Privacy Notice: Full Notice

We understand how important it is to keep your personal information safe and secure and we take this very seriously. We have taken steps to make sure your personal information is looked after in the best possible way and we review this regularly.

Please read this privacy notice (‘Privacy Notice’) carefully, as it contains important information about how we use the personal and healthcare information we collect on your behalf.

Why is a privacy notice needed?

The new General Data Protection Regulation (GDPR) requires The Village Surgery (the surgery) to ensure that our patients and employees are aware of what personal information we hold on them, how we collect that data, how we keep it safe and how we may use it.

We are required to provide you with this Privacy Notice by Law. It explains how we use the personal and healthcare information we collect, store and hold about you. If, after reading this, you have any questions about this Privacy Notice or any other issue regarding information about your personal data or healthcare, please contact our Data Protection Officer via the practice (details below).

Practice contact details

The Data Protection Officer for the Surgery is Barry Mount. He oversees our GDPR team (Dr Sheetal Purohit our practice manager Anita Mixides and our assistant practice manager Elaine Pope). They are also supported in turn by the Information Governance team at Central East Integrated Care Board.

You can contact the Data Protection officer or our GDPR team at The Village Surgery on 01582 712021 if:

• You have any questions about how your information is being held
• If you require access to your information or if you wish to make a change to your information
• If you wish to make a complaint about anything to do with the personal and healthcare information we hold about you
• You have any other query relating to this Policy and your rights as a patient.

The Data Controller: 

The Village Surgery
Amenbury Lane
Harpenden
Hertfordshire
AL5 2BT

This means we, as a practice, are responsible for collecting, storing and handling your personal and healthcare information when you register with us as a patient.

There may be times where we also process your information. That means we use it for a particular purpose and, therefore, on those occasions we may also be Data Processors. The purposes for which we use your information are set out in this Privacy Notice.

Information we collect from you

The information we collect from you will include:

• Your contact details (such as your name and email address, telephone numbers including place of work and work contact details)
• Details and contact numbers of your next of kin
• Your age range, gender, ethnicity
• Details in relation to your medical history
• The reason for your visit to the surgery
• Medical notes and details of diagnoses, consultations with our practice team members or other health professionals within the surgery who are involved in your direct care
• Results of investigations such as laboratory tests, xrays etc
• Any contact the surgery has had with you such as appointments, clinic visits, immunisations, emergency appointments, telephone consultations etc

Information we collect about you from others

• Relevant information from other health professionals, relatives or those involved in your direct care
• Occasionally information regarding immigration matters, court orders etc

Why do we need information from you?

We need to collect and process your information in order to:

• be able to provide you with direct health or social care
• be able to monitor the safety and quality of care that is provided
• be able to detect diseases early
• be able to comply with legal obligations

The GDPR specifies the reasons we can lawfully process your data in different situations. For more detailed information on this, please see “Legal justification for collecting and using your information” section below. If this doesn’t answer your questions, please contact our Data Protection officer or GDPR team.

How we keep your information confidential and safe

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential. We will only ever use or pass on information about you if others involved in your care have a genuine need for it.

NHS health records may be electronic, on paper or a mixture of both. Our GP records database is hosted by EMIS Health Ltd, who is acting as a data processor. All information is stored on their secure servers, is protected by appropriate security, and access is restricted to authorised personnel.

We also make sure that data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.

We only text you regarding matters of medical care, such as appointment reminders and (where appropriate), test results.

How we use information about you, and why

Direct care

Confidential patient data will be shared within the healthcare team at the practice, including nursing staff, administration staff, secretaries and receptionists. This is necessary to allow us to facilitate the best possible care for you. These individuals have a professional and contractual duty of confidentiality.

We may pass your personal information on to the following people or organisations, because they may require your information to assist them in the provision of your direct healthcare needs. It may be important for them to be able to access your information in order to ensure they can properly deliver their services to you:

• Hospital professionals (such as doctors, consultants, nurses)
• Other GPs/Doctors
• Pharmacists, dentists, opticians
• Nurses and other healthcare professionals including mental health professionals
• Ambulance services
• Any other person that is involved in providing services related to your general healthcare.

Mandatory disclosure of information

We may also share your information with the following organisations, where there is a legal basis, to help with planning services, improving care, research into developing new treatments and preventing illness. Sometimes, we have a legal obligation to provide information, usually to protect people from risk of harm. In all circumstances the minimum identifiable data that is essential to serve that legal purpose will be disclosed.

• Police and/or the courts – often to keep people safe and protect them from harm
• Local authorities including social services – often to protect people from risk of harm
• NHS Digital – a national body which has legal responsibilities to collect information about health and social care services to help plan and improve services. The Village Surgery will continue to support vital health and care planning and research by sharing your data with NHS Digital. For more information about the changes planned for existing data sharing activities (from 1st September 2021), see the GP Practice Privacy Notice for General Practice Data for Planning and Research (opens in a new tab).
• Public Health England - responsible for local and national disease monitoring, and for national screening programmes (for early disease detection)
• Commissioners eg Care Quality Commission (CQC) – ensures safe care is provided.
• Clinical Commissioning Groups (CCG) –helps plan and fund local healthcare services. The clinical commissioning group at times extracts medical information about you, but the information we pass to them via our computer systems cannot identify you to them. This information only refers to you by way of a code that only your practice can identify (it is pseudo-anonymised). This therefore protects you from anyone who may have access to this information at the Clinical Commissioning Group from ever identifying you as a result of seeing the medical information and we will never give them the information that would enable them to do this. There are good reasons why the Clinical commissioning Group may require this pseudo-anonymised information, for example: Flu vaccination uptake, Extended Access, Commissioned Services, Federation Services, Medicines Management (Review of prescribedmedicines), Childhood Immunisations, Risk stratification (such as hospital admission prevention)
• Immigration enforcement
• DVLA
• General Medical Council
• HMRC
• NHS Counter fraud
• Health service Ombudsmen

Explicit consent disclosures

Once you have given your explicit consent, The Village Surgery can release information about you from your GP record, to relevant organisations. These may include:

• Your employer
• Insurance companies
• Solicitors
• Local authorities
• Police

Please note, if you give another person or organisation consent to access your record we will need to contact you to verify your consent before we release that record. It is important that you are clear and understand how much and what aspects of, your record you give consent to be disclosed.

External companies

We may also use external companies to process personal information, such as for sending you text messages and completing dictation of referral letters. These companies are bound by contractual agreements to ensure information is kept confidential and secure. These companies include:

• EMIS Health (suppliers of the clinical system that supplies your data)
• EMIS Patient Access (suppliers of the online system that allows prescription requests and online booking of appointments)
• EMIS Online Consult (Collaboration between Emis health and Egton Digital to direct you to relevant online information, and allow online communication with your surgery)
• Mjog and Accurix (suppliers of texting services allowing direct contact with your mobile phone; Accurix also allows video contact with your mobile phone)
• Lexacom (software that allows us to dictate letters to other healthcare providers electronically)
• Electronic referral system (Intergrated software that allows us to process referrals)

Case finding and profiling

• Eclipse Live - Risk stratification tool

Sometimes your information will be used to identify whether you need particular support from us. Those involved in your care might look at particular ‘indicators’ (such as particular conditions) and contact you or take action for healthcare purposes.

For example, this might be to prevent you from having to visit accident and emergency by supporting you in your own home or in the community. We will use automated technology to help us to identify people that might require support but ultimately, the decision about how or whether to provide extra support you is made by those involved in your care. Our Data Protection Officer will be happy to speak to you about this if you have concerns or objections.

Data sharing schemes

A number of data- sharing schemes are active, enabling healthcare professionals outside of the surgery to view information from your GP record should the need arise.

• National Summary Care Record (SCR) - The SCR is a national scheme. It is an electronic record of your healthcare history and other relevant personal information, created from GP medical records and held on a national healthcare records database provided and facilitated by NHS England. It can be seen and used by authorised staff in other areas of the health and care system involved in the patient's direct care.
• Extended Access, Covid Hot hub and Covid vaccination centre– Extended access services provide you with access to medical services for routine problems outside of normal working hours. The Covid Hot hub has been set up for assessment of patients in our area with suspected Coronavirus. For both of these services, we work with local practices and offer appointments from a central “Hub”. In order to be able to provide you with high-quality routine care, the hosting “Hub” practitioner will need access to your medical record. If you use this service, you will be asked for your explicit consent to allow access to your records in this situation. Please note to ensure that those practices comply with the law and to protect the use of your information, we have very robust data sharing agreements and other clear arrangements in place to ensure your data is always protected and used for those purposes only.

The Covid Hot hub is currently in Hemel Hempstead and overseen by Dacorum Healthcare.

The Covid Vaccination centre will run out of Harpenden Public Halls, and is being set up and run by Harpenden Health PCN which consists of the three Harpenden surgeries. This service will use secure IT systems (Pinnacle and Accubook) to ensure your vaccinations are safely booked and recorded. Volunteers, bound by confidentiality agreements, will be helping to run the vaccination centres.

• Adastra Web Access - used by GP out-of-hours locally

Primary Care Network (PCN)

We are a member of Harpenden Health Primary Care Network (PCN). This means we will be working closely with a number of other GP Practices and health and care organisations to provide healthcare services to you. No health data is automatically shared. Patient records remain with the practice that the patient is registered with, the record would only be accessed by another practice if the patient has booked and agreed an extended access appointment or clinical services delivered in a GP Practice, the patient is advised of this at the time of accepting the appointment

Other Practices in our PCN are:

• The Elms Surgery
• Davenport House Surgery

My Care Record

My Care Record enables health and care professionals to access the information they need to look after you, even if they work for different organisations or in different locations.

The Village Surgery is part of My Care Record, an approach to improving care by joining up health and care information. Health and care professionals from other services will be able to view information from the records we hold about you when it is needed for your care. Please see My Care Record website (opens in a new tab) for more information.

For further information please access the website My Care Record - Home (opens in a new tab) or contact the practice.

Integrated Care Systems (ICS)

As the country moves to an integrated care system based on geographical areas (East & North Herts, Herts Valleys and West Essex) Information may be available to other care providers in order to provide safe, effective and cost efficient care. Robust training, policies, procedures, controls, audits and technical measures will be in place to safeguard against inappropriate access and disclosure.

COVID

The Secretary of State for Health and Social Care issued a Notice under Regulation 3(4) of The Health Service (Control of Patient Information) Regulations 2002 requiring organisations such as GP Practices to use your information to help GP Practices and other healthcare organisations to respond to and deal with the COVID-19 pandemic. These measures are temporary and will expire on 30th September 2021 unless a further extension is required

Research

Sometimes your information may be requested for use in research. The Village Surgery will only take part in accredited research projects and your explicit consent would always be sought before accessing or sharing any patient identifiable data.

Teaching and training

As a training practice, you may be booked an appointment with one of our trainee GPs or junior doctors. Towards the end of their training, these trainees need to submit examples of their consultations for assessment. You may be asked if you would be happy for your consultation to be recorded. Your explicit consent will always be sought for this and you are under no obligation to say yes. Your recorded consultation would be stored securely and only able to be viewed by the trainee, their educational supervisor and their assigned examiner before being permanently deleted.

Audit and healthcare planning/risk stratification

Whenever you use a healthcare service, such as attending Accident & Emergency or using Community Care Services, important information about you is collected to help ensure you get the best possible care and treatment. This information may be passed to other approved organisations where there is a legal basis, to help with planning services, improving care, research into developing new treatments and preventing illness. All of this helps in proving better care to you and your family and future generations. Confidential information about your health and care is only used in this way where allowed by law and would never be used for any other purpose without your clear and explicit consent.

The surgery may use your clinical information to conduct internal clinical audits. These allow us to monitor and improve the quality of the service we provide. All information is collated anonymously and is not shared with outside agencies.

Risk stratification tools are increasingly used in the NHS to help determine a person’s risk of suffering a particular condition, preventing an unplanned admission or identifying the need for intervention. Information about you is collated and analysed and a score is calculated using software managed by EMIS Health. Only the result is provided to your GP in an identifiable form. These tools allow us to help prevent ill health.

Anonymised information

Sometimes we may provide information about you in an anonymised form. If we do so, then none of the information we provide to any other party will identify you as an individual and cannot be traced back to you.

Your right to opt-out of us sharing your information

You have the right to opt-out (or object) to ways in which your information is shared, both for direct medical care purposes (such as National Summary Care Record, My Care Record), or for purposes other than your direct medical care (e.g. medical research). If you wish to opt out of any data sharing process, please contact our GDPR team.
(opens in a new tab)

For details on the National Data opt out scheme (which applies to uses of your confidential medical information for secondary purposes, that is unrelated to, and beyond, the direct medical care that GP surgeries and other healthcare organisations provide you with when you are unwell, or to keep you well. Secondary purposes include healthcare planning, audit, population analytics, “risk stratification”, research, "commissioning", commercial and even political uses) please see these links:

• NHS – Your NHS Data Matters (opens in a new tab)
• NHS Digital – National Data Opt-Out Programme (opens in a new tab)

Please also be aware that you are not able to object to your name, address and other demographic information being sent to NHS Digital – this is necessary if you wish to be registered to receive NHS Care. You are also not able to object when information is legitimately shared for safeguarding reasons – when appropriate, it is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm.

Access to personal information

Your medical information is available on NHS APP from August 2023 or from when you registered at The Village Surgery. Please visit the NHS App for your medical information.

The Law gives you certain rights to your personal and healthcare information that we hold, as set out below:

Online Access

You can also sign up to have secure online access to your medical record. Please register with NHS APP, if you are successfully registered with NHS APP but you are unable to view your medical information please either write to the surgery or use an admin online GP form via our website(opens in a new tab). A reply to this may take up to 42 days.

Access and Subject Access Requests

You have the right to see what information we hold about you and to request a copy of this information.

If you would like a copy of the information we hold about you please contact our Practice Manager, Anita Mixides, ideally in writing. We will provide this information free of charge however in some circumstances we may have to make an administrative charge if the information requested is excessive, complex or repetitive.

We have one month to reply to you and give you the information that you require. We would ask, therefore, that any requests you make are ideally in writing and it is made clear to us what and how much information you require.

Sometimes details of third parties are recorded in your notes, most likely when you would have mentioned them to us during a consultation. We are under an obligation to make sure we also protect that third party’s rights as an individual and to ensure that references to them which may breach their rights to confidentiality are removed before we send any information to any other party (including yourself). Third parties can include: spouses, partners, and other family members.

Correction

We want to make sure that your personal information is accurate and up to date. You may ask us to correct any information you think is inaccurate. It is very important that you make sure you tell us if your contact details including your mobile phone number has changed.

Removal

You have the right to ask for your information to be removed however, if we require this information to assist us in providing you with appropriate medical services and diagnosis for your healthcare, then removal may not be possible.

Transfer

You have the right to request that your personal and/or healthcare information is transferred, in an electronic form (or other form), to another organisation, but we will require your clear consent to be able to do this.

Legal justification for collecting and using your information

The Law says we need a legal basis to handle your personal and healthcare information.

Contract:

We have a contract with NHS England to deliver healthcare services to you. This contract provides that we are under a legal obligation to ensure that we deliver medical and healthcare services to the public.

Consent:

Sometimes we also rely on the fact that you give us consent to use your personal and healthcare information so that we can take care of your healthcare needs.

Necessary care:

Providing you with the appropriate healthcare, where necessary. The Law refers to this as ‘protecting your vital interests’ where you may be in a position not to be able to consent.

Law:

Sometimes the Law obliges us to provide your information to an organisation (see above).

Special category data

The Law states that personal information about your health falls into a special category of information because it is very sensitive. Reasons that may entitle us to use and process your information may be as follows:

Public interest:

Where we may need to handle your personal information when it is considered to be in the public interest. For example, when there is an outbreak of a specific disease and we need to contact you for treatment, or we need to pass your information to relevant organisations to ensure you receive advice and/or treatment.

Consent:

When you have given us consent.

Vital interest:

If you are incapable of giving consent, and we have to use your information to protect your vital interests (e.g. if you have had an accident and you need emergency treatment).

Defending a claim:

If we need your information to defend a legal claim against us by you, or by another party.

Providing you with medical care:

Where we need your information to provide you with medical and healthcare services.

How long we keep your personal information

GP medical records will be kept in line with the law and national guidance. Information on how long records are kept can be found at: Records Management Code of Practice for Health and Social Care(opens in a new tab)

Under 16s

We have a separate privacy notice for the Under 16s. This is on our website and in reception areas at both sites. If any individual under the age of 16 has any concerns about their information or has any questions, please contact our Data Protection Officer or GDPR team.

Notification

The Data Protection Act 1998 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information. The Village Surgery is registered as a data controller and our registration can be viewed online in the public register at:

Visit the ICO website(opens in a new tab)

Complaints

If you have concerns or are unhappy about any of our services, please contact our practice manager, Anita Mixides. If you have a concern about the way we handle or use your personal data then please contact our Data Protection Officer.

If you are still unhappy following a review by us, you have a right to raise any concern or complaint with the UK information regulator, on the Information Commissioner’s Office website(opens in a new tab).

Our website

The only website this Privacy Notice applies to is the Surgery’s website. If you use a link to any other website from the Surgery’s website then you will need to read their respective privacy notice. We take no responsibility (legal or otherwise) for the content of other websites.

Cookies

The Surgery’s website uses cookies. For more information on which cookies we use and how we use them, please see our Cookies Policy.

Security

We take the security of your information very seriously and we do everything we can to ensure that your information is always protected and secure. We regularly update our processes and systems and we also ensure that our staff are properly trained. We also carry out assessments and audits of the information that we hold about you and make sure that if we provide any other services, we carry out proper assessments and security reviews.

Your contact details and text messages

Because we are obliged to protect any confidential information we hold about you, it is imperative that you let us know immediately if you change any of your contact details.

We may contact you using SMS texting to your mobile phone (unless you opt out of this) -eg to notify you about appointments or other services that we provide to you involving your direct care. We may also text you about any changes to our service and to convey messages from your doctor. We may also text you with test results or clinical information, but only if we had your specific consent to do this. We may occasionally text to let you know about healthcare events the surgery may be holding, but would need your express consent to do this. Therefore you must ensure that we have your up to date details. This is to make sure we are actually contacting you and not another person.

What do I do now?

If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have concerns about how your data is used then please contact the practice or visit the NHS England website to opt out.

Where to find our privacy notice

You may find a copy of this Privacy Notice on our website, or a copy may be provided on request.

If you require a translated version of the policy or if you require a copy of this in large font, please contact our GDPR team.

Changes to our privacy notice

We regularly review and update our Privacy Notice.