Privacy Policy

The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA18) became law on 25th May 2018. The GDPR is a single EU-wide regulation on the protection of confidential and sensitive information and the DPA18 implements the regulations into comprehensive UK legislation. Following the decision for the UK to leave the European Union and following the end of the transition period, from January 1st, 2021 the UK has been subject to an Adequacy Agreement which will allow data to continue to be shared with European Union Countries without further safeguarding being necessary.  This is to allow the European Commission suitable time to grant the UK with adequacy status, meaning they have met the required standards in ensuring data transfers to and from the UK are safe.  All references to GDPR will now be referred to as UK GDPR.

For the purpose of applicable data protection legislation (including UK GDPR) and the Data Protection Act 2018 the practice responsible for your personal data, and referred to at the Data Controller, is Wychall Lane Surgery.

Click here to download the GDPR leaflet.

Access to Service Information

Equality Act 2010

What are PECR? | ICO

This privacy notice explains why the GP Practice collects information about you, and how that information may be used.

As data controllers, GPs have responsibilities which are regulated by law under the General Data Protection Regulations. This means ensuring that your personal confidential data (PCD) is handled in ways that are safe, transparent and what you would reasonably expect.

Wychall Lane Surgery works with other health and social care organisations to share information that will form part of your Shared Care Record. The Shared Care Record allows health and care professionals involved in your care to view your records to help them understand your needs and make the best decisions with you, and for you. Information we hold about you will be available, to read only, to other health and care professionals in Birmingham and Solihull, Coventry and Warwickshire, and Herefordshire and Worcestershire when they are involved in your health or social care.

For more information on how your data is used on the Shared Care Record and how to exercise your rights please see the full Privacy Notice or copy and paste this link: www.livehealthylivehappy.org.uk/birmingham-and-solihull-shared-care-record/privacy-notice/.

The NHS Long Term plan published in 2019 requires the digitisation of all primary care paper medical records, commonly known as ‘Lloyd George’ records or ‘A4 medical records’

Having paper based medical records restricts the use of technology to provide ‘joined up’ services and therefore the current paper records will be transferred to a digital format and then destroyed.

This will involve the current patient paper medical records being scanned and then entered directly into a patient’s electronic medical record. This work will be completed by a third party supplier, NEC (formerly known as Northgate Public Services), whose security standards have been reviewed by NHS Birmingham and Solihull Clinical Commissioning Group.

We are required by Data Protection law to provide you with the following information about how we handle your information.

Data Controller contact details

The service is available via the following email: ourhealthpatnership@nhs.net (Queries will be responded to within 24 hours). Any data breaches will be dealt with immediately and you can contact Umar Sabat on 07894 826037.

Data Protection Officer contact details

Umar Sabat on 07894 826037.

Purpose of the processing

Transferring the current paper medical records into patients’ electronic medical records.

Lawful basis for processing

The following provisions of the General Data Protection Regulation permit us to digitise existing paper medical records:

Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller…’’

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…’

Recipient or categories of recipients of the processed data

The paper patient records will be shared with NEC, who will scan and digitise the current paper medical records before destroying them.

Right to access and correct

You have the right to access your medical record and have any errors or mistakes corrected. Please speak to a member of staff or look at our ‘subject access request’ policy on the practice website – https://wychalllanesurgery.co.uk/

Retention period

GP medical records will be kept in line with the law and national guidance. Information on how long records can be kept can be found at: https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 or speak to the practice.

The paper medical records will be destroyed three months after they are transferred to an electronic format. (Practice seeks longer retention).

The practice holds medical records to provide medical treatment and advice and patients have a relationship with a GP in order for them to be provide health and care service to you. We therefore do not require your consent to transfer these papers records to an electronic format.

If you have any questions about this project, please contact Wychall Lane Surgery.

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come in to such possession. The processing of personal data is governed by the General Data Protection Regulation (the ‘GDPR’).

Wychall Lane Surgery is the data controller. This means it decides how your personal data is processed and for what purposes.

The Health and Social Care Act 2012 changed the way that personal confidential data is processed. Therefore, it is important that patients are made aware of, and understand these changes and that you have an opportunity to object if you so wish and that you know how to do so.

Health care professionals maintain records about your health and any treatment or care you have received within the NHS (e.g. NHS Hospital Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide the best possible healthcare.

NHS health records may be processed electronically, on paper or a mixture of both, and a combination of working practices and technology are used to ensure that your information is kept confidential and secure. Records held by this GP Practice may include the following information:

• Details about you, such as address, telephone numbers, DOB and next of kin

• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.

• Notes and reports about your health

• Details about your treatment and care

• Results of investigations, such as laboratory tests, x-rays, etc.

• Relevant information from other health professionals, relatives or those who care for you.

• Religious beliefs, ethnicity, sexuality etc (if required in a healthcare setting)

To ensure you receive the best possible care, your records are used to facilitate the care you receive, including contacting you. Information held about you may be used to help protect the health of the public and to help us manage the NHS and the services we provide. Limited information may be used within the GP practice for clinical audit to monitor the quality of the service we provided.

All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information may be located on servers within the European Union.

No third parties have access to your personal data unless the law allows them to do so, and appropriate safeguards have been put in place such as a Data Processing agreement.  We have a Data Protection regime in place to oversee the effective and secure processing of your personal and or special category data.

EMIS Web

The Practice uses a clinical system provided by a Data Processor called EMIS.  Since June 2019, EMIS commenced storing your practice’s EMIS Web data in a highly secure, third party cloud hosted environment, namely Amazon Web Services (“AWS”).

The data will remain in the UK at all times and will be fully encrypted both in transit and at rest. In doing this there will be no change to the control of access to your data and the hosted service provider will not have any access to the decryption keys. AWS is one of the world’s largest cloud companies, already supporting numerous public sector clients (including the NHS), and it offers the very highest levels of security and support.

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.

More information on records retention can be found in the NHS Records Management Code of Practice 2020

https://www.nhsx.nhs.uk/media/documents/NHSX_Records_Management_Code_of_Practice_2020_3.pdf

This will only happen following a review of the information at the end of its retention period. Where data has been identified for disposal, we have the following responsibilities:

• To ensure that information held in manual form is destroyed using a cross-cut shredder or contracted to a reputable confidential waste company [name of shredding company used, if applicable] that complies with European Standard EN15713 and obtain certificates of destruction.

• To ensure that electronic storage media used to store, or process information are destroyed or overwritten to national standards.

This GP Practice collects and holds data for the sole purpose of providing healthcare services to our patients and we will ensure that information is kept confidential.  Under the UK GDPR the lawful bases for using your information are:

Article 6(1)(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

Article 9(2)(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems.

We can disclose personal information if:

• It is required by law

• You consent – either implicitly for the sake of your own care or explicitly for other purposes

• It is justified in the public interest

This privacy notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Some of this information will be held centrally and used for statistical purposes. Where we hold data centrally, we take strict measures to ensure that individual patients cannot be identified.

We will normally ask you for your consent, but there are times when we may be required by law to share your information without your consent, for example:

• Where there is a serious risk of harm or abuse to you or other people.

• Safeguarding matters and investigations

• Where a serious crime, such as assault, is being investigated or where it could be prevented.

• Notification of new births

• Where we encounter infectious diseases that may endanger the safety of others, such as meningitis or measles (but not HIV/AIDS)

• Where a formal court order has been issued

• Where there is a legal requirement, for example if you had committed a Road Traffic Offence.

Sometimes information about you may be requested to be used for other purposes. These have been outlined below.

1. Risk stratification

2. Population Health Management

3. Medicines Management

4. Patient Communication

5. Safeguarding

6. Invoice Validation

7. Research

8. Third party processors

Risk stratification is a process for identifying and managing patients who are at a higher risk of emergency hospital admission. Typically, this is because patients have a long-term condition such as COPD or cancer. NHS England encourages GPs to use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help prevent avoidable admissions.

Information about you is collected from several sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your anonymous information using computer programmes. Your information is only provided back to your GP or member of your care team in an identifiable form. Risk stratification enables your GP to focus on the prevention of ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services.

If you do not wish to be included in the risk stratification process, then please get in touch with the Practice. Please note the purpose of risk stratification is to prevent and detect health issues therefore we will ask our Patients for their consent to be included in this.

Individual Risk Management at a GP practice level however is deemed to be part of your individual healthcare and is covered by our legal powers above.

Our data processors  for Risk Stratification is monitored by our Administration team.

Population Health Management is the use of data to help with planning and delivery of proactive care to address the needs of the population. It includes a number of techniques to identify local ‘at risk’ cohorts of patients, to design better care and support for people with ongoing health conditions and give a consistent service.

The benefits of Population Health Management are:

• Using data-driven insights and evidence of best practice to inform targeted

interventions to improve the health & wellbeing of specific populations & cohorts

• The wider determinants of health, not just health & care

• Making informed judgements, not just relying on the analytics

• Prioritising the use of collective resources to have the best impact

• Acting together – the NHS, local authorities, public services, the VCS,

communities, activists & local people. Creating partnerships of equals

• Achieving practical tangible improvements for people & communities

Information about you is collected from several sources including NHS Trusts and from this GP Practice. The identifying parts of your data are removed, and an analysis of your data is undertaken. This analysis may be undertaken by external organisations who are acting on behalf of your GP Practice and have a Data Processing contract with the Practice. This is then provided back to your GP as data controller in an identifiable form.  As a result of population health management, your GP may be able to offer you additional services.

The practice may conduct Medicines Management Reviews of medications prescribed to its patients, to ensure patients receive the most appropriate, up-to-date and cost-effective treatments. The reviews are carried out by the Clinical Commissioning Group’s Medicines Management Team under a Data Processing contract with the Practice.

The Practice would like to use your name, contact details, and email address to inform you of NHS services, or provide inform about your health/information to manage your healthcare or information about the management of the NHS service.  There may be occasions where authorised research facilities would like you to take part in research in regard to your particular health issues, to try and improve your health. Your contact details may be used to invite you to receive further information about such research opportunities, but you must give your explicit consent to receive messages for research purposes.

The Practice is dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently, and conscientiously applied with the wellbeing of all patients at the heart of what we do.

Our legal basis for processing information for safeguarding purposes, as stipulated in the UK GDPR is:

 Article 6(1)(e) ‘…exercise of official authority…’.

For the processing of special categories data, the basis is:

Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’

Categories of personal data collected in the event of a safeguarding situation will be minimised to include only the personal information as is necessary in order to handle the situation. In addition to some basic demographic and contact details, we will also process details of what the safeguarding concern is. This is likely to be special category information.

This data will be collected when someone contacts the Practice with safeguarding concerns, or we believe there may be a concern and make enquiries to relevant providers.

The information related to the concern may be shared accordingly to ensure a duty of care and investigation as required with other partners such as local authorities, the police, or healthcare professionals.

Clinical Practice Research Datalink (CPRD) collects anonymised patient data from a network of GP practices across the UK. Primary care data is linked to a range of other health related data to provide a fully representative UK population health dataset.  You can opt out of your information being used for research purposes at any time and full details on CRPD can be found here.

If you have received treatment within the NHS, access to your personal information may be required to determine which Clinical Commissioning Group should pay for the treatment or procedure you have received.

This information would most likely include information such as your name, address, date of treatment and may be passed on to enable the billing process. These details are held in a secure environment and kept confidential. This information will only be used to validate invoices and will not be shared for any further purposes.

The NHS needs data about the patients it treats in order to plan and deliver its services and to ensure that care and treatment provided is safe and effective. The General Practice Data for Planning and Research (GDPDR) data collection will help the NHS to improve health and care services for everyone by collecting patient data that can be used to do this. For example, patient data can help the NHS to:

• Monitor the long-term safety and effectiveness of care.

• Plan how to deliver better health and care services.

• Prevent the spread of infectious diseases.

• Identify new treatments and medicines through health research.

Sometimes your information may be requested for other research purposes – the practice will always gain your consent before releasing the information for this purpose in an identifiable format.

In order to deliver the best possible service, the practice will share data (where required) with other NHS bodies such as other GP practices and hospitals. In addition, the practice will use carefully selected third party service providers. When we use a third-party service provider to process data on our behalf then we will always have an appropriate agreement in place to ensure that they keep the data secure, that they do not use or share information other than in accordance with our instructions and that they are operating appropriately. Examples of functions that may be carried out by third parties include:

Companies that provide IT services & support, including our core clinical systems; systems which manage patient facing services (such as our website and service accessible through the same); data hosting service providers; systems which facilitate appointment bookings or electronic prescription services; document management services etc.

Delivery services (for example if we were to arrange for delivery of any medicines to you).

Payment providers (if for example you were paying for a prescription or a service such as travel vaccinations).

Further details regarding specific third-party processors can be supplied on request to the practice.

A primary care networks is a group of local GP practices working together to create more collaborative workforces which ease the pressure of GP’s, leaving them better able to focus on patient care. The aim is for all areas within England to be covered by a PCN.

This means the practice may share your information with other practices within the PCN to provide you with your care and treatment.

Wychall Lane Surgery is a member of the Northfield/Bournville which includes the following local GP Practices:

St Heliers Northfield

College Green Bournville

There are times that we may want to use your information to contact you or offer you services, not directly about your healthcare. In these instances, we will always gain your consent to contact you.

There may be occasions where authorised research facilities would like you to take part on innovations, research, improving services or identifying trends, you will be asked to opt into such programmes if you are happy to do so.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you can consent and opt out prior to any data processing taking place.

This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the practice.

In certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the practice in writing if you wish to withdraw your consent.  In some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• Data Protection Act 2018

• The UK General Data Protection Regulations (UK GDPR)

• Human Rights Act 1998

• Common Law Duty of Confidentiality

• Health and Social Care Act 2012

• NHS Codes of Confidentiality, Information Security and Records Management

• Information: To Share or Not to Share Review

All NHS staff, contractors and committee members receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures. Only a limited number of authorised staff has access to personal information where it is appropriate to their role and is strictly on a need-to-know basis. If a sub-contractor acts as a data processor for the Practice, an appropriate contract will be established for the processing of your information.

We maintain our duty of confidentiality to you always. We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), or where the law requires information to be passed on and/or in accordance with the Caldicott principle for information sharing (sharing information in the best interest of the patient).

We may also have to share your information, subject to strict agreements on how it will be used. The following are examples of the types of organisations that we are likely to share information with:

• NHS and specialist hospitals, Trusts

• Independent Contractors such as dentists, opticians, pharmacists

• Private and Voluntary Sector Providers

• Ambulance Trusts

• Clinical Commissioning Groups and NHS England

• Social Care Services and Local Authorities

• Education Services

• Police, Fire and Rescue Services

• Other ‘data processors’ during specific project work e.g. Diabetes UK

Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data: –

• The right to request a copy of your personal data which this practice holds about you – Make your request directly to the practice. (For information from a hospital or other Trust/ NHS organisation you should write directly to them).

1. Be aware that there is no charge to have a copy of the information held about you.

2. Be aware that information must be released to you within one calendar month (unless in exceptional circumstances, which you will be informed of a part of the process)

• Be aware you may be asked for key information to process the request (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records retrieved.

• The right to request that this practice corrects any personal data if it is found to be inaccurate or out of date – You should tell us so that we can update our records as we are required to keep accurate and up-to-date records at all times. Please contact the Practice as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number).   The practice will from time to time ask you to confirm that the information we currently hold is accurate and up to date.

• The right to request your personal data is erased where it is no longer necessary for the practice to retain such data. Although please note for Patients at this practice, your records will be retained until death;

• The right to withdraw consent to the processing at any time;

• The right to data portability;

• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;

• The right to lodge a complaint with the Information Commissioners Office.

Statement of intent

Activities carried out by the practice that fall outside our contractual NHS service are known as ‘private’ work. Our fees for private work are in line with British Medical Association approved national guidelines. We endeavour to ensure that our charges and processes are fair and competitive, whilst recovering the costs of the resources used for these additional activities. However, we must ensure that all private activities do not interfere with or allow there to be a detrimental effect on the normal services of the practice. Resources will be allocated by the partners of the practice, if they are available without compromise to the NHS service we provide to our patients.

Remissions

Invoices must be paid before any work can be commenced, and at least 48 hours before any face-to-face consultation. We regret we are unable to accept cash payment.  We will provide an invoice for all pre-booked work and, prior to payment of invoices, we will provide a time frame required to carry out the work based on the resources available. If there is substantial time between the issuing of an invoice and completion of private work, we may agree to accept payment in installments. However, this decision will need to be made by a partner of the practice, and all payments must be made in full prior to any work commencing or a face-to-face consultation. The practice will not normally refund fees paid for private work done, including face-to-face consultations, and completion of documentation and reports. An exception to this is where private work has not been commenced in a timely manner due to lack of resources and necessary prioritisation of NHS work; in which case we may agree to refund any fees paid.

A full list of our fees can be found in ‘What are the fees for non-NHS services?’ on our FAQs page.

The Partners of Wychall Lane Practice are committed to achieving Best Value in all decisions made. We use the principles of Best Value as they apply to securing continuous improvement within the practice and will:

• Regularly review functions of the practice, challenging how and why services are provided and setting targets and performance indicators for improvement.

• Monitor outcomes and compare performance with similar practices as well as within the practice.

• Consult appropriate stakeholders before major decisions are made; and

• Promote fair competition through quotations and tenders to ensure that goods and services are secured in the most economic, efficient and effective way.

• We will promote transparency around our funding to ensure that there is accountability for all public funds.

We will strive to ensure that the Practice is using its resources effectively to meet the needs of the patients.

We will submit our Best Value statement with our annual audited accounts. The progress of the annual budget plan and the Best Value statement will be monitored with the practice in order to determine the extent of continuous improvement.

The Practice will set guidelines, updated annually, which will ensure that Best Value will be reviewed and demonstrated.

Partnership best value statement

The Partners of Wychall Lane Practice are committed to achieving Best Value in all decisions made. We use the principles of Best Value as they apply to securing continuous improvement within the practice and will:

• Regularly review functions of the practice, challenging how and why services are provided and setting targets and performance indicators for improvement.

• Monitor outcomes and compare performance with similar practices as well as within the practice.

• Consult appropriate stakeholders before major decisions are made; and

• Promote fair competition through quotations and tenders to ensure that goods and services are secured in the most economic, efficient and effective way.

• We will promote transparency around our funding to ensure that there is accountability for all public funds.

We will strive to ensure that the Practice is using its resources effectively to meet the needs of the patients.

We will submit our Best Value statement with our annual audited accounts. The progress of the annual budget plan and the Best Value statement will be monitored with the practice in order to determine the extent of continuous improvement.

The Practice will set guidelines, updated annually, which will ensure that Best Value will be reviewed and demonstrated.

Areas of focus will include:

• Staffing and their development

• Quality of Clinical services

• Quality of Care

• Quality of Leadership and management

• Safety of our patients and staff

• Quality of our services to meet the needs of our patients

• Purchasing supplies and staffing

• Quality of our teaching

• Use of premises

• Use of resources

These areas will be monitored for Best Value by using:

• Performance Indicators including

1. Patient feedback

2. Staff surveys

3. Management of budgets

4. Comparison of our achievements against set targets

5. Benchmarking against other practices

6. Staffing structure reviews

7. Staffing costs per patient

8. Patient satisfaction

Useful Websites:-

https://www.cqc.org.uk/guidance-providers/regulationsenforcement/regulation-13-financial-position

https://www.cqc.org.uk/what-we-do/how-we-do-our-job/five-keyquestions-we-ask

https://jfhlaw.co.uk/cqc-inspections-guide-answering-5-key-questions/

Should you have any concerns about how your information is managed or wish to object to any of the data collection at the Practice, please contact the Practice Manager or your healthcare professional to discuss how the disclosure of your personal information can be restricted. All patients have the right to change their minds and reverse a previous decision. Please contact the practice if you change your mind regarding any previous choice.

If you would like to make a ‘data subject access request’ please contact the practice in writing. We will endeavour to respond to your request within one calendar month or two months if the request is complex.

Suspected breaches in data protection can be reported to the independent OHP Data Protection Officers Leanne Hoye and Naomi Frazer on 0121 422 1366. Breaches in data protection will result in an incident investigation. Serious breaches will be reported to the ICO.

The Practice IG Lead is: Practice Manager

The Practice Caldicott Guardian is: Dr Anne Gillies

It is the responsibility of all employees of the practice to report suspected breaches of information security to the Practice lead and Data Protection Officer without delay.

The Practice is registered as a data controller with the ICO. The registration number is Z6610564 and can be viewed online in the public register at: ico.org.uk. You can contact the ICO on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.

This site uses cookies – small text files that are placed on your machine to help the site provide a better user experience. In general, cookies are used to retain user preferences, store information for things like shopping carts, and provide anonymised tracking data to third party applications like Google Analytics. As a rule, cookies will make your browsing experience better. However, you may prefer to disable cookies on this site and on others. The most effective way to do this is to disable cookies in your browser. We suggest consulting the Help section of your browser or taking a look at the About Cookies website which offers guidance for all modern browsers.

The Government is delaying the implementation of the General Practice Data for Planning and Research (GP DPR) programme until four key areas of work are strengthened:

the ability for patients to opt out or back in to sharing their GP data with NHS Digital, with data being deleted even if it has been uploaded

the backlog of opt-outs has been fully cleared

a Trusted Research Environment (TRE) is available where approved researchers can work securely on de-identified patient data which does not leave the environment

a campaign of engagement and communication has increased public awareness of the programme, explaining how data is used and patient choices

This delay will also provide more time to speak with patients, doctors, health charities and others.

This Privacy Notice will be updated when further details of the proposed implementation have been confirmed, and this may not be for at least another 12 months.

For further information please refer to NHS Digitals webpage on this subject matter

GP practices already share patient data for these purposes, but this new data collection will be more efficient and effective.  We have agreed to share the patient data we look after in our practice with NHS Digital who will securely store, analyse, publish, and share this patient data to improve health and care services for everyone. This includes:

informing and developing health and social care policy

planning and commissioning health and care services

taking steps to protect public health (including managing and monitoring the coronavirus pandemic)

in exceptional circumstances, providing you with individual care. 

enabling healthcare and scientific research

This means that we can get on with looking after our patients and NHS Digital can provide controlled access to patient data to the NHS and other organisations who need to use it to improve health and care for everyone.

Contributing to research projects will benefit us all as better and safer treatments are introduced more quickly and effectively without compromising your privacy and confidentiality.

NHS Digital has engaged with the British Medical Association (BMA), Royal College of GPs (RCGP) and the National Data Guardian (NDG) to ensure relevant safeguards are in place for patients and GP practices.

Opting Out

If you don’t want your identifiable patient data to be shared for purposes except for your own care, you can opt-out by registering a Type 1 Opt-out or a National Data Opt-out, or both. These opt-outs are different, and they are explained in more detail below. Your individual care will not be affected if you opt out using either option.

Type 1 Opt-Outs – If you do not want your identifiable patient data to be shared outside of the GP practice for purposes except your own care, you can register an opt-out with the GP practice. This is known as a Type 1 Opt-out.  Type 1 Opt-outs were introduced in 2013 for data sharing from GP practices, but may be discontinued in the future as a new opt-out has since been introduced to cover the broader health and care system, called the National Data Opt-out. If this happens, patients who have registered a Type 1 Opt-out will be informed. There is more information about National Data Opt-outs below.

NHS Digital will not collect any patient data for patients who have already registered a Type 1 Opt-in line with current policy. If this changes patients who have registered a Type 1 Opt-out will be informed.

If you do not want your patient data shared with NHS Digital for the purposes above, you can register a Type 1 Opt-out with your GP practice. You can register a Type 1 Opt-out at any time. You can also change your mind at any time and withdraw a Type 1 Opt-out.

If you have already registered a Type 1 Opt-out with us your data will not be shared with NHS Digital.  If you wish to register a Type 1 Opt-out with your us before data sharing starts with NHS Digital, this should be done by returning this form to the practice. If you do intend to opt out of the GP DPR we will update this Privacy Notice with the date by which you must provide your opt-out by to allow time for processing it.  If you have previously registered a Type 1 Opt-out and you would like to withdraw this, you can also use the form to do this. You can send the form by post or email to your us at the GP Practice or call 0300 3035678 for a form to be sent out to you.

If you do not want NHS Digital to share your identifiable patient data with anyone else for purposes beyond your own care, then you can also register a National Data Opt-out.

National Data Opt-out

If you don’t want your confidential patient information to be shared by NHS Digital with other organisations for purposes except your own care – either GP data, or other data it holds, such as hospital data – you can register a National Data Opt-out.

If you have registered a National Data Opt-out, NHS Digital will not share any confidential patient information about you with other organisations, unless there is an exemption to this, such as where there is a legal requirement or where it is in the public interest to do so, such as helping to manage contagious diseases like coronavirus. You can find out more about exemptions on the NHS website.

There is an intention for the National Data Opt-out to apply to any confidential patient information shared by the GP practice with other organisations for purposes except your individual care. This means it will replace the Type-1 Opt-out. If this happens, patients who have registered a Type 1 Opt-out will be informed. Please note that the National Data Opt-out will not apply to confidential patient information being shared by GP practices with NHS Digital, as it is a legal requirement for us to share this data with NHS Digital and the National Data Opt-out does not apply where there is a legal requirement to share data.

You can find out more about and register a National Data Opt-out or change your choice on nhs.uk/your-nhs-data-matters or by calling 0300 3035678. 

You can also set your opt-out preferences via the NHS App if you are registered to use this application.

The legal bases for processing this information.

The Health and Social Care Act 2012 covers the sharing and collection of health and care data.  It says that when the Secretary of State for Health and Social Care needs to collect and analyse data to help the health service, they can tell NHS Digital to do this for them.  The instruction, which NHS Digital must act on, is called a direction.  In this case:

1.) The Secretary of State for Health and Social Care sent a direction to NHS Digital, instructing them to collect and analyse general practice data for health and social care purposes including policy, planning, commissioning, public health, and research purposes. 

2.) NHS Digital sent all GP practices a document called a Data Provision Notice, giving details of the data it needs GP Practices like ours to share so it can comply with the direction.  All GP Practices in England are required to share data with NHS Digital when they are sent a Data Provision Notice.

Under data protection law, we can only share patient data if we have a legal basis under Articles 6 and 9 of the UK GDPR.  Our legal basis for sharing patient data with NHS Digital is Article 6(1)(c) – legal obligation, as we are required under the 2012 Act to share it with NHS Digital.

When we are sharing patient data about health, we also need a legal basis under Article 9 of the UK GDPR.  This is:

• Article 9(2)(g) – as we are sharing patient data for reasons of substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the General Practice Data for Planning and Research Directions. It is substantially in the public interest to process patient data for planning and research purposes to improve health and care services for everyone. This is permitted under paragraph 6 of Schedule 1 of the Data Protection Act 2018 (DPA).

• Article 9(2)(h) – as we are sharing patient data for the purposes of providing care and managing health and social care systems and services. This is permitted under paragraph 2 of Schedule 1 of the DPA. 

• Article 9(2)(i) – as patient data will also be used for public health purposes. This is permitted under paragraphs 3 of Schedule 1 of the DPA.

• Article 9(2)(j) – as patient data will also be used for the purposes of scientific research and for statistical purposes. This is permitted under paragraph 4 of Schedule 1 of the DPA.