Privacy Notice – GDPR

SCR coronavirus (COVID-19) supplementary privacy notice

Website: www.digital.nhs.uk

Purpose of the document

This Privacy Notice has been prepared to meet the requirements of the General Data Protection Regulation (GDPR) (EU) 2016/679.The Notice explains your rights to privacy and how we gather, use and share information about you.

Who we are

Gossoms End Surgery is a General Practice operated by Dr Ojo-Aromokudu; which has entered into a contract with NHS England to provide General Medical Services for patients. We are registered with the Information Commissioner’s Office; Registration Number Z9202092.

Who is the data subject?

This Privacy Notice applies to all those who are or have in the past been registered patients of the Practice; and patients using the services of the Practice as Temporary Residents, or for immediately necessary treatment.

Who is collecting the data?

Personal data is collected by our clinical staff (doctors, nurses and health care assistants), other clinicians working with in the Practice (such as the midwife or dietician), receptionists and administrative staff.

Data Controller

Dr Ojo-Aromokudu, is responsible for the processes of data collection and  processing within the practice.

Data Protection Officer

Barry Moult has been appointed Data Protection Officer.

What data is being collected?

• Data held by the practice includes:Name, address, NHS Number and phone number
• Medications
• Test results and investigations
• Correspondence between healthcare professionals involved in your care
• Clinical history
• Emergency department treatment
• Future and past appointments
• Health plans and alerts
• Mental health alerts and diagnoses
• Social care information
• Social care plan.

How will the information be used?

The use of personal information is integral to you receiving quality treatment and care. This will ensure:

• Safer and faster treatment
• Reduced duplication of tests and results
• Reduced delays to treatment
• Better informed clinical decision making

Will the data be shared with any third parties?

The people caring for you need to access about your health and care records in order to make the best decisions about your diagnosis, treatment and care. The organisations that could be involved in your care are:

• General Practice Surgeries
• Hospitals
• Community Services
• Out of Hours Services
• Ambulance Services

What is the legal basis for processing the data?

In the majority of situations, our legal basis for processing the data is defined in the Lawful Basis for Processing Health and Social Care information Direct Care and administration relating to care General Data Protection Regulation (GDPR) – Article 6 (1)e

• Necessary for the performance of a task carried out in the public interest or in the exercise of official authority

General Data Protection Regulation (GDPR) – Article 9 (2)h

• Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and  safeguards referred to in Article 9 – paragraph 3

Health and Social Care Act 2012

Safeguarding For the purposes of safeguarding children and vulnerable adults, the following Article 6 and 9 conditions may apply: General Data Protection Regulation (GDPR) – Article 6 (1)e

• Necessary for the performance of a task carried out in the public interest or in the exercise of official authority General Data Protection Regulation (GDPR) – Article 9(2)b
• Necessary for the purposes of carrying out the obligations and exercising the
  specific rights of the controller or of the data subject in the field of …social
  protection law in so far as it is authorised by Union or Member State law..’

How long will the data be stored?

All information exchanged/viewed /shared is stored securely for as long as we need for the purposes described, destruction of records is carried out as per to the IGA Records Retention Schedule.

Your rights

You have the right to object how we process your personal information. You have the right to access, correct and restrict the information we use. You can tell your care provider if you don’t want them to make your information available to any partners. Your record will be updated accordingly and no information will be available to access. You can change your mind about opting out at any time. Access to your information If you require a copy of your own information please contact the GP practice. Full details of your rights can be found on the Information Commissioner’s website ico.org.uk

Coronavirus (COVID-19) pandemic and your information

The ICO – ico.org.uk – recognises the unprecedented challenges the NHS and other health professionals are facing during the COVID-19 pandemic.

The ICO also recognise that ‘Public bodies may require additional collection and sharing of personal data to protect against serious threats to public health.’

The Government have also taken action in respect of this and on 20th March 2020 the Secretary of State for Health and Social Care issued a notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 requiring organisations such as GP Practices to use your information to help GP Practices and other healthcare organisations to respond to and deal with the COVID-19 pandemic.

Please note that this notice has now been revised and extended by a further notice from 29th July 2020 until 31st March 2021.

In order to look after your healthcare needs during this difficult time, we may urgently need to share your personal information, including medical records, with clinical and non clinical staff who belong to organisations that are permitted to use your information and need to use it to help deal with the COVID-19 pandemic. This could (amongst other measures) consist of either treating you or a member of your family and enable us and other healthcare organisations to monitor the disease, assess risk and manage the spread of the disease. Additionally, the use of your information is now required to support NHS Test and Trace.

Please be assured that we will only share information and health data that is necessary to meet yours and public healthcare needs.

The Secretary of State for Health and Social Care has also stated that these measures are temporary and will expire on 31st March 2021 unless a further extension is required. Any further extension will be will be provided in writing and we will communicate the same to you.

Please also note that the data protection and electronic communication laws do not stop us from sending public health messages to you, either by phone, text or email as these messages are not direct marketing.

It may also be necessary, where the latest technology allows us to do so, to use your information and health data to facilitate digital consultations and diagnoses and we will always do this with your security in mind.

If you are concerned about how your information is being used, please contact our DPO using the contact details provided in this Privacy Notice.

How can the data subject make an enquiry or raise a complaint?

An enquiry or complaint may be communicated in writing to the Data Protection Officer.
Barry Moult
Practice Manager
Gossoms End Surgery
Victory Road
Berkhamsted HP4 1DL

Patients also have the right to make a complaint to the Information Commissioner’s Office regarding breaches of confidentiality:

Population health management and Risk Stratification carried out by the Clinical Commissioning Group Herts Valleys CCG (HVCCG)