Recipients or categories of recipients of the personal or special categories of personal data | Purpose of the processing and data retention periods | Lawful basis | Your Rights |
|
NHS Trusts – Hospitals, Community or Mental Health Trusts. | Personal data concerning your GP medical record may be shared with NHS Trusts in order to enable their healthcare professionals make the best informed decision about your health needs, and provide you with the best possible care if you visit the hospital for routine care and referrals. Your personal information may also be processed for local administrative purposes such as: · Waiting list management; · local clinical audit; · Performance against local targets; · activity monitoring; · production of datasets to submit for commissioning purposes and national collections. The source of the information shared in this way is your electronic GP record. In accordance with DPA Part 1, Schedule 1 (2) health or social care purposes means the purposes of preventive or occupational medicine; medical diagnosis; the provision of health care or treatment; the provision of social care, or the management of health care systems or services or social care systems or services. Data Retention Period All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care. | The processing of personal data is permitted under the following GDPR and DPA conditions: GDPR Article 6(1) (e) - public interest or in the exercise of official authority; DPA Section 8 (d) - processing is necessary for the exercise of statutory functions; The processing of special categories of personal data concerning health is permitted under the following GDPR and DPA conditions: GDPR Article 9 (2) (h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services; DPA Section 10 (1) (c) – processing is necessary for health and social care purposes; In accordance with DPA Schedule 1, Part 1, (2) health or social care purposes means the purposes of preventive or occupational medicine; medical diagnosis; the provision of health care or treatment; the provision of social care, or the management of health care systems or services or social care systems or services. Related Legislation: Common Law of Duty of Confidentiality | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21 and DPA Section 99, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Emergency Services (Ambulance trusts, police, A&E departments, out of hours services, 111) | There are circumstances when intervention is necessary in order to save or protect a patient’s life or to prevent them from serious immediate harm, for example, during a collapse or diabetic coma or serious injury or accident. In many of these circumstances the patient may be unconscious or too ill to communicate. Medical professionals have a duty of care to share data in emergencies to protect their patients or other persons. In these circumstances, your GP medical record will be shared with emergency healthcare services, the police or fire service in order to enable you receive the best treatment or service. The source of the information shared in this way is your electronic GP record. Data Retention Period All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care. | The processing of personal data is permitted under the following GDPR and DPA conditions: GDPR Article 6(1) (e) - public interest or in the exercise of official authority; DPA Section 8 (d) - processing is necessary for the exercise of statutory functions; The processing of special categories of personal data concerning health is permitted under the following GDPR and DPA conditions: GDPR Article 9 (2) (h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services; Article 9 (2) (C) – the processing is necessary to protect the vital interests of the data subject; DPA Section 10 (1) (c) – processing is necessary for health and social care purposes; In accordance with DPA Schedule 1, Part 1, (2) health or social care purposes means the purposes of preventive or occupational medicine; medical diagnosis; the provision of health care or treatment; the provision of social care, or the management of health care systems or services or social care systems or services. In accordance with DPA Schedule 1, Part 3, (30) (b) the conditions for protecting individual’s vital interests is met where the data subject is physically or legally incapable of giving consent. | You have the right to: · Make pre-determined decisions about the type and extent of care you will receive in an emergency, these are known as “Advance Directives”; · access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: You have the right to object to some or all of your personal information being shared with the recipients. You also have the right to have an “Advance Directive” placed in your records and brought to the attention of relevant healthcare workers or staff. We will notify you at the earliest opportunity where we have shared your personal data in an emergency situation. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
GP Federations (groups of GP practices working together) | GP Federations are groups of GPs (patient centered organisation,) working collaboratively and developing closer integration with other partners across health, social and third sector partners to facilitate an enhanced delivery of health and care services. Through various hubs in the community the GP Federation provide direct health and care services such as continued extended access, home visits, universal offers, musculoskeletal service, GP at front door and other neighbourhood services across East Kent. If you visit receive treatment/consultation on any of these services, personal data concerning your GP medical record may be shared with the GP Federation and their Multidisciplinary Team (MDT) in order to enable them make the best informed decision about your health/care needs, and provide you with the best possible care. The source of the information shared in this way is your electronic GP record. Data Retention Period All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care. | The processing of personal data is permitted under the following GDPR and DPA conditions: GDPR Article 6(1) (e) - public interest or in the exercise of official authority; DPA Section 8 (d) - processing is necessary for the exercise of statutory functions; The processing of special categories of personal data concerning health is permitted under the following GDPR and DPA conditions: GDPR Article 9 (2) (h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services; DPA Section 10 (1) (c) – processing is necessary for health and social care purposes; In accordance with DPA Schedule 1, Part 1, (2) health or social care purposes means the purposes of preventive or occupational medicine; medical diagnosis; the provision of health care or treatment; the provision of social care, or the management of health care systems or services or social care systems or services. Related Legislation: Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share); Common Law of Duty of Confidentiality | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Pharmacists - Medicines Optimisation | Medicines optimisation looks at the value which medicines deliver, making sure they are clinically-effective and cost-effective. It is about ensuring patients get the right choice of medicines, at the right time, and are engaged in the process by their clinical team. Medicines optimisation enables community pharmacies to request medication electronically from the Practice and view relevant information from your GP record in order to provide you with the best medicines. The source of the information shared in this way is your electronic GP record. Data Retention Period All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care. | The processing of personal data is permitted under the following GDPR and DPA conditions: GDPR Article 6(1) (e) - public interest or in the exercise of official authority; DPA Section 8 (d) - processing is necessary for the exercise of statutory functions; The processing of special categories of personal data concerning health is permitted under the following GDPR and DPA conditions: GDPR Article 9 (2) (h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services; DPA Section 10 (1) (c) – processing is necessary for health and social care purposes; In accordance with DPA Schedule 1, Part 1, (2) health or social care purposes means the purposes of preventive or occupational medicine; medical diagnosis; the provision of health care or treatment; the provision of social care, or the management of health care systems or services or social care systems or services. Related Legislation: Common Law of Duty of Confidentiality | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Local Authority – Social Services | Faversham Medical Practice works closely with Local Authorities to support and care for people of all ages to deliver the best possible social care. Personal data concerning your GP medical record may be shared with Local Authorities and Multidisciplinary Team (MDT) delivering social care in order to enable them make the best informed decision about your social care needs if required. The source of the information shared in this way is your electronic GP record. Data Retention Period All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care. | The processing of personal data is permitted under the following GDPR and DPA conditions: GDPR Article 6(1) (e) - public interest or in the exercise of official authority; DPA Section 8 (d) - processing is necessary for the exercise of statutory functions; The processing of special categories of personal data concerning health is permitted under the following GDPR and DPA conditions: GDPR Article 9 (2) (h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services; GDPR Article 9(2) (b) – processing necessary in the field of employment, social security and social protection law; In accordance with DPA Schedule 1, Part 1, (2) - health or social care purposes means the purposes of preventive or occupational medicine; medical diagnosis; the provision of health care or treatment; the provision of social care, or the management of health care systems or services or social care systems or services. In accordance with DPA Part 1, Schedule 1, (1a) the the processing for employment, social security and social protection is met where it is for the purposes of performing or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, social security or social protection; | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Care Homes | Personal data concerning your GP medical record may be shared with Care Homes and other Multidisciplinary Team (MDT) delivering care in order to enable their care professionals make the best informed decision about your care needs, and provide you with the best possible care if you visit a Care Home. The source of the information shared in this way is your electronic GP record. Data Retention Period All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care. | The processing of personal data is permitted under the following GDPR and DPA conditions: GDPR Article 6(1) (e) - public interest or in the exercise of official authority; DPA Section 8 (d) - processing is necessary for the exercise of statutory functions; The processing of special categories of personal data concerning health is permitted under the following GDPR and DPA conditions: GDPR Article 9 (2) (h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services; DPA Section 10 (1) (c) – processing is necessary for health and social care purposes; In accordance with DPA Schedule 1, Part 1, (2) -health or social care purposes means the purposes of preventive or occupational medicine; medical diagnosis; the provision of health care or treatment; the provision of social care, or the management of health care systems or services or social care systems or services. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Community Pharmacy BP monitoring | The NHS Community Pharmacist Consultation Service (CPCS) is a National Programme and was launched by NHS England and NHS Improvement on the 29 October 2019, to progress the integration of community pharmacy into local NHS urgent care services, providing more convenient treatment closer to patients’ homes If a patient presents at a GP Practice with a minor ailment which falls within the criteria for this service, the patient would be offered a GP CPCS referral and would need to consent to the referral. The patient would then state which Pharmacy they wish the consultation to take place at. The practice care navigator/receptionist/call handler will then generate the referral. The Data Retention Period The Standard Care Records retention period will be applied. All data is held in line with NHSE data retention guidelines | Within the General Data Protection Regulation (GDPR), Article 6 sets out the conditions for lawfully processing personal data and Article 9 sets out further conditions for processing special categories of personal data. As personal data concerning health is one of the special categories, organisations that process such data must be able to demonstrate they have met a condition in both Article 6 and Article 9. Under the GDPR, for processing personal data in the delivery of direct care, and for providers’ administrative purposes, the most appropriate Article 6 condition that is available to all public funded health and social care organisations is Article 6(1)(e): “Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller”. For work undertaken the relevant condition to rely on under Article 9 is (2)(h): “processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, provision of health or social care treatment.” (read with Schedule 1 paragraph 2 of the Data Protection Act). There is an obligation in s. 251B of the Health and Social Care Act 2012 to share information amongst relevant commissioners and providers for the purposes of direct care. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Kent & Medway Healthy.io Adherence as a Service - at home kidney test for patients with diabetes Kent & Medway GP Practices | Kent & Medway Healthy.io Adherence as a Service - at home kidney test for patients at risk of Chronic Kidney Disease. Healthy.io has been contracted by the NHS, via the Accelerated Access Collaborative, to provide an at home kidney test service for participating primary care practices. This project will enable Kent & Medway practices to identify patients at risk of chronic kidney disease through the offer of an at home kidney screening albumin to creatinine urinalysis test. It will also increase practice adherence with the urinary albumin test for diabetic patients, which is one of the 9 NICE recommended annual care processes. The Data Retention Period The Standard Care Records retention period will be applied. All data is held in line with NHSE data retention guidelines | Kent and Medway GP practices will instruct Healthy.io to contact individuals as part of their provision of care. Due to this, the lawful basis is as follows: Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (for processing under a public body contract); or As the Controllers are health and care organisations, the Article 9 exemption applying to the processing of special category data will be: Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services Schedule 1, Part 1(2) Health and Social Care Purposes, Data Protection Act 201 (2) (d) the provision of health care or treatment It is noted that the transfer of patient information to Healthy.io by the GP practice in order to involve the Albumin: Creatinine Ratio test in their treatment is compatible with the above lawful basis and consent is not required by the patient in order for this information to be shared. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Community Pharmacy Consultation Service Kent & Medway GP Practices | The NHS Community Pharmacist Consultation Service (CPCS) is a National Programme and was launched by NHS England and NHS Improvement on the 29 October 2019, to progress the integration of community pharmacy into local NHS urgent care services, providing more convenient treatment closer to patients’ homes If a patient presents at a GP Practice with a minor ailment which falls within the criteria for this service, the patient would be offered a GP CPCS referral and would need to consent to the referral. The patient would then state which Pharmacy they wish the consultation to take place at. The practice care navigator/receptionist/call handler will then generate the referral. The Data Retention Period The Standard Care Records retention period will be applied. All data is held in line with NHSE data retention guidelines | Within the General Data Protection Regulation (GDPR), Article 6 sets out the conditions for lawfully processing personal data and Article 9 sets out further conditions for processing special categories of personal data. As personal data concerning health is one of the special categories, organisations that process such data must be able to demonstrate they have met a condition in both Article 6 and Article 9. Under the GDPR, for processing personal data in the delivery of direct care, and for providers’ administrative purposes, the most appropriate Article 6 condition that is available to all public funded health and social care organisations is Article 6(1)(e): “Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller”. For work undertaken the relevant condition to rely on under Article 9 is (2)(h): “processing is necessary for the purposes of preventive or occupational medicine, medical diagnosis, provision of health or social care treatment.” (read with Schedule 1 paragraph 2 of the Data Protection Act). There is an obligation in s. 251B of the Health and Social Care Act 2012 to share information amongst relevant commissioners and providers for the purposes of direct care. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Kent & Medway Healthy.io Adherence as a Service - at home kidney test for patients with diabetes Kent & Medway GP Practices | Kent & Medway Healthy.io Adherence as a Service - at home kidney test for patients at risk of Chronic Kidney Disease. Healthy.io has been contracted by the NHS, via the Accelerated Access Collaborative, to provide an at home kidney test service for participating primary care practices. This project will enable Kent & Medway practices to identify patients at risk of chronic kidney disease through the offer of an at home kidney screening albumin to creatinine urinalysis test. It will also increase practice adherence with the urinary albumin test for diabetic patients, which is one of the 9 NICE recommended annual care processes. Healthy.io support Kent and Medway Primary Care Practices to identify and extract a list of patients that have a diagnosis of diabetes Type 1 or 2 or hypertension that have not had their urinary albumin screening test in the last 12 months as required by the practice as part of the patient’s care. The list is generated from the reporting functionality within the Practice’s own clinical system. | Kent and Medway GP practices will instruct Healthy.io to contact individuals as part of their provision of care. Due to this, the lawful basis is as follows: Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; (for processing under a public body contract); or As the Controllers are health and care organisations, the Article 9 exemption applying to the processing of special category data will be: Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services Schedule 1, Part 1(2) Health and Social Care Purposes, Data Protection Act 201 (2) (d) the provision of health care or treatment It is noted that the transfer of patient information to Healthy.io by the GP practice in order to involve the Albumin: Creatinine Ratio test in their treatment is compatible with the above lawful basis and consent is not required by the patient in order for this information to be shared. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Post COVID Assessment Service (PCAS) West Kent Federation | A post Covid assessment service is required for the Kent & Medway Integrated Care System covering a population of 1.9 million and encompassing the following Integrated Care Partnerships: • Dartford, Gravesham and Swanley • Medway and Swale • East Kent • West Kent In October 2020 NHSE and NHSI made a commitment to establish Post-Covid Assessment and Rehabilitation Service (PCAS) across England giving patients access to multi-professional advice. The multi-professional team will provide physical, cognitive, psychological and psychiatric assessments, as well as testing functional abilities, of those people experiencing suspected post-COVID syndrome, so that they can be referred to the right specialist help. The Data Retention Period Data Retention and Disposal Guidance is provided in the Information (Data) Governance Policy May 2021. Adult health records are retained for 8 years from the point of last consultation or discharge. Electronic records will be made inaccessible at the end of the retention period and paper records will be shredded and destroyed using confidential records destruction at the end of the retention period. | Initially, Health Service (Control of Patient Information (COPI)) Regulation 2002 will be relied upon. UK GDPR Article 6(1)(e) and Article 9(2)(b) However, as the Country emerges from lockdown and the service moves into business as usual the following lawful bases will be engaged. Article 6(1)(e) processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller Access to the information is to provide direct care Article 9 (2) (h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards Access to the information is to provide direct care The lawfulness of sharing/processing of Shared Personal Data set out in Article 6(1) (e) of the GDPR (as above) is also permitted under Section 8 (d) of DPA 2018: Processing is necessary for the exercise of statutory functions. Access to the information is to provide direct care. The lawfulness of sharing/processing Shared Personal Data set out in Article 9 (2) (h) of the GDPR (as above) is permitted under DPA Section 10 (health and social care purposes) Conditions relied upon for obligations of professional secrecy. For the purpose of Article 9 (2) (h) of the GDPR, Part 2, Schedule 1, DPA 2018(Health and Social Care purposes) is also engaged For the purposes of Article 9(2) (h) of the GDPR, the circumstances in which the processing of Shared Personal Data is carried out is subject to the conditions and safeguards referred to in Article 9(3) of the GDPR (obligation of professional secrecy). Therefore, in accordance with DPA Section 11(1), these include circumstances in which it is carried out – (a) by or under the responsibility of a health professional or a social work professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Collaborative Practice – Altogether Better Potentially all 196 Kent & Medway GP Practice although initially, the programme has been commissioned for 12 Practices. | Altogether Better are an NHS national network organisation who have developed a nationally recognised, evidence- based approach. They support GP practices to provide better healthcare by inviting patients to work alongside them as volunteer practice health champions to improve the health and well-being of their practice community. Altogether Better support, guide and mentor staff in general practice to invite and support a group of volunteer Practice Health Champions to work with the practice to create new ways for patients to access support that meets their health needs. Altogether Better have found that if practice’s reach out to their practice population via the use of their SMS/instant messaging system then the practice is much more likely to attract potential Practice Health Champions who do not regularly engage with the practice for their own health needs and who therefore would not be reached via posters in surgery or the practice’s social media. The Data Retention Period The data will be retained for the duration of the programme (approx. 1 year) NHS mail and digital files are deleted. | Under the GDPR, for processing personal data in the delivery of direct care, and for providers’ administrative purposes, the most appropriate Article 6 condition that is available to all public funded health and social care organisations is Article 6(1)(e): ‘Public Task’ “Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller”. For work undertaken by the ‘health champion’ is carried out subject to the conditions and safeguards of Obligation of Professional Secrecy Article 9 (3). There is an obligation in s. 251B of the Health and Social Care Act 2012 to share information amongst relevant commissioners and providers for the purposes of direct care. In terms of Health Champions providing direct care to the wider Practice patient population - Articles 6(1)(e) and Article and 9(3) together with Part 1(2) Schedule 1 DPA 2018 may apply Health Champions will be working under the direction of a Clinical Lead in each GP Practice. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Proxy Access – Implementation within care homes across Kent & Medway All GP practices across Kent and Medway and all care homes across Kent and Medway | Proxy access is a national directive from NHS England, where the plan is to roll out to all the care homes across England. We have been tasked with rolling it out to care homes across Kent and Medway. https://www.england.nhs.uk/ourwork/clinical-policy/ordering-medication-using-proxy-access/ - More information can be found about the project. This project uses current proxy functionality via GP online available to the general public when acting as proxy for relatives/friends via a website to access the GP clinical system EMIS. GP practices via GP online services can enable care home staff to order medications in the GP record for the resident’s care. Proxy access was developed to allow someone other than the patient to access and manage parts of their GP online services account. The proxy is given their own online access account (rather than using the patient’s login details). It is often used by the parents or recognised carers of young children, and recognised carers of adults. Staff have proxy access to patient medication records on EMIS GP system, which gives authorised access to order repeat medication on behalf of the resident The Data Retention Period Patient medication records are kept indefinitely in an electronic format in the GP practice. The recommendation is that care homes should keep medicines administration records for at least 8 years after the person’s care ended at the service. After 8 years, review the records. If they are no longer needed, destroy them in line with local policies. | Lawfulness of processing- Article 6 (1) (e) ‘…for the performance of a public task carried out in the public interest or in the exercise of official authority. • Processing of special categories of personal data Article 9 (2) (h) ‘…medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems’. • Sharing Personal Data is carried out subject to the conditions and safeguards of Obligation of Professional Secrecy Article 9 (3). • Sharing is done in accordance with DPA 2018 S.11 (1) by: - By or under the responsibility of a health professional or a social work professional, or - By another person who in the circumstances owes a duty of confidentiality | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
West Kent HCP Integrated Neighbourhood Working – Weald PCN – Mental Health MDT Howell Surgery Lamberhurst Surgery Marden Medical Centre Weald View Medical Practice/North Ridge Old Parsonage Surgery Old School Surgery Marden Medical Centre Orchard End Surgery Staplehurst Health Centre The Crane Surgery Yalding Surgery West Kent Health Limited Kent and Medway NHS Care and Social Partnership Trust Maidstone and Tunbridge Wells NHS Trust Kent County Council Change Grow Live (CGL) Live Well Kent (IAPT) Porchlight Kent Community Health NHS Foundation Trust We are with you IESO West Kent Mind SECAMB EMIS Clinical Services DOCMAN | This project is initially a 6-9-month pilot starting 1st January 2023, implementing a mental health MDT across practices that form the Weald PCN for frequent attenders of primary care who’s main presenting complaint is related to mental health. This is to provide a more personalised and joined up management of care to this group of patients by developing a multi-agency response informed by both mental health workers but also social care and community-based staff in the form of a Multi-Disciplinary Team meeting. The MDT will consist of core members such as: Mental Health Practitioner, Social Prescriber Link Worker, Mental Health GP, MDT Co-ordinator, Pharmacist, Primary Care Mental Health Team & Frequent Attender Team The Data Retention Period All data held will be either destroyed securely at the end of the contract or handed back to the data controller. Each GP Practice within The Weald PCN recognises that different record retention arrangements are needed in respect of retention and disposal schedules of Shared Personal Data. Therefore, each Party shall ensure it has a written policy and procedure for the archiving, retention and disposal of information in accordance with Records-management-code of practice 2021 All joint controllers , will store data on their systems and delete/destroy in compliance with the NHS records managements code of practice 2021 Paper records once uploaded to the digital records will be destroyed using a crosscut shredder or subcontracted to a confidential waste company that complies with European Standard EN15713 | Lawfulness of processing is based on the fulfilment of a legal obligation (Article 6(1)(c) UK GDPR) as detailed in the Health and Social Care Act 2012 s251(b) (as amended by the Health and Social Care (Safety and Quality) Act 2015 which created a statutory ‘duty to share’ information amongst relevant commissioners and providers for the purposes of direct care and commissioning. Processing is further carried out under the lawfulness conditions and the performance of a public task (Article 6(1)(e)) of the UK GDPR. the use is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller e.g. in order to provide healthcare services Article 9(2)(h) Direct Care and Administration: processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards. For the purpose of Article 9 (2) (h) of GPDR the circumstances in which the processing of shared personal data is carried out is subject to the conditions and safeguards referred to in article 9(3) of the GDPR (obligation of professional secrecy) there in accordance with DPA section 11(1) these include circumstances in which it is carried out - by or under the responsibility of a health professional or a social work professional or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law. The use is necessary for compliance with a legal obligation to which the WKPC is subject. the use is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller e.g. in order to provide healthcare services processing is necessary for reasons of public interest in the area of public health, such as ensuring high standards of quality and safety of health care | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Dementia Coordinators Service All GP Practices across Kent and Medway East Kent Age UK Herne Bay West Kent Alzheimer’s and Dementia Support Service NHS Social Care Partnership Trust Memory Assessment Service | The Dementia Coordinator programme has been jointly commissioned by Kent and Medway ICB and Kent County Council (KCC). Whilst the Service will be made available across Kent and Medway, it should be noted that Medway Council have not commissioned the Service. Principally, the aim is to establish Dementia Coordinators within the Specialist Dementia Support services. This is to create a model of care that proactively responds to ongoing care needs, has no service gaps enabling us to work collaboratively across our local health and care system. There will be added benefit in the model of coordination selected to support people pre and post diagnosis integrating with Primary Care Networks, pursuing a more rapid assessment process and reassuring GPs that there is a full supportive pathway of care for people following diagnosis. The Data Retention Period Data is stored electronically in clinically systems and deleted/destroyed in compliance with the NHS Record Management Code of Practice 2021.As Joint Controllers, providers will store data on their systems and delete/destroy in compliance with the NHS Record Management Code of Practice 2021. Paper records will be destroyed using a crosscut shredder or subcontracted to a confidential waste company that complies with European Standard EN15713. The Dementia Registers are held on GP EMIS systems, which will be updated by the Dementia Coordinators. | Article 6(1)(e) processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller Access to the information is to provide direct care Article 9 (2) (h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards Access to the information is to provide direct care The lawfulness of sharing/processing of Shared Personal Data set out in Article 6(1) (e) of the GDPR (as above) is also permitted under Section 8 (d) of DPA 2018: Processing is necessary for the exercise of statutory functions. Access to the information is to provide direct care. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
Targeted Lung Health Check NHS Kent and Medway East Kent Hospitals University NHS Foundation Trust St James Surgery Church Lane Surgery Pencester Surgery Sun Lane Balmoral Surgery St Richards Road Surgery White House Surgery Orchard House The New Surgery Guildhall Street Surgery The Cedars Surgery High Street Surgery Sandgate Road Peter Street Surgery Oak Hall Oaklands Health Centre Hawkinge And Elham Folkestone East Family Practice Aylesham Medical Practice Central Lydden Surgery Manor Clinic Church Road Pencester Health Martello Health Centre New Lyminge Surgery Manor Road Surgery Buckland Medical Practice White Cliffs Medical Centre Park Farm Sandwich Medical practice Harbour Medical Practice The New Surgery | The TLHC programme will identify those eligible for a Targeted Lung Health Check (55-74 years of age who have ever smoked) and invite them for a lung health check. This is done via a data extraction from GP Clinical system EMIS by Apollo Extraction to HISBI > EKHUFT extract and link to internal data If identified as high risk following the initial lung health check appointment conducted by a TLHC nurse, the patients will then be invited for a low dose CT scan. The only patient-level information that will be made available to East Kent Hospitals University NS Foundation Trust (EKHUFT), as lead provider for the programme, will be patient contact and demographic details, patient date of birth, NHS number, and smoking status (which is a QOF flag). Only members of the EKHUFT TLHC team will be able to access this patient-level information, and patient details will only be used for the purpose of inviting eligible participants to take part in this programme, and for the purpose of administrating the programme and subsequent recall. EKHUFT will also use the information to crosscheck whether the participant has had a CT scan within the previous twelve months, as per national eligibility criteria. Data Retention Period Data is stored electronically in clinically systems used by the Acute trusts including such as infoflex and PAS and deleted/destroyed in compliance with the NHS Record Management Code of Practice 2021. | Within the UK General Data Protection Regulation (GDPR), Article 6 sets out the conditions for lawfully processing personal data and Article 9 sets out further conditions for processing special categories of personal data. As personal data concerning health is one of the special categories, organisations that process such data must be able to demonstrate they have met a condition in both Article 6 and Article 9. The lawful basis under the UK General Data Protection Regulation will be: To support health and social care: • Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. and • Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...”; Schedule 1, Part 1 DPA 2018 supplementary condition Health or social care purposes 2(1)This condition is met if the processing is necessary for health or social care purposes. (2)In this paragraph “health or social care purposes” means the purposes of— (a)preventive or occupational medicine, and (d)the provision of health care or treatment, | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
eHUB Proof of Concept - Pilot Programme – eConsultation Room eHUB Proof of Concept - Pilot Programme – eConsultation Room | eHubs will enable GP practices to come together and create a centralised model for supporting the management of online consultations and remote monitoring at a practice / PCN level, known as a virtual online consultation hub (eHub) The aim for the eHubs will be to enable GP practices and NHS Trusts to come together and create a centralised model for supporting the management of: • Online Consultations • COVID Oximetry • Acute breathing difficulties: Children with RSV-like illnesses and adults What are eHubs? • eHubs coordinate remote monitoring services and support clinical decision making. • The eHub is a virtual ‘house’ enabled to support teams/networks of clinicians working in virtual ‘rooms’ to monitor patients including recognition, assessment and out-of-hospital monitoring. | Article 6(1)(e) processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller Access to the information is to provide direct care Article 9 (2) (h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards Access to the information is to provide direct care The lawfulness of sharing/processing of Shared Personal Data set out in Article 6(1) (e) of the GDPR (as above) is also permitted under Section 8 (d) of DPA 2018: Processing is necessary for the exercise of statutory functions. Access to the information is to provide direct care. The lawfulness of sharing/processing Shared Personal Data set out in Article 9 (2) (h) of the GDPR (as above) is permitted under DPA Section 10 (health and social care purposes) Conditions relied upon for obligations of professional secrecy. For the purpose of Article 9 (2) (h) of the GDPR, Part 2, Schedule 1, DPA 2018(Health and Social Care purposes) is also engaged For the purposes of Article 9(2) (h) of the GDPR, the circumstances in which the processing of Shared Personal Data is carried out is subject to the conditions and safeguards referred to in Article 9(3) of the GDPR (obligation of professional secrecy). Therefore, in accordance with DPA Section 11(1), these include circumstances in which it is carried out – (a) by or under the responsibility of a health professional or a social work professional, or (b) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
The Digitalisation of Lloyd George Records GP Practices Iron Mountain EMIS | This work forms part of a national NHSX acceleration programme to fully digitalise Lloyd George medical records (historic paper records). The provider will be determined through a procurement process supported by the NHSE regional team. The tender process will determine a range of suppliers who meet the minimum criteria to support the digitalisation of Lloyd George Medical Records. This will ensure the procurement is fit for purpose. This work follows an extensive audit of current Lloyd George storage situation across the primary care estate. Significant opportunities for repurposing the use of storage have been identified such as creating additional clinical rooms, admin rooms to support Practice and PCN development. A five-year framework for GP contract reform to implement The NHS Long Term Plan states that all patients will be able to have digital access to their full records from 2020 | 6(1)(e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. 9(2)(h) – Processing is necessary for the purposes of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of Union or Member State law or a contract with a health professional. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |
HCRG Care Group and GPs EMIS DGS GP Practices Swale GP Practices | The information sharing agreement has been drafted to support clinicians in sharing relevant and appropriate clinical information between the GP practices and Adult Community services within HCRG Care Group for the purposes of Direct Care, using the EMIS clinical information system. The GPs will sign up to the EMIS Configuration document which will be managed by the HCRG Care Group clinical systems team who will then complete the technical information sharing. The purpose of the sharing of information detailed in this agreement is: 1. To deliver health care to patients 2. Support services that are managed by HCRG Care Group & GP practices 3. To allow appropriate data sharing of care records through EMIS to EMIS HCRG Care Ltd Data Retention Period All data, whether held on paper or in electronic format must be stored and disposed of in line with each partner organisation’s retention and disposal schedule. Retention periods should be informed by the Records Management Code of Practice published on 4 August 2021 by the Information Governance Alliance (IGA). | Article 6(1)(e) – ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority’. Where special categories personal data is being processed for purposes related to the commissioning and provision of health and social care services the condition is: Article 9(2)(h) – ‘processing is necessary for the purposes of preventive or occupational medicine, for ... medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...’ HCRG Care Ltd, company number 5466033 registered in England and Wales at The Heath Business and Technical Park, Runcorn, Cheshire WA7 4QX Send any correspondence to the address at the top of this letter UK GDPR Article 6(1)(e) and Article 9(2)(h) is the lawful basis Yes Sharing for Safeguarding Purposes For the purposes of safeguarding vulnerable patients/service users, the Article 6(1)(e) and 9(2)(b) may apply. The Children Act 1989 (CA) establishes implied powers for local authorities to share information to safeguard children. Local authorities have a duty to investigate where a child is the subject of an emergency protection order, is in police protection or where there is reasonable cause to suspect that a child is suffering or is likely to suffer significant harm. The CA also requires local authorities ‘to safeguard and promote the welfare of children within their area who are in need’ and to request help from specified authorities including NHS organisation. These are required by the CA to comply ‘…with the request if it is compatible with their own statutory or other duties and obligations and does not unduly prejudice the discharge of any of their functions’. Under the Children Act 2004 local authorities must make arrangements to promote cooperation with relevant partners and others, to improve well-being. • Article 6(1)e – ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority’. Where special categories personal data is being processed for purposes related to the commissioning and provision of health and social care services the condition is: Article 9(2)(b) – ‘‘…is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of …social protection law in so far as it is authorised by Union or Member State law...’ UK GDPR Article 6(1)(e) and Article 9(2)(b) is the lawful basis Explicit consent is available as a lawful basis for processing special categories of data but is not normally use consent as a legal basis in a healthcare setting. | You have the right to: · To access, view or request copies of your personal information; · request rectification of any inaccuracy in your personal information; · restrict the processing of your personal information where: ü accuracy of the data is contested, ü the processing is unlawful or, ü where we no longer need the data for the purposes of the processing. Right to object: In line with the GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject. If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain: If you are dissatisfied with the way Faversham Medical Practice process your data, you have the right to appeal/complain to the Information Commissioner (IC). The IC can be contacted at: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire Tel: 0303 123 1113 or 01625 545 745 Email: https://ico.org.uk/global/contact-us/ |