Feastfield Medical CentreTel: 01423 711369
The Grange Medical CentreTel: 01423 780436
Spring Gables Surgery Tel: 01423 770202
This privacy notice explains why Nidderdale Group Practice collects information about you, how we keep it safe and confidential and how that information may be used. To download as a document please click on the links below.
Adult Privacy Notice
Children's Privacy Notice
Being transparent and providing accessible information to patients about how we will use your personal information is a key element of the Data Protection Act 2018 and the EU General Data Protection Regulations (GDPR)
The following notice reminds you of your rights in respect of the above legislation and how your GP Practice will use your information for lawful purposes in order to deliver your care and the effective management of the local NHS system.
This notice reflects how we use information for:
Mr Paul Couldrey has been designated as the Data Protection Officer for the practice.
Postal: PCIG Consulting Limited, 7Westacre Drive, Quarry Bank, Dudley, West Midlands, DY5 2EE
As your registered GP practice, we are the 'Data Controller' for any personal data that we hold about you.
All personal data must be processed fairly and lawfully, whether it is received directly from you or from a third party in relation to your care.
We will collect the following types of information from you or about you from a third party (provider organisation) engaged in the deliver of your care:
Your healthcare records contain information about your health and any treatment or care you have received previously (e.g. from an acute hospital, GP surgery, community care provider, mental health care provider, walk-in-centre, social services). These records may ne electronic, a paper record or a mixture of both. We use a combination of technologies and working practices to ensure that we keep your information secure and confidential.
The NHS Act 2006 and the Health and Social Care Act 2012 invests statutory functions on GP Practices to promote and provide the health service in England, improve quality of services, reduce inequalities, conduct research, review performance of services and deliver education and training. To do this we will need to process your information in accordance with current data protection legislation to:
Your information will be collected either electronically using secure NHS mail or a secure electronic method transferred over an NHS encrypted network connection. In addition physical information will be sent to your practice. This information will be retained within your GP's electronic patient record or within your physical medical records.
In order to deliver and coordinate your health and social care, we may share the information with the following organisations:
Your information will only be shared if it is appropriate for the provision of your care or required to satisfy our statutory function and legal obligations.
Your information will not be transferred outside of the European Union
Whilst we might share your information with the above organisations, we may also receive information from them to ensure your medical records are kept up to date and so that your GP can provide the appropriate care.
In addition we receive data from NHS Digital (as directed by the department of Health) such as the uptake of flu vaccinations and disease prevalence in order to assist us to improve 'out of hospital care'.
We are committed to protecting your privacy and will only use information that has been collected lawfully. Every member of staff who works for an NHS organisation ahs legal obligation to keep information about you confidential. We maintain our duty of confidentiality by conducting annual training and awareness, ensuring access to personal data is limited to the appropriate staff and information is only shared with organisations and individuals that have a legitimate and legal basis for access.
Information is not held for longer than necessary. We will hold your information in accordance with the 'Records Management Code of Practice for Health and Social care 2016'.
The GDPR sets a high standard of consent. Consent means offering people genuine choice and control over how their data is used. When consent is used properly, it helps you build trust and enhance your reputation. However, consent is only one potential lawful basis for processing information. Therefore your GP practice may not need to seek your explicit consent for every instance of processing and sharing your information, on the condition that the processing is carried out in accordance with this notice. Your GP will contact you if they are required to share your information for any other purpose which is not mentioned in this notice. Your consent will be documented within your electronic patient record.
You have the right to write to withdraw your consent at any time for any particular instance of processing, provided consent is the legal basis for the processing. Please contact your GP Practice for further information and to raise your objection.
Health Risk Screening or Risk Stratification is a process that helps your GP to determine whether you are at risk of an unplanned admission or deterioration of health. By using selected information such as age,gender, NHS number, diagnosis, existing long term condition(s), medication history, patterns of hospital attendances, admissions and periods of access to community care, your GP will be able to judge if you are likely to need more support and care from time to time, or if the right services are in place to support the local population's needs.
To summarise Risk Stratification is used in the NHS to:
Your GP will use computer based algorithms or calculations to identify their registered patients who are at most risk, with support from the local Commissioning Support Unit (CSU) and/or a third party accredited Risk Stratification provider. The risk stratification contracts are arranged by Harrogate and Rural District Clinical Commissioning Group (CCG) in accordance with the current Section 251 agreement. Neither the CSU nor your local CCG will at any time have access to your personal or confidential data. They will only act on behalf of your GP to organise the risk stratification service with appropriate contractual technical and security measures in place.
Your GP will routinely conduct the risk stratification process outside of you GP appointment. This process is conducted electronically and without human intervention. The resulting report is then reviewed by a multidisciplinary team of staff within the practice. This may result in contact being made with you if alterations to the provision of your care are identified.
A Section 251 agreement is where the Secretary of State for Health and Social Care has granted permission for personal data to be used for the purposes of risk stratification, in acknowledgment that it would overburden the NHS to conduct manual reviews of all patient registers held by individual providers.
As mentioned above, you have a right to object to your information being used in this way. However you should be aware that your objection may have a negative impact on the timely and proactive provision of your direct care. Please contact the Practice Manager to discuss how disclosure of your personal data can be limited.
Electronic patient records are kept in most places where you receive healthcare. Our local electronic system (TPP - SystmOne) enables your record to be shared with organisations involved in your direct care, such as:
In addition, NHS England have implemented the Summary care Record which contains information including medication you are taking and any bad reactions to medication that you have had in the past.
In most cases, particularly for patients with complex conditions and care arrangements, the shared electronic health record plays a vital role in delivering the best care and a co-ordinated response, taking into account all aspects of a person's physical and mental health. Many patients are understandably not able to provide a full account of their care, or may not be in a position to do so. The shared record means patients do not have to repeat their medical history at every care setting.
Your record will be automatically be setup to be shared with the organisations listed above, however you have the right to ask your GP to disable this function or restrict access to specific elements of your record. This will mean that the information recorded by your GP will not be visible at any other care setting.
You can also reinstate your consent at any time by giving your permission to override your previous dissent.
If you have received treatment within the NHS, the local Commissioning Support Unit (CSU) may require access to your personal information to determine which Clinical Commissioning Group is responsible for payment for the treatment or procedures your have received. Information such as your name, address, date of treatment and associated treatment code may be passed onto the CSU to enable them to process the bill. These details are held in a secure environment and kept confidential. This information is only used to validate invoices in accordance with the current Section 251 agreement and will not be shared for any further commissioning purposes.
The Data protection Act and General Data Protection Regulations allows you to find out information is held about you including information held within your medical records, wither in electronic or physical format. This is known as the 'right of subject access'. if you would like to have access to all or part of your records, you make a request in writing to the organisation that you believe holds your information. This can be your GP, or a provider that is or has delivered your treatment and care. You should however be aware that some details within your health records may be exempt from disclosure, however this will be in the interests of your wellbeing or to protect the identity of a third party. if you would like access to your GP record please submit your request in writing to the surgery.
In the event that you feel your GP practice has not compiled with the current data protection legislation, either in responding to your request or in our general processing or your personal information, you should raise your concerns in the first instance in writing to:
Pat Berriman, Practice Manager, Nidderdale Group Practice, King Street, Pateley Bridge, Harrogate, HG3 5AT
If you remain dissatisfied with our response you can contact the
Information Commissioners Office at Wycliffe House, Water lane, Wilmslow, Cheshire SK9 5AF - Enquiry Line: 01625 545700 or online at www.ico.gov.uk
You have the right to get a copy of information that is held about you
This is known as a 'subject access request' (SAR)
If you do wish to make a subject access request then:
Please let us know what information you would like. We will provide the information within 28 calendar days. There will be no fee for the information provided except in certain circumstances.
Access to Medical Records (SAR) policy
We know people understand the importance of health and social care professionals having access to basic information about patients and the people they care for. This is especially important when care is urgent or required during the evenings or weekends. The information your GP holds if you share will save time and could also be life-saving in some circumstances.
Without sharing being available, people would need to wait for information to be sent from GPs during surgery hours, which could cause delay in providing treatment, care or medication.
If you are being treated by a service that uses SystmOne certain clinicians will be able to override your refusal to share either with your permission or, if you are unable to give your permission, because it would be in your best medical interests to do so. Any override of your sharing settings will be monitored to ensure that it is appropriate and done in the best interests of your care.
You can ask your GP to mark individual items on your record held at any service be marked as Private. When your full record is shared, the Private information will not be visible to any other service.
No.That is why we encourage you not to opt out of sharing. In these instances the only data they can see is basic demographic data such as your name date of birth, address and your registered GP practice name.
The SystmOne record includes details of your visits to your GP and includes Information about medications you are taking, any allergies you may have or details of Medication that hasn’t agreed with you in the past, details of any health conditions which mean you shouldn’t have certain medicines and any factors which need to be considered before discharging you from care.
For another NHS service using SystmOne to view your record they must first gain your consent to view and also they must have registered you under their care. If you give permission they will be able to see your full record except for any items you have asked your GP to mark as private.
No.Only NHS organisations directly caring for you and use the SystmOne clinical system have access to the SystmOne shared health record.
Pick up an opt-out form from your GP practice or download one from your GP Practice website. Once you have completed it return it to your practice who will record your preference in their computer system
Please contact your surgery if you are happy for your GP to share your medical details with other professionals if they are caring for you. However if you have previously opted of the National Summary Care record you will need to inform your GP practice that you would like to share your SystmOne health record.
Patients who have opted out of the National Summary Care record will be automatically opted out of Record sharing in SystmOne. You can opt in to sharing in SystmOne and remain opted out for the Summary Care Record or Vice Versa. Please speak with your GP practice if you wish to change your sharing preferences for either the Summary Care record or the SystmOne health record.
All computer Software systems used by the NHS have to conform to stringent national safety standards. This is the care records guarantee. The system itself runs on a secure NHS network which is separate from the internet so cannot be compromised from unauthorised access. For another service to view your record they have to be using the SystmOne clinical system. They also have to ask your permission to view your record. You also have to be registered for treatment with them. The staff using have to use a smartcard which looks like a credit/bank card and the chip on the card authorises them for a certain level of access so they can only see the level of detail required for them to carry out their job role. The system also has a tamper proof audit trail that details the name, time and date or any access and any data added, changed or deleted to ensure appropriate and safe use. Your GP practice would also be alerted when you receive care elsewhere – unless you have asked them not to disclose.
Sharing SystmOne Health Record Opt-Out form
We ask all our patients to provide us with their mobile phone numbers and their email address, if they have them and should they so wish.
We use your mobile phone number in two ways:
The texts we send are only ever related to your medical care - for example, an invitation for a check-up or immunisation, or if we need you to contact the surgery for a non urgent matter.
We do not use SMS messaging for direct marketing in any way.
If you would prefer us not to ring you on your mobile phone then please let us know and we will either not add your mobile phone number to your record, or remove any existing mobile phone number.
If you would prefer us not to send you SMS text messages - but you are happy for us to ring you on your mobile phone (when needed) - then please say so and will mark your record accordingly.
Currently we do not routinely email our patients.
There is a new Central NHS Computer System called the Summary Care Record (SCR). The Summary Care Record is meant to help emergency doctors and nurses help you when you contact them when the surgery is closed. Initially, it will contain just your medications and allergies.
Later on as the central NHS computer system develops, (known as the ‘Summary Care Record’ – SCR), other staff who work in the NHS will be able to access it along with information from hospitals, out of hours services, and specialists letters that may be added as well.
Your information will be extracted from practices such as ours and held on central NHS databases.
As with all new systems there are pros and cons to think about. When you speak to an emergency doctor you might overlook something that is important and if they have access to your medical record it might avoid mistakes or problems, although even then, you should be asked to give your consent each time a member of NHS Staff wishes to access your record, unless you are medically unable to do so.
On the other hand, you may have strong views about sharing your personal information and wish to keep your information at the level of this practice. Connecting for Health (CfH), the government agency responsible for the Summary Care Record have agreed with doctors’ leaders that new patients registering with this practice should be able to decide whether or not their information is uploaded to the Central NHS Computer System.
For existing patients it is different in that it is assumed that you want your record uploaded to the Central NHS Computer System unless you actively opt out.
For further information visit the Connecting for Health Website
If you choose to opt out of the scheme, then you will need to complete a form and bring it along to the surgery.
Information Governance ensures necessary safeguards for, and appropriate use of, patient and personal information. Key areas are information policy for health and social care, IG standards for systems and development of guidance for NHS and partner organisations.
Information Governance provides a framework to bring together all the legal rules, guidance and best practice that apply to the handling of information, allowing:
At its heart, Information Governance is about setting a high standard for the handling of information and giving organisations the tools to achieve that standard. The ultimate aim is to demonstrate that an organisation can be trusted to maintain the confidentiality and security of personal information, by helping individuals to practice good information governance and to be consistent in the way they handle personal and corporate information.
There are many different standards and legal rules that apply to information handling, including:
Due to the range and complexity of the standards and legal rules, the Deaprtment of Health has developed sets of information governance requirements, available in the IG Toolkit, which enable NHS and partner organisations to measure their compliance. The requirements cover all aspects of information governance including:
Information Governance ensures the appropriate use of information (both corporate and personal). All staff with access to NHS patient information undertake appropriate information governance training.
The CALDICOTT GUARDIAN for Nidderdale Group Practice is Dr John Hain
We are a Research Practice for the NHS Primary Care Research Network and participate in research studies. We believe it is important to be involved in research in primary care as it has a vital role in improving treatments for patients. If anything to do with the research would require that you provide additional information about yourself, you will be contacted to see if you are willing to take part; you will not be identified in any published results. If you would like to opt out of this data collection scheme, please let your doctor know and no data from your records will be collected for use in research. This will not affect your care in anyway.
Copyright 2006 - 2019 My Surgery Website | Privacy & Usage | Edit | Staff Home | Site Map | Accessibility | Site T&C's | Service T&C's