Privacy - Hope Citadel Healthcare
During the COVID-19 period, we are required to do some additional sharing and processing of information, which is outlined in the Fair Processing Notice at the end of this page.
The GP Practice also has a Caldicott Guardian. A Caldicott Guardian is a senior person within a health or social care organisation, preferably a health professional, who makes sure that the personal information about those who use its services is used legally, ethically and appropriately, and that confidentiality is maintained. The Caldicott Guardian for our GP practices is:
Under GDPR all public bodies must nominate a Data Protection Officer. The DPO is responsible for advising on compliance, training and awareness and is the main point of contact with the Information Commissioner's Office (ICO). The DPO for our practices is:
This term came from the Caldicott review undertaken in 2013 and describes personal information about identified or identifiable individuals, which should be kept private or secret. It includes personal data and special categories of data but it is adapted to include dead as well as living people and 'confidential' includes both information 'given in confidence' and 'that which is owed a duty of confidence'.
Individual-level information where individuals can be distinguished by using a coded reference, which does not reveal their 'real world' identity. When data has been pseudonymised it still retains a level of detail in the replaced data by use of a key / code or pseudonym that should allow tracking back of the data to its original state.
Personal Data - demographics Special category of data - Health data
Direct care means a clinical, social or public health activity concerned with the prevention, investigation and treatment of illness and the alleviation of suffering of individuals. This is carried out by one or more registered and regulated health or social care professionals and their team with whom the individual has a legitimate relationship with. In addition, this also covers administrative purposes which are in the patient's reasonable expectations.
Personal Data - demographics
Special category of data - Health data
In cases where identifiable data is required, this is done with practice agreement and in the case of repeat prescription processing with patient consent. No data is removed from the practice's clinical system and no changes are made to patient's records without permission from the GP. Patient records are viewed [insert how they are viewed e.g. remotely via secure laptops from the CCG's premises, in the GP practice, in care homes or patient homes].
Common law duty of confidentiality - explicit consent or if there is a legal statute for this which you will be informed of
Even though consent is not the legal basis for processing personal data for research, the common law duty of confidentiality is not changing, so consent is still needed for people outside the care team to access and use confidential patient information for research, unless you have support under the Health Service (Control of Patient Information Regulations) 2002 ('section 251 support') applying via the Confidentiality Advisory Group in England and Wales or similar arrangements elsewhere in the UK
It's important for you to be aware that if you are taking part in research, or information about you is used for research, your rights to access, change or move information about you are limited. This is because researchers need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from a study, the sponsor will keep the information about you that it has already obtained. They may also keep information from research indefinitely.
In England you can register your choice to opt out via the "Your Data Matters" webpage on the link below:
Article 6 (1)(a) - Explicit Consent
Common law duty of confidentiality - explicit consent
We will use the information in a manner that conforms to the General Data Protection Regulations (GDPR) and Data Protection Act 2018. The information you provide will be subject to rigorous measures and procedures to make sure it can't be seen, accessed or disclosed to any inappropriate persons. We have an Information Governance Framework that explains the approach within the GP practice, our commitments and responsibilities to your privacy and cover a range of information and technology security areas.
Emis Web - to provide our electronic clinical system
NHS Greater Manchester Shared service - to provide our IT services
required for fraud management - we may share information about fraudulent activity in our premises or systems. This may include sharing data about individuals with law enforcement bodies.
Subject Access Rights - you can request access to and or copies of personal data we hold about you, free of charge (subject to exemptions) and provided to you within 1 calendar month. We request that you provide us with adequate information in writing to process your request such as full name, address, date of birth, NHS number and details of your request and documents to verify your identity so we can process the request efficiently. On processing a request, there may be occasions when information may be withheld if the organisation believes that releasing the information to you could cause serious harm to your physical or mental health. Information may also be withheld if another person (i.e. third party) is identified in the record, and they do not want their information disclosed to you. However, if the other person was acting in their professional capacity in caring for you, in normal circumstances they could not prevent you from having access to that information.
Right to Erasure ('be forgotten') - If we obtain consent for any processing we do, you have the right to have that data deleted / erased. Please note this does not apply to health records.
Right to object to processing - you have the right to object to processing however please note if we can demonstrate compelling legitimate grounds which outweighs the interest of you then processing can continue. If we didn't process any information about you and your health care if would be very difficult for us to care and treat you.
Or write to us at: , , , .
If you are not happy with our responses and wish to take your complaint to an independent body, you have the right to lodge a complaint with the Information Commissioner's Office.
Or go online to www.ico.org.uk/concerns (opens in a new window, please note we can't be responsible for the content of external websites)
Sometimes your information may be requested to be used for research purposes - the surgery will always gain your consent before releasing the information for this purpose.
Health Innovation Manchester works across Greater Manchester's Health and Social Care system and is rolling out the GM Care Record on behalf of its partners.