Privacy Notice

A full copy of our Practice Privacy Notice can be found here.

Key information

This organisation is lawfully required to provide you with the following information about how we handle your information:

Data Controller

Market Surgery

Data Protection Officer

Caroline Million caroline.million@outlook.com

Purpose of the processing

To give direct health or social care to individual patients. An example is, when a patient agrees to a referral for direct care, such as to a hospital, relevant information about the patient will be shared with the other healthcare staff to enable them to give appropriate advice, investigations, treatments and/or care.

To check and review the quality of care. This is called audit and clinical governance.

Medical research and to check the quality of care which is given to patients. This is called national clinical audit.

Lawful basis for processing

These purposes are supported under the following sections of the GDPR:

Article 6(1)(c) ‘…necessary for compliance with a legal obligation to which the controller is subject’; and

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’; and

Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”

The following sections of the GDPR mean that we can use medical records for research and to check the quality of care (national clinical audits):

Article 6(1)(e) – ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.

For medical research: there are two possible Article 9 conditions.

Article 9(2)(j) – ‘processing is necessary for… scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member States law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject’.

Common law duty of confidence and the Caldicott Principles

Healthcare staff will also respect and comply with their obligations under the common law duty of confidence and in accordance with the eight Caldicott Principles:

1. Information is used only when necessary

2. Information is used only when necessary for a specified purpose

3. Information is used when necessary but only the minimum necessary is used

4. Access is limited to those who need it

5. Everyone with access understands their responsibilities

6. Compliance with the law is understood and complied with

7. The duty to share information for individual care is as important as the duty to protect confidentiality

8. Information is used in ways that people can understand and reasonable expectations are met

The Caldicott Principles apply to confidential information used within health and social care and when information is shared between organisations. This organisation will also consider the Caldicott Principles when deciding whether information is shared between other healthcare organisations.

Recipient or categories of recipients of the processed data

The data will be shared with:

● healthcare professionals and staff in this surgery

● local hospitals

● out of hours services

● diagnostic and treatment centres

● ther organisations involved in the provision of direct care to individual patients.

● GPs

● NHS Commissioning Support Units

● Independent Contractors such as dentists, opticians, pharmacists

● Private Sector Providers

● Voluntary Sector Providers

● Ambulance Trusts

● Clinical Commissioning Groups / Integrated Care Boards

● Social Care Services

● NHS England (NHSE) and NHS Digital (NHSD)

● Local Authorities

● Education Services

● Fire and Rescue Services

● Police & Judicial Services

● Voluntary Sector Providers

● Private Sector Providers

● Connect Healthcare Rotherham

Other ‘data processors’ which you will be informed of

● TPP SystmOne

● Numed Healthcare

● Eclipse Healthcare

● Accurx

● C The Signs

● World Healthnet

● Express Diagnostics

● IGPR

● INR Star

● Tandem Health (Accurx Scribe)

For national clinical audits that check the quality of care, the data will be shared with NHS England.

Rights to object and the national data opt-out

You have the right to object to information being shared between those who are providing you with direct care. This may affect the care you receive – please speak to the organisation. You are not able to object to your name, address and other demographic information being sent to NHS England. This is necessary if you wish to be registered to receive NHS care.

You are not able to object when information is legitimately shared for safeguarding reasons. In appropriate circumstances, it is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm. The information will be shared with the local safeguarding service.

The national data opt-out model provides an easy way for you to opt-out of information that identifies you being used or shared for medical research purposes and quality checking or audit purposes.

Please contact the organisation if you wish to opt-out.

Guidance is available from NHS England’s webpage titled National Data Opt-Out.

Right to access and correct

You have the right to access your medical record and have any errors or mistakes corrected. Please speak to a member of staff or look at our Access to Medical Records Policy.

We are not aware of any circumstances in which you will have the right to delete correct information from your medical record although you are free to obtain your own legal advice if you believe there is no lawful purpose for which we hold the information and contact us if you hold a different view.

Retention period

Records will be kept in line with the law and national guidance. Information on how long records are kept for can be found in the NHS England guidance titled Records Management Code of Practice.

Right to complain

In the unlikely event that you are unhappy with any element of our data processing methods, do please contact the Practice Manager in the first instance. If you feel that we have not addressed your concern appropriately, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) or, as for other types of level 2 complaints, alternatively you may wish to escalate your complaint to the Parliamentary and Health Service Ombudsman.

For further details, visit the ICO webpage titled For the public and select “Make a complaint” or select the Live Chat option, or telephone: 0303 123 1113.

Data we get from other organisations

We receive information about your health from other organisations that are involved in providing you with health and social care. For example, if you go to hospital for treatment or an operation the hospital will send us a letter to let us know what has happened. This means your GP medical record is kept up to date when you receive care from other parts of the health service.

Patient Requests (Accurx)