Sharing Your Information

How can be my information be viewed outside of Ireland Wood and Horsforth Medical Practice?

Privacy Notice 2023

Easy Rad Privacy Notice – Please click the link below

5a_Easy_Read_Privacy_Notice

Your health information can be shared both locally and nationally at differing levels of detail.

For direct care locally in Leeds: Leeds Care Record

Patients in Leeds are able to benefit from the sharing of information via the Leeds Care Record. This shares contact details, diagnosis list, medications, allergies, test results, referrals & letters and care plans between health professionals in Leeds. Information is shared by GP practices, the Hospital trusts, Community and Mental Health services, and Social Care.

You have the right to object to your Leeds Care Record being shared by contacting them directly. Details are available via their website.

Download a leaflet on Leeds Care Record. Leeds Care Record Leaflet

This is also available in an Easy Read version. Easy Read Leeds Care Record Leaflet

You can opt in and out of these sharing agreements whenever you choose. Details of these schemes are as follows:

Nationally for direct care: Summary Care Record – sharing your information for your care across the NHS.

Your core Summary Care Record is created when you register at a GP practice (although you should be given the option to opt in/out during your registration). If you do not express a preference, it is currently assumed that your consent is implied.

The Summary Care Record shares only your contact details, medications and allergies with other healthcare professionals involved in your care.

You can also choose to share a Summary Care Record with Additional Information. This shares contact details, medications, allergies, diagnosis list, care plans, end of life care and immunisations with other healthcare professionals. Sensitive data is excluded. A Summary Care Record with Additional Information will only be created for you if you explicitly choose this option. Only the most up to date information is shared for each category (EMISWeb). All current and past information is shared for each category (SystmOne).

Choosing to share a summary care record with additional information is thought to be of great benefit if you are admitted to hospital locally or elsewhere in the UK.

You can opt out of sharing any of your information in a Summary Care Record. If you decide not to share this will not affect your entitlement to care. However, it could result in the delivery of your care being less efficient as other health professionals will not have access to these parts of your medical history.

Further details are available in this leaflet. Summary Care Record – What You Need to Know

This is also available in an Easy Read version. Adding important information to your NHS Summary Care Record

You can change your mind about your Summary Care Record at any time.

To register or change your Summary Care Record preferences, please complete this form and return it to us.

Summary Care Record Consent Summary Care Record Consent Form

Nationally: The national data-out; for purposes beyond direct care.

NHS Digital is developing a new system to support the national data opt-out which will give patients more control over how identifiable health and care information is used for reasons other than your individual care and treatment. The system will offer patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used for purposes beyond their direct care such as research and planning purposes.

In the past, you may have already chosen to prevent your identifiable data leaving NHS Digital, known as a Type 2 opt-out. All existing Type 2 opt-outs will be converted to the new national data opt-out and this will be confirmed by a letter to all individuals aged 13 or over with an existing Type 2 in place. Once the national data opt-out is launched, it will no longer be possible to change preferences via local GP practices.

The national data opt-out is due to be launched on 25 May 2018.

More information is available via https://digital.nhs.uk/national-data-opt-out

More information about health and care records in general can be found on the NHS website here: NHS Choices

If you have any queries or concerns about how your information is handled, please do not hesitate to contact our Practice Manager for further information.

How we collect, use, and look after your data

This notice explains how Ireland Wood and Horsforth Medical Practice will collect, look after, use or otherwise process your personal data. “Personal data” is information relating to you as a living, identifiable individual.

HOW IS MY INFORMATION COLLECTED AND LOOKED AFTER?

Who is responsible for my information?

Ireland Wood and Horsforth Medical Practice is the data controller for your information (if you are currently registered with the practice) and is responsible for looking after your record while you are a registered patient. The person with the key responsibility for data protection and security is Dr MA Brown, who is a GP Partner and also our Caldicott Guardian.

The Data Protection Officer for Ireland Wood and Horsforth Medical Practice is yet to be appointed. We will publish the details of our Data Protection Officer as soon as one is appointed.

Any queries or concerns should be raised with the practice first.

Why do we collect information about you?

As health professionals, we maintain records about you in order to support your care. By registering with the practice, your existing records will be transferred to us from your previous practice so that we can keep them up to date while you are our patient. If you do not have a previous medical record (a new-born child or coming from overseas, for example), we will create a medical record for you. We take great care to ensure that your information is kept securely, that it is up to date, accurate and used appropriately. All of our staff are trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to.

What information do we hold about you?

• Details about you, such as your name, address, carers, biological gender, gender identity, ethnic origin, date of birth, legal representatives and emergency contact details
• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
• Notes and reports about your health
• Details about your treatment and care
• Results of investigations such as laboratory tests, x-rays, etc.
• Relevant information from other health professionals, relatives or those who care for you

How is my information stored?

Our practice uses a clinical records programme called Emis Web which is where any electronic information about you will be stored. Any information held in paper records is stored securely at the practice. We use a combination of working practices and technology to ensure that your information is kept confidential and secure.

What is the legal basis that we use to process your information?

We are required to tell you the legal basis that is used for the various ways we process and use your data. The following table sets the main ways your personal data may be used and the corresponding legal basis and category of data. Each purpose is covered in more detail within this notice to explain what these mean in more practical terms.

Legal Basis for Processing

When is my information shared?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• Data Protection legislation
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• NHS Codes of Confidentiality, Information Security and Records Management
• Information: To Share or Not to Share Review

How long does the practice hold my information?

As long as you are registered as a patient with Ireland Wood and Horsforth Medical Practice, your paper records are held at the practice along with your GP electronic record. If you register with a new practice, they will initiate the process to transfer your records. The electronic record is transferred to the new practice across a secure NHS data-sharing network and all practices aim to process such transfers within a maximum of 8 working days. The paper records are then transferred via Primary Care Support England (operated on behalf of NHS England by Capita) which can take longer. Primary Care Support England also look after the records of any patient not currently registered with a practice and the records of anyone who has died.

Once your records have been forwarded to your new practice (or after your death forwarded to Primary Care Support England), a cached version of your electronic record is retained in the practice and classified as “inactive”. If anyone has a reason to access an inactive record, they are required to formally record that reason and this action is audited regularly to ensure that all access to inactive records is valid and appropriate. We may access this for clinical audit (measuring performance), serious incident reviews, or statutory report completion (e.g., for HM Coroner).

Change of Details

It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.

How can I see what information you hold about me?

You have a right under data protection legislation to request to see what information the practice holds about you. You also have the right to ask for inaccuracies to be corrected and in some circumstances you have the right to request that we stop processing your data. Some of these rights are not automatic and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

If you make a Subject Access Request, we will:

• describe the information we hold about you
• tell you why we are holding that information
• tell you who it might be shared with
• at your request, provide a copy of the information in an easy to read form.

In order to request this, you need to do the following:

• Your request must be made in writing – for information from the hospital you should write direct to them
• We will provide electronic copies (via online access) free of charge.
• We are required to respond to you within 1 month.

You will need to give enough information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located.

In some circumstances there may be a charge to have a printed copy of the information held about you. If this is the case, this will be discussed with you before any charge is made.

If you would like to make a Subject Access Request or have any further questions, please contact the surgery.

HOW IS MY INFORMATION USED?

For provision of direct care:

In the practice, individual staff will only look at what they need in order to carry out such tasks as booking appointments, making referrals, giving health advice or provide you with care.

Sometimes your information may be used to run automated calculations. These can be as simple as calculating your Body Mass Index but they can be more complex and used to calculate some risks to your health that we should consider with you. The ones we use in practice include QRisk (cardiovascular risk assessment – usually following an NHS Healthcheck), Qdiabetes (diabetes risk assessment) and eFI (electronic frailty index). Whenever we use these profiling tools, we assess the outcome on a case-by-case basis. No decisions about individual care are made solely on the outcomes of these tools but they are used to help us assess and discuss your possible future health and care needs with you.

We share information about you with other health professionals where they have a genuine need for it to support your care, as follows.

For commissioning and healthcare planning purposes:

In some cases, for example when looking at population healthcare needs, some of your data may be shared (usually in such a way that you cannot be identified from it). The following organisations may use data in this way to inform policy or make decisions about general provision of healthcare, either locally or nationally.

• Leeds City Council: Public Health, Adult or Child Social Care Services
• Embed Health Consortium (NHS commissioning support unit)
• Leeds Clinical Commissioning Group
• NHS Digital (Formerly known as (HSCIC)
• The “Clinical Practice Research Datalink” (EMISWeb practices) or ResearchOne Database (SystmOne practices).
• Other data processors which you will be informed of as appropriate.

In order to comply with its legal obligations we may send data to NHS Digital when directed by the Secretary of State for Health under the Health and Social Care Act 2012.

This practice contributes to national clinical audits and will send the data which are required by NHS Digital when the law allows. This may include demographic data, such as date of birth, and information about your health which is recorded in coded form, for example, the clinical code for diabetes or high blood pressure.

For research purposes:

Research data is usually shared in a way that individual patients are non-identifiable. Occasionally where research requires identifiable information you may be asked for your explicit consent to participate in specific research projects. The surgery will always gain your consent before releasing any information for this purpose.

Where specific information is asked for, such as under the National Diabetes audit, you have the choice to opt of the audit.

Further details of these audits will be available on this page shortly.

For safeguarding purposes, life or death situations or other circumstances when we are required to share information:

We may also disclose your information to others in exceptional circumstances (ie life or death situations) or in accordance with Dame Fiona Caldicott’s information sharing review (Information to share or not to share).

For example, your information may be shared in the following circumstances:

• When we have a duty to others e.g. in child protection cases
• Where we are required by law to share certain information such as the birth of a new baby, infectious diseases that may put you or others at risk or where a Court has decided we must.

When you request to see your information or ask us to share it with someone else:

If you ask us to share your data, often with an insurance company, solicitor, employer or similar third party, we will only do so with your explicit consent. Usually the requesting organisation will ask you to confirm your consent, often in writing or electronically. We check that consent before releasing any data and you can choose to see the information before we send it.

Please see the section Sharing your Information for more details of how your personal data is shared electronically within the NHS locally & nationally and your choices about being included in these sharing agreements.

OBJECTIONS/CONCERNS/COMPLAINTS

If you are happy for your data to be extracted and used for the purposes described in this notice then you do not need to do anything.

Should you have any concerns about how your information is managed at the practice, please contact Freya Keith, our Deputy Practice Manager. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website www.ico.org.uk, [email protected], telephone: 0303 123 1113 (local rate) or 01625 545 745

GDPR and My GP Patient Record – FAQs

How do I find out what data you hold on me and who you share it with?

We post our full Privacy Notice (sometimes referred to as a Fair Processing notice) on our website.

In this document you can find detailed information on the data we collect, why we collect it, the people we share data with it and who to make enquiries to about your data.

I have heard that under the GDPR I can ask to see my medical records – is this correct?

It is – but this is not a new right and has in fact been the case since 1998.

When you make an application to view your medical record it is called a Subject Access Request.

Usually patients ask because they want to see a specific piece of information or information relating to a specific appointment or time or illness.

The main way we encourage patients to view medical records in general practice is through signing up to view your medical records online.  Most practices will give you a form to apply for Online Records at any time.

We will normally be able to respond to your Subject Access Request within 30 days unless it is very complex information you are requesting in which case we will let you know of the delay.

There is no charge for requesting access to your health data.

If you ask to see your records you may be asked to fill out a form and will be asked to provide proof of your identify.

Occasionally patients request access to their entire medical record including old data that is only held in paper form.  If this is the case and the record is lengthy we may levy a fee based on the time and cost of providing the copy.

You may also be charged if you put repeated requests in for the same data.

I have heard that I can have my data corrected or ‘rectified’ – is this true?

You have the right to have any factual inaccuracies corrected.

We encourage you to let us know if you have given us some information and it is not correct in your records such as your DOB, address etc.  Ask your health professional about amending your records if you believe they contain a factual error relating to your health information.

There is no obligation to amend professional opinion, however sometimes it is difficult to distinguish between fact and opinion. Where you and the health professional cannot agree on whether the information in question is accurate you can ask that a statement is included to set out that the accuracy of the information is disputed by you.

I have heard under the GDPR I have the right to data portability? Can I take my records with me when I transfer to another practice? 

Data portability allows individuals to obtain and reuse their personal data for their own purposes across different services.

This does not apply to the information in your heath record which is collected under the legal basis of ‘Public Task’.  The right to ‘data portability’ applies to personal data an individual has provided, where the processing is based on the individual’s consent or for the performance of a contract; and when processing is carried out by automated means.

However in the UK if you move from a practice your electronic health record does follow you automatically and securely to your new practice.

I want the practice to stop processing my data – do I have this right?

You have the right to request that your confidential information is not used beyond your own care and treatment and to have your objections considered, and where your wishes cannot be followed, to be told the reasons including the legal basis.

However GPs are obligated under both medico-legal and contractual reasons to maintain accurate records and would be unable to provide safe provision of direct care and processing which is necessary for compliance with a legal obligation if you withdraw processing consent for your care and treatment.

I have heard under new rules I can ask my data to be deleted – is this true?

You have the right to request this however as a practice we cannot ‘delete’ GP health data – legally we are bound to retain health records for the lifetime of a patient and at least 10 years after death.

When you move on to another practice your file is ‘archived’ and restricted at your old practice but we cannot ‘delete’ your health record.

Don’t you need my explicit consent (ie clearly stated) to process my data – why haven’t you asked me for this?

For direct care the lawful basis for processing special category health data is that processing is: ‘necessary… in the exercise of official authority vested in the controller’ (Article 6(1)(e)).12

The special category condition for processing for direct care is that processing is:‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…’ (Article 9(2)(h)).

Neither of these legal basis rely on consent and it would be misleading/disingenuous to ask for your consent as we would be unable to provide care to you if you refused.

The one occasion when we will seek your explicit consent is when you have given instruction to release any of your medical records to solicitors/insurers.

How we use your information to provide you with healthcare

This practice keeps medical records confidential and complies with the General Data Protection Regulation.

We hold your medical record so that we can provide you with safe care and treatment.

We will also use your information so that this practice can check and review the quality of the care we provide. This helps us to improve our services to you.

• We will share relevant information from your medical record with other health or social care staff or organisations when they provide you with care. For example, when they refer you to a specialist in a hospital. Or your prescription to your chosen pharmacy.
• Healthcare staff working in A&E and out of hours care will also have access to your information. For example, it is important that staff who are treating you in an emergency know if you have any allergic reactions. This will involve the use of your Summary Care Record or locally Leeds Care record.   For more information see our privacy notice on our practice website.
• You have the right to object to information being shared for your own care. Please speak to the practice if you wish to object. You also have the right to have any factual mistakes or errors corrected.

Other important information about how your information is used to provide you with healthcare

Registering for NHS care

• All patients who receive NHS care are registered on a national database.
• This database holds your name, address, date of birth and NHS Number but it does not hold information about the care you receive.
• The database is held by NHS Digital a national organisation which has legal responsibilities to collect NHS data.

Identifying patients who might be at risk of certain diseases

• Your medical records will be searched by a computer programme so that we can identify patients who might be at high risk from certain diseases such as heart disease or unplanned admissions to hospital.
• This means we can offer patients additional care or support as early as possible.
• This process will involve linking information from your GP record with information from other health or social care services you have used.
• Information which identifies you will only be seen by this practice.

Safeguarding

• Sometimes we need to share information so that other people, including healthcare staff, children or others with safeguarding needs, are protected from risk of harm.
• These circumstances are rare.
• We do not need your consent or agreement to do this.

How your information is used for medical research and to measure the quality of care

Medical research

We share information from medical records:

• to support medical research when the law allows us to do so, for example to learn more about why people get ill and what treatments might work best;
• we will also at times use your medical records to carry out research within the practice.

If we share information with medical research organisations we would do this with your explicit consent or when the law allows.   You have the right to object to your identifiable information being used or shared for medical research purposes. Please speak to the practice if you wish to object

Checking the quality of care – national clinical audits

We contribute to national clinical audits so that healthcare can be checked and reviewed.

• Information from medical records can help doctors and other healthcare workers measure and check the quality of care which is provided to you.
• The results of the checks or audits can show where hospitals are doing well and where they need to improve.
• The results of the checks or audits are used to recommend improvements to patient care.
• Data is sent to NHS Digital a national body with legal responsibilities to collect data.
• The data will include information about you, such as your NHS Number and date of birth and information about your health which is recorded in coded form – for example the code for diabetes or high blood pressure.
• We will only share your information for national clinical audits or checking purposes when the law allows.
• You have the right to object to your identifiable information being shared for national clinical audits. Please contact the practice if you wish to object.

How your information is shared so that this practice can meet legal requirements

The law requires practices to share information from your medical records in certain circumstances. Information is shared so that the NHS or Public Health England can, for example:

• plan and manage services;
• check that the care being provided is safe;
• prevent infectious diseases from spreading.

We will share information with NHS Digital, the Care Quality Commission and local health protection team (or Public Health England) when the law requires us to do so.

National screening programmes

• The NHS provides national screening programmes so that certain diseases can be detected at an early stage.
• These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms and a diabetic eye screening service.
• The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening programme.

To view the practice confidentiality policy, click on the link below:
CONFIDENTIALITY POLICY UPDATED 2018

GDPR Guidance for Practices

To download and print a copy of our Subject Access Request form, click the link below.
Subject Access request (SAR) Form and Info Leaflet