Policies and other info

Information Governance – Data Protection
Back Scanning of Paper GP Records in Westburn Medical Group LLP

What is happening and how is my data being used?

Westburn Medical Group LLP are back scanning all GP paper records including the Lloyd George Wallets (LGW) to store them in a digital format.
Personal data and Special categories of personal data All paper records and LGWs will be scanned which contain your personal data and health data which is recorded in your GP records.
This will include but not limited to your full name, DOB, CHI, address, previous addresses and names, contact details such as telephone numbers and email addresses, NOK & emergency contact name(s) and contact details, details of your family along with potentially family history, social history, health information, imaging and photography, any other data received from other organisations such as NHS Boards, private healthcare, local authority, other health organisations or voluntary organisations.
Data controller Westburn Medical Group LLP is the data controller for the data to be digitised.

The scanning of your paper health records will be undertaken by a company called NEC Software Solutions UK Limited (NEC).
NEC are providing a complete end-to-end solution with records being digitised and automatically filed within the GP Practice’s Docman application by suppliers Microtech.
NEC are also supported by other organisations they have contracted with to deliver the end-to-end solution. They use Freight-port as their couriers for transportation of the records from the GP practice to NEC, and they use Shred-it for the secure destruction of the patient records after they have been scanned and instruction provided to NEC by the Practice to destroy the physical records.

The Practice have a signed an Agreement with NEC setting out instructions and standards on how your information is processed by them and their sub-processors.
Personal data which the Practice is data controller for, is retained in the same way as the other medical information we hold about you. Please see our full privacy notice for more information – (information below)

NHS Inform also provides information how NHS Scotland uses and retains your data; please see the link below

How the NHS handles your personal health information

A specific Information Sharing Agreement has been put in place to document the sharing of personal data by the participating health organisations, including GP Practices. This is supported by a high level Agreement known as the Intra NHS Scotland Information Sharing Accord (2020) which enables participating health organisations share your personal data for specific purposes.
Lawful processing
We assert that it is lawful for us to process your personal data in this way as:
• processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• processing is necessary in order to protect the vital interests of the data subject or of another natural person;
We assert that it is lawful for us to process special categories of your personal data in this way as:
• processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards … ;
AND
DPA 2018 Schedule 1 Condition:
2(1) Health & Social Care Purposes
• processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent;
• processing is necessary for the establishment, exercise or defence of legal claims.
• processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
Your rights
We respect your rights and preferences in relation to your data. If you wish to update, access, erase, limit, or complain about the use of your information, please let us know by calling us on 0345 099 5757 in the first instance and we will consider your questions. You may also wish to contact the Health Board under which your care is being delivered or the Information Commissioner’s Office.

Confidentiality & Medical Records

The practice complies with data protection and access to medical records legislation. Identifiable information about you will be shared with others in the following circumstances:

• To provide further medical treatment for you e.g. from district nurses and hospital services.
• To help you get other services e.g. from the social work department. This requires your consent.
• When we have a duty to others e.g. in child protection cases anonymised patient information will also be used at local and national level to help the Health Board and Government plan services e.g. for diabetic care.

If you do not wish anonymous information about you to be used in such a way, please let us know.
Reception and administration staff require access to your medical records in order to do their jobs. These members of staff are bound by the same rules of confidentiality as the medical staff.

Consent

Here is a paragraph explaining a consent policy to a patient at a GP practice;

As part of ensuring you receive the best possible care, our practice adheres to strict consent policies regarding your medical treatment. Before any procedure or intervention, your doctor will explain it to you clearly, outlining the benefits, risks, and alternatives. You’ll have the opportunity to ask any questions you may have. We require your informed consent, which means you understand the nature of the procedure and agree to it voluntarily, without coercion. You have the right to refuse any part of your care. For certain complex treatments, we may ask you to sign a consent form, but for routine care, your verbal consent is sufficient. Your consent is an ongoing process that you can withdraw at any time during your care. Our goal is to involve you as the key decision maker about your health.
In Scotland, a child of 12 or more is presumed to be of sufficient age and maturity to form a view, although it is important to remember that this presumption is only a starting point and that each child must be assessed as an individual to determine whether or not they have capacity.

NHS Grampian

Privacy notice

Emergency Care Summary (ECS) and Key Information Summary (KIS) Access for approved Pharmacists, Optometrists and Dentists

What is happening?

NHS Grampian is making your Emergency Care Summary (ECS) and Key Information Summary (KIS) avaialble to approved Pharmacists, Optometrists and Dentists in our region. This is to allow them to access key information about you, your healthcare and your medication when they are providing support to you. This reduces the risk to you and improves the quality of the advice and care they can offer you.

Your data is only accessed when you are receiving care from an approved Pharmacist, Optometrist or Dentist.

To be approved to access the system, the Pharmacist, Optometrist, or Dentist must sign and Information Sharing Agreement with NHS Grampian that sets the standards for their access to your data.

NHS Grampian is making this information avaialble to Pharmacists, Optometrists and Dentists in compliance with this Scottish Government Directive – https://www.publications.scot.nhs.uk/files/ecs-kis-summary.pdf.

Personal data and special categories of personal data

Your ECS includes your demographic data (name, address, contact information, date of birth, CHI number etc) and your health data. For more information about the data that will be available please see Schedule 1 of the Directive linked above.

Data controller

Your GP practice is the data controller for the information in your ECS and KIS insofar as they code the data that is included in the summaries. This is jointly controlled by NHS Grampian who provide appropriate access to the system. When your Pharmacist, Optometrist or Dentist accesses the data and writes their own professional notes around your care they control their copy of your information.

Lawful processing

The processing of your data is further to the official authority of your GP and NHS Grampian and a task in the public interest (ie making information available for the provision of safe care in compliance with a Scottish Government Directive). The processing of your health data in this way is lawful for the purposes of the provision of health or social care and the management of the health and social care system.

Please note that this access is not provided further to your consent. This is a change from earlier approaches to KIS in particular. The change is made under the direction of Scottish Government – https://www.publications.scot.nhs.uk/files/key-information-summary.pdf.

Your rights

If you wish to update, access, erase, or limit or complain about the use of your personal data please let NHS Grampian’s Data Protection Officer know in the first instance by contacting Information Governance – gram.infogovernance@nhs.scot – or 01224 551549. You may also wish to contact the Information Commissioner’s Office – https://ico.org.uk/your-data-matters/raising-concerns/ or seek to enforce your rights through judicial remedy.