GDPR & Personal Data

This notice explains how The New Hall Lane Practice will collect, look after, use or otherwise process your personal data. “Personal data” is information relating to you as a living, identifiable individual. This is line with the data protection act 2018 and the General Data Protection Regulations.

Who is responsible for my information?

As your registered GP Practice, The New Hall Lane Practice is the data controller for your information and is responsible for looking after your record while you are a registered patient (Information Commissioners Office registration reference Z8776203).

The Data Protection Officer for The New Hall Lane Practice is Dr Amandeep Singh, GP Partner.

Any queries or concerns should be raised with the practice first.

Why do we collect information about you?

As health professionals, we maintain records about you in order to support your care. By registering with the practice, your existing records will be transferred to us from your previous practice so that we can keep them up to date while you are our patient.

If you do not have a previous medical record (if you are a new-born child or coming from overseas, for example) the NHS will create a medical record for you.

We take great care to ensure that your information is kept securely, that it is up to date, accurate and used appropriately. All of our staff are trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to.

What information do we hold about you?

• Details about you, such as your name, address, carers, biological gender, gender identity, ethnic origin, date of birth, legal representatives and emergency contact details
• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
• Notes and reports about your health
• Details about your treatment and care
• Results of investigations such as laboratory tests, x-rays, etc.
• Relevant information from other health professionals, relatives or those who care for you

How is my information stored?

The practice uses a clinical records programme called EMIS Web which is where any electronic information about you will be stored. Any information held in paper records is stored securely at the practice or scanned onto your medical records. The practice uses a combination of working practices and technology to ensure that your information is kept confidential and secure. Every member of staff who works for the practice has a legal obligation to keep information about you confidential. We maintain our duty of confidentiality by conducting annual training and awareness ensuring access to personal data is limited to appropriate staff and information is only shared with organisations and individuals that have a legitimate and legal basis for access.

What is the legal basis that we use to process your information?

We are required to tell you the legal basis that is used for the various ways we process and use your data. The following document sets the main ways your personal data may be used and the corresponding legal basis and category of data.

When is my information shared?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• Data Protection legislation
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• NHS Codes of Confidentiality, Information Security and Records Management

How long does the practice hold my information?

As long as you are registered as a patient with The New Hall Lane Practice your electronic record will be held by the practice. If you register with a new practice, they will initiate the process to transfer your records. The electronic record is transferred to the new practice across a secure NHS data-sharing network via a system called GP2GP.

Once your electronic record has been forwarded to your new practice (or after your death forwarded to Primary Care Services England), a cached version of your record is retained in the practice and classified as “inactive”. If anyone has a reason to access an inactive record, they are required to formally record that reason and this action is audited regularly to ensure that all access to inactive records is valid and appropriate. We may access this for clinical audit (measuring performance), serious incident reviews, or statutory report completion (e.g., for HM Coroner).

Change of Details

It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.

How can I see what information you hold about me?

You have a right under Data Protection legislation to request to see what information the practice holds about you. You also have the right to ask for inaccuracies to be corrected and in some circumstances you have the right to request that we stop processing your data. Some of these rights are not automatic and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

If you make a Subject Access Request, we will:

• describe the information we hold about you
• tell you why we are holding that information
• tell you who it might be shared with
• at your request, provide a copy of the information in an easy to read form.

In order to request this, you need to do the following:

• Your request must be made in writing –
• We will provide electronic copies (via online access, by email) free of charge.
• We are required to respond to you within 28 days.

You will need to give enough information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located.

In some circumstances there may be a charge to have a printed copy of the information held about you. If this is the case, this will be discussed with you before any charge is made.

If you would like to make a Subject Access Request or have any further questions, please contact a member of the practice team.

You can also access your medical records online. For further details please follow the links on this section of our surgery website or contact the practice for further information.

Recording Consultations

The practice trains health professionals, who will sometimes need to record consultations for their education and assessment. These recordings would only be shared with other health professionals and would be deleted after use. The focus of such recordings is to assess the behaviour of the clinician. If they wish to record a consultation, you will be asked before the consultation takes place. It is entirely your choice whether to agree to this and your decision will not affect the care you are given. After the recording you will be asked whether you are willing for the recording to be kept. If you agree the recording will be kept securely, and managed according to our data protection procedures. It will be erased after use, and definitely not kept for longer than one year. If at any time you wish the recording to be erased please contact the practice.

How is my information used?

For provision of direct care:

In the practice, individual staff will only look at what they need in order to carry out such tasks as booking appointments, making referrals, giving health advice or provide you with care.

Sometimes your information may be used to run automated calculations. These can be as simple as calculating your Body Mass Index but they can be more complex and used to calculate some risks to your health that we should consider with you. The ones we use in practice include Qrisk (cardiovascular risk assessment – usually following an NHS Health check), and eFI (electronic frailty index). Whenever we use these profiling tools, we assess the outcome on a case-by-case basis. No decisions about individual care are made solely on the outcomes of these tools but they are used to help us assess and discuss your possible future health and care needs with you.

Data Sharing for Direct Care for commissioning and healthcare planning purposes:

In some cases, for example when looking at population healthcare needs, some of your data may be shared (usually in such a way that you cannot be identified from it). The following organisations may use data in this way to inform policy or make decisions about general provision of healthcare, either locally or nationally.

• Public Health, Adult or Child Social Care Services
• Lancashire & South Cumbria ICB
• NHS England
• Other data processors which you will be informed of as appropriate.

In order to comply with its legal obligations we may send data to NHS Digital when directed by the Secretary of State for Health under the Health and Social Care Act 2012.

This practice contributes to local & national clinical audits and will send the data which are required by NHS Digital when the law allows. This may include demographic data, such as date of birth, and information about your health which is recorded in coded form, for example, the clinical code for diabetes or high blood pressure. Such data is often pseudonymised (this means using your NHS number instead of your name or other details) to ensure additional security.

In a few cases, where specific information is asked for, you have the choice to opt out of the audit.

For safeguarding purposes, life or death situations or other circumstances when we are required to share information:

We may also disclose your information to others in exceptional circumstances (i.e. life or death situations) or in accordance with Dame Fiona Caldicott’s information sharing review (Information to share or not to share).

For example, your information may be shared in the following circumstances:

• When we have a duty to others e.g. in child protection cases
• Where we are required by law to share certain information such as the birth of a new baby, infectious diseases that may put you or others at risk or where a Court has decided we must.

When you request to see your information or ask us to share it with someone else:

If you ask us to share your data, often with an insurance company, solicitor, employer or similar third party, we will only do so with your explicit consent. Usually the requesting organisation will ask you to confirm your consent, often in writing or electronically. We check that consent before releasing any data and you can choose to see the information before we send it.

Patient Information

Sharing your information.

Your health information can be shared both locally and nationally at differing levels of detail. You can opt in and out of these sharing agreements whenever you choose. Detailed information is available at the practice but includes:

Nationally for you in Direct Care:

Summary Care Record (SCR) – sharing your information for your care across the NHS.

Please read the separate block for further detail on the SCR.

Nationally: The national data-out. For purposes beyond direct care.

NHS Digital is developing a new system to support the national data opt-out which will give patients more control over how identifiable health and care information is used for reasons other than your individual care and treatment. The system will offer patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used for purposes beyond their direct care such as research and planning purposes.

In the past, you may have already chosen to prevent your identifiable data leaving NHS Digital, known as a Type 2 opt-out. All existing Type 2 opt-outs will be converted to the new national data opt-out and this will be confirmed by a letter to all individuals aged 13 or over with an existing Type 2 in place. Once the national data opt-out is launched, it will no longer be possible to change preferences via local GP practices.

More information is available here 

Locality Primary Care Services

Your GP surgery is working together with other local practices to ensure you are able to access primary care services outside of core hours, this means that if you need to be seen a certain times over the weekend the doctor or nurse who see you will be able to see the GP health record from the registered practice and be able to determine the best way to help you.

Use of non-identifiable data

To ensure you receive the best possible care, you records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified.

Risk Stratification

Risk stratification tools are increasingly being used in the NHS to determine a persons risk of suffering a particular condition, preventing an unplanned admission to hospital and identifying a need for preventative intervention. Information about you is collected from a number of sources including NHS Trusts and GP practices. A risk score is then arrived through an analysis of de-identified information use software managed by the practice clinical computer system. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness.

Medicine Management

The practice conducts medicine management reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate up to date and cost effective treatments.

If you have any queries of concerns about how you information is handed, please contact a member of the practice team for further information

Objections, Concerns & Complaints

If you are happy for your data used for the purposes as described in this notice then you do not need to do anything.

Should you have any concerns about how your information is managed or used by the practice or you identify any inaccuracies, please contact a member of the management team. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website www.ico.org.uk, [email protected], telephone: 0303 123 1113 (local rate) or 01625 545 745