Information about named patients must NOT be discussed by reception or other non-clinical staff unless there is a risk to their safety.  Individual patient cases are not to be the subject of casual conversation.

1:3 – Disclosure to family or others

1:3:1    Medical information, including test results etc, may only be divulged to a relative, friend or advocate if the patient has given explicit consent in writing or in person, or the requester has a legal right to the information as described in the Subject Access Request policy.

1:3:2    Particular care must be taken when a parent or guardian requests information about a child.  Refer to the Subject Access Request policy for guidance.

1:3:3    Confidentiality extends beyond the grave.  There are restrictions on who may request information from deceased patients’ records – refer to the Subject Access Request policy

1:3:4    Staff must check with the Caldicott Lead or a manager before divulging information if there is any doubt about the requester’s right to the information – see the Subject Access Request policy

1:4 – Disclosure to health authorities, hospitals, etc

1:4:1    Enquiries from hospitals to confirm a patient’s personal details can usually be answered.  If there is any doubt about the authenticity of the request, take the caller’s number and ring them back.

1:4:2    IOS or enhanced services claims may require details of patients, including the NHS number, and the procedures carried out.  Staff must comply with the procedures and avoid giving confidential information unnecessarily to health providers or authorities.

1:4:3    Explicit patient consent is NOT required where mandatory notification of infectious diseases is required.

1:4:4    Patients must be informed that their records may be subject to inspection by health authority officers for the purposes of practice quality control or claims verification.

1:4:5    Great care must be taken when accessing patient details and processing referrals through Choose & Book and any of the Care Records Service functions as they come on-line.

1:5 – Disclosure to third parties

1:5:1    See the Subject Access Request policy for full details

1:5:2    The decision of whether or not to disclose must be made by a GP or a manager, preferably after discussion with the Caldicott Guardian or at least one colleague and if necessary, the medical defence body.

2 – CONFIDENTIALITY FOR TEENAGERS AGED UNDER 16 YEARS

2:1       Under the Children Act, any COMPETENT young person, regardless of age, can independently seek medical advice, give valid consent for medical treatment and expect the same standards of confidentiality as an adult.  Confidentiality must be maintained in these cases in the same way as would be the case for an adult, and with the same exceptions.

2:2       A young person is deemed to be competent to consent to advice or treatment provided the Fraser guidelines (1985) have been satisfied.  Although these have been worded in terms of a doctor giving specifically contraceptive advice and treatment, they should be applied to any healthcare professional giving any healthcare advice or treatment.  The criteria are shown below:

• The young person understands the doctor’s advice
• The doctor cannot persuade the young person to inform his/her parents or allow them to be informed
• The young person is very likely to begin or continue having intercourse with or without contraceptive treatment
• Unless he/she receives contraceptive advice or treatment the young person’s physical or mental health or both are likely to suffer
• The young person’s best interests require the doctor to give contraceptive advice, treatment or both without parental consent.

2:3       People will seek health advice more willingly if they can trust that their consultations and treatment will be kept confidential.  This is particularly true for teenagers and young people aged under 16 years who may need advice on any clinical issue, but may be particularly reluctant to discuss sensitive issues such as sexual health and contraception, pregnancy, termination, depression, self-harm, addiction and substance abuse, etc.

2:4       Care must be taken when communicating with young patients by home telephone or post if there is a risk that the information may be heard/seen by another person.  A secure or acceptable means of communication should be agreed with the young person at the time of the consultation wherever possible.

2:5       Patients should be assured that their confidentiality will be maintained by providing information via the practice website, leaflet and information in the waiting room.

2:6       If the healthcare provider considers the young person to be incapable of giving consent because of immaturity, illness or mental capacity, they should encourage the young person to allow an appropriate adult to be involved in the consultation.  If they refuse and the healthcare provider is convinced that it is essential in their medical interests, he/she may disclose relevant information to an appropriate person or authority.  In such cases, the patient must be informed before disclosure, and where appropriate, the views of an advocate or carer sought.  All the steps taken must be documented in the patient’s medical record.

3 – SECURITY/STORAGE OF CONFIDENTIAL INFORMATION

3:1 – Lloyd George (manual) records

3:1:1    Lloyd George notes must not be left accessible to unauthorised users and all storage cabinets must be locked when not in use and when the Medical Centre is closed.

3:1:2    Medical records must not be taken home.  Home visit print-outs must not be left in practitioners’ cars or homes, from where they could be stolen or seen by others without the patient’s consent.

3:1:3    Patients/visitors to the practice must not be left unaccompanied in rooms where medical records could be accessible, for example in consulting rooms, reception or other offices.  Documents containing patient identifiable data must be locked away when not in use.

3:1:4    Test result slips, hospital letters, etc must not be left on the reception desks where they might be seen by people at the counter.

3:1:5    Any rooms containing medical records must be locked when unoccupied.

3:1:6    All reasonable steps must be taken to avoid unauthorised access to the medical records.  For example, the reception area should not be left vacant while patients or visitors to the practice are on the premises.

3:1:7    People who are seen within the surgery who cannot be identified as a genuine patient or visitor with grounds to be on the premises must be challenged, provided this can be done safely without risk of harm to the staff member.

3:1:8    A manager must be informed immediately if any medical records are lost or stolen or if there is believed to have been a breach of confidentiality.

3:2 – Computer records

3:2:1    All security measures described in the IMT & IG policy must be adhered to.

3:2:2    Patients or others must not be left unaccompanied in rooms where they could access computer information.  It is necessary to log off or lock the computer when leaving a room for a period of time.

3:2:3    Logins and passwords must not be shared.  Refer to the IM&T and IG policy for further details on using the computers and computer held information.

3:2:4    Computer screens showing information about patients must be positioned to avoid other patients seeing the screen.

3:2:5    Data must be wiped before a computer, photocopier, fax machine, scanner or other equipment capable of storing information is decommissioned or destroyed.

3:2:6    Smart cards, passwords and mobile devices must be stored securely to prevent access by unauthorised users in line with the IMT & IG policy.

3:2:7    Loss of smart cards or mobile devices must be reported immediately to the manager.

4 – TRANSMISSION OF CONFIDENTIAL INFORMATION

4:1 – Verbal transmission

4:1:1    Assuming justification/consent for disclosure has been established, information must be transmitted accurately, effectively and securely.

4:1:2    Discussion with or about patients must not take place within hearing of potential eavesdroppers.

4:1:3    When on the telephone, the identity of the patient to whom you are speaking must not be made explicit if you are within earshot of the waiting room.

4:1:4    Messages must NOT be left on patients’ answering machines or with relatives.  If unable to contact a patient by ‘phone results/information must be sent by post marked private and confidential.

4:1:5    Particular care must be taken when contacting competent patients aged under 16.  Ways in which to contact them confidentially should be agreed with them in advance wherever possible.

4:1:6    Patient enquiries at the reception counter must be answered discreetly, so that other patients cannot overhear.  If the information is particularly sensitive, or if the patient wishes to speak to the receptionist privately, they should be taken to a vacant room.

4:1:7    The practice has a loop system, which can be used to assist patients with hearing aids to hear clearly without the need for the receptionist or practitioner to speak loudly.

4:1:8    Personal information may be texted to patients by prior arrangement with the patient provided they have given permission and updated their mobile ‘phone number each time such an arrangement is made.

 4:2 – Written information

4:2:1    Envelopes must be marked private and confidential when writing to patients.

4:2:2    Letters, forms or other information must not be left where other patients or visitors could see them.

4:2:3    Confidential information awaiting disposal, including repeat prescription slips, must be placed in the confidential waste disposal bins

5 – TRAINING

5:1       All new staff must receive training in Confidentiality and the application of this policy as part of their induction.

5:2       All staff members are required to keep their knowledge about confidentiality and consent up-to-date in line with the mandatory training programme and their role within the practice.  Training resources are available on the Bluestream Academy website.

6 – MISCELLANEOUS

6:1       Clinical audit is a valid use of patient information.  Individual consent is not required unless direct patient feedback is involved.  However, if consent has not been sought, personally identifiable information about participating patients must NOT be included in the write up or discussion.

6:2       Medical or personal information about patients or staff that a staff member has become aware of from a source outside the Medical Centre must be treated confidentially, as others may perceive disclosure of such information to be a breach of confidentiality from the Medical Centre.  Disclosure of such information will be treated as a breach of confidentiality from a disciplinary point of view.

6:3       Personal information about staff members including telephone numbers must NOT be disclosed to enquirers.

6:4       All contractors visiting the site must sign the visitors’ register and complete a confidentiality agreement prior to commencing work on-site.

6:5       If it is believed that a breach of confidentiality may have occurred, whether deliberate or accidental, the practice a manager must be informed immediately, so that investigation and action can be put in place to protect the patient’s information as far as possible.  Advice should be sought from the medical defence body if necessary.

6:6       Any queries about this policy must be directed to the practice business manager.

6:7       Clarification about the disclosure of information in a particular situation can be sought from a manager or the Caldicott Lead.

6:8       Patients must be informed about confidentiality and the use of their records in the practice patient information leaflet, poster in the waiting room and via privacy notices on the website.

6:9       Copies of this policy may be given to patients under the Freedom of Information Act.

6:10     The practice must periodically assess its performance against the principles of the Data Protection Act, GDPR and the Caldicott Committee recommendations.

KEY LEGISLATION/GUIDELINES PERTAINING TO PATIENT CONFIDENTIALITY

Public authorities including the NHS are obliged to comply with Administrative Law, which requires them to act intra vires (within their lawful powers).

Confidentiality is covered by various professional regulations, including the GMC, IHM and NMC Codes of Conduct, the common law duty of confidentiality and the NHS codes of practice for Confidentiality and Records Management.  In addition, the NHS Care Record Guarantee for England and HSC 1999/012 require the highest standards of patient confidentiality to be maintained.  Aspects of the holding and disclosure of personal and medical information are also protected by statute within the following legislation:

• Abortions Regulations 1991
• Access to Health Records Act 1990
• Access to Medical Reports Act 1988
• Caldicott Committee 1997
• Children Act
• Computer Misuse Act 1990
• Crime and Disorder Act 1998
• Data Protection Act 1998
• Freedom of Information Act 2000
• Health and Social Care Act 2001
• HSC 1999/012
• Human Fertilisation & Embryology Act 1990
• Human Rights Act 1998
• Mental Capacity Act 2005
• NHS Venereal Diseases Regulations 1974
• Public Health (Control of Diseases) Act 1984
• General Data Protection Regulations

 TERMINOLOGY

 Personal Data – Information about living, identifiable individuals, e.g. name and address etc.  Statements of fact/expressions of opinion about an individual and information about the data controllers’ intentions towards them are personal data.

 Processing – Processed by computer or other technology such as document image-processing systems.  Processing also includes obtaining, storing & disclosing data.

 Manual Records – Information that is recorded as part of a ‘relevant filing system’ (e.g. Lloyd George), where records are structured either by reference to individuals or by reference to certain criteria, so that specific information relating to individuals is readily available (e.g. disease registers).

 Data Users – Those who control the contents & use of a collection of personal data.

 Data Controller – Those who determine the purposes and manner in which any personal data are processed i.e. St Paul’s Medical Centre

 Health Records – Record that relates to the physical or mental health of an individual, which has been made by or on behalf of a health professional in connection with the care of that individual.

 Sensitive Personal Data – Information relating to:

• Racial/ethnic origin of the subject
• Political opinion
• Religious or other similar beliefs
• Trade Union membership
• Physical/mental health or condition
• Sexual life
• Commission or alleged commission of any offence
• Details of any proceedings for any offence/alleged offence

 DATA PROTECTION ACT PRINCIPLES

Records containing personal information should…

• Be obtained and processed lawfully and fairly.
• Be obtained for only one or more specified and lawful purpose and not used for anything incompatible with that purpose.
• Be adequate, relevant and not excessive in relation to the purpose for which they are held.
• Be accurate and, where necessary, up to date.
• Be held for no longer than is necessary for the purpose for which they are held.
• Be processed in accordance with the rights of data subjects under this Act.
• Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing and against accidental loss or destruction or damage to personal data.
• Not to be transferred to a country outside the EU unless that country ensures an adequate level of protection for the rights and freedoms of data subjects.

 CALDICOTT COMMITTEE PRINCIPLES

• Justify the purpose – every proposed use/transfer of patient identifiable information should be clearly defined and scrutinised, with continuing users regularly reviewed by an appropriate guardian.
• Do not use patient identifiable information unless it is absolutely necessary.
• Use the minimum necessary patient identifiable information.
• Access to patient identifiable information should be on a strict need to know basis.
• Everyone should be aware of their responsibilities.
• Understand and comply with the law.
• The duty to share information can be as important as the duty to protect patient confidentiality

 GDPR SUBJECT DATA RIGHTS

• The right to be informed
• The right of access
• The right to rectification
• The right to erase or ‘the right to be forgotten’
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision-making and profiling

 DoH Standards of Information Handling (HORUS)

Information must be:

• Held securely and confidentially
• Obtained fairly and efficiently
• Recorded accurately and reliably
• Used effectively and ethically
• Shared appropriately and lawfully

Caldicott Audit completed _______________________ (date)

Data Protection Register No:              Z5620272 (SPMC)      

Data Protection Security No:              10230267 (SPMC)     

Signed ______________________________            Date _______________

Dr R Straker- Bennett

Guardian of Confidentiality

The records we keep enable us to plan for your care.

This Practice keeps data on you that we apply searches and algorithms to in order to identify from preventive interventions.

This means using only the data we hold or in certain circumstances linking that data to data held elsewhere by other organisations and usually processed by organisations within or bound by contracts with the NHS.

If any processing of this data occurs outside the practice your identity will not be visible to the processors. Only this Practice will be able to identify you and the results of any calculated factors, such as your risk of having a heart attack in the next 10 years or your risk of being admitted to hospital with a complication of chest disease

You have the right to object to our processing your data in these circumstances and before any decision based upon that processing is made about you. Processing of this type is only lawfully allowed where it results in individuals being identified with their associated calculated risk. It is not lawful for this processing to be used for other ill-defined purposes, such as “health analytics”.

Despite this we have an overriding responsibility to do what is in your best interests.  If we identify you as being at significant risk of having, for example a heart attack or stroke, we are justified in performing that processing.

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

1) Data Controller contact details	St Paul’s Medical Centre Dickson Road, Blackpool, FY1 2HH Tel: 01253 623896 e-mail: st.pauls.medicalcentre@nhs.net
2) Data Protection Officer contact details	Compliance officer (DPO) = Hilary Gidman Email: mlcsu.dpo@nhs.net Caldicott Guardian Dr Robert Straker-Bennett
3) Purpose of the processing	The Practice performs computerised searches of some or all of our records to identify individuals who may be at increased risk of certain conditions or diagnoses i.e.  Diabetes, heart disease, risk of falling). Your records may be amongst those searched.  This is often called “risk stratification” or “case finding”. These searches are sometimes carried out by Data Processors who link our records to other records that they access, such as hospital attendance records. The results of these searches and assessment may then be shared with other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.
4) Lawful basis for processing	The legal basis for this processing is Article 6(1)(e); “necessary… in the exercise of official authority vested in the controller’ And Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” We will recognise your rights under UK Law collectively known as the “Common Law Duty of Confidentiality”*
5) Recipient or categories of recipients of the shared data	The data will be shared for processing with NHS Digital and for subsequent healthcare with the CCG.
6) Rights to object	You have the right to object to this processing where it might result in a decision being made about you. That right may be based either on implied consent under the Common Law of Confidentiality, Article 22 of GDPR or as a condition of a Section 251 approval under the HSCA. It can apply to some or all of the information being shared with the recipients. Your right to object is in relation to your personal circumstances. Contact the Data Controller or the Practice.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected.  There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained in line with the law and national guidance. https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Cre-2016 or speak to the practice.
9)  Right to Complain	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament.  It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law.  The law is applied by reference to those previous cases, so common law is also said to be based on precedent.

The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.

In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient.  It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.

Three circumstances making disclosure of confidential information lawful are:

• where the individual to whom the information relates has consented;
• where disclosure is in the public interest; and
• where there is a legal duty to do so, for example a court order.

This Practice keeps data on you relating to who you are, where you live, what you do, your family, possibly your friends, your employers, your habits, your problems and diagnoses, the reasons you seek help, your appointments, where you are seen and when you are seen, who by, referrals to specialists and other healthcare providers, tests carried out here and in other places, investigations and scans, treatments and outcomes of treatments, your treatment history, the observations and opinions of other healthcare workers, within and without the NHS as well as comments and aide memoires reasonably made by healthcare professionals in this practice who are appropriately involved in your health care.

When registering for NHS care, all patients who receive NHS care are registered on a national database, the database is held by NHS Digital a national organisation which has legal responsibilities to collect NHS data.

GPs have always delegated tasks and responsibilities to others that work with them in their surgeries.  On average GPs are responsible for 1,500 to 2,500 patients each (around 11,500 patients in our practice). It is not possible for the GP to provide hands on personal care for each and every one of those patients in those circumstances, for this reason GPs share your care with others, predominantly within the surgery, but occasionally with outside organisations.

If your health needs require care from others elsewhere outside this Practice, we will exchange with them whatever information about you that is necessary for them to provide that care. When you make contact with healthcare providers outside the Practice, but within the NHS it is usual for them to send us information relating to that encounter. We will retain part or all of those reports. Normally we will receive equivalent reports of contacts you have with non-NHS services, but this is not always the case.

Your consent to this sharing of data, within the practice and with those others outside the practice is assumed and is allowed by the Law.

People who have access to your information will only normally have access to that which they need to fulfil their roles, for instance admin staff will normally only see your name, address, contact details, appointment history and registration details in order to book appointments, the practice nurses will normally have access to your immunisation, treatment, significant active and important past histories, your allergies and relevant recent contacts whilst the GP you see or speak to will normally have access to everything in your record.

You have the right to object to our sharing your data in these circumstances but we have an overriding responsibility to do what is in your best interests. Please see below.

1) Data Controller contact details	St Paul’s Medical Centre Dickson Road, Blackpool, FY1 2HH Tel: 01253 623896  e-mail st.pauls.medicalcentre@nhs.net
2) Data Protection Officer (DPO) contact details	Compliance officer (DPO) = Hilary Gidman Email: mlcsu.dpo@nhs.net Caldicott Guardian Dr Robert Straker-Bennett
3) Purpose of the processing	Direct Care is care delivered to the individual alone, most of which is provided in the surgery. After a patient agrees to a referral for direct care elsewhere, such as a referral to a specialist in a hospital, necessary and relevant information about the patient, their circumstances and their problem will need to be shared with the other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.
4) Lawful basis for processing	The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere  is supported under the following Article 6 and 9 conditions of the GDPR: Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. and Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*
5) Recipient or categories of recipients of the processed data	The data will be shared with Health and care professionals and support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care.
6) Rights to object	You have the right to object to some or all the information being processed under Article 21. Please contact the Data Controller or the practice. You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained in line with the law and national guidance. https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 or speak to the practice.
9) Right to Complain	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament.  It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law.  The law is applied by reference to those previous cases, so common law is also said to be based on precedent.

The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.

In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient.  It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.

Three circumstances making disclosure of confidential information lawful are:

• where the individual to whom the information relates has consented;
• where disclosure is in the public interest; and
• where there is a legal duty to do so, for example a court order.

As employers we need to keep certain information so that we can remain your employer and manage payments. This is a combination of personal and financial information. We are required by law to hold certain types of data on those we employ under the Health and Social Care Act and this data is examined during CQC inspection visits. For more information about the CQC see http://www.cqc.org.uk/

We are also required to share information about you with NHS Digital under a submission known as the “Workforce Minimum Dataset”. To find out more visit https://digital.nhs.uk/data-and-information/areasof-interest/workforce/workforce-minimum-data-set-wmds Workforce Minimum Data Set (wMDS) – NHS Digital

We are also required by HMRC and various taxation laws, such as “The Income Tax (Pay As You Earn) Regulations 2003” to keep financial records.

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

 

1.      Data Controller contact details	St Paul’s Medical Centre, Dickson Road, Blackpool, FY1 2HH.  Tel: 01253 623896 st.pauls.medicalcentre@nhs.net
2.      Data Protection Officer contact detail	Data Protection Officer: Hilary Gidman mlcsu.dop@nhs.net The Caldicott Guardian is Dr Robert Straker-Bennett
3.      Purpose of the processing	To comply with the Health and Social Care Act and taxation law.
4.      Lawful basis for the processing	Article 6(b) –performance of a contract with the data subjectArticle 6(f) –legitimate interests pursued by the controller or a third party Article 9(b) – for carrying out obligations in the field of employment Article 9(h) – for purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management or health or social care systems
5.      Recipients or categories of recipients of the share data	HMRC, Pension provider, Practice Accountant, Health Education England – NW (HENW) and the Care Quality Commission (CQC), its officers and staff and members of the inspection teams that visit us from time to time.
6.      Right to object	You have the right to object to some or all of the information being shared with CQC. Contact the Data Controller or the practice. There is no right to have UK taxation related data deleted except after certain statutory periods.
7.      Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have records deleted except when ordered by a court of Law.
8.      Retention period	The data will be retained for active use during the processing and thereafter according to NHS Policies, taxation and employment law.
9.      Right to Complain	If you are unhappy with the way in which your personal data has been processed you may in the first instances contact the Business Practice Manager or the HR Manager. You also have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/

NHS Digital is the secure haven for NHS patient data, a single secure repository where data collected from all branches of the NHS is processed. NHS Digital provides reports on the performance of the NHS, statistical information, audits and patient outcomes (https://digital.nhs.uk/data-and-information). Examples include: A&E and outpatient waiting times, the numbers of staff in the NHS, percentage target achievements, payments to GPs etc and more specific targeted data collections and reports such as the Female Genital Mutilation, general practice appointments data and English National Diabetes Audits.

GPs are required by the Health and Social Care Act to provide NHS Digital with information when instructed. This is a legal obligation which overrides any patient wishes. These instructions are called “Directions”. More information on the directions placed on GPs can be found at https://digital.nhs.uk/article/8059/NHS-England-Directions and www.nhsdatasharing.info

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

1) Data Controller contact details	St Paul’s Medical Centre Dickson Road, Blackpool, FY1 2HH Tel: 01253 623896 e-mail: st.pauls.medicalcentre@nhs.net
2) Data Protection Officer contact details	Compliance officer (DPO) = Hilary Gidman Email: mlcsu.dpo@nhs.net Caldicott Guardian Dr Robert Straker-Bennett
3) Purpose of the processing	To provide the Secretary of State and others with information and reports on the status, activity and performance of the NHS.
4) Lawful basis for processing	The legal basis will be Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”
5) Recipient or categories of recipients of the processed data	The data will be shared with NHS Digital according to directions which can be found at https://digital.nhs.uk/article/8059/NHS-England-Directions
6) Rights to object	You have the right to object to some or all of the information being shared with NHS Digital. Contact the Data Controller or the practice.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected.  There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained for active use during the processing and thereafter according to NHS Policies and the law.
9)  Right to Complain	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

 

Contract holding GPs in the UK receive payments from their respective governments on a tiered basis. Most of the income is derived from baseline capitation payments made according to the number of patients registered with the practice on quarterly payment days. These amounts paid per patient per quarter varies according to the age, sex and other demographic details for each patient.

There are also graduated payments made according to the practice’s achievement of certain agreed national quality targets known as the Quality and Outcomes Framework (QOF), for instance the proportion of diabetic patients who have had an annual review. Practices can also receive payments for participating in agreed national or local enhanced services, for instance opening early in the morning or late at night or at the weekends. Practices can also receive payments for certain national initiatives such as immunisation programs and practices may also receive incomes relating to a variety of non patient related elements such as premises.

Finally there are short term initiatives and projects that practices can take part in. Practices or GPs may also receive income for participating in the education of medical students, junior doctors and GPs themselves as well as research².

In order to make patient-based payments basic and relevant necessary data about you needs to be sent to the various payment services. The release of this data is required by English laws¹

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

1) Data Controller contact details	St Paul’s Medical Centre Dickson Road, Blackpool, FY1 2HH Tel: 01253 623896 e-mail: st.pauls.medicalcentre@nhs.net
2) Data Protection Officer contact details	Compliance officer (DPO) = Hilary Gidman Email: mlcsu.dpo@nhs.net The Caldicott Guardian is Dr Robert Straker-Bennett
3) Purpose of the processing	To enable GPs to receive payments.  To provide accountability.
4) Lawful basis for processing	The processing of personal data in the delivery of direct care and for providers’ administrative purposes in the surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR: Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”
5) Recipient or categories of recipients of the processed data	The data will be shared with Health and care professionals and support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care.
6) Rights to object	You have the right to object to some or all the information being processed under Article 21. Please contact the Data Controller or the practice. You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained in line with the law and national guidance. https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 or speak to the practice.
9) Right to Complain	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ Or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

1, NHS England’s powers to commission health services under the NHS Act 2006 or to delegate such powers to CCGs and the GMS regulations 2004 (73)1

2, For more information about payments the English GPs please see; https://digital.nhs.uk/NHAIS/gp-payments , https://digital.nhs.uk/catalogue/PUB30089 and http://www.nhshistory.net/gppay.pdf

This Practice participates in research. We will only agree to participate in any project if there is an agreed clearly defined reason for the research that is likely to benefit healthcare and patients.  Such proposals will normally have a consent process, ethics committee approval, and will be in line with the principles of Article 89(1) of GDPR.

Research organisations do not usually approach patients directly, but will ask us to make contact with suitable patients to seek their consent. Occasionally research can be authorised under law without the need to obtain consent. This is known as the section 251 arrangement¹.  We may also use your medical records to carry out research within the practice.

You have the right to object to your identifiable information being used or shared for medical research purposes.  Please speak to the practice if you wish to object.

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

1) Data Controller contact details	St Paul’s Medical Centre Dickson Road, Blackpool, FY1 2HH Tel: 01253 623896 e-mail: st.pauls.medicalcentre@nhs.net
2) Data Protection Officer contact details	Compliance officer (DPO) = Hilary Gidman Mlcsu.dpo@nhs.net The Caldicott Guardian is Dr Robert Straker-Bennett
3) Purpose of the sharing	Medical research.
4) Lawful basis for processing or sharing	Most information shared with researchers will not be identifiable, however where identifiable data will be shared with researchers, this will be either with explicit consent or, where the law allows, without consent.  The lawful justifications are; “Article 6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes” and “Article 9(2)(j) – ‘processing is necessary for… scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member States law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject’. We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”2
5) Recipient or categories of recipients of the shared data	Information to be provided when available
6) Rights to object	You do not have to consent to your data being used for research.  If you have consented to your data being used in research you can change your mind and withdraw your consent at any time.  Contact the Data Controller or the practice.  We will normally comply with any request.
7) Right to access and correct	You have the right to access any identifiable data that is being shared and have any inaccuracies corrected.
8) Retention period	The data will be retained for the period as specified in the specific research protocol(s).
9) Right to Complain.	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

1, Section 251 and the NHS Act, Health Research Authority.  https://www.dropbox.com/s/sekq3trav2s58xw/Official%20Section%20251%20guidance%20Health%20Research%20Authority.pdf?dl=0

2 “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament.  It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law.  The law is applied by reference to those previous cases, so common law is also said to be based on precedent.

The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.

In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient.  It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.

Three circumstances making disclosure of confidential information lawful are:

• where the individual to whom the information relates has consented;
• where disclosure is in the public interest; and
• where there is a legal duty to do so, for example a court order.

 

 

Some members of society are recognised as needing protection, for example children and vulnerable adults. If a person is identified as being at risk from harm we are expected as professionals to do what we can to protect them.  In addition we are bound by certain specific laws that exist to protect individuals. This is called “Safeguarding”.

Where there is a suspected or actual safeguarding issue, we will share information that we hold with other relevant agencies whether the individual or their representative agrees.

There are three laws that allow us to do this without relying on the individual or their representatives agreement (unconsented processing), these are:

Section 47 of The Children Act 1989 : (https://www.legislation.gov.uk/ukpga/1989/41/section/47),

Section 29 of Data Protection Act (prevention of crime) https://www.legislation.gov.uk/ukpga/1998/29/section/29

and Section 45 of the Care Act 2014 http://www.legislation.gov.uk/ukpga/2014/23/section/45/enacted.

In addition there are circumstances when we will seek the agreement (consented processing) of the individual or their representative to share information with local child protection services, the relevant law being

Section 17 Children’s Act 1989 https://www.legislation.gov.uk/ukpga/1989/41/section/17

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

1)      Data Controller contact details	St Paul’s Medical Centre Dickson Road, Blackpool, FY1 2HH Tel: 01253 623896 e-mail: st.pauls.medicalcentre@nhs.net
2) Data Protection Officer contact details	Compliance officer (DPO) = Hilary Gidman Email: mlcsu.dpo@nhs.net
3) Purpose of the processing	The purpose of the processing is to protect the child or vulnerable adult.
4) Lawful basis for processing	The sharing is a legal requirement to protect vulnerable children or adults, therefore for the purposes of safeguarding children and vulnerable adults, the following Article 6 and 9 conditions apply: For consented processing; Article 6(1)(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes For unconsented processing;  Article 6(1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject and: Article 9(2)(b) ‘…is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of …social protection law in so far as it is authorised by Union or Member State law..’ We will consider your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*
5) Recipient or categories of recipients of the shared data	The data will be shared with local safeguarding services.
6) Rights to object	This sharing is a legal and professional requirement and therefore there is no right to object. There is also GMC guidance: https://www.gmc-uk.org/guidance/ethical_guidance/children_guidance_56_63_child_protection.asp
7) Right to access and correct	The Data Subject or legal representatives has the right to access the data that is being shared and have any inaccuracies corrected.  There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained for active use during any investigation and thereafter retained in an inactive stored form according to the law and national guidance
9)  Right to Complain	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament.  It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law.  The law is applied by reference to those previous cases, so common law is also said to be based on precedent.

The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.

In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient.  It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.

Three circumstances making disclosure of confidential information lawful are:

• where the individual to whom the information relates has consented;
• where disclosure is in the public interest; and
• where there is a legal duty to do so, for example a court order.

The Summary Care Record is an English NHS development. It consists of a basic medical record held on a central government database on every patient registered with a GP surgery in England. The basic data is automatically extracted from your GP’s electronic record system and uploaded to the central system GPs are required by their contract with the NHS to allow this upload. The basic upload consists of current medication, allergies and details of any previous bad reactions to medicines, the name, address, date of birth and NHS number of the patient.

As well as this basic record additional information can be added and this can be far reaching and detailed. However, whereas the basic data is uploaded automatically any additional data will only be uploaded if you specifically request it and with your consent.

Summary Care Records can only be viewed within the NHS are NHS smartcard controlled screens or by organisation, such as pharmacies, contracted to the NHS.

You can find out more about the SCR here https://digital.nhs.uk/summary-care-records

You have the right to object to our sharing your data in these circumstances and you can ask your GP to block uploads.

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

 

1) Data Controller contact details	St Paul’s Medical Centre Dickson Road, Blackpool, FY1 2HH Tel: 01253 623896 e-mail: st.pauls.medicalcentre@nhs.net
2) Data Protection Officer contact details	Compliance officer (DPO) = Hilary Gidman Email: mlcsu.dpo@nhs.net Caldicott Guardian Dr Robert Straker-Bennett
3) Purpose of the processing	Upload of basic and detailed additional Summary Care Record data
4) Lawful basis for processing	The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR: Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*
5) Recipient or categories of recipients of the processed data	The data will be shared with Health and care professionals and support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care.
6) Rights to object	You have the right to object to some or all the information being processed under Article 21.  Please contact the Data Controller or the practice.  You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance.
7) Right to access and correct	You have the right to access the data that is being shared and have any inaccuracies corrected.  There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention period	The data will be retained in line with the law and national guidance https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 or speak to the practice.
9)  Right to Complain	You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament. It
is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case
law. The law is applied by reference to those previous cases, so common law is also said to be based on precedent.

The general position is that if information is given in circumstances where it is expected that a duty of confidence
applies, that information cannot normally be disclosed without the information provider’s consent.

In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or
held in the memory of the professional, must not normally be disclosed without the consent of the patient. It is
irrelevant how old the patient is or what the state of their mental health is; the duty still applies.

Three circumstances making disclosure of confidential information lawful are:

• where the individual to whom the information relates has consented;
• where disclosure is in the public interest; and
• where there is a legal duty to do so, for example a court order.