Accessing someone else’s information

As a parent, family member or carer, you may be able to access services for someone else. We call this having proxy access. We can set this up for you if you are both registered with us.

To requests proxy access:

• collect a proxy access form from reception from 10am to 6pm

Linked profiles in your NHS account

Once proxy access is set up, you can access the other person’s profile in your NHS account, using the NHS App or website.

The NHS website has information about using linked profiles to access services for someone else.

Comments and Complaints

Comments:

We welcome your views and constructive suggestions which will help us improve our service to you. There is a suggestion / comments box located in reception for this purpose.

Practice Complaints Procedure:

If you have a complaint about the service you have received from any of the doctors or staff working at this Practice, please let us know.  We operate a Practice complaints procedure as part of the NHS system for dealing with complaints. Our procedure meets national criteria.

 We hope that most problems can be sorted out easily and quickly, preferably at the time they arise and with the person concerned. If your problem cannot be sorted out in this way and you wish to make a complaint, we would like you to let us know as soon as possible, ideally within a matter of days, or at the most a few weeks, as this will enable us to establish what happened more easily.

If it is not possible to do that, please let us have details of your complaint:

• Within 12 months of the incident that caused the problem, or
• Within 12 months of discovering that you have a problem.

Complaints should be addressed to the Practice Manager, Vanessa Graham in the first instance, or one of the doctors.  Alternatively, you may ask for an appointment with the Practice Manager in order to discuss your concerns.  She will explain the complaints procedure to you and will ensure your concerns are dealt with promptly. It will be a great help if you are as specific as possible about your complaint.

Mechanism for dealing with a complaint:

We shall acknowledge your complaint within 3 working days and aim to have looked into your complaint within 10 working days of the date when you raised it with us. We shall then be in a position to offer you an explanation, or a meeting with the people involved.

When we look into your complaint, we shall aim to:

• Find out what had happened and what went wrong;
• Agree a plan on how your complaint will be dealt with and the timescales involved;
• Make it possible for you to discuss the problem with those concerned, if you would like this;
• Make sure you receive an apology where appropriate;
• Identify what we can do to make sure the problem doesn’t happen again.

Complaining on behalf of someone else

Please note that we keep strictly within the rules of medical confidentiality. If you are complaining on behalf of someone else, we have to know that you have their permission to do so.  A note signed by the person concerned will be needed, unless they are incapable (because of illness) of providing this or in the case of a minor.

Complaining to the Primary Care Trust:

We hope that if you have a grievance you will use our Practice complaints procedure. We believe this will give us the best chance of correcting whatever has gone wrong and an opportunity to improve our Practice.  Nevertheless, this does not affect your right to approach Sunderland CCG.

If you feel you cannot raise your complaint with us, you can raise the complaint through the NHS Customer Service Centre on 0300 311 2233.

In addition, ICAS (Independent Complaints Advocacy Service) are available to help you through the complaints process. Their services are free of charge and they can be contacted on 0808 802 3000 or at

Room 312, Aidan House, Sunderland Road, Gateshead, Tyne & Wear, NE8 3HU

If you are dissatisfied with the result of our investigation you can contact the Parliamentary and Health Service Ombudsman:

• By telephone: 0345 015 4033; or
• In writing to:

The Parliamentary and Health Service Ombudsman,

Millbank Tower,

Millbank,

London

SW1P 4QP; or

• By email: [email protected]

Data Protection Legislation is Changing

What is Changing? 

From the 25^th May, the current UK Data Protection Act 1998 is being replaced by the EU General Data Protection Regulation (GDPR) and Data Protection Act 2018.

The new legislation is very similar to the 1998 Act but provides some enhanced rights for individuals around how the Practice uses your information.

Why do we Need your information?

The NHS Act 2006 and Health and Social Care Act 2012 invests statutory functions on GP Practices to promote and provide the health service to improve quality of services, reduce inequalities, conduct research, review performance of services and deliver education & training.  To do this we will need to process your information in accordance with current data protection legislation to:

Protect your vital interests:

• Pursue our legitimate interests as a provider of medical care, particularly where the individual is a child or vulnerable adult
• Performs tasks in the public’s interests
• deliver preventative medicine, medical diagnosis, medical research; and
• Manage the health and social system and services.

Should require any further information on GDPR or Data Protection Act, this can be found on the Information Commissioner’s Office (ICO) website:

• https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/

You can also contact the Practices Data Protection Officer. When contacting the Data Protection Officer please ensure that you include the details of the Practice.

Data Protection Officer:       Mr James Carroll

Tel No:                                    0191 404 1000 Ext 3436

Email address:                     [email protected]

Definitions

Introduction

Grangewood Surgery is a General Practitioner contracted by NHS England to provide General Medical Services. The personal data that Grangewood Surgery processes to provide these services relates to its patients, relatives and Practice staff.

This policy sets out Grangewood Surgery commitment to ensuring that any personal data, including special category personal data, which Grangewood Surgery  processes, is carried out in compliance with data protection law. Grangewood Surgery is committed to ensuring that all the personal data that it processes is done in accordance with data protection law. Grangewood Surgery ensures that good data protection practice is imbedded in the culture of our staff and our organisation.

Grangewood Surgery other data protection policies and procedures are (these should be considered and may not all be necessary):

• record of processing activities (data mapping/data flow documentation)
• privacy notices (website, clients, employees)
• personal data breach reporting process and a breach register
• data retention policy (NHS Records Management Code of Practice)
• data subject rights procedure
• data protection impact assessment process (DPIA Template on Team Net)
• IT security policies (NECS Acceptable User / Security Policies)

‘Data Protection Law’ includes the General Data Protection Regulation 2016/679; the UK Data Protection Act 2018 and all relevant EU and UK data protection legislation.

This policy applies to all personal data processed by the Practice. All staff are expected to comply with this policy and failure to comply may lead to disciplinary action up to and including dismissal.

1. Data protection principles

The Practice is committed to processing data in accordance with its responsibilities under the Data Protection Act and General Data Protection Regulations (GDPR).

Article 5 of the GDPR requires that personal data shall be:

1. processed lawfully, fairly and in a transparent manner in relation to individuals;
2. collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall not be considered to be incompatible with the initial purposes;
3. adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed;
4. accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay;
5. kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed; personal data may be stored for longer periods insofar as the personal data will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes subject to implementation of the appropriate technical and organisational measures required by the GDPR in order to safeguard the rights and freedoms of individuals; and
6. processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures.”

2. General Provisions

1. This policy applies to all personal data processed by the Practice.
2. The Data Protection Lead shall take responsibility for the Practice’s ongoing compliance with this policy.
3. This policy shall be reviewed at least annually.
4. The Practice shall register with the Information Commissioner’s Office as an organisation that processes personal data.

3. Lawful, Fair and Transparent Processing

1. The Practice will publish a Privacy Notice that provides details in relation to its processing of information.
2. The privacy notice shall identify:
   1. Details of the Data Controller
   2. Details of the Data Protection Officer
   3. Purpose of the processing
   4. Lawful basis for processing
   5. Recipients or categories of recipients of data
   6. Individuals rights.
3. The Practice privacy notice will be reviewed and updated annually or as required following any major changes to processing activities.
4. To ensure its processing of data is lawful, fair and transparent, the Practice shall maintain a Register of Processing.
5. The Register of Processing shall be reviewed at least annually.
6. Individuals have the right to access their personal data and any such requests made to the Practice shall be dealt with in a timely manner in accordance with the requirements of the legislation.

4. Lawful Purposes

1. All data processed by the Practice must be based on the appropriate lawful basis for both personal and special category data.
2. Processing shall be based on at least on for the following:

1. 1. Legal basis for processing personal data;
      1. Consent
      2. Necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.
      3. Legal obligation to carry out the processing.
      4. Necessary to protect the vital interests of the data subject or another individual.
      5. Necessary for the performance of a task carried out in the public interest.
      6. Necessary for the legitimate interests of the Practice or by a third party.

1. 1. Legal basis for processing special category data;
      1. Explicit Consent
      2. Necessary for the purposes of carrying out obligations in the field of employment, social security or social protection law
      3. Necessary to protect the vital interests of the data subject or another natural person where the data subject is physically or legally incapable of giving consent.
      4. The data subject has deliberately put the data within the public domain.
      5. Necessary for the establishment, exercise or defence of legal claims.
      6. Necessary for reasons of substantial public interest.
      7. Necessary for the purposes of preventative or occupational medicine, for the assessment of working capacity of an employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
      8. Necessary for reasons of public interest in the area of public health.
      9. Necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.

1. The Practice shall note the appropriate lawful basis in the Register of Processing.
2. Where consent is relied upon as a lawful basis for processing data, evidence of opt-in  consent shall be kept with the personal data.
3. Where communications are sent to individuals based on their consent, the option for the individual to revoke their consent should be clearly available and systems should be in place to ensure such revocation is reflected accurately in the Practice’s systems.

5. Data Minimisation

1. The Practice shall ensure that personal data are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed.

6. Accuracy

1. The Practice shall take reasonable steps to ensure personal data is accurate.
2. Where necessary for the lawful basis on which data is processed, steps shall be put in place to ensure that personal data is kept up to date.

7. Archiving / removal

1. To ensure that personal data is kept for no longer than necessary, the Practice shall put in place an archiving policy for each area in which personal data is processed and review this process annually.
2. The archiving policy shall consider what data should/must be retained, for how long, and why.

8. Security

1. The Practice shall ensure that personal data is stored securely.
2. Access to personal data shall be limited to personnel who need access and appropriate security should be in place to avoid unauthorised sharing of information.
3. When personal data is deleted this will be done safely such that the data is irrecoverable.
4. Appropriate backup and disaster recovery solutions shall be in place.

9. Confidentiality

As an individual working for, on behalf of or within, the Practice you are subject to an obligation of confidentiality and must adhere to the Data Protection Act 2018 (DPA18), General Data Protection Regulation (GDPR), Caldicott Guidelines, Records Management and NHS Information Security Procedures which form part of all employees, contractors, volunteers and honorary staff Terms and Conditions of Employment/Engagement.

All employees have a duty of confidence to patients and staff under common law. Furthermore statute law imposes legal obligations regarding confidentiality of patient data whether it is manually documented or collected and held within computer systems.

To access patient identifiable clinical information, you must have a legitimate relationship with the individual service user to whom the information relates or be part of the team providing / supporting that care.  A legitimate relationship is created only when an individual is an active recipient of the service providing care. The relationship ends when the individual is discharged from that service.

At no time are you permitted to access your own or clinical information relating to friends or relatives without a legitimate relationship being in place. Access to confidential clinical information outside of a legitimate relationship is deemed unauthorised access and may be subject to disciplinary action by the Trust or in some circumstances legal action.

While you are at work you will have access to information about patients/colleagues and/or the Practice. You may come in to contact with this type of information during the course of your work or simply see, hear or read something while you are working. In these circumstances where a duty of care, either to the patient or the staff member potentially overrides the duty of confidentiality, you must discuss the matter with the Practice manager. Otherwise, you must keep this information confidential.

The Practice will establish and maintain policies and procedures to ensure compliance with the requirements contained in the NHS Data Security & Protection Toolkit.

Professional bodies (e.g. Nursing & Midwifery Council (NMC), General Medical Council (GMC)) provide additional supplementary advice and guidance for their own disciplines. These guidelines are complementary to this policy and do not conflict with this policy or legislation.

All staff are responsible for:

• protecting the integrity, availability and confidentiality of Trust information;
• acting to prevent the improper use or disclosure of information;
• following the guidance as set out in this and other related documentation;
• reporting breaches of Confidentiality through the Trust Incident Reporting procedure;
• ensuring the safe collection, storage, processing and disclosure of personal and confidential information;
• attending relevant training, induction and annual mandatory training in relation to Information Governance.
• Where necessary, informing Information Governance of any new or proposed uses of data

9. Data Subject Rights

Grangewood Surgery has processes in place to ensure that it can facilitate any request made by an individual to exercise their rights under data protection law. All staff have received training and are aware of the rights of data subjects. Staff can identify such a request and know who to send it to.

All requests will be considered without undue delay and within one month of receipt as far as possible.

Subject access: the right to request information about how personal data is being processed, including whether personal data is being processed and the right to be allowed access to that data and to be provided with a copy of that data along with the right to obtain the following information:

• the purpose of the processing
• the categories of personal data
• the recipients to whom data has been disclosed or which will be disclosed
• the retention period
• the right to lodge a complaint with the Information Commissioner’s Office
• the source of the information if not collected direct from the subject, and
• the existence of any automated decision making

Rectification: the right to allow a data subject to rectify inaccurate personal data concerning them.

Erasure: the right to have data erased and to have confirmation of erasure, but only where:

• the data is no longer necessary in relation to the purpose for which it was collected, or
• where consent is withdrawn, or
• where there is no legal basis for the processing, or
• there is a legal obligation to delete data

Restriction of processing: the right to ask for certain processing to be restricted in the following circumstances:

• if the accuracy of the personal data is being contested, or
• if our processing is unlawful but the data subject does not want it erased, or
• if the data is no longer needed for the purpose of the processing but it is required by the data subject for the establishment, exercise or defence of legal claims, or
• if the data subject has objected to the processing, pending verification of that objection

Data portability: the right to receive a copy of personal data which has been provided by the data subject and which is processed by automated means in a format which will allow the individual to transfer the data to another data controller. This would only apply if Grangewood Surgery was processing the data using consent or on the basis of a contract.

Object to processing: the right to object to the processing of personal data relying on the legitimate interests processing condition unless Grangewood Surgery can demonstrate compelling legitimate grounds for the processing which override the interests of the data subject or for the establishment, exercise or defence of legal claims.

10. Breach

In the event of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data, the Practice shall promptly assess the risk to people’s rights and freedoms and if appropriate report this breach to the ICO (more information on the ICO website).

11. Responsibility for the processing of personal data

The partners of Grangewood Surgery]take ultimate responsibility for data protection.

If you have any concerns or wish to exercise any of your rights under the GDPR, then you can contact the data protection lead in the following ways:

Name                          James Carrol
Address                       DPO, Information Governance Dept

Harton Wing,  South Tyneside District Hospital

Harton Lane,  South Shields,  NE34 0PL

Telephone 0191 404 1000 Ext 3436

NHS England require that the net earnings of doctors engaged in the practice is publicised, and the required disclosure is shown below. However it should be noted that the prescribed method for calculating earnings is potentially misleading because it takes no account of how much time doctors spend working in the practice, and should not be used to form any judgement about GP earnings, nor to make any comparison with any other practice.

All GP practices are required to declare the mean earnings (e.g. average pay) for GPs working to deliver NHS services to patients at each practice.

The average pay for GPs working in this practice in the last full financial year was £91,106 before Tax and National insurance. This is for Xero full time GPs, 6 part time GPs and 1 locum GP who worked in the practice for more than six months.

Grangewood Surgery wish to inform all patients that they have been allocated a named GP who will have overall responsibility for the care and support that our surgery provides to them.

This does not prevent you from seeing any GP in the practice as you currently do.

If you would like to know who your allocated GP is, please ask at reception or a member of staff.

A Data Provision Notice (DPN) has been received for this new data collection.

The data, as specified by the DPN, supports a Direction from NHS England. Organisations that are in scope of the notice are legally required to comply.

All General Practices are therefore mandated to comply with this invitation and approve the collection.

As NHS Digital is collecting personal data from General Practices through this collection, we have a legal duty to be transparent and to provide patients with transparency information under GDPR about the data we are sharing with NHS Digital. For further information relating to the use of data for this collection, please go to:

• https://digital.nhs.uk/about-nhs-digital/our-work/keeping-patient-data-safe/gdpr/gdpr-register/physical-health-checks-for-people-with-severe-mental-illness-phsmi-gdpr-information

GRANGEWOOD SURGERY – Privacy Notice – Direct Care (routine care & referrals)

* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament. It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law. The law is applied by reference to those previous cases, so common law is also said to be based on precedent.

The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.

In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient. It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.

Three circumstances making disclosure of confidential information lawful are:

• where the individual to whom the information relates has consented;
• where disclosure is in the public interest; and
• where there is a legal duty to do so, for example a court order.

Please click here for our Statement of Purpose

How data in your GP record is used and how you can control the use (opt-out)

As a practice, we fully respect your right as a patient to control your data. We outline our privacy policy in more detail on this website and explain how we share data with other providers, including the Great North Care Record and NHS Digital for secondary use.

You have the right to opt-out at any time from data being shared.

Your data is used in broadly two different ways:

1. To provide you with care. This is called “Primary Use“
2. To allow for planning and research to be done. This is called “Secondary Use“

Both uses will only be made where it is considered secure and appropriate to use patient data.

Opting-out of data sharing is an option for all patients, however it is not without potential downsides. For Primary Use data, if you opt-out and need care in a local hospital, for example, it may be much harder for the staff to access important medical information about you needed to provide safe and effective care. For Secondary Use, the downsides are more indirect. If everyone in the country were to opt-out, it would make it much harder to ensure funding is used in the NHS to develop services where they are needed. It would also be harder to develop new treatments.

It is possible to opt-out of specific parts of data sharing, while keeping some elements of data sharing in place. It is very common, for example, for people who have privacy concerns about Secondary Use, to be happy to continue sharing data for Primary Use/Direct Care.

The below table summarises what opt-outs are possible, and how to request them:

How data in your GP record is used, and how you can control the use

Primary Use – sharing your data for your direct care

Secondary Use – Using your data to design health services and do health research

How to manage your sharing preferences using the NHS App

You can view or change your current preference at any time.

To view and change your preference in the NHS App:

1. Go to Your health
2. Select Choose if data from your health and care records is shared for planning and research.
3. Select Make your choice.
4. Review the information on the page, then select Start now.
5. View your preference, then select Change if you want to change it.
6. Update your choice, then select Submit.

You can also visit www.nhs.uk/your-nhs-data-matters.