GDPR (General Data Protection Regulation)
We've updated our COVID-19 privacy notice
GDPR Privacy Notice (Downloadable and available at the practice upon requests)
How We Use Your Information
This practice keeps medical records confidential and complies with the General Data Protection Regulation.
We hold your medical record so that we can provide you with safe care and treatment.
We will also use your information so that this practice can check and review the quality of the care we provide. This helps us to improve our services to you.
- We will share relevant information from your medical record with other health or social care staff or organisations when they provide you with care. For example, your GP will share information when they refer you to a specialist in a hospital. Or your GP will send details about your prescription to your chosen pharmacy.
- Healthcare staff working in A&E and out of hours care will also have access to your information. For example, it is important that staff who are treating you in an emergency know if you have any allergic reactions. This will involve the use of your Summary Care Record.
- You have the right to object to information being shared for your own care. Please speak to the practice if you wish to object. You also have the right to have any mistakes or errors corrected.
- We will use the data that we hold on your medical records to contact you directly in relation to your medical care. This may include text, phone or written communication.
Consent to discuss clinical information - guidance for children and young people
Children and young people - Consent to treatment
People aged 16 or over are entitled to consent to their own treatment. This can only be overruled in exceptional circumstances.
Like adults, young people (aged 16 or 17) are presumed to have sufficient capacity to decide on their own medical treatment, unless there's significant evidence to suggest otherwise.
Therefore, we will not be able to discuss details about any patient aged 16 and over without their consent. This could be verbal consent at the time of a telephone conversation or a more permanent written consent which would be added to their medical record.
Notice to patients aged 16 & over - if you consent for a parent or guardian to discuss your clinical information with a GP or healthcare professional, please send a written consent letter to us. Click the example document link below and forward it to firstname.lastname@example.org or post it to us. Your medical record will then indicate your permission permanently (or until you tell us otherwise)
Children under the age of 16 can consent to their own treatment if they're believed to have enough intelligence, competence and understanding to fully appreciate what's involved in their treatment. This is known as being Gillick competent.
Otherwise, someone with parental responsibility can consent for them.
This could be:
the child's mother or father
the child's legally appointed guardian
a person with a residence order concerning the child
a local authority designated to care for the child
a local authority or person with an emergency protection order for the child
A person with parental responsibility must have the capacity to give consent.
If a parent refuses to give consent to a particular treatment, this decision can be overruled by the courts if treatment is thought to be in the best interests of the child.
By law, healthcare professionals only need 1 person with parental responsibility to give consent for them to provide treatment.
In cases where 1 parent disagrees with the treatment, doctors are often unwilling to go against their wishes and will try to gain agreement.
If agreement about a particular treatment or what's in the child's best interests cannot be reached, the courts can make a decision.
In an emergency, where treatment is vital and waiting for parental consent would place the child at risk, treatment can proceed without consent.
When consent can be overruled
If a young person refuses treatment, which may lead to their death or a severe permanent injury, their decision can be overruled by the Court of Protection.
This is the legal body that oversees the operation of the Mental Capacity Act (2005).
The parents of a young person who has refused treatment may consent for them, but it's usually thought best to go through the courts in this situation.
National Opt Out (Type 2 Data)
What is it?
It means where the public can opt out of their information being used for any purpose beyond their care, the patients have to opt out themselves, by using the NHS App, calling the opt out team (0300 3035678) or using the website, www.nhs.uk/your-nhs-data-matters
What does it apply to:-
The opt out is only to sharing of data from the practice where the legal power for using so is the authorisation of the CAG – Confidentiality Advisory Group using s.251 powers – this is usually for research. But includes for GP’s CCG invoice validation, IFR validation and Risk Stratification. It does not apply to:-
- Anonymised data sharing
- Sharing where the patient has given consent (some research projects)
- Public interest disclosures
- Legal requirements to share
How information about you helps us to provide better care
Confidential information from your medical records can be used by the NHS to improve the services offered so we can provide the best possible care for everyone.
This information along with your postcode and NHS number but not your name, are sent to a secure system where it can be linked with other health information.
This allows those planning NHS services or carrying out medical research to use information from different parts of the NHS in a way which does not identify you.
You have a choice. If you are happy for your information to be used in this way you do not have to do anything.
If you have any concerns or wish to prevent this from happening, please speak to practice staff or complete the opt out form below and return to the surgery.
More information can be found here
Fair Processing Notice
This fair processing notice explains why our Surgery collects information about you and how that information may be used and shared.
The employees and Partners of the Surgery use electronic and paper records to create and maintain an in-depth history of your NHS medical care at the Surgery and elsewhere, to help ensure you receive the best possible healthcare. Anyone who accesses your data within the Surgery can only do so using a ‘smartcard’ that identifies him/her and what he/she accessed.
We comply with the Data Protection Act in ensuring your personal information is as confidential and secure as possible.
WHAT INFORMATION DO YOU HOLD?
Records which Castle Medical Centre holds about you may include the following information;
- Details about you, such as your address, legal representative, emergency contact details
- Any contact the Surgery has had with you, such as appointments, telephone conversations and letters.
- Notes and reports about your physical (including sexual) and mental health
- Details about your treatment and medications
- Results of investigations such as laboratory tests, x-rays etc
- Relevant information from other health professionals, relatives or those who care for you
- Reports from social services such as child protection reports or police reports if relevant to the care of you or your family
- Private reports sent, at your request, to other organisations
We are committed to protecting your privacy and will only use information collected lawfully in accordance with the Data Protection Act 1998 (which is overseen by the Information Commissioner’s Office), Human Rights Act, the Common Law Duty of Confidentiality, and the NHS Codes of Confidentiality and Security.
All of our staff and contractors receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.
We maintain our duty of confidentiality to you at all times. We will only ever use or pass on information about you, if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), or where the law requires information to be passed on and / or in accordance with the new information sharing principle i.e. “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles. They should be supported by the policies of their employers, regulators and professional bodies.
Your information may be used within Castle Medical Centre for clinical Audit to monitor the quality of the service provided or ensure we are providing appropriate care.
SHARING YOUR DATA OUTSIDE THE PRACTICE
Information held about you may be used to help protect the health of the public and to help the Department of Health manage the NHS. Some of this information will be extracted and held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified.
We currently only share information from your records on an individual basis either by letter or courier, but with improvements in information technology and strict information governance standards, it is becoming possible to share your GP records across Coventry & Warwickshire Health & Social Care. We will only allow this to happen with your consent, so that you are able to allow doctors, nurses and other health and social care services to see all the information held on your GP records.
The following are examples of the types of organisations that we are likely to share information with:
- NHS and specialist hospitals, Trusts
- Independent Contractors such as dentists, opticians, pharmacists
- Private and Voluntary Sector Providers
- Ambulance Trusts
- Clinical Commissioning Groups and NHS England
- Social Care Services and Local Authorities
- Education Services
- Police, Fire and Rescue Services
Any patient can choose to withdraw their consent to their data being used in this way. When the Surgery is about to participate in any new data-sharing scheme we will make patients aware by displaying prominent notices in the Surgery and on our website. These schemes are only for direct care so you (or your carer) will be present when the information is accessed and will be asked for consent again, before your records are opened.
A patient can object to their personal information being shared with other health care providers but if this limits the treatment that you can receive then the doctor will explain this to you at the time.
Risk stratification is a process for identifying and managing patients who are at a higher risk of emergency hospital admission. This may be because patients have a long term condition such as COPD, cancer or are more frail. NHS England encourages GPs to use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and help reduce the patients’ risk of hospital admissions.
Information about you is collected from a number of sources including NHS Trusts and from Castle Medical Centre. Your risk is then ‘scored’ after analysis of your anonymous information using computer programmes. Your information is only provided back to your GP or member of your care team in an identifiable form. Risk stratification enables your GP to focus on the prevention of ill health and not just the treatment of sickness.
NATIONAL DATA EXTRACTIONS (Also known as GPES)
The Health and Social Care Act 2012 allows NHS Digital to collate personal confidential data from GP practices without seeking your specific consent. This is extracted in order to make increased use of information from medical records and either used just by the NHS with the intention of improving healthcare and the quality of care delivered to patients or may be sold to external companies such as universities or commercial organisations. Please see below if you do not want your data used in this way.
More information about how NHS Digital uses your data can be found at https://digital.nhs.uk/services/general-practice-extraction-service
WHAT IF I WANT TO SEE MY RECORDS?
You have a right under the Data Protection Act 1998 to access/view information the Surgery holds about you, and to have it amended or removed should it be inaccurate. This is known as ‘the right of subject access’. We are very keen for you to have access to help you manage your own health and maintain the quality of the records about your health. With some provisos, we are now able to give most adults access to their records on-line if they wish. If you would like access on-line, please ask our receptionists.
WHAT IF I WANT TO SEE WHO HAS ACCESSED MY RECORDS?
On our computer system called EMIS WEB you can look at your GP Shared Record History to find out when your GP record has been accessed. To do this all you need is the username and password that you use to order prescriptions or make appointments with via our website. (If you have chosen to have sharing functionality disabled this will not be available.) This only covers instances where your record has been accessed outside of Castle Medical Centre for direct care purposes, i.e. it does not cover accesses by your own GP, and it does not cover the data that gets copied for research and to NHS Digital.
The Data Protection Act 1998 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.
This information is publicly available on the Information Commissioners Office website www.ico.org.uk
The Surgery is registered with the Information Commissioners Office (ICO) as a data controller under the Data Protection Act 1998. The registration number is Z4794614 and can be viewed online in the public register at https://ico.org.uk/ESDWebPages/Search
Should you have any concerns about how your information is managed at the Surgery, please contact our Practice Managers. If you are still unhappy following a review by the Surgery, you can then complain to the Information Commissioners Office (ICO) via their website (https://ico.org.uk).
If you are happy for your data to be extracted and used for the purposes described in this fair processing notice then you do not need to do anything.
General Practice Transparency Notice for GPES Data for Pandemic Planning and Research (COVID-19)
This practice is supporting vital coronavirus (COVID-19) planning and research by sharing your data with NHS Digital.
The health and social care system is facing significant pressures due to the coronavirus (COVID-19) outbreak. Health and care information is essential to deliver care to individuals, to support health, social care and other public services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the coronavirus outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations. This practice is supporting vital coronavirus planning and research by sharing your data with NHS Digital, the national safe haven for health and social care data in England.
Our legal basis for sharing data with NHS Digital
NHS Digital has been legally directed to collect and analyse patient data from all GP practices in England to support the coronavirus response for the duration of the outbreak. NHS Digital will become the controller under the General Data Protection Regulation 2016 (GDPR) of the personal data collected and analysed jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse this data under the COVID-19 Public Health Directions 2020 (COVID-19 Direction).
All GP practices in England are legally required to share data with NHS Digital for this purpose under the Health and Social Care Act 2012 (2012 Act). More information about this requirement is contained in the data provision notice issued by NHS Digital to GP practices.
Under GDPR our legal basis for sharing this personal data with NHS Digital is Article 6(1)(c) - legal obligation. Our legal basis for sharing personal data relating to health, is Article 9(2)(g) – substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the COVID-19 Direction.
The type of personal data we are sharing with NHS Digital
The data being shared with NHS Digital will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. The data contains NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death for those patients. It will also include coded health data which is held in your GP record such as details of:
- diagnoses and findings
- medications and other prescribed items
- investigations, tests and results
- treatments and outcomes
- vaccinations and immunisations
How NHS Digital will use and share your data
NHS Digital will analyse the data they collect and securely and lawfully share data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only. These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials. The British Medical Association, the Royal College of General Practitioners and the National Data Guardian are all supportive of this initiative.
NHS Digital has various legal powers to share data for purposes relating to the coronavirus response. It is also required to share data in certain circumstances set out in the COVID-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).
Legal notices under the COPI Regulations have also been issued to other health and social care organisations requiring those organisations to process and share confidential patient information to respond to the coronavirus outbreak. Any information used or shared during the outbreak under these legal notices or the COPI Regulations will be limited to the period of the outbreak unless there is another legal basis for organisations to continue to use the information.
Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared. Organisations using your data will also need to have a clear legal basis to do so and will enter into a data sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.
For more information about how NHS Digital will use your data please see the NHS Digital Transparency Notice for GP Data for Pandemic Planning and Research (COVID-19).
National Data Opt-Out
The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.
Your rights over your personal data
To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see: