Sharing Your Medical Record

Increasingly, patient medical data is shared e.g. between GP surgeries and District Nursing, in order to give clinicians access to the most up to date information when attending patients.

The systems we operate require that any sharing of medical information is consented to by patients beforehand. Patients must consent to sharing of the data held by a health provider out to other health providers and must also consent to which of the other providers can access their data.

E.g. it may be necessary to share data held in GP practices with district nurses but the local podiatry department would not need to see it to undertake their work. In this case, patients would allow the surgery to share their data, they would allow the district nurses to access it but they would not allow access by the podiatry department. In this way access to patient data is under patients’ control and can be shared on a ‘need to know’ basis.

Emergency Care Summary

There is a Central NHS Computer System called the Emergency Care Summary (ECS). The Emergency Care Summary is meant to help emergency doctors and nurses help you when you contact them when the surgery is closed. It will contain information on your medications and allergies.

Your information will be extracted from practices such as ours and held securely on central NHS databases.

As with all systems there are pros and cons to think about. When you speak to an emergency doctor you might overlook something that is important and if they have access to your medical record it might avoid mistakes or problems, although even then, you should be asked to give your consent each time a member of NHS Staff wishes to access your record, unless you are medically unable to do so.

On the other hand, you may have strong views about sharing your personal information and wish to keep your information at the level of this practice. If you don’t want an Emergency Care Summary to be made for you, tell your GP surgery. Don’t forget that if you do have an Emergency Care Summary, you will be asked if staff can look at it every time they need to. You don’t have to agree to this.

Complaints

How to make a complaint

How long do I have to make a complaint?

All complaints should be made as soon as possible. However, should you decide to complain at a later stage, complaints can be made within 12 months of the event. Should a complaint be raised after 12 months, it is at the discretion of the practice to investigate your concerns after this time.

How we investigate complaints:

If you wish to raise your concern verbally and do not wish to make a formal complaint requiring a written response, a manager will try to speak to you as soon as possible. Should a manager not be available at the time, you should expect to receive a telephone call back within 2 working days to deal with your concerns.

We will listen to your concerns and try to resolve the matter to your satisfaction.

Should you wish for put your complaint in writing, we will aim to acknowledge your complaint within 2 working days to inform you that your complaint has been received and investigated.

The Practice Manager will investigate all incidents. We aim to response to you within 30 working days. Some complaints can take longer depending on the investigation. Should a response require longer, you will be notified in writing.

Our Service to Patients:

We are committed to providing a high quality service to our patients. Although most of our patients and carers are happy with the service they receive from us, we understand that at times this may not always be achieved which may lead patients, carers or their relatives feeling dissatisfied. At any time that things go wrong, please let us know so we can investigate and improve our services.

If at all possible, please speak to any member of staff about an incident, issue or dissatisfaction as soon as possible. There are times that issues can be dealt with quickly and resolved to your satisfaction without the need to complain.

Who can make a complaint?

All patients registered at the practice can make a complaint informally or formally in writing. At times, patients feel unable to do this themselves and may wish a relative or carer to complain on their behalf. Permission must be provided in writing before the practice can pursue the complaint on a patient’s behalf to ensure confidentiality is maintained.

If you do not feel satisfied with our response:

We will make every effort to try and resolve the complaint to your satisfaction. However, you may wish to ask the Independent Complaints Advocacy Service (ICAS) for independent, free advice and information, support or representation with your complaint about NHS treatment. You can contact them on: 08088023000.

If you are not happy with our response, please let us know as soon as possible to arrange a meeting or investigate further. You may wish to contact the parliamentary and Health Service Ombudsman for help on: 03450154033 or visit www.ombudsman.org.uk.

Service Improvements:

The practice continually reviews and makes changes to the services that we provide to our patients. All complaints will consider any improvements to be made to avoid repeated incidents or dissatisfaction with the care, treatment and services we provide to our patients.

Contacting us with your complaint

In Person or Telephone- Ask to speak to one of the supervisors or managers working that day. We would encourage all patients to discuss any concerns first to try and resolve any issues quickly.
In writing – Ask reception for a complaints form and write: FAO Managing Partner, Colton Mill Medical Centre, Stile Hill Way, LS15 9JH.
Online – Fill in our Online Complaint Form.

Your Personal Information

How is My Information Collected and Looked After?

Who is responsible for my information?

Colton Mill and The Grange Medical Practice is the data controller for your information and are responsible for looking after your record while you are a registered patient.
The person with the key responsibility for data protection and security is Andrea Mann, Practice Manager Colton Mill and The Grange Medical Centre, Stile Hill Way, Leeds, LS15 9JH.
The Data Protection Officer for Colton Mill and The Grange Medical Practice is Andrea Mann, Practice Manager Colton Mill and The Grange Medical Centre, Stile Hill Way, Leeds, LS15 9JH. Any queries or concerns should be raised with the practice first.
For any queries regarding GDPR please email gdpr.tfoxandpartners@nhs.net

Why do we collect information about you?

As health professionals, we maintain records about you in order to support your care. By registering with the practice, your existing records will be transferred to us from your previous practice so that we can keep them up to date while you are our patient. If you do not have a previous medical record (a new-born child or coming from overseas, for example), we will create a medical record for you. We take great care to ensure that your information is kept securely, that it is up to date, accurate and used appropriately. All of our staff are trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to.

What information do we hold about you?

Details about you, such as your name, address, carers, biological gender, gender identity, ethnic origin, date of birth, legal representatives and emergency contact details
Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
Notes and reports about your health
Details about your treatment and care
Results of investigations such as laboratory tests, x-rays, etc.
Relevant information from other health professionals, relatives or those who care for you

How is my information stored?

Our practice uses a clinical records programme called SystmOne which is where any electronic information about you will be stored. Any information held in paper records is stored securely at the practice. We use a combination of working practices and technology to ensure that your information is kept confidential and secure.

What is the legal basis that we use to process your information?

We are required to tell you the legal basis that is used for the various ways we process and use your data. The following table sets the main ways your personal data may be used and the corresponding legal basis and category of data. Each purpose is covered in more detail within this notice to explain what these mean in more practical terms.

Purpose of using personal data	Legal basis of processing	Special category of data
Provision of direct care and related administrative purposes e.g., e-referrals to hospitals or other care providers	GDPR Article 6(1)(e) – the performance of a task carried out in the public interest	GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems.
For commissioning and healthcare planning purposes e.g., collection of mental health data set via NHS Digital or local	GDPR Article 6(1)(c) – compliance with a legal obligation	GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health
For planning and running the NHS (other mandatory flow) e.g., CQC powers to require information and records	GDPR Article 6(1)(c) – compliance with a legal obligation (the GP practice) Regulation 6(1)(e) – the performance of a task carried out in the public interest (CQC)	GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health
For planning & running the NHS – national clinical audits	GDPR Article 6(1)(e) – the performance of a task carried out in the public interest	GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health
For research	GDPR Article 6(1)(f) – legitimate interests…except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject. GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 6(1)(a) – explicit consent	GDPR Article 9(2)(j) – scientific or historical research purposes or statistical purposes
For safeguarding or other legal duties	GDPR Article 6(1)(e) – the performance of a task carried out in the public interest Regulation 6(1)(c) – compliance with a legal obligation	GDPR Article 9(2)(b) – purposes of carrying out the obligations of ..social protection law.
When you request us to share your information e.g., subject access requests	GDPR Article 6(1)(a) – explicit consent	GDPR Article 9(1)(a) – explicit consent

When is my information shared? We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection legislation
Human Rights Act 1998
Common Law Duty of Confidentiality
Health and Social Care Act 2012
NHS Codes of Confidentiality, Information Security and Records Management
Information: To Share or Not to Share Review

How long does the practice hold my information?

As long as you are registered as a patient with Colton Mill and The Grange Medical Practice your paper records are held at the practice along with your GP electronic record. If you register with a new practice, they will initiate the process to transfer your records. The electronic record is transferred to the new practice across a secure NHS data-sharing network and all practices aim to process such transfers within a maximum of 8 working days. The paper records are then transferred via Primary Care Services England (operated on behalf of NHS England by Capita) which can take longer. Primary Care Services England also look after the records of any patient not currently registered with a practice and the records of anyone who has died.

Once your records have been forwarded to your new practice (or after your death forwarded to Primary Care Services England), a cached version of your electronic record is retained in the practice and classified as “inactive”. If anyone has a reason to access an inactive record, they are required to formally record that reason and this action is audited regularly to ensure that all access to inactive records is valid and appropriate. We may access this for clinical audit (measuring performance), serious incident reviews, or statutory report completion (e.g., for HM Coroner).

Change of Details

It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.

How can I see what information you hold about me?

You have a right under data protection legislation to request to see what information the practice holds about you. You also have the right to ask for inaccuracies to be corrected and in some circumstances you have the right to request that we stop processing your data. Some of these rights are not automatic and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.

If you make a Subject Access Request, we will:

describe the information we hold about you
tell you why we are holding that information
tell you who it might be shared with
at your request, provide a copy of the information in an easy to read form.

In order to request this, you need to do the following:

Your request must be made in writing – for information from the hospital you should write direct to them.
We will provide electronic copies (via online access, by email or on CDROM) free of charge.
We are required to respond to you within 1 month.

You will need to give enough information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located.

In some circumstances there may be a charge to have a printed copy of the information held about you. If this is the case, this will be discussed with you before any charge is made.

If you would like to make a Subject Access Request or have any further questions, please contact our Administration Team.

How is my information used?

For provision of direct care:

In the practice, individual staff will only look at what they need in order to carry out such tasks as booking appointments, making referrals, giving health advice or provide you with care.

Sometimes your information may be used to run automated calculations. These can be as simple as calculating your Body Mass Index but they can be more complex and used to calculate some risks to your health that we should consider with you. The ones we use in practice include Qrisk (cardiovascular risk assessment – usually following an NHS Healthcheck), Qdiabetes (diabetes risk assessment) and eFI (electronic frailty index). Whenever we use these profiling tools, we assess the outcome on a case-by-case basis. No decisions about individual care are made solely on the outcomes of these tools but they are used to help us assess and discuss your possible future health and care needs with you.

We share information about you with other health professionals where they have a genuine need for it to support your care, as follows.

Recipient of data	Reason
Leeds Hospital Foundation Trust	Secondary or emergency care
Other national providers of health care who you choose to be referred to, in consultation with your healthcare professional	Secondary or specialist care
Leeds & York Partnership Foundation Trust	Mental health & learning disability services
Mid-Yorkshire Hospitals Trust	Diabetic eye-screening services
Leeds Community Healthcare Trust	District Nursing services
NHS National Diabetes Prevention Programme	Information and lifestyle education
Local Care Direct	Out of Hours primary care provider
Leeds City Council	Social Care services
Connect for Health	Social prescribing
Reed Momenta	Provider of One You Leeds services
Forward Leeds partnership	Provider of Forward Leeds drug & alcohol services
Calibre Care Partners Ltd	Provider of extended access appointments over the telephone and at local hubs.

For commissioning and healthcare planning purposes:

In some cases, for example when looking at population healthcare needs, some of your data may be shared (usually in such a way that you cannot be identified from it). The following organisations may use data in this way to inform policy or make decisions about general provision of healthcare, either locally or nationally.

Leeds City Council: Public Health, Adult or Child Social Care Services
Embed Health Consortium (NHS commissioning support unit)
Leeds Clinical Commissioning Group
NHS Digital (Formerly known as (HSCIC)
ResearchOne Database.
Other data processors which you will be informed of as appropriate.

In order to comply with its legal obligations we may send data to NHS Digital when directed by the Secretary of State for Health under the Health and Social Care Act 2012.

This practice contributes to national clinical audits and will send the data which are required by NHS Digital when the law allows. This may include demographic data, such as date of birth, and information about your health which is recorded in coded form, for example, the clinical code for diabetes or high blood pressure.

For research purposes:

Research data is usually shared in a way that individual patients are non-identifiable. Occasionally where research requires identifiable information you may be asked for your explicit consent to participate in specific research projects. The surgery will always gain your consent before releasing any information for this purpose.

Where specific information is asked for, such as under the National Diabetes audit, you have the choice to opt of the audit.

For safeguarding purposes, life or death situations or other circumstances when we are required to share information:

We may also disclose your information to others in exceptional circumstances (ie life or death situations) or in accordance with Dame Fiona Caldicott’s information sharing review (Information to share or not to share).

For example, your information may be shared in the following circumstances:

When we have a duty to others e.g. in child protection cases.
Where we are required by law to share certain information such as the birth of a new baby, infectious diseases that may put you or others at risk or where a Court has decided we must.

When you request to see your information or ask us to share it with someone else:

If you ask us to share your data, often with an insurance company, solicitor, employer or similar third party, we will only do so with your explicit consent. Usually the requesting organisation will ask you to confirm your consent, often in writing or electronically. We check that consent before releasing any data and you can choose to see the information before we send it.

Objections/Concerns/Complaints

If you are happy for your data to be extracted and used for the purposes described in this notice then you do not need to do anything.

Should you have any concerns about how your information is managed at the practice, please contact Andrea Mann, Practice Manager.

If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website www.ico.org.uk, or email casework@ico.org.uk, or telephone 0303 123 1113 (local rate) or 01625 545 745.

Sharing Your Information

How can my information be viewed outside of Colton Mill and The Grange Medical Practice?

Your health information can be shared both locally and nationally at differing levels of detail.

For direct care locally in Leeds: Leeds Care Record Patients in Leeds are able to benefit from the sharing of information via the Leeds Care Record. This shares contact details, diagnosis list, medications, allergies, test results, referrals & letters and care plans between health professionals in Leeds. Information is shared by GP practices, the Hospital trusts, Community and Mental Health services, and Social Care.

You have the right to object to your Leeds Care Record being shared by contacting them directly. Details are available via their website.

You can opt in and out of these sharing agreements whenever you choose. Details of these schemes are as follows:

Nationally for direct care: Summary Care Record – sharing your information for your care across the NHS.
Your core Summary Care Record is created when you register at a GP practice (although you should be given the option to opt in/out during your registration). If you do not express a preference, it is currently assumed that your consent is implied.

The Summary Care Record shares only your contact details, medications and allergies with other healthcare professionals involved in your care.

You can also choose to share a Summary Care Record with Additional Information. This shares contact details, medications, allergies, diagnosis list, care plans, end of life care and immunisations with other healthcare professionals. Sensitive data is excluded. A Summary Care Record with Additional Information will only be created for you if you explicitly choose this option. All current and past information is shared for each category.

Choosing to share a summary care record with additional information is thought to be of great benefit if you are admitted to hospital locally or elsewhere in the UK.

You can opt out of sharing any of your information in a Summary Care Record. If you decide not to share this will not affect your entitlement to care. However, it could result in the delivery of your care being less efficient as other health professionals will not have access to these parts of your medical history.

You can change your mind about your Summary Care Record at any time.

Nationally: The national data-out. For purposes beyond direct care.

NHS Digital is developing a new system to support the national data opt-out which will give patients more control over how identifiable health and care information is used for reasons other than your individual care and treatment. The system will offer patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used for purposes beyond their direct care such as research and planning purposes. In the past, you may have already chosen to prevent your identifiable data leaving NHS Digital, known as a Type 2 opt-out. All existing Type 2 opt-outs will be converted to the new national data opt-out and this will be confirmed by a letter to all individuals aged 13 or over with an existing Type 2 in place. Once the national data opt-out is launched, it will no longer be possible to change preferences via local GP practices.

More information is available via https://digital.nhs.uk/national-data-opt-out

More information about health and care records in general can be found on the NHS website here: NHS Choices

If you have any queries or concerns about how your information is handled, please do not hesitate to contact Andrea Mann, Practice Manager for further information.

Heart Failure Project Privacy Notice

Privacy Notice – Colton Mill and The Grange Medical Centre Health Inequalities Heart Failure Project

Our contact details

Name: Andrea Mann

Address: Colton Mill Medical Centre

Phone Number: 0113 2951800

E-mail: colton.andthegrange@nhs.net

The type of personal information we collect

We will collect and process the following information during the pilot:

Personal identifiers; Name, Address, Postcode, Date of birth, GP Practice, NHS Number
Sensitive data; Racial or Ethnic Origin, Health Data

How we get the personal information and why we have it

The personal information we will process during the project is provided to us directly by you for one of the following reasons:

Provision of Healthcare Services

We use the information that you have given us in order to care for you.

We will share this information with the Leeds General Practice Confederation, Leeds Integrated Care Board, Leeds Community Cardiac Service and Leeds Teaching Hospitals NHS Trust to help us to carry out and evaluate the pilot.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

How we store your personal information

Your information is securely stored on our practice Medical Information System and on secure servers at the Leeds General Practice Confederation and Leeds Integrated Care Board.

We will keep information collected during the pilot for a period of two years at which point it will be anonymised and any personal data deleted from the servers on which it is kept.

Your data protection rights

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact Managing Partner Andrea Mann at colton.andthegrange@nhs.net or contact 0113 2951800 if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at Managing Partner Andrea Mann at colton.andthegrange@nhs.net or contact 0113 2951800.

You can also complain to the ICO if you are unhappy with how we have used your data.
The ICO’s address:
Information Commissioner’s Office,
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

Privacy Policy

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains:

Who we are, how we use your information and our Data Protection Officer
What kinds of personal information about you do we process?
What are the legal grounds for our processing of your personal information (including when we share it with others)?
What should you do if your personal information changes?
For how long your personal information is retained by us?
What are your rights under data protection laws?

The General Data Protection Regulation (GDPR) became law on 24th May 2016. This is a single EU-wide regulation on the protection of confidential and sensitive information. It entered into force in the UK on the 25th May 2018, repealing the Data Protection Act (1998).

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”), and the Data Protection Act 2018 (currently in Bill format before Parliament) the practice responsible for your personal data.

This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

How we use your information and the law.

The practice will be what’s known as the ‘Controller’ of the personal data you provide to us.

We collect basic personal data about you which does not include any special types of information or location-based information. This does however include name, address, contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sex during the services we provide to you and or linked to your healthcare through other health providers or third parties.

Why do we need your information?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the Practice hold about you may include the following information;

Details about you, such as your address, carer, legal representative, emergency contact details
Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
Notes and reports about your health
Details about your treatment and care
Results of investigations such as laboratory tests, x-rays etc
Relevant information from other health professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

How do we lawfully use your data?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the General Data Protection Regulation we will be lawfully using your information in accordance with:

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your de-identified information is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way.

Medicines Management

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

How do we maintain the confidentiality of your records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The General Data Protection Regulations 2016
Human Rights Act 1998
Common Law Duty of Confidentiality
Health and Social Care Act 2012
NHS Codes of Confidentiality, Information Security and Records Management
Information: To Share or Not to Share Review

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for the practice an appropriate contract (art 24-28) will be established for the processing of your information.

In Certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer in writing if you wish to withdraw your consent. If some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.

Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes.

With your consent we would also like to use your information to

We would however like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions were authorised research facilities would like you to take part on innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place. This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the practice DPO as below.

Where do we store your information Electronically?

All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information may be located on servers within the European Union.

No 3rd parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place. We have a Data Protection regime in place to oversee the effective and secure processing of your personal and or special category (sensitive, confidential) data.

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;

NHS Trusts / Foundation Trusts
GP’s
eMBED Health
Independent Contractors such as dentists, opticians, pharmacists
Private Sector Providers
Voluntary Sector Providers
Ambulance Trusts
Clinical Commissioning Groups
Social Care Services
NHS England (NHSE) and NHS Digital (NHSD)
Local Authorities
Education Services
Fire and Rescue Services
Police & Judicial Services
Voluntary Sector Providers
Private Sector Providers
Other ‘data processors’ which you will be informed of

You will be informed who your data will be shared with and in some cases asked for consent for this to happen when this is required.

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for the practice an appropriate contract (art 24-28) will be established for the processing of your information.

How long will we store your information?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.

How can you access, amend move the personal data that you have given to us?

Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.

Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example for a research project), or consent to market to you, you may withdraw your consent at any time.

Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to “erase” your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will Delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.

Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP to GP data transfer and transfer of your hard copy notes

Access to your personal information

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

Your request should be made to the Practice – for information from the hospital you should write direct to them
There is no charge to have a copy of the information held about you
We are required to respond to you within one month
You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

What should you do if your personal information changes?

You should tell us so that we can update our records please contact the Practice Manager as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

Accessibility

Supporting patients who have disabilities, including physical accessibility, mental health needs, learning disability, neurodiverse conditions (this includes for example people with autism, ADHD, Tourette’s, dyslexia) and arrangements for sensory disabilities.

Every effort will be made to support patients and carers who require reasonable adjustments and adaptations to attend the service including

Early or later appointments
Longer appointments for patients with special needs, mental health or disabilities who may require longer to carry out the procedure in a safe and supportive environment
Quiet clinics for childrens’ reviews, immunisations or learning disability assessments. These may be small clinics when other services are not on to ensure children with sensory impairments or neurodiversity can be seen in a suitable environment. We also have practice leads for learning disabilities and mental health needs to support clinics and adaptations required
Translation services with language line or interpreter apps
Medical records can record patients preferred name or title
Hearing loop
Staff who are trained/training in sign language
Reception champions for dementia, carers, mental health, learning disabilities, domestic abuse to recognise patients or carers attending the service who may need assistance
Hydraulic couch for patients who require assistance or have a disability
Patient gowns for privacy and dignity including changing area
Wheelchair
Ground floor clinic
Posters displayed with the practice policy on accessible standards including website
Easy read leaflets, large print, email, text or telephone communication to meet the patients communication needs

Access

There is access through the main door at both sites on the ground floor. There are no steps into the building. We have a wheelchair available for use in surgery.

Colton Mil has automatic doors to the entrance.

Assistance can be provided by reception to and from your car if required.

Disabled parking bays are available at both the Grange and Colton Mill site near the entrance.

Hearing Difficulties

If you are experiencing hearing difficulties when being called in to see the doctor or nurse, please do let us know in order for us to set up an alert on your medical records and personally collect you from the waiting room.

The practice has installed a hearing loop. If you would like to use this, please ask at reception for assistance.

We can arrange for someone to support you book appointments, make enquires or in your consultations using British sign language. Some of our staff are also training in BLS.

The call screens will beep when called but also state your name, name of the person you are seeing and room number. If you are hard of hearing, please monitor the call screen for your name being called or inform reception to let you know.

Interpreter

If you do not speak English and require an interpreter, please inform reception so we can arrange a double appointment and for language line to support you in your appointment or arranging appointments. Please let reception know your preferred language so we can update your medical records.

Large Print and Easy Read

Those who are visually impaired or find large print or easy read documents helpful, we can provide a range of documents to support you with your medical care. Please let reception or practitioner know your preferences.

How to request website content in an accessible format

If you need information on from our website in a different format like accessible PDF, large print, easy read, audio recording or braille, you can contact us by:

Email: colton.andthegrange@nhs.net

This inbox is only for accessibility queries. This inbox is not for technical queries or IT problems.

Enforcement procedure

The Equality and Human Rights Commission (EHRC) is responsible for enforcing the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 (the ‘accessibility regulations’).

If you’re not happy with how we respond to your complaint, contact the Equality Advisory and Support Service (EASS).

Personal Data & IT Policy

The following IT systems are in use at the practice:

Referral Management (using NHS numbers in referrals)
Electronic Appointment Booking (the facility to book routine appointments online and, similarly, to cancel appointments
Online booking of repeat prescriptions
Summary Care Record (uploading details of your current medication and allergies to the national “spine” so that these are available for doctors involved in your care elsewhere)
GP to GP transfers (the electronic transfer of records from practice to practice when you re-register
Patient Access to records (the facility to view your medical records online)

If you would like access to your medical records enabled or would like to opt out of the local or national summary care record, please contact reception.

This practice is committed to preserving, as far as is practical, the security of data used by our information systems. This means that we will take all reasonable actions to:

Maintain the Confidentiality of all data within the practice by:

Ensuring that only authorised persons can gain access to our systems
Not disclosing information to anyone who has no right to see it

Maintain the integrity of all data within the practice by:

Taking care over input
Ensuring that all changes are reported and monitored
Checking that the correct record is on the screen before updating
Reporting all apparent errors and ensuring that they are resolved

Maintain the availability of all data by:

Ensuring that all equipment is protected from intruders
Ensuring that backups are taken at regular, predetermined intervals
Ensuring that contingency is provided for possible failure or equipment theft and that any such contingency plans are tested and kept up to date

Additionally we will take all reasonable measures to comply with our legal responsibilities under:

Chaperone Policy

We will always respect your privacy, dignity and your religious and cultural beliefs particularly when intimate examinations are advisable – these will only be carried out with your express agreement and you will be offered a chaperone to attend the examination if you so wish.

You may also request a chaperone when making the appointment or on arrival at the surgery (please let the receptionist know) or at any time during the consultation.

Confidentiality & Data Protection

You can be assured that anything you discuss with any member of the surgery staff, whether doctor, nurse or receptionist, will remain confidential. Even if you are under 16, nothing will be said to anyone, including parents, other family members, care workers or teachers, without your permission. The only reason why we might want to consider passing on confidential information without your permission would be to protect either you or someone else from serious harm. In this situation, we would always try to discuss this with you first.

If you have any worries or queries about confidentiality, please ask a member of staff.

If you would like to discuss matters of a confidential nature, either with our receptionists or a member of the dispensary team, we have a side room available in reception for this purpose.

Data Protection

We need to hold personal information about you on our computer systems and in paper records to help us to look after your health needs, and your doctor is responsible for their accuracy and safe-keeping. Please help to keep your record up to date by informing us of any changes to your circumstances.

Doctors and staff in the practice have access to your medical records to enable them to do their jobs. From time to time information may be shared with others involved in your care if it is necessary. Anyone with access to your record is properly trained in confidentiality issues and is governed by both legal and contractual duty to keep your details private.

All information about you is held securely and appropriate safeguards are in place to prevent accidental loss.

In some circumstances we may be required by law to release your details to statutory or other official bodies, for example if a court order is presented, or in the case of public health issues. In other circumstance you may be required to give written consent before information is released – such as for medical reports for insurance, solicitors etc.

To ensure your privacy, we will not disclose information over the telephone or fax unless we are sure that we are talking to you. Information will not be disclosed to family, friends or spouses unless we have prior written consent, and we do not leave messages with others.

You have a right to see your records if you wish. Please ask at reception if you would like further details about our patient information leaflet. An appointment may be required. In some circumstances a fee may be payable.

Practice Data Protection Policies

Data Protection Certificate

Privacy Notice April 2023

Easy Read Privacy Notice April 2023

SAR Policy April 2023

FOI Policy April 2023

Confidentiality and Data Protection Policy April 2023

Data and Information Security Policy April 2023

Data Quality Policy April 2023

Network Security Policy April 2023

Zero Tolerance Policy

The Practice takes it very seriously if a member of staff is treated in an abusive or violent way.

The Practice supports the government’s ‘Zero Tolerance’ campaign for Health Service Staff. This states that GPs and their staff have a right to care for others without fear of being attacked or abused. To successfully provide these services a mutual respect between all the staff and patients must be in place. Dealing with people who are abusive or aggressive towards our staff and our patients, takes us away from caring for you. All our staff aim to be polite, helpful, and sensitive to all patients’ individual needs and circumstances. The staff understand that ill patients do not always act in a reasonable manner and will take this into consideration when trying to deal with a misunderstanding or complaint.

However, aggressive behaviour, be it violent or abusive, will not be tolerated and may result in you being removed from the Practice list and, in extreme cases, the Police being contacted. We have the right to refuse treatment and take further action against anyone who threatens the safety of our staff and our patients.

In order for the practice to maintain good relations with their patients the practice would like to ask all its patients to read and take note of the occasional types of behaviour that would be found unacceptable:

Using bad language or swearing at practice staff
Any physical violence towards any member of the Primary Health Care Team or other patients, such as pushing or shoving
Verbal abuse towards the staff in any form including verbally insulting the staff
Racial abuse and sexual harassment will not be tolerated within this practice
Persistent or unrealistic demands that cause stress to staff will not be accepted. Requests will be met wherever possible and explanations given when they cannot
Causing damage/stealing from the Practice’s premises, staff or patients
Obtaining drugs and/or medical services fraudulently

As a result of other GP surgeries facing the same unprecedented abuse and aggression from patients, a new campaign has been launched. We would encourage you can listen and share the experiences of receptionists by watching the video attached.

Finally, we ask you to treat your GPs and their staff courteously at all times.

The Receptionist Campaign – (Abuse should not be in a day’s work.)

We’ve launched a new campaign to make our community aware of the hate that our Reception team encounter on a daily basis. We want to ensure that everyone knows we will not accept any abuse or aggression aimed at NHS staff or at our patients.

These posters show (only some) genuine quotes of sarcastic, aggressive, personal and disrespectful comments that our team have experienced during their career as a receptionist. (We apologise in advance for the language you see in these images.)

Our staff, just like you have feelings. *So please be kind, for everyone you meet is fighting a battle you know nothing about.* We must support each other and create mutual respect.

Dealing with people who are abusive or aggressive towards our staff and our patients, takes us away from caring for you. Let’s work together to ensure abuse and aggression is #NotInADaysWork.

Training Practice

GPs in Training

Our practice is approved to train fully qualified doctors who wish to specialise in general practice. Our GP registrar will have had 2-4 years of experience as a qualified hospital doctor working in various specialities. They consult patients on their own, under the mentorship of our trainer. Occasionally we ask permission to video a consultation. You will always be asked in advance and are given the option not to take part, and this will not affect your care in any way. No recording will be taken without your consent and the camera will be switched off on request. These videos are used only for educational purposes with the doctor doing the consultation and are destroyed after use.

Medical Students

Medical students are sometimes attached to the practice for 2 – 3 weeks as part of their training. If you do not wish a student to be present during your consultation, please inform the receptionist.