GDPR 

General Data Protection Regulations (GDPR) 2018 (formerly Data Protection Act 1998)

All practice calls are recorded for training and monitoring purposes and will be stored in line with NHS guidance. 

Information about you and how we use it
When you come to the surgery, information about you, your medical treatment and family background may be recorded, on paper and computer, to help us care for you. The information is part of your health record and will be kept in case we need to see you again.  We hold demographic data (name, address, telephone numbers, date of birth, ethnic origin, family relationships, next of kin) and clinical data (diagnoses, family history, allergies and sensitivities, medication, consultation records, investigations, test results, referrals and letters to and from other NHS organisations about your care).  We can also have copies of any photographs sent to us that are for medical reasons.

Members of the clinical teams looking after you may share your personal health information with each other. This team may include healthcare professionals and support staff. All NHS staff are bound by law and a strict code of confidentiality, and are monitored by the Surgery's Caldicott Guardian, who is responsible for ensuring patients' confidentiality is respected. Your confidentiality is very important to us, and we have strict controls in place to protect your information.

You may be offered a remote consultation as an alternative to attending the practice in person. If you agree to a remote consultation the GP or healthcare professional may need to receive and store images taken by patients for clinical purposes; this could include images for the purpose of intimate clinical assessment.

This will only be done in the interests of the patient where it is necessary for providing health care and with patient consent. The approach to video consulting, image sharing, and storage is the same as it would be for face to face interactions. If we need to store images on your GP record this will be only for as long as necessary. It is a patient’s choice to share an image either of a patient’s own accord or on request of the health professional treating you. 

Refusal to share an image does not prevent access to care and treatment or result in patients receiving an inferior standard of care.

Further details about how remote consultation works can be obtained by contacting the practice

Your information rights
• You have the right to know how we will use your personal information.

• You have the right to see your health record (your medical notes). This is known as Right of Subject Access.

• You have the right to object to us making use of your information.

• You can ask us to change or restrict the way we use your information and we have to agree if possible.

• You have the right to ask for your information to be changed, blocked or erased if it is incorrect.

Change of Details
It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.

Accessing your Record
You have a right under the General Data Protection Regulations 2018 to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate

How your records are used to help you

Accurate, up-to-date information about you:
• helps staff to assess your health and care for you
• will help staff to treat you in future, in the surgery or elsewhere
• allows staff to monitor and if necessary investigate the care you have received

How your records help us
Accurate, up-to-date information about you:
• helps us provide high quality care and meet all our patients' needs
• helps us train healthcare professionals and support research and development
• is necessary for the surgery to be paid for your treatment
• supports audits of NHS services and accounts
• supports investigation of any incidents or issues that arise
• contributes to national NHS statistics.

Sharing your information
Sometimes we have to pass on information by law:
• to notify a birth or death
• when an infectious disease such as meningitis or measles may endanger the safety of others
• where a formal court order has been issued
• when sharing information with the police may prevent a serious crime, or prevent harm to you or other people.

We may have to share information about you with non-NHS staff (for example Social Services): we will only do this if it is necessary, and if we need your consent we will ask you for it. The main NHS organisations which may need your information are Clinical Commissioning Groups, Commissioning Support Units, other NHS trusts, hospitals, other GP practices and ambulance services. If we have to share information about you, we will remove your personal details where possible.

The Great North Care Record
Doctors, nurses and health professionals are working to improve the way patient information is securely shared within the North East and North Cumbria - improving the care you receive and helping NHS services to run more efficiently 

Happy to Share
If you would like us to be able to share your health record electronically with other NHS Services, like hospitals, community clinics or the district nurses, please complete the form available reception.
If you would like to see a short video of how this new service can improve your health care and save you time repeating your medical history

Statement of Intent
Summary Care Record (SCR)
Having your Summary Care Record (SCR) available will help anyone treating you who does not have immediate access to your full medical record (eg in an emergency or out-of-hours). If you do not want your medical records to be available in this way then you will need to let us know 

GP to GP record transfers
It is very important that you are registered with a doctor at all times. NHS England require practices to utilise the GP2GP facility for the transfer of patient records between practices when a patient registers or de-registers (not for temporary registration) 
Data for other purposes
It is already a requirement of the Health and Social Care Act that practices must meet the reasonable data requirements of commissioners and other health and social care organisations 

Notification
The General Data Protection Regulations 2018 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information. This information is publicly available on the Information Commissioners Office (ICO) website and the practice is registered with them.
Lawful basis for direct care and administrative purposes

All health and adult social care providers are subject to the statutory duty under section 251B of the Health and Social Care Act 2012 to share information about a patient for their direct care. This duty is subject to both the common law duty of confidence and currently the DPA98 (and in due course the DPA18 and GDPR).

For common law purposes, sharing information for direct care is on the basis of implied consent, which may also cover administrative purposes where the patient has been informed or it is otherwise within their reasonable expectations.
Under the GDPR, for processing personal data in the delivery of direct care, and for providers' administrative purposes, the Article 6 condition for lawful processing that applies to the surgery and all publicly funded health and social care organisations in the delivery of their functions is:

6(1)(e) for the performance of a task carried out in the public interest or in the exercise of official authority
Under the GDPR, personal data concerning health are special categories of personal data; the most appropriate Article 9 condition which applies to the surgery for direct care or administrative purposes is:
9(2)(h) medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

Data transferred outside the EU
The data we hold on you will not be transferred outside the EU. Should any future changes in the NHS mean that this is possible, we will seek you permission before transferring any of your information outside the EU.