NHS Health Check Online Privacy Notice

Please click here to view.

Please click here to view.

Your health records contain a type of data called confidential patient
information. This data can be used to help with research and planning.
You can choose to stop your confidential patient information being used for
research and planning. You can also make a choice for someone else like your
children under the age of 13.
Your choice will only apply to the health and care system in England. This does
not apply to health or care services accessed in Scotland, Wales or Northern
Ireland.
WHAT IS CONFIDENTIAL PATIENT INFORMATION
Confidential patient information is when 2 types of information from your
health records are joined together.
The 2 types of information are:
 something that can identify you
 something about your health care or treatment
For example, your name joined with what medicine you take.
Identifiable information on its own is used by health and care services to
contact patients and this is not confidential patient information.
HOW WE USE YOU CONFIDENTIAL PATIENT INFORMATION:
Your individual care
Health and care staff may use your confidential patient information to help with
your treatment and care. For example, when you visit your GP they may look at
your records for important information about your health.
Research and planning
Confidential patient information might also be used to:
 plan and improve health and care services
 research and develop cures for serious illnesses
You can stop your confidential patient information being used for research and
planning. Find out how to make your choice.
If you’re happy with your confidential patient information being used for
research and planning you do not need to do anything. Any choice you make
will not impact your individual care.

SUMMARY CARE RECORD
All patients registered with a GP have a Summary Care Record, unless they
have chosen not to have one. The information held in your Summary Care
Record gives health and care professionals, away from your usual GP practice,
access to information to provide you with safer care, reduce the risk of
prescribing errors and improve your patient experience.

Your Summary Care Record contains basic information about allergies and
medications and any reactions that you have had to medication in the past.
Some patients, including many with long term health conditions, have
previously agreed to have Additional Information shared as part of their
Summary Care Record. This additional information includes information about
significant medical history (past and present), reasons for medications, care
plan information and immunisations.

The only people who might see your Summary Care Record are registered and
regulated healthcare professionals, for example doctors, nurses, paramedics,
pharmacists and staff working under their direct supervision. Your Summary
Care record will only be accessed so a healthcare professional can give you
individual care. Staff working for organisations that do not provide direct care
are not able to view your Summary Care Record.

When you are treated away from your usual doctor’s surgery, the health care
staff there can’t see your GP medical records. Looking at your SCR can speed
up your care and make sure you are given the right medicines and treatment.
Before accessing a Summary Care Record healthcare staff will always ask your
permission to view it, unless it is a medical emergency and you are unable to
give permission.

Opting out
Make your choice about sharing data from your health records – NHS
(www.nhs.uk)

The purpose of SCR is to improve the care that you receive, however, if you
don’t want to have an SCR you have the option to opt out. If this is your
preference please inform your GP or fill in an SCR patient consent preferences
form and return it to your GP practice.

Regardless of your past decisions about your Summary Care Record consent
preferences, you can change your mind at any time. You can choose any of the
following options:

1. To have a Summary Care Record with Additional Information shared.
This means that any authorised, registered and regulated health and
care professionals will be able to see a enriched Summary Care Record if
they need to provide you with direct care.

2. To have a Summary Care Record with core information only. This means
that any authorised, registered and regulated health and care
professionals will be able to see information about allergies and
medications only in your Summary Care Record if they need to provide
you with direct care.

3. To opt-out of having a Summary Care Record altogether. This means that
you do not want any information shared with other authorised,
registered and regulated health and care professionals involved in your
direct care, including in an emergency.

To make these changes, you should inform your GP practice or complete
the SCR patient consent preferences form and return it to your GP practice.
RESEARCH AND PLANNING

How confidential patient information is used

The NHS collects confidential patient information from:

 all NHS organisations, trusts and local authorities (including GP
surgeries)
 private organisations, such as private hospitals providing NHS funded
care
Research bodies and organisations can request access to this information. This
includes:
 university researchers
 hospital researchers
 medical royal colleges
 pharmaceutical companies researching new treatments
Who cannot use confidential patient information
Access to confidential patient information will not be given for:
 marketing purposes
 insurance purposes
(unless you request this)
Setting or changing an opt-out choice

The national data opt-out allows a patient to choose if they do not want their
confidential patient information to be used for purposes beyond their
individual care and treatment – for research and planning. Patients, or people
acting for them by proxy, have control over setting or changing their own optout choice, and can change their mind at any time. In most cases health and
care staff won’t be involved – but it’s helpful to understand how the process
works so you can tell patients where to find out more about their choices.
Read more about how patients can opt out, including special arrangements for
people in secure settings.

Find a range of resources you can use to inform patients about their opt-out
choice.

Which data disclosures do national data opt-outs apply to?
National data opt-outs apply to a disclosure when an organisation, for example
a research body, confirms they have approval from the Confidentiality Advisory
Group (CAG) for the disclosure of confidential patient information held by
another organisation responsible for the data (the data controller) such as an
NHS Trust.

The CAG approval is also known as a section 251 approval and refers to section
251 of the National Health Service Act 2006 and its current Regulations, the
Health Service (Control of Patient Information) Regulations 2002. The NHS Act
2006 and the Regulations enable the common law duty of confidentiality to be
temporarily lifted so that confidential patient information can be disclosed
without the data controller being in breach of the common law duty of
confidentiality.

In practice, this means that the organisation responsible for the information
(the data controller) can, if they wish, disclose the information to the data
applicant, for example a research body, without being in breach of the
common law duty of confidentiality. To be clear – it is only in these cases where
opt-outs apply.

In certain cases it has been agreed that the National Data Opt-Out should not
be applied to programmes which have section 251 approval. More information
on these can be found at paragraphs 7 and 8 below and a list of the programmes for which the NDOO should not be applied to is available. This list
is subject to change so please ensure you check the most up to date version.
The organisation requesting the data can also inform you that the National
Data Opt-Out does not apply.

Read more information about CAG and the section 251 approvals process on
the Health Research Authority (HRA) website.

3. Do you have explicit consent for the use or disclosure?
If a patient has agreed to a specific use of data, after being fully informed, then
the national data opt-out does not apply. Even patients who have registered a
national data opt-out can agree to take part in a specific research project or
clinical trial, by giving their explicit consent.

Read more in 6.1: Consent and 7.4: Consent for consent for more details on
consent and finding participants for research projects, in the operational policy
guidance document.

Declaring compliance
If you have worked out that the national data opt-out policy applies to your
change of use or disclosure of data, you need to apply national data opt-outs
by removing the records of anyone who has an opt-out registered before you
use or disclose the information.

Where a patient has a national data opt-out in place alongside any other form
of opt-out(s) the other opt-out(s) must still be applied in accordance with the
policy for each specific opt-out.

See 8: Applying the national data opt-out in the national data opt-out
operational policy guidance for more information.
Even if you have no current uses or disclosures that fall into scope, in order to
declare compliance you still need to amend your procedures to consider the
national data opt-out policy for future uses and disclosures.
Follow our compliance implementation guide to find out how to set up
the Check for national data opt-outs service, and to achieve and declare
compliance

Please see here for the consent form

Privacy Notice

What information do we collect about you?

We only collect the information (“data”) that we need to help us keep you healthy – such as your name, address, next of kin, records of appointments, visits, telephone calls, your health record, treatment and medicines, test results, X-rays and any other information to enable us to care for you.

How do we use your information?

• • We share your medical records with other health professionals who are involved in providing you with care and treatment. This is only ever on a need-to-know basis and event by event.

• • Some of your data is automatically copied to the Shared Care Summary Record.

• • We share some of your data with local out-of-hours provider

• • Data about you is used to manage national screening campaigns such as flu, cervical cytology and diabetes prevention.

• • Your data about you is used to manage the NHS and make payments.

• • We share information when the law requires us to, for instance when we are inspected or reporting certain illnesses or safeguarding vulnerable people

• • Your data is used to check the quality of care provided by the NHS.

• • We may also share medical records for medical research

Enhanced Access Privacy Notice

Streatham PCN is made up of a number of GP Practices and has been created for members practices to work collaboratively to deliver the requirements of the PCN Directed Enhanced Service Contract.

The following practices are part of Streatham PCN:

• • Palace Road Surgery

• • Streatham Hill Group Practice

• • Valley Road Surgery

• • The Exchange Surgery

• • Streatham Common Practice

• • The Vale Surgery

As part of the PCN DES service, we are required to provide Enhanced Access to patients registered with practices in the PCN. Enhanced Access is patient appointments outside core practice hours – that is between 6.30-8.00 pm on weekdays, and on Saturdays 9.00 am till 5.00pm. We have chosen to also offer some appointments between 7.00 am-8.00 am on weekdays. We have also chosen to subcontract some of the provision of these appointments to our local GP federation (Lambeth GP Federation), who have previously provided access hubs in the area.

The Enhanced Access service for our patients requires the following:

• An interoperable Clinical IT solution and
• Data Sharing between the PCN practices and the GP Federation

To enable us to provide our Enhanced Access Service to you, clinicians from other practices in our PCN and working for our local Federation will at times have access to your full GP record, but only when providing direct care to you.

People who have access to your information will only normally have access to information that they need to fulfil their roles. For example, admin staff will normally only see your name, address, contact details, appointment history and registration details in order to book appointments; the practice nurses will normally have access to your immunisation, treatment, significant active and important past histories, your allergies and relevant recent contacts whilst any GP you see or speak to will normally have access to everything in your record.

1. Controller Contact Details

The controller of your data when it is in your practice clinical record is:

Operations Manager

Anushia Seevaratnam
Palace Road Surgery,
1 Palace Road,
Streatham Hill,
London,
SW2 3DY

The controller of your data when it is in the GP Federation clinical record system is Lambeth GP Federation, 1 Alleyn Park, London, SE21 8AU.

2. Data Protection Officer Contact Details

John Eni-Uwubame, GP Data Protection Officer, gpdpo@selondonics.nhs.uk

3. Purpose of the Processing

To provide our patients with direct care.

4. The Lawfulness Conditions and Special Categories

The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR:

• Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.
• Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”.

5. Recipient or Categories of Recipients of the Shared Data

• Palace Road Surgery
• Streatham Hill Group Practice
• Valley Road Surgery
• The Exchange Surgery
• Streatham Common Practice
• The Vale Surgery
• Lambeth GP Federation

6. Rights to Object

You have the right under Article 21 of the GDPR to object to your personal information being processed. Please contact the Practice if you wish to object to the processing of your data. You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance.

GP Practices process personal data under Article 6(1)(c) on a lawful and legitimate basis where the organisation is obliged under law to comply with:

• The General Data Protection Regulations (GDPR)
• The Freedom of Information Act
• The NHS Constitution
• The Local Authority Social Services and National Health Service Complaints (England) Regulations 2009

By complying with these laws, the Practice has compelling legitimate grounds for the processing which override the interests, rights and freedoms in the right to object.

7. Right to Access and Correct

Under GDPR and the Data Protection Act 2018, you have the right to see or be given a copy of any personal data we hold about you. To gain access to a copy of your information, you will need to make a Subject Access Request (SAR) to the Practice you are normally registered with.

You also have the right to have incorrect data held about you corrected.

8. Retention Period

The data will be retained for the period as specified in the national NHS records retention schedule.

9. Right to Complain

You have the right to complain to the Information Commissioner’s Office or call their helpline on 0303 123 1113 (local rate) or 01625 545 745 (national rate).

The NHS App

We use the NHS Account Messaging Service provided by NHS England to send you messages relating to your health and care. You need to be an NHS App user to receive these messages. Further information about the service can be found at the privacy notice for the NHS App managed by NHS England.

Data Provision Notices

NHS Digital has powers, under sections 259(1)(a) and 259(1)(b) of the 2012 Health and Social Care Act 2012, which requires health and social care bodies in England to provide NHS England with certain datasets.

The DPN makes it clear whether an organisation is legally required to supply the data or is being requested to do so only.

In either case, when data is provided in response to a requirement or a request made under section 259, the data can be supplied without breaching the common law duty of confidentiality.

For more information about Dara Provision Notices, please see https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/data-provision-notices-dpns

COVID-19 Public Health Directions 2020

NHS England established the OpenSAFELY service Trusted Research Environment (TRE). It supports the use of data for COVID-19 purposes only including research, clinical audit, service evaluation and health surveillance.

NHS England has been directed by the Government to establish and operate the OpenSAFELY service. This service provides a Trusted Research Environment that supports COVID-19 research and analysis.

Each GP practice remains the controller of its own patient data but is required to let researchers run queries on pseudonymised patient data. This means identifiers are removed and replaced with a pseudonym, through OpenSAFELY.

Only researchers approved by NHS England are allowed to run these queries and they will not be able to access information that directly or indirectly identifies individuals.

Our practice has been designed to accommodate disabled access. If you need assistance or experience difficulties climbing stairs, please inform reception when you book your appointment and arrangements will be made to assist you. The surgery has a ramp for wheelchair access and toilet facilities for disabled people and there is a hearing loop available at reception.

Our practice is a designated training practice. You may be offered a consultation with a GP registrar who is a qualified doctor that spends a year at the practice following their foundation training.

The registrar works closely with our approved GP trainers. We are also a research practice and can be called at times to provide names and addresses of patients with certain illnesses under our studies.

You may receive a letter asking if you would like to participate. In these circumstances, a researcher is allowed to access relevant records in order to gain such a list of approval to carry out research.

Being a patient attending a busy GP practice can be anxious and worrying time for you. We aim to make your time here as short and as simple as possible. The following should help to explain what you, as a patient can expect from our staff and what we, the staff can expect from you.

Your doctor’s responsibilities:

• To treat you with respect and courtesy at all times.
• To treat you as an individual, and to discuss with you the care and treatment we can provide.
• To give you full information on the services we offer.
• To give you the most appropriate care by suitably qualified staff.
• To provide you with emergency care when you need it.
• To refer you to a suitable consultant when necessary.
• To give you access to your health records, subject to any limitations in the law.

Your responsibilities as a patient:

• To treat all staff with respect and courtesy at all times.
• To tell us if you are unsure about the treatment we are offering you.
• To ask for a home visit, only when you are unable to attend the practice through illness or infirmity.
• To request such a visit if at all possible before 10:00.
• To ask for an out-of-hours visit only when necessary.
• To keep your appointments and contact the practice in advance if you cannot attend.

All GP practices are required to declare the mean earnings (e.g. average pay) for GPs working to deliver NHS services to patients at each practice.

The average pay for GPs working in Palace Road Surgery in the last financial year was £64,854.00 before tax and national insurance. This is for 2 full time GPs, 1 part time GP and 2 locum GP who worked in the practice for more than 6 months.

It should be noted that the prescribed method for calculating earnings is potentially misleading because it takes no account of how much time doctors spend working in the practice, and should not be used to from any judgement about GP earnings, nor to make any comparison with any other practice.