Accessing your GP-held records via the NHS app or NHS website

As your GP practice, we have been asked to provide you with, no later than 31 October 2023, access to your full medical record going forward via the NHS app (and NHS website) if you have a suitable NHS login

Your GP medical record contains consultation notes based on conversations between you, your GP and their team: medicines prescribed to you; all test results including hospital investigations; allergies; vaccines; and your medical conditions along with documents that may have been sent from local hospitals, clinics or other agencies, eg the police. There is likely to be sensitive and personal information within your medical record.

We are supportive of providing you with access to your record, but we wish to do this safely and make you aware that this is happening so that you can opt out, if you so wish. You may wish to speak with us first to understand what it is that you will see, and the risks which may be involved in having such confidential data either on your smartphone with the NHS app installed or online if other people might have access to that information through your devices. If you are in a difficult or pressured relationship for example, you may prefer your records to remain accessible only to those treating you, with them not appearing on your smartphone or online. Government has been clear that if a patient does not wish to have access, then we do not have to provide it. This is one reason why we have asked if you wish to opt out, or have it switched off for the time being.

For those who would like access, we are happy to explain the different levels you might like. Everyone can have access to their medication history and allergies, for example, and will be able to order their repeat prescriptions. It’s also possible to request access to what we call your ‘coded record’ where you can see a list of medical problems and results. You can also request access to the ‘full’ record where you will be able to see everything, including the notes which have been written by doctors, nurses and others involved in your care, at the GP surgery, and elsewhere.

It’s important to remember that these documents may, at times, contain information that could be upsetting, especially if they contain news of a serious condition. It can also be a cause for worry seeing results online when it isn’t clear what the results might mean, and no one is available to ask, as can be the case during the evening or at weekends, for example.

Sometimes people with a mental health condition might prefer not to see documents that remind them of difficult times in their life. Letters from mental health teams sometimes go into detail about past events, and great care would be needed in deciding whether you would want to see these letters. It is possible for individual items to be hidden at your request and your GP would be happy to talk about any concerns you may have.

Great care is also needed in case private details might cause harm at home, should people in a difficult or pressured relationship be forced to show their medical record to an abusive partner. Anyone in such a position should make this clear to us at the practice, so we can take steps to keep you safe. This might mean removing access through the NHS app for the time being, or through a careful process where we hide sensitive things. We would talk this through with you.

Requesting access – what do I need to do?

The easiest way to get access is to create an NHS login through the NHS app. Although you can also access your GP records via the internet on a computer, the first bit is easiest if done through a smartphone. If you don’t have one, you may have a family member or friend you trust who can help you. You can also ask your practice receptionist, but you’ll need some proof of who you are, eg a passport, driving licence or household bill.

If you use the NHS app, you’ll have to set up an account using a unique e-mail address and then ‘authenticate’ yourself to the NHS system to prove you are who you say you are. This will involve confirming your name, date of birth and contact details. The NHS login has several levels of authentication and to gain access to your records you’ll need the highest level of authentication. This generally involves you recording a short video of yourself to prove you are a real person as well as uploading a copy of a suitable identification document. Your GP practice can bypass this step if you are struggling, but we’d ask you to try to sign up to the NHS app yourself.

Once you have suitably authenticated yourself to the NHS app and created your NHS login you can approach your practice and ask for access, being mindful of the risks associated with access and the importance of not sharing passwords or having them stored in your smartphone if you think other people might want to see them without your permission. If you have any concerns, you should explain these to your GP practice team who can guide you.

Your GP practice will have a form they will ask you to complete, with your NHS login (this will be the email address you used to sign up) and then you will have a chat about access and your agreement and understanding will be requested. Once you are happy to get online access, your request will be passed to the clinical team to review. It may be that the practice wishes to contact you to discuss your request if there are any concerns raised so that access can be given safely. We’re not sure how many people will ask for access all at once so there may be a wait, but we will do our best to get you online access as soon as we can.

The form to request access can be accessed via reception.

The Elms Practice aims to give a friendly and professional service to all our patients. However, if you have any concerns about any aspect of our service, please let us know. Speak to whoever you feel most comfortable – your GP, our practice manager or our reception staff will be happy to help. In the majority of cases, concerns can be resolved quite easily. There is a complaints, form readily available from reception or you can telephone the Practice manager.

However, if you feel we have not dealt with the issues you have raised as you would wish, you can write to NHS England, P.O. Box 16738, Redditch, B97 9PT. or Telephone 0300 311 22 33 (Monday to Friday 8 am-6 pm, excluding, English Bank Holidays), you can also Email: [email protected].

You can also contact Parliamentary and Health Service Ombudsman if you feel the issues you have raised have not been dealt with.

The Ombudsman’s role is to make final decisions on complaints that have not been resolved locally by the NHS in England. The Ombudsman looks at complaints where someone believes there has been injustice or hardship because an organisation has not acted properly or has given a poor service and not put things right.

The Ombudsman can recommend that organisations provide explanations, apologies and financial remedies to service users and that they take action to improve services.

Making a complaint | Parliamentary and Health Service Ombudsman (PHSO)

Complaints Procedure

This practice is supporting vital coronavirus (Covid-19) planning and research by sharing your data with NHS Digital.

The health and social care system is facing significant pressures due to the coronavirus (Covid-19) outbreak. Health and care information is essential to deliver care to individuals, to support health, social care and other public services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the coronavirus outbreak. In the current emergency, it has become even more important to share health and care information across relevant organisations. This practice is supporting vital coronavirus planning and research by sharing your data with NHS Digital, the national safe haven for health and social care data in England.

Our Legal Basis for Sharing Data With NHS Digita

NHS Digital has been legally directed to collect and analyse patient data from all GP practices in England to support the coronavirus response for the duration of the outbreak. NHS Digital will become the controller under the General Data Protection Regulation 2016 (GDPR) of the personal data collected and analysed jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse this data under the COVID-19 Public Health Directions 2020 (Covid-19 Direction).

All GP practices in England are legally required to share data with NHS Digital for this purpose under the Health and Social Care Act 2012 (2012 Act). More information about this requirement is contained in the data provision notice issued by NHS Digital to GP practices.

Under GDPR our legal basis for sharing this personal data with NHS Digital is Article 6(1)(c) – legal obligation. Our legal basis for sharing personal data relating to health is Article 9(2)(g) – substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the Covid-19 Direction.

The Type of Personal Data we are Sharing With NHS Digital

The data being shared with NHS Digital will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. The data contains NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death for those patients. It will also include coded health data which is held in your GP record such as details of:

• Diagnoses and findings.
• Medications and other prescribed items.
• Investigations, tests and results.
• Treatments and outcomes.
• Vaccinations and immunisations.

How NHS Digital Will Use And Share Your Data

NHS Digital will analyse the data they collect and securely and lawfully share data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only. These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials. The British Medical Association, the Royal College of General Practitioners and the National Data Guardian are all supportive of this initiative.

NHS Digital has various legal powers to share data for purposes relating to the coronavirus response. It is also required to share data in certain circumstances set out in the Covid-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).

Legal notices under the COPI Regulations have also been issued to other health and social care organisations requiring those organisations to process and share confidential patient information to respond to the coronavirus outbreak. Any information used or shared during the outbreak under these legal notices or the COPI Regulations will be limited to the period of the outbreak unless there is another legal basis for organisations to continue to use the information.

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared. Organisations using your data will also need to have a clear legal basis to do so and will enter into a data-sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital Transparency Notice for GP Data for Pandemic Planning and Research (COVID-19).

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because, during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your Rights Over Your Personal Data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see:

• The NHS Digital GPES Data for Pandemic Planning and Research (COVID-19) Transparency Notice.
• The NHS Digital Coronavirus (COVID-19) Response Transparency Notice.
• The NHS Digital General Transparency Notice.
• How NHS Digital looks after your health and care information.

Please read our Covid-19 Privacy Notice form our covid-19 page.

The Elms Medical Practice

How we use Your Medical Records

Important Information For Patients

• This practice handles medical records in-line with laws on data protection and confidentiality.
• We share medical records with those who are involved in providing you with care and treatment.
• In some circumstances, we will also share medical records for medical research, for example, to find out more about why people get ill.
• We share information when the law requires us to do so, for example, to prevent infectious diseases from spreading or to check the care being provided to you is safe.
• You have the right to be given a copy of your medical record.
• You have the right to object to your medical records being shared with those who provide you with care.
•  You have the right to object to your information being used for medical research and to plan health services.
• You have the right to have any mistakes corrected and to complain to the Information Commissioner’s Office. Please see the practice privacy notice on the website in the pink files in the waiting rooms or speak to a member of staff for more information about your rights.

For more information ask at reception for a leaflet or visit our website www.theelmspractice.nhs.uk.

How The Elms Medical Practice Uses Your Information to Provide you With Healthcare

This practice keeps medical records confidential and complies with the General Data Protection Regulation.

We hold your medical record so that we can provide you with safe care and treatment.

We will also use your information so that this practice can check and review the quality of the care we provide. This helps us to improve our services to you.

• We will share relevant information from your medical record with other health or social care staff or organisations when they provide you with care. For example, your GP will share information when they refer you to a specialist in a hospital. Or your GP will send details about your prescription to your chosen pharmacy.
• For more information on how we share your information with organisations who are directly involved in your care can be found within practice.
• Healthcare staff working in A&E and out of hours care will also have access to your information. For example, it is important that staff who are treating you in an emergency know if you have any allergic reactions. This will involve the use of your Summary Care Record. For more information see:  https://digital.nhs.uk/summary-care-records or alternatively speak to your practice.
• You have the right to object to information being shared for your own care. Please speak to the practice if you wish to object. You also have the right to have any mistakes or errors corrected.

Other Important Information About How Your Information is Used to Provide you With Healthcare

Registering for NHS Care

• All patients who receive NHS care are registered on a national database.
• This database holds your name, address, date of birth and NHS Number but it does not hold information about the care you receive.
• The database is held by NHS Digital a national organisation which has legal responsibilities to collect NHS data.
• More information can be found at: [Link to relevant website] or the phone number for general enquires at NHS Digital is 0300 303 5678.

Identifying Patients Who Might be at Risk of Certain Diseases

• Your medical records will be searched by a computer programme so that we can identify patients who might be at high risk from certain diseases such as heart disease or unplanned admissions to hospital.
• This means we can offer patients additional care or support as early as possible.
• This process will involve linking information from your GP record with information from other health or social care services you have used.
• The information which identifies you will only be seen by this practice.
• More information at the practice.

Safeguarding

• Sometimes we need to share information so that other people, including healthcare staff, children or others with safeguarding needs, are protected from the risk of harm.
• These circumstances are rare.
• We do not need your consent or agreement to do this.

We are required by law to provide you with the following information about how we handle your information.

How Your Information is Shared so That This Practice Can Meet Legal Requirements

The law requires The Elms Medical practice to share information from your medical records in certain circumstances. Information is shared so that the NHS or Public Health England can, for example:

• Plan and manage services;
• Check that the care being provided is safe;
• Prevent infectious diseases from spreading.

We will share information with NHS Digital, the Care Quality Commission and local health protection team (or Public Health England) when the law requires us to do so. Please see below for more information.

We must also share your information if a court of law orders us to do so.

The Mapping Data Process 28 06 2021

The Data Protection Impact Assessment 28 06 2021

NHS Digital

• NHS Digital is a national body which has legal responsibilities to collect information about health and social care services.
• It collects information from across the NHS in England and provides reports on how the NHS is performing. These reports help to plan and improve services to patients.
• This practice must comply with the law and will send data to NHS Digital, for example, when it is told to do so by the Secretary of State for Health or NHS England under the Health and Social Care Act 2012.
• More information about NHS Digital and how it uses information can be found at: https://digital.nhs.uk/home.
• NHS Digital sometimes shares names and addresses of patients suspected of committing immigration offences with the Home Office. More information on this can be found here: https://www.gov.uk/government/publications/information-requests-from-the-home-office-to-nhs-digital.

Care Quality Commission (CQC)

• The CQC regulates health and social care services to ensure that safe care is provided.
• The law says that we must report certain serious events to the CQC, for example, when patient safety has been put at risk.
• For more information about the CQC see: http://www.cqc.org.uk/.

Public Health

• The law requires us to share data for public health reasons, for example, to prevent the spread of infectious diseases or other diseases which threaten the health of the population.
• We will report the relevant information to local health protection team or Public Health England.
• For more information about Public Health England and disease, reporting see https://www.gov.uk/guidance/notifiable-diseases-and-causative-organisms-how-to-report .

Handle Your Information and Our Legal obligations to Share Data.

How The Elms Medical Practice uses Your Information For National Screening Programmes

National Screening Programmes

• The NHS provides national screening programmes so that certain diseases can be detected at an early stage.
• These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms and a diabetic eye screening service.
• The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening programme.
• More information can be found at: https://www.gov.uk/topic/population-screening-programmes or speak to the practice.

We are required by law to provide you with the following information about how we handle your information in relation to our legal obligations to share data.

How Your Information is Used for Medical research and to Measure the Quality of Care

Medical Research

The Elms Medical Practice shares information from medical records:

• To support medical research when the law allows us to do so, for example, to learn more about why people get ill and what treatments might work best;
• We will also use your medical records to carry out research within the practice.

This is important because:

• The use of information from GP medical records is very useful in developing new treatments and medicines;
• Medical researchers use information from medical records to help answer important questions about illnesses and disease so that improvements can be made to the care and treatment patients receive.

We share information with the following medical research organisations with your explicit consent or when the law allows.

You have the right to object to your identifiable information being used or shared for medical research purposes. Please speak to the practice if you wish to object.

Checking the Quality of Care – National Clinical Audits

The Elms Medical Practice contributes to national clinical audits so that healthcare can be checked and reviewed.

• Information from medical records can help doctors and other healthcare workers measure and check the quality of care which is provided to you.
• The results of the checks or audits can show where hospitals are doing well and where they need to improve.
• The results of the checks or audits are used to recommend improvements to patient care.
• Data are sent to NHS Digital a national body with legal responsibilities to collect data.
• The data will include information about you, such as your NHS Number and date of birth and information about your health which is recorded in coded form –  for example, the code for diabetes or high blood pressure.
• We will only share your information for national clinical audits or checking purposes when the law allows.
• For more information about national clinical audits see the Healthcare Quality Improvements Partnership website: https://www.hqip.org.uk/ or phone 020 7997 7370.
• You have the right to object to your identifiable information being shared for national clinical audits. Please contact the practice if you wish to object.

We are required by law to provide you with the following information about how we share your information for medical research purposes.

At The Elms Medical Practice we take Data Security very seriously. Please see our policies below, which will inform you on how we treat your records, and how you can request your records from us.

Information governance breach reporting policy

Freedom of information policy (Template 1.3)

The Type of Personal Data we are Sharing With NHS Digital

The data being shared with NHS Digital will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. The data contains NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death for those patients. It will also include coded health data which is held in your GP record such as details of:

• Diagnoses and findings.
• Medications and other prescribed items.
• Investigations, tests and results.
• Treatments and outcomes.
• Vaccinations and immunisations.

How NHS Digital Will Use And Share Your Data

NHS Digital will analyse the data they collect and securely and lawfully share data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only. These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials. The British Medical Association, the Royal College of General Practitioners and the National Data Guardian are all supportive of this initiative.

NHS Digital has various legal powers to share data for purposes relating to the coronavirus response. It is also required to share data in certain circumstances set out in the Covid-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).

Legal notices under the COPI Regulations have also been issued to other health and social care organisations requiring those organisations to process and share confidential patient information to respond to the coronavirus outbreak. Any information used or shared during the outbreak under these legal notices or the COPI Regulations will be limited to the period of the outbreak unless there is another legal basis for organisations to continue to use the information.

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared. Organisations using your data will also need to have a clear legal basis to do so and will enter into a data-sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital Transparency Notice for GP Data for Pandemic Planning and Research (COVID-19).

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because, during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your Rights Over Your Personal Data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see:

• The NHS Digital GPES Data for Pandemic Planning and Research (COVID-19) Transparency Notice.
• The NHS Digital Coronavirus (COVID-19) Response Transparency Notice.
• The NHS Digital General Transparency Notice.
• How NHS Digital looks after your health and care information.

Your named accountable GP is either Dr A Krishnamurthy or Dr G Duddukuri.

If you would like to know who your named GP is, please contact the Practice 

 Your named GP will not be available at all times and if your needs are urgent you may need to discuss them with an alternative doctor.

We respect your right to privacy and keep all your health information confidential and secure. It is important that the NHS keep accurate and up-to-date records about your health and treatment that those treating you can give you the best possible advice and care. You have a right to know what information we hold about you and if you would like to see your records please call our practice.

We aim to treat our patients courteously at all times and expect our patients to treat our staff in a similarly respectful way. We take seriously any threatening, abusive behaviour against any of our staff or patients. If a patient is violent or abusive, they will be warned to stop their behaviour. If they persist, we may exercise our right to take action to have them removed, immediately if necessary, from our list of patients.

Privacy information leaflet

We are introducing Summary Care Records to improve the safety and quality of patient care.

The Summary Care Record is an electronic record which will give healthcare staff faster, easier access to essential information about you.

For more information about Summary Care Records please copy and paste website address below into your web address from the internet

Summary Care Records (SCR) – NHS Digital

If you would like to opt-out please fill out the form under ‘Our Documents’ page.

What Does it Mean if I do not Have Summary Care Record?

NHS healthcare staff caring for you may not be aware of your current medications, allergies you suffer from and any bad reactions to medicines you have had, in order to treat you safely in an emergency.

Your records will stay as they are now with information being shared by letter, email, fax or phone. If you have any questions, or if you want to discuss your choices, please:

• Phone the Summary Care Record Information Line on 0300 123 3020;

• Contact your local Patient Advice Liaison Service (PALS); or

• Contact your GP practice.

National Data Opt-Out

Using your health data for planning and research

You can decide whether you wish to have your information extracted and there are two main options available to you.

Option 1:                         

Type 1 Opt-out applies at organisational level and means that your medical record is not extracted from the organisation for any purpose other than for direct patient care. You can opt out at any time. Opting out will mean that no further extractions will be taken from your medical record.

Further information is available here.

Option 2:

Type 2 Opt-out allows data to be extracted by NHS Digital for their lawful purposes but they cannot share this information with anyone else for research and planning purposes. You can opt out at any time.

Further information is available here.

How do you opt out?

Type 1 – You need to contact the practice by phone, email or post to let us know that you wish to opt out.

Type 2 – you need to inform NHS Digital. Unfortunately, this cannot be done by the practice for you. You can do this by any of the following methods:

• Online service – You will need to know your NHS number or your postcode as registered at your GP practice via https://www.nhs.uk/your-nhs-data-matters/manage-your-choice/

• Telephone service 0300 303 5678 which is open Monday to Friday between 0900 and 1700

• NHS App – For use by patients aged 13 and over (95% of surgeries are now connected to the NHS App). The app can be downloaded from the App Store or Google play

• “Print and post” registration form: https://assets.nhs.uk/prod/documents/Manage_your_choice_1.1.pdf

• Photocopies of proof of the applicant’s name (e.g., passport, UK driving licence etc.) and address (e.g., utility bill, payslip etc.) need to be sent with the application.

It can take up to 14 days to process the form once it arrives at NHS, PO Box 884, Leeds. LS1 9TZ

As a registered patient, The Elms Medical Practice has a legal duty to explain how we use any personal information we collect about you at the organisation. We collect records about your health and the treatment you receive in both electronic and paper format.

Practice privacy notice

At The Elms Medical Practice, we have a legal duty to explain how we use any personal information we collect about you at the
organisation. We collect records during the recruitment stage and then data is continued to be collected for any successful candidate.
This is in both electronic and paper format.

This privacy notice applies to personal information processed by or on behalf of The Elms Medical Practice. We are required to provide
you with this privacy notice by law. It provides information on how we use the personal and healthcare information we collect, store and hold about you.

If you have any questions about this privacy notice or are unclear about how we process or use your personal
information or have any other issue regarding your personal and healthcare information, then please contact our data protection officer, Paula McIlroy ([email protected])

Privacy Notice – Candidates applying for work

Purpose and Legal Basis for Processing

West Lancashire CCG has a duty to secure continuous improvement in the quality of services provided to individuals for, or in connection with the prevention, diagnosis or treatment of illness. Taking that into account, the Medicines Management Team supports the CCG with commissioning services that make the best use of available medicines. Your personal data will be used to fulfil this duty in respect of promoting cost-effective use of medicines as well as implementing projects or actions to optimise the use of medicines to improve outcomes, enhance patient safety and improve capacity within the local health economy.

The legal basis we rely on under GDPR is Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. For the special categories of data, we rely on article 9(2)(h) “processing is necessary for the purposes of the provision of health or social care or treatment”

Source of Data

Data used to fulfil the above duties is received directly from the primary and secondary healthcare providers for which the CCG has responsibility for.

Categories of Data

Typically, clinicians and pharmacists will require access to patient information including NHS Numbers and medication lists.

Recipients of Personal Data

Personal data is shared between the CCG and local healthcare providers including GP practices. They do this to facilitate the implementation of recommendations by the medicines management team.

We take action to make improvements where necessary and inform the patients via a ‘you said, we did’ section on our website, also displaying this information in our waiting room.

Fraud awareness toolkit | NHS Fraud Prevention | NHS Counter Fraud Authority | NHSCFA