Please see the attached policy

Aire Valley Surgery is registered to provide the following services:

• Diagnostic and screening procedures
• Family planning services
• Maternity and midwifery services
• Services for everyone
• Surgical procedures
• Treatment of disease, disorder or injury

We achieved an overall rating of good during our last inspection.

Please see more detail on the CQC website.

ACR project for patients with diabetes

A pilot programme to monitor urine albumin : creatinine ratio (ACR) annually for patients with diabetes is being provided at this practice by Healthy.io, which enables patients with diabetes to test their kidney function from home.  With your permission, we will share your contact details with Healthy.io to enable them to contact you and send you a testing kit.  This will help identify those at risk of kidney disease and proactively manage early interventions for the benefit of patient care.  If you do not wish to be contacted by Healthy.io, you will have the opportunity to say so by replying to the text message sent from our practice.

The Leeds Care Record provides health and social care professionals directly involved in your care access to the most up to date information about you.

Data shared with who and why?

Leeds Teaching Hospital Trust/Primary Care such as your GP/Leeds Mental Health/Leeds Social Care. It is designed to be a local one stop shop shared record for direct care to enable health professionals to provide better care by seeing all your information together in one place.

What is shared?

Problems, Medication, Allergies, Appointments, Test Results, Communications, Discharges, Demographics.

How is the data shared?

Held on a secure computer system and records remain confidential. All existing data protection laws apply. Only accessed by people directly involved in your care. This is role based access by Leeds Teaching Hospital Trust/Primary Care/Leeds Mental Health/Leeds Social Care.

How is consent given?

GP Practices Opt in to Leeds Care Record. Patients can opt out via Leeds Teaching Hospital Trust (by phone on 0113 206 4102, by email “[email protected]”, or by letter to “Access to Health Records, Leeds Teaching Hospitals NHS Trust, St James University Hospital, Lincoln Wing/Chancellor Wing Link Corridor, Beckett Street, Leeds, LS9 7TF”).

How do I get more information?

Go to Leeds Care Record Website.

Rights

• Every patient at the practice is allocated a named, accountable GP.  This means you have a ‘usual’ GP who you should always try and see, especially for ongoing problems. You can request for your accountable GP to be changed at any time.
• Patients have the right to say if they would prefer to see a particular doctor or nurse and we will try to arrange this (as long as they are available). We understand that ‘continuity of care’ is important. Seeing the same nurse or doctor for a particular condition can make it easier to get the right diagnosis and plan your treatment/management better.
• Registered patients are invited to have a health check from time to time. We hope you will take up this service.
• We also offer all patients over 40 an NHS Health Check every 5 years. Please contact reception to discuss this.
• Patients have the right to see their own health records, subject to the terms of the Data Protection Act.

Responsibilities

• Please arrive on time for your appointment. That way clinics are more likely to run on time.
• Please inform the practice if you can’t make an appointment or if the appointment is no longer necessary, so the slot can be offered to another patient.
• Please try and attend the surgery and do not make a request for a home visit unless absolutely necessary. Home visits are for housebound or seriously ill patients. In the time it takes to conduct 1 home visit we can typically see at least 4 patients at the surgery.
• Please make requests for repeat prescriptions in good time. We suggest at least 72 hours before you need more medication.
• Please co-operate with all practice staff and treat them courteously. They are trying to help you.

We have training Doctors at Aire Valley surgery. As part of their training they need to record their consultations for learning and reflection.

This is solely for training, education and assessment purposes.

The recording, processing and storage of the consultation will comply with General Data Protection Regulations (GDPR) and is in line with guidance of the General Medical Council.

More information is available at www.rcgp.org.uk/-/media/Files/Privacy-statement/RCGP-data-protection-impact-assessment-procedure-june-2020.as

You do not have to agree to your consultation with the doctor being recorded. If you do not want us to record the consultation, this is not a problem and will not affect the care you receive in in any way.

If you do give your consent, then you will have the opportunity to withdraw this at any time in the future, including immediately after the consultation.

If you are happy for us to record your consultation, please confirm this by responding with YES to the message sent to you.

If you do not wish to give consent that is fine, and all you need to do is respond with NO.

We take part in an NHS service that helps us to spot whether you need more help to manage your health. The service is called “risk profiling”

Data shared with who and why?

Using information from your health records, a secure NHS computer system will look at any recent treatments you have had in hospital or at this surgery, and any existing health conditions that you have, and alert your doctor to the likelihood of a possible future hospital admission.

What is shared?

Most Data.

How is the data shared?

The information will be seen only by qualified health workers involved in your care. NHS security systems will protect your health information and patient confidentiality at all times. The clinical team at the surgery will use the information to help you get early care and treatment where it is needed.

How is consent given?

If you don’t want your information being used in this way, or have any other concerns, please contact the Practice.

How do I get more information?

At Leeds West CCG Website and the NHS England Website.

The Summary Care Record is a national electronic record which contains information about your current medication and any allergies or adverse reactions that you may have.

Having this information stored in one place makes it easier for healthcare staff to treat you in an emergency.

Data shared with who and why?

The National Care Record Service (NCRS) for sharing important summary clinical data nationwide for emergency direct care purposes. For example, if you were admitted to hospital in a different part of the country this record would enable the doctors to see vital information about your care.

What is shared?

Medication, Allergies, Drug reactions, optionally specific Read coded entries (called rich SCR).

How is the data shared?

Access is restricted to NHS Smartcard holders in Hospitals, Out of Hours Services and GPs.

How is consent given?

Implied consent with patient opt out and requirement to explicitly opt in for Rich SCR.

How do I get more information?

You can also visit the NHS Care Records website or download the NHS Care Record Guarantee.

Creating tomorrow’s workforce

Staff Training

Please be aware that we will be closed for staff training one Thursday afternoon every month from 12.00. During this time the Out Of Hours Service will cover the surgery if you require urgent medical assistance.

Training Practice

The practice is committed to the further training of health professionals. These include medical students, nurses and GP trainees. Staff receiving training are fully supervised and you will be advised at the time of booking an appointment that a student will be present but if you change your mind and would prefer them not to be present please say and we will honour your preference.

How we collect, look after and use your data. This notice explains how Aire Valley Surgery will collect, look after, use or otherwise process your personal data. “Personal data” is information relating to you as a living, identifiable individual.

HOW IS MY INFORMATION COLLECTED AND LOOKED AFTER?

Who is responsible for my information?

Aire Valley Surgery is the data controller for your information and is responsible for looking after your record while you are a registered patient. The person with the key responsibility for data protection and security is Dr C A Mills

Any queries or concerns should be raised with the practice first

The contact details of our data protection officer

Our Data Protection Officer is Louise Whitworth and they can be contacted on: [email protected]

What we do

As a GP practice we are responsible for your day to day medical care and the purpose of this notice is to inform you of the type of information that we hold about you, how that information is used for your care, our legal basis for using the information, who we share this information with and how we keep it secure and confidential.

It covers information we collect directly from you (that you have either provided to us, or from consultations with staff members), or we collect from other organisations who manage your care (such as hospitals or community services).

We are required by law to maintain records about your health and treatment, or the care you have received within any NHS service.

Our Commitment to Data Privacy and Confidentiality

As a Practice, we are committed to protecting your privacy and will only process data in accordance with the General Data Protection Regulation (GDPR), the Data Protection Act 2018, the Common Law Duty of Confidentiality, professional codes of practice, the Human Rights Act 1998 and other appropriate legislation.

Everyone working for the Practice has a legal and contractual duty to keep information about you confidential. All our staff receive appropriate and ongoing training to ensure that they are aware of their personal responsibilities and their obligations to uphold confidentiality.

Staff are trained to ensure how to recognise and report any incident and the organisation has procedures for investigating, managing and learning lessons from any incidents that occur.

All identifiable information that we hold about you in an electronic format will be held securely and confidentially in secure hosted servers that pass stringent security standards.

Any companies or organisations we use we may use to process your data are also legally and contractually bound to operate under the same security and confidentiality requirements.

All identifiable information we hold about you within paper records is kept securely and confidentially in lockable cabinets with access restricted to appropriately authorised staff.

As an organisation we are required to provide annual evidence of our compliance with all applicable laws, regulations and standards through the Data Security and Protection toolkit.

Your information will not be sent outside of the United Kingdom where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.

In addition to our Data Protection Officer, we also have a senior person within the practice who is responsible for protecting the confidentiality of our records and ensuring that any use of your data is fair and appropriate- this person is the Caldicott Guardian. The Caldicott Guardian for the practice is: Dr C A Mills.

The practice is registered with the Information Commissioners Office as a Data Controller.

We will endeavour to maintain our duty of confidentiality to you at all times and will only share data about you if we genuinely believe that it would improve the care you provide for you.

Other than for the purposes of direct care or indirect care (such as healthcare planning), we will only share your information without your permission when we are required to do so under exceptional circumstances (such as a serious risk to yourself and others) or if it is required by law.

The categories of personal data we hold and the sources we obtain them from

• Details about you, such as your name, address, carers, biological gender, gender identity, ethnic origin, date of birth, legal representatives and emergency contact details are collected from you when you register with the practice via the GMS1 form and new patient questionnaire you fill in when your register.
• Information that you provide about your health when you consult with healthcare professionals at the practice, which will be recorded in your notes
• Any contact the surgery has with you, such as appointments, clinic visits, emergency appointments, etc. are recorded on our clinical system
• Notes and reports about your health- your historic notes are transferred to us from your old practice- this can happen electronically and your paper notes are transferred via an organisation called Primary Care Support England
• Results of investigations such as laboratory tests, x-rays, etc. which are sent to the practice electronically from hospitals
• Any consultations you may have had with “extended access” hubs, which the practice is part of.
• We are routinely informed of any A&E visits or outpatient appointments at local hospitals
• We are routinely advised of any contact with out of hours providers or NHS111
• We are hold details of any other relevant information from other health professionals, relatives or those who care for you. All information flows within the practice are routinely mapped as part of our GDPR compliance and compliance with the Data Security and Protection toolkit.

How we use your personal data (the purposes of processing).

As health professionals, we maintain records about you in order to support your care. By registering with the practice, your existing records will be transferred to us from your previous practice so that we can keep them up to date while you are our patient and if you do not have a previous medical record (a new-born child or coming from overseas, for example), we will create a medical record for you.

We take great care to ensure that your information is kept securely, that it is up to date, accurate and used appropriately. All of our staff are trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to.

For provision of direct care:

In the practice, individual staff will only look at what they need in order to carry out such tasks as booking appointments, making referrals, giving health advice or provide you with care.

Primary Care Networks:

All practices in the UK are members of a Primary Care Network (PCN), which is a group of practices who have chosen to work together and with local community, mental health, social care, pharmacy, hospital and voluntary services to provide care to their patients.

PCNs are built on the core of current primary care services and enable greater provision of proactive, personalised, coordinated and more integrated health and social care.

We are members of Yeadon PCN along with Menston & Guiseley Practice and Guiseley & Yeadon Medical Practice.

This arrangement means that practices within the same PCN may share data with other practices within the PCN, for the purpose of patient care (such as extended hours appointments and other services), Each practice within the PCN is part of a stringent data sharing agreement that means that all patient data shared is treated with the same obligations of confidentiality and data security.

For commissioning and healthcare planning purposes:

In some cases, for example when looking at population healthcare needs, some of your data may be shared (usually in such a way that you cannot be identified from it). The following organisations may use data in this way to inform policy or make decisions about general provision of healthcare, either locally or nationally.

• Leeds City Council: Public Health, Adult or Child Social Care Services
• Leeds Clinical Commissioning Group (or their approved data processors)
• NHS Digital (Formerly known as (HSCIC)
• The “Clinical Practice Research Datalink” (EMISWeb practices) or ResearchOne Database(SystmOne practices).
• Other data processors which you will be informed of as appropriate.

In order to comply with its legal obligations, we may send data to NHS Digital when directed by the Secretary of State for Health under the Health and Social Care Act 2012.

This practice contributes to national clinical audits and will send the data which are required by NHS Digital when the law allows. This may include demographic data, such as date of birth, and information about your health which is recorded in coded form, for example, the clinical code for diabetes or high blood pressure.

For research purposes:

Research data is usually shared in a way that individual patients are non-identifiable.  Occasionally where research requires identifiable information you may be asked for your explicit consent to participate in specific research projects.  The surgery will always gain your consent before releasing any information for this purpose unless the research has been granted a specific exemption from the Confidentiality Advisory Group of the Health Research Authority

Where specific information is asked for, such as under the National Diabetes audit, you will be given the choice to opt of the audit.

For safeguarding purposes, life or death situations or other circumstances when we are required to share information:

We may also disclose your information to others in exceptional circumstances (i.e. life or death situations) or in accordance with Dame Fiona Caldicott’s information sharing review (Information to share or not to share).

For example, your information may be shared in the following circumstances:

• When we have a duty to others e.g. in child protection cases
• Where we are required by law to share certain information such as the birth of a new baby, infectious diseases that may put you or others at risk or where a Court has decided we must.

When you request to see your information or ask us to share it with someone else:

If you ask us to share your data, often with an insurance company, solicitor, employer or similar third party, we will only do so with your explicit consent. Usually the requesting organisation will ask you to confirm your consent, often in writing or electronically. We check that consent before releasing any data and you can choose to see the information before we send it.

The lawful basis for the processing.

We are required to tell you the legal basis that is used for the various ways we process and use your data. In order to process your personal data we must specify a lawful basis and if we process any personal  data that is deemed to be “special category” data we must also specify a separate condition for processing special category data.

The following table sets the main ways your personal data may be used and the corresponding legal basis and category of data. Each purpose is covered in more detail within this notice to explain what these mean in more practical terms.

The recipients and categories of recipients of personal data.

We share information about you with other health professionals where they have a genuine need for it to support your care, as follows.

From time to time we may offer you referrals to other providers, specific to your own health needs- in these cases we will discuss the referral with you and advise you that we will be sharing your information (generally by referral) with those organisations.

The details of transfers of the personal data to any third countries or international organisations.

As a GP surgery, the only occasions when this would occur would be if you specifically requested this to occur- the practice will never routinely send patient data outside of the UK where the laws do not protect your privacy to the same extent as the law in the UK.

NHS App

We use the NHS Account Messaging Service provided by NHS England to send you messages relating to your health and care. You need to be an NHS App user to receive these messages. Further information about the service can be found at the privacy notice for the NHS App managed by NHS England.

Retention periods for your personal data.

As long as you are registered as a patient with the surgery, your paper records are held at the practice along with your GP electronic record. If you register with a new practice, they will initiate the process to transfer your records. The electronic record is transferred to the new practice across a secure NHS data-sharing network and all practices aim to process such transfers within a maximum of 8 working days. The paper records are then transferred which can take longer. Primary Care Services England also look after the records of any patient not currently registered with a practice and the records of anyone who has died.

Once your records have been forwarded to your new practice (or after your death forwarded to Primary Care Services England), a cached version of your electronic record is retained in the practice and classified as “inactive”. If anyone has a reason to access an inactive record, they are required to formally record that reason and this action is audited regularly to ensure that all access to inactive records is valid and appropriate.  We may access this for clinical audit (measuring performance), serious incident reviews, or statutory report completion (e.g., for HM Coroner).

A summary of retention periods for medical records can be found on the BMA website

The rights available to you in respect of data processing.

Under the GDPR all patients have certain rights in relation to the information which the practice holds about them. Not all of these will rights apply equally, as certain rights are not available depending on situation and the lawful basis used for the processing- for reference these rights may not apply are where the lawful basis we use (as shown in the above table in the section on “lawful bases”) is:

• Processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller – in these cases the rights of erasure and portability will not apply.
• Legal Obligation – in these cases the rights of erasure, portability, objection, automated decision making and profiling will not apply.

Right to be informed

You have the right to be informed of how your data is being used. The propose of this document is to advise you of this right and how your data is being used by the practice

The right of access

You have the right of access You have the right to ask us for copies of your personal information- this right always applies. There are some exemptions, which means you may not always receive all the information we process.

The right to rectification

You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

The right to erasure

You have the right to ask us to erase your personal information in certain circumstances- This will not generally apply in the matter of health care data

The right to restrict processing

You have the right to ask us to restrict the processing of your information in certain circumstances– You have to right to limit the way in which your data is processed if you are not happy with the way the data has been managed.

The right to object

You have the right to object to processing if you disagree with the way in which part of your data is processed you can object to this- please bear in mind that this may affect the medical services we are able to offer you

Rights in relation to automated decision making and profiling.

Your rights in relation to automated processing– Sometimes your information may be used to run automated calculations. These can be as simple as calculating your Body Mass Index or ideal weight but they can be more complex and used to calculate your probability of developing certain clinical conditions, and we will discuss these with you if they are a matter of concern.

Typically, the ones used in the practice may include:

Qrisk– a cardiovascular risk assessment tool which uses data from your record such as your age, blood pressure, cholesterol levels etc to calculate the probability of you experiencing a cardiovascular event over the next ten years.

Qdiabetes– a diabetes risk assessment  tool  which uses your age, blood pressure, ethnicity data etc to calculate the probability of you developing diabetes.

CHADS – an assessment tool which calculates the risk of a stroke occurring for patients with atrial Fibrillation

This is not an exhaustive list- other tools may be used depending on your personal circumstances and health needs, however whenever we use these profiling tools, we assess the outcome on a case-by-case basis. No decisions about individual care are made solely on the outcomes of these tools, they are only used to help us us assess your possible future health and care needs with you and we will discuss these with you.

The right to data portability

Your right to data portability This only applies to information you have given us- you have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under a contract, and the processing is automated, so will only apply in very limited circumstances

The right to withdraw consent

Because under the provisions of Data Protection Law most of the data processing activities carried out by the practice are not done under the “lawful basis” of consent you cannot withdraw consent as such, however if you are not happy with the way your data is being processed you do have the right to object and the right to ask us to restrict processing.

There is a new national opt-out that allows people to opt out of their confidential patient information being used for certain reasons other than their individual care and treatment. The system offers patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used just for their individual care and treatment or also used for research and planning purposes. Details of the national patient opt out can be found online.

In the past, you may have already chosen to prevent your identifiable data leaving NHS Digital, known as a Type 2 opt-out. All existing Type 2 opt-outs will be converted to the new national data opt-out and this will be confirmed by a letter to all individuals aged 13 or over with an existing Type 2 objection in place. Once the national data opt-out is launched, it will no longer be possible to change preferences via local GP practices.

The right to lodge a complaint with a supervisory authority.

If you are happy for your information to be used, and where necessary shared, for the purposes described in this notice then you do not need to do anything.

Should you have any concerns about how your information is managed at the practice, please contact us.

If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via:

• Their website: ico.org.uk
• Email: [email protected]
• Telephone: 0303 123 1113 (local rate) or 01625 545 745
• Or by mail: The Information Commissioner

Wycliffe House

Water lane

Wilmslow

Cheshire

SK9 5AF