Data Security & Protection
Statement of Policy which will apply:
The Policy
- The Practice is committed to security of patient and staff records.
- The Practice will display a poster in the waiting room, explaining the practice policy to patients.
- The Practice will make available a brochure on Access to Medical Records and Data Protection for the information of patients.
- The Practice will take steps to ensure that individual patient information is not deliberately or accidentally released or (by default) made available or accessible to a third party without the patient's consent, unless otherwise legally compliant.
This will include training on Confidentiality issues, DPA principles, working security procedures, and the application of Best Practice in the workplace.
- The Practice will undertake prudence in the use of, and testing of, arrangements for the backup and recovery of data in the event of an adverse event.
- The Practice will maintain a system of "Significant Event Reporting" through a no-blame culture to capture and address incidents which threaten compliance.
- DPA issues will form part of the Practice general procedures for the Management of Risk.
- Specific instructions will be documented within confidentiality and security instructions and will be promoted to all staff.
Download Data Security & Protection Policy HERE
View our Privacy Notice HERE
NHS Data Sharing
Your Summary Care Record and Medical Interoperability Gateway (MIG) is a short summary of your GP medical records. It tells other health professionals who care for you about the medicines you take and your allergies. This means they can give you better treatment if you need healthcare away from your usual doctor's surgery.
What information do we share?
- Patient demographics. e.g. name, date of birth
- Summary, including current problems, current medical, allergies and recent tests.
- Problem View
- Diagnosis view
- Medical including current and past issues
- Risks and Warnings
- Procedures
- Investigations
- Examination (Blood Pressure Only)
- Events consisting of encounters, admissions and referrals
--------------------------------------------------------------------------------------------
Patient Accessibility to Medical Records
Patients with an online account will automatically get access to their full prospective GP health record, from 1 February 2023 including free text, letters, and documents. Patients will see new information once it is entered, or filed, onto their record in the clinical system.
Patients will not see their historic, or past, health record information unless they have already been given access to it by their GP practice.
Patients that currently have access to their GP medical records online these permissions will remain the same for historic access, although prospective record access will automatically be available to patients from February 2023.
Who can get access to their medical record?
Only people aged 16 years or older and who are registered with a GP in England will automatically have access to their full GP record via the NHS App or any other approved patient facing service apps.
Patients can download the NHS App, if they wish to use third-party apps these may require the login details that are provided by their GP practice (pin or linkage key) or they may be able to register using NHS Login if the product is integrated.
Information on how to download the NHS App or open the NHS website to access their NHS account in a web browser can be found here: https://www.nhs.uk/nhs-app/.
Patients with online accounts set up before their 16th birthday will receive access to records entered after their 16th birthday when they turn 16. If you judge a particular young person to be sufficiently competent to have access to their own records before they reach the age of 16, we can manually allow them to access information on the NHS App or any other approved patient facing service apps.
What will a new patient see if moving from another practice?
When a patient registers at a new GP practice from 1 February 2023, they will lose any access they had to historical information but will automatically get access to their future record in full, from the date they join that practice. If a patient would like to access their historical information (detailed coded record or full), they will have to request this, and the new practice will need to review before granting access.
Third Part information
Within the patient record there is also third-party information stored from other providers which the practice is not the data controller for and we are not required to divulged any of this information to patients, this is the responsibility of the data controllers from where this information was inputted.
Patients must contact the relevant service for information they require.