GDPR overview leaflet
Data Op-Outs
You can choose whether your confidential patient information is used for research and planning. You do not need to do anything if you are happy about how your confidential patient information is used. You can change your choice at any time.
Type 1 opt-out: medical records held at your GP practice - You can tell your GP practice if you do not want your confidential patient information held in your GP medical record to be used for purposes other than your individual care. This is commonly called a type 1 opt-out. This opt-out request can only be recorded by your GP practice. Please fill and return this form to the surgery Type 1 Opt Out form
How we collect, look after and use your data
This notice explains how Dr Mourmouris & Partners, Thornton Medical Centre will collect, look after, use or otherwise process your personal data. “Personal data” is information relating to you as a living, identifiable individual.
HOW IS MY INFORMATION COLLECTED AND LOOKED AFTER?
Who is responsible for my information?
Dr Mourmouris & Partners is the data controller for your information and is responsible for looking after your record while you are a registered patient. The person with the key responsibility for data protection and security is the Practice Manager.
Our Data Protection Officer is Aaron Linden (Leedsccg.dpo@nhs.net)
Why do we collect information about you? As health professionals, we maintain records about you in order to support your care. By registering with the practice, your existing records will be transferred to us from your previous practice so that we can keep them up to date while you are our patient. If you do not have a previous medical record (a new-born child or coming from overseas, for example), we will create a medical record for you. We take great care to ensure that your information is kept securely, that it is up to date, accurate and used appropriately. All of our staff are trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to.
What information do we hold about you?
- Details about you, such as your name, address, carers, biological gender, gender identity, ethnic origin, date of birth, legal representatives and emergency contact details
- Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
- Notes and reports about your health
- Details about your treatment and care
- Results of investigations such as laboratory tests, x-rays, etc.
- Relevant information from other health professionals, relatives or those who care for you
How is my information stored? Our practice uses a clinical records programme called Systm One which is where any electronic information about you will be stored. Any information held in paper records is stored securely at the practice. We use a combination of working practices and technology to ensure that your information is kept confidential and secure.
What is the legal basis that we use to process your information? We are required to tell you the legal basis that is used for the various ways we process and use your data. The following table sets the main ways your personal data may be used and the corresponding legal basis and category of data. Each purpose is covered in more detail within this notice to explain what these mean in more practical terms.
Purpose of using personal data | Legal basis of processing | Special category of data |
Provision of direct care and related administrative purposes e.g., e-referrals to hospitals or other care providers | GDPR Article 6(1)(e) – the performance of a task carried out in the public interest | GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. |
For commissioning and healthcare planning purposes e.g., collection of mental health data set via NHS Digital or local | GDPR Article 6(1)(c) – compliance with a legal obligation | GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health |
For planning and running the NHS (other mandatory flow) e.g., CQC powers to require information and records | GDPR Article 6(1)(c) – compliance with a legal obligation (the GP practice) Regulation 6(1)(e) – the performance of a task carried out in the public interest (CQC) | GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health |
For planning & running the NHS – national clinical audits | GDPR Article 6(1)(e) – the performance of a task carried out in the public interest | GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health |
For research | GDPR Article 6(1)(f) – legitimate interests…except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject. GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 6(1)(a) – explicit consent | GDPR Article 9(2)(j) – scientific or historical research purposes or statistical purposes |
For safeguarding or other legal duties | GDPR Article 6(1)(e) – the performance of a task carried out in the public interest Regulation 6(1)(c) – compliance with a legal obligation | GDPR Article 9(2)(b) – purposes of carrying out the obligations of ..social protection law. |
When you request us to share your information e.g., subject access requests | GDPR Article 6(1)(a) – explicit consent | GDPR Article 9(1)(a) – explicit consent |
When is my information shared? We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
- Data Protection legislation
- Human Rights Act 1998
- Common Law Duty of Confidentiality
- Health and Social Care Act 2012
- NHS Codes of Confidentiality, Information Security and Records Management
- Information: To Share or Not to Share Review
How long does the practice hold my information? As long as you are registered as a patient with Dr Addlestone & Partners your paper records are held at the practice along with your GP electronic record. If you register with a new practice, they will initiate the process to transfer your records. The electronic record is transferred to the new practice across a secure NHS data-sharing network and all practices aim to process such transfers within a maximum of 8 working days. The paper records are then transferred via Primary Care Services England (operated on behalf of NHS England by Capita) which can take longer. Primary Care Services England also look after the records of any patient not currently registered with a practice and the records of anyone who has died.
Once your records have been forwarded to your new practice (or after your death forwarded to Primary Care Services England), a cached version of your electronic record is retained in the practice and classified as “inactive”. If anyone has a reason to access an inactive record, they are required to formally record that reason and this action is audited regularly to ensure that all access to inactive records is valid and appropriate. We may access this for clinical audit (measuring performance), serious incident reviews, or statutory report completion (e.g., for HM Coroner).
Change of Details It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.
How can I see what information you hold about me? You have a right under data protection legislation to request to see what information the practice holds about you. You also have the right to ask for inaccuracies to be corrected and in some circumstances you have the right to request that we stop processing your data. Some of these rights are not automatic and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
If you make a Subject Access Request, we will:
- describe the information we hold about you
- tell you why we are holding that information
- tell you who it might be shared with
- at your request, provide a copy of the information in an easy to read form.
In order to request this, you need to do the following:
- Your request must be made verbally or in writing – for information from the hospital you should contact them
- We will provide electronic copies (via online access, by email or on CDROM) free of charge.
- We are required to respond to you within 1 month.
You will need to give enough information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located.
If you would like to make a Subject Access Request or have any further questions, please contact our Practice Manager.
HOW IS MY INFORMATION USED?
For provision of direct care: In the practice, individual staff will only look at what they need in order to carry out such tasks as booking appointments, making referrals, giving health advice or provide you with care.
Sometimes your information may be used to run automated calculations. These can be as simple as calculating your Body Mass Index but they can be more complex and used to calculate some risks to your health that we should consider with you. The ones we use in practice include Qrisk (cardiovascular risk assessment – usually following an NHS Healthcheck) and eFI (electronic frailty index). Whenever we use these profiling tools, we assess the outcome on a case-by-case basis. No decisions about individual care are made solely on the outcomes of these tools but they are used to help us assess and discuss your possible future health and care needs with you.
We share information about you with other health professionals where they have a genuine need for it to support your care, as follows.
Recipient of data | Reason |
Leeds Teaching Hospitals | Secondary or emergency care |
· Other national providers of health care who you choose to be referred to, in consultation with your healthcare professional | Secondary or specialist care |
Leeds & York Partnership Foundation Trust | Mental health & learning disability services |
Mid-Yorkshire Hospitals Trust | Diabetic eye-screening services |
Leeds Community Healthcare Trust | District Nursing services |
Independent Contractors such as dentists, opticians, pharmacists | Community care |
NHS National Diabetes Prevention Programme | Information and lifestyle education |
Local Care Direct | Out of Hours primary care provider |
Leeds City Council | Social Care services, Educational services |
The Armley Hub | Provider of extended access appointments at the local hub. |
For commissioning and healthcare planning purposes:
In some cases, for example when looking at population healthcare needs, some of your data may be shared (usually in such a way that you cannot be identified from it). The following organisations may use data in this way to inform policy or make decisions about general provision of healthcare, either locally or nationally.
- Leeds City Council: Public Health, Adult or Child Social Care Services
- Embed Health Consortium (NHS commissioning support unit)
- Leeds Clinical Commissioning Group
- NHS Digital (Formerly known as (HSCIC)
- ResearchOne Database
- Other data processors which you will be informed of as appropriate.
In order to comply with its legal obligations we may send data to NHS Digital when
directed by the Secretary of State for Health under the Health and Social Care Act 2012.
This practice contributes to national clinical audits and will send the data which are required
by NHS Digital when the law allows. This may include demographic data, such as date of birth,
and information about your health which is recorded in coded form, for example, the clinical
code for diabetes or high blood pressure.
This practice is supporting vital health and care planning and research by sharing your data with NHS Digital. For more information about this see the GP Practice Privacy Notice for General Practice Data for Planning and Research.
For research purposes:
Research data is usually shared in a way that individual patients are non-identifiable. Occasionally where research requires identifiable information you may be asked for your explicit consent to participate in specific research projects. The surgery will always gain your consent before releasing any information for this purpose.
Where specific information is asked for, such as under the National Diabetes audit, you have the choice to opt of the audit.
For safeguarding purposes, life or death situations or other circumstances when we are required to share information:
We may also disclose your information to others in exceptional circumstances (ie life or death situations) or in accordance with Dame Fiona Caldicott’s information sharing review (Information to share or not to share).
For example, your information may be shared in the following circumstances:
- When we have a duty to others e.g. in child protection cases
- Where we are required by law to share certain information such as the birth of a new baby, infectious diseases that may put you or others at risk or where a Court has decided we must.
When you request to see your information or ask us to share it with someone else: If you ask us to share your data, often with an insurance company, solicitor, employer or similar third party, we will only do so with your explicit consent. Usually the requesting organisation will ask you to confirm your consent, often in writing or electronically. We check that consent before releasing any data and you can choose to see the information before we send it.
Please see the section Sharing your Information for more details of how your personal data is shared electronically within the NHS locally & nationally and your choices about being included in these sharing agreements.
OBJECTIONS/CONCERNS/COMPLAINTS If you are happy for your data to be extracted and used for the purposes described in this notice then you do not need to do anything.
Should you have any concerns about how your information is managed at the practice, please contact our Practice Manager. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website www.ico.org.uk, casework@ico.org.uk, telephone: 0303 123 1113 (local rate) or 01625 545 745
Sharing your information
How can be my information be viewed outside of Dr Addlestone & Partners, Thornton Medical Centre? Your health information can be shared both locally and nationally at differing levels of detail.
- For direct care locally in Leeds: Leeds Care Record Patients in Leeds are able to benefit from the sharing of information via the Leeds Care Record. This shares contact details, diagnosis list, medications, allergies, test results, referrals & letters and care plans between health professionals in Leeds. Information is shared by GP practices, the Hospital trusts, Community and Mental Health services, and Social Care.
You have the right to object to your Leeds Care Record being shared by contacting them directly. Details are available via their website.
Download a leaflet on Leeds Care Record.
You can opt in and out of these sharing agreements whenever you choose. Details of these schemes are as follows:
- Nationally for direct care: Summary Care Record – sharing your information for your care across the NHS. Your core Summary Care Record is created when you register at a GP practice (although you should be given the option to opt in/out during your registration). If you do not express a preference, it is currently assumed that your consent is implied.
The Summary Care Record shares only your contact details, medications and allergies with other healthcare professionals involved in your care.
You can also choose to share a Summary Care Record with Additional Information. This shares contact details, medications, allergies, diagnosis list, care plans, end of life care and immunisations with other healthcare professionals. Sensitive data is excluded. A Summary Care Record with Additional Information will only be created for you if you explicitly choose this option. All current and past information is shared for each category.
Choosing to share a summary care record with additional information is thought to be of great benefit if you are admitted to hospital locally or elsewhere in the UK.
You can opt out of sharing any of your information in a Summary Care Record. If you decide not to share this will not affect your entitlement to care. However, it could result in the delivery of your care being less efficient as other health professionals will not have access to these parts of your medical history.
Further details are available at https://www.nhs.uk/NHSEngland/thenhs/records/healthrecords/Pages/health-record-types.aspx
- Nationally: The national data opt-out. For purposes beyond direct care.
NHS Digital is developing a new system to support the national data opt-out which will give patients more control over how identifiable health and care information is used for reasons other than your individual care and treatment. The system will offer patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used for purposes beyond their direct care such as research and planning purposes. In the past, you may have already chosen to prevent your identifiable data leaving NHS Digital, known as a Type 2 opt-out. All existing Type 2 opt-outs will be converted to the new national data opt-out and this will be confirmed by a letter to all individuals aged 13 or over with an existing Type 2 in place. Once the national data opt-out is launched, it will no longer be possible to change preferences via local GP practices. The national data opt-out is due to be launched on 25 May 2018.
More information is available via https://digital.nhs.uk/national-data-opt-out
More information about health and care records in general can be found on the NHS website here: NHS Choices
If you have any queries or concerns about how your information is handled, please do not hesitate to contact the Practice Manager for further information.
Your information and responding to coronavirus (COVID-19)
The health and social care system is facing significant pressures due to the coronavirus outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency, it has become even more important to share health and care information across relevant organisations.
This notice describes how GPs and other health and social care organisations may use your information within the health and social care system to protect you and others during the Coranavirus (COVID-19) outbreak with regard to your Summary Care Record.
Summary Care Records
All patients registered with a GP have a Summary Care Record, unless they have chosen not to have one. The information held in your Summary Care Record gives registered and regulated healthcare professionals, away from your usual GP practice, access to information to provide you with safer care, reduce the risk of prescribing errors and improve your patient experience.
Your Summary Care Record contains basic (Core) information about allergies and medications and any reactions that you have had to medication in the past.
Some patients, including many with long term health conditions, previously have agreed to have Additional Information shared as part of their Summary Care Record. This Additional Information includes information about significant medical history (past and present), reasons for medications, care plan information and immunisations.
Change to information held in your Summary Care Record
In light of the current emergency, the Department of Health and Social Care has removed the requirement for a patient’s prior explicit consent to share Additional Information as part of the Summary Care Record.
This is because the Secretary of State for Health and Social Care has issued a legal notice to healthcare bodies requiring them to share confidential patient information with other healthcare bodies where this is required to diagnose, control and prevent the spread of the virus and manage the pandemic. This includes sharing Additional Information through Summary Care Records, unless a patient objects to this.
If you have already expressed a preference to only have Core information shared in your Summary Care Record, or to opt-out completely of having a Summary Care Record, these preferences will continue to be respected and this change will not apply to you. For everyone else, the Summary Care Record will be updated to include the Additional Information. This change of requirement will be reviewed after the current coronavirus (COVID-19) pandemic.
Why we have made this change
In order to look after your health and care needs, health and social care bodies may share your confidential patient information contained in your Summary Care Record with clinical and non-clinical staff in other health and care organisations, for example hospitals, NHS 111 and out of hours organisations. These changes will improve the healthcare that you receive away from your usual GP practice.
Your rights in relation to your Summary Care Record
Regardless of your past decisions about your Summary Care Record preferences, you will still have the same options that you currently have in place to opt out of having a Summary Care Record, including the opportunity to opt-back in to having a Summary Care Record or opt back in to allow sharing of Additional Information.
You can exercise these rights by doing the following:
- Choose to have a Summary Care Record with all information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a detailed Summary Care Record, including Core and Additional Information, if they need to provide you with direct care.
- Choose to have a Summary Care Record with Core information only. This means that any authorised, registered and regulated health and care professionals will be able to see limited information about allergies and medications in your Summary Care Record if they need to provide you with direct care.
- Choose to opt-out of having a Summary Care Record altogether. This means that you do not want any information shared with other authorised, registered and regulated health and care professionals involved in your direct care. You will not be able to change this preference at the time if you require direct care away from your GP practice. This means that no authorised, registered and regulated health and care professionals will be able to see information held in your GP records if they need to provide you with direct care, including in an emergency.
To make these changes, you should inform your GP practice or complete this form and return it to your GP practice.
More information
For more information about these changes see the following resources:
This privacy notice supplements your GP practice's main privacy notice