How do we maintain the confidentiality of your records?
We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
- Data Protection Act 1998
- Human Rights Act 1998
- Common Law Duty of Confidentiality
- Health and Social Care Act 2012
- NHS Codes of Confidentiality and Information Security
- Information: To Share or Not to Share Review (click here to read further information about this)
Every member of staff who works for the Practice or another NHS organisation has a legal obligation to keep information about you confidential.
We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any 3rd party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on for example Child/Adult Protection and Serious Criminal Activity.
Who are our partner organisations?
We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations or receive information from the following organisations:-
- NHS Trusts / Foundation Trusts
- NHS Commissioning Support Units
- Independent Contractors such as dentists, opticians, pharmacists
- Private Sector Providers
- Voluntary Sector Providers
- Ambulance Trusts
- Clinical Commissioning Groups
- Social Care Services
- NHS Digital
- Local Authorities
- Education Services
- Fire and Rescue Services
- Police & Judicial Services
- Other ‘data processors’ which you will be informed of
You will be informed who your data will be shared with and in some cases asked for explicit consent for this happen when this is required.
We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure.
Access to personal information
You have a right under the Data Protection Act to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. In order to request this, you need to do the following:
- Your request must be made in writing to the GP - for information from the hospital you should write direct to them
- From 25/5/2018 this information will be provided free of charge unless the practice considers your requests are excessive or unreasonable. All reasonable requests will be provided free of charge.
- We are required to respond to you within 30 days
- You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located
How do we use your data?
We will use your data for direct patient care as specified in Article 6(1)(e) and 9(2)(h) of the GDPR.
This means "necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services"; "for compliance with a legal obligation"; "for the performance of a task carried out in the public interest"
In order to comply with its legal obligations this practice may send data to NHS Digital when directed by the Secretary of State for Health under the Health & Social care Act 2012.
This practice contributes to national clinical audits and will send the data which are required by NHS Digital when the law allows. This may include demographic data, such as date of birth, and information about your health which is recorded in coded form, for example, the clinical code for diabetes or high blood pressure.
This practice contributes to medical research and may send relevant information to medical research databases such as the Clinical Practice Research Datalink and QResearch or others – when the law allows.
Objections / Complaints
Should you have any concerns about how your information is managed at the GP, please contact the Practice Manager. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website (www.ico.org.uk).
Change of Details
It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.
How long will we keep your data?
GP records are retained until death.
The Data Protection Act 1998 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.
This information is publicly available on the Information Commissioners Office website www.ico.org.uk
The practice is registered with the Information Commissioners Office (ICO).
Who is the Data Controller?
The Data Controller, responsible for keeping your information secure and confidential is: Dr Vincent Brady at Donneybrook Medical Centre
Who is the Data Protection Officer?
The Data Protection Officer has expert knowledge of data protection law and is responsible for monitoring compliance with the law. Our data Protection Officer is Dr Richard Fitton and he is based at West Pennine Local Medical Committee (LMC)
Is this information clear for you?
The full version of our Fair Processing & Privacy Notice can be found here
The practice can provide this information in other formats if needed. Please ask if this would help you.
In particular, we have a child-friendly version of this information which can be accessed via this link: Privacy Information Child friendly version
If you need further information or assistance, please contact:
Lynne Wilkinson Practice Manager