You have a right to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. From May 2018, there will usually be no charge to see the information that the practice holds about you unless the file is particularly large.

In order to request this, you need to make a request to the practice.

You may find it helpful (though it is not mandatory) to use the Subject Access Request form available from reception or at the following link which provides the practice with the relevant information needed to be able to grant the request. Subject Access Request Form

The practice will respond to you within one month of receipt of your request. You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located.

For information on your hospital records you should write direct to them.

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

From May 2018, a new European regulation called the General Data Protection Regulation came into force and the practice also has a legal responsibility to ensure that we will also comply with these new regulations about personal data.

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• General Data Protection Regulation 2017
• Data Protection Act 2018
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• NHS Codes of Confidentiality, Information Security and Records Management
• Information: To Share or Not to Share Review

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances such as a life or death situation, or where the law requires information to be passed, or where it is in the best interest of the patient to share the information.

COVID 19 PANDEMIC

As part of the NHS Digital response to the Covid 19 Pandemic, arrangements have been made for GP Practices in England to access the GP Connect functionality.  Confidential patient information can be processed for the purposes as set out in Regulation 3(1) of the Control of Patient Information (COPI) to support the Secretary of State’s response to Covid 19 (Covid 19 purpose).  This notice will remain in place until 31 October 2022.  Information can be shared under the regulations by GPs, NHS Digital and NHS England.

Further information on the COPI notice and the Covid-19 purpose can be obtained at: https://www.gov.uk/government/publications/coronavirus-covid-19-notification-to-organisations-to-share-information/coronavirus-covid-19-notice-under-regulation-34-of-the-health-service-control-of-patient-information-regulations-2002

If you feel that the personal data that the practice holds about you is inaccurate or incomplete then please let us know and we will update your records within one month of notification. If this incorrect information has been sent onwards, we will also inform any other organisations of this. If it is not possible to correct the information then we will write to you to let you know the reason behind the decision and inform you how you can complain about this.

In specific circumstances, as an individual you also have the right to request the deletion or removal of information the practice keeps about you. This may be where you withdraw your consent for the practice to hold the information, if it is no longer relevant, or where there is a legal obligation to remove the data.

Secretary of State for Health and Social Care has asked NHS Digital to establish and operate an information system for the collection and analysis of General Practice data for health and social care purposes. The original launch date was 23 June 2021 but this has now been pushed back until 1 September 2021.

NHS Digital has been directed to collect, process, analyse and disseminate general practice data. The data collection process is moving from the existing GP Extraction Service (GPES) to a new service, the General Practice Data for Planning and Research. The BMA, RCGP and National Data Guardian have been involved in this process.

This is a legal process. GP practices cannot opt out of this data extraction. The data will be used for:

1. Research the long term impacts of coronavirus on the population;
2. Analyse health care inequalities – for example to understand how people of different ethnicities access healthcare and how health outcomes in these groups compare to the rest of the population; and
3. Research and develop cures for serious illnesses

Patient identifiable information will be pseudonomised before it leaves the practice. This is a process which takes personally identifiable data and changes it so that it cannot be attributed back to a specific person without additional processing.

Data collected will include NHS number, local patient ID, postcode, date of birth and date of death. Additional coded special category data will also be collected including Physical / Mental Health or Condition, Sexual Life / Orientation, Family / Lifestyle / Social Circumstance, Religion or Other Beliefs and Racial / Ethnic Origin.

Some data will not be collected. This data includes Name and Address, Written notes (free text), Images, letters and documents and Legally restricted codes for Gender Recognition, Human Fertilisation and Embryology. None of these items will be collected.

There are two types of opting out:

1. Type 1 Opt Out – this is a patient opting out of NHS Digital Collecting your data. Patients can follow this link and print out a form to pass back to their GP Surgery: https://nhs-prod.global.ssl.fastly.net/binaries/content/assets/website-assets/data-and-information/data-collections/general-practice-data-for-planning-and-research/type-1-opt-out-form.docx

2. National Data Opt Out – opting out of NHS Digital Sharing your confidential data including GP data and Hospital data. To Opt Out a patient needs to follow the link below: https://www.nhs.uk/your-nhs-data-matters/ and do this online themselves. They must be over 13 years of age, have access to email/mobile phone and have their NHS number to do this.

For further information, please follow this link: https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research#top

All GP practices are required to declare the mean earnings (e.g. average pay) for GPs working to deliver NHS services to patients at each practice.

The average pay for GPs working in Testvale Surgery in the last financial year was £81,669 before tax and National Insurance. This is for 1 full time GP and 10 part time GPs who worked in the practice for more than six months.

We use Heidi Healthcare AI transcribing software during consultations.

The purpose of Heidi Health transcribing software is to transcribe audio recordings of consultations, meetings, or other interactions within the practice. This software helps improve the accuracy and efficiency of record-keeping and provides a reliable means of documenting key information discussed during appointments. It allows the clinician to focus on their patient rather than on the computer.

These recordings are transcribed into text for the purpose of creating accurate and detailed records and integrated into the patient medical record. All transcriptions are treated as confidential information, in line with our broader privacy and data protection policies. We ensure that the Heidi Healthcare AI system we use complies with NHS data security standards.

You have the right to request for the transcribing software not to be used during a consultation. If you have any concerns regarding the processing of your information, or if you wish to exercise your rights to opt out, please contact us.

he national data opt-out is a new service that allows patients to choose whether or not to allow their confidential patient information being used for research and planning. All NHS organisations must be compliant by September 2021.

If you don’t want your confidential patient information to be used for research and planning, you can opt out of this. If you do opt out, there are some specific situations where your data may still be used. Data that does not identify you may still also be used.

Your confidential patient information will still be used to support your individual care. Any preference you set using this service will not change this.

If you opt out, your decision will only apply within the health and care system in England. Your opt-out will not apply to your health data where you have accessed health or care services outside of England, such as in Scotland and Wales.

You can manage your choice by using the online service at the following address: Your NHS Data Matters or you can or request a print-and-post form to make or change your choice at any time.

A useful video outlining the National Data Opt Out Programme can be seen here:

Introduction  

 This leaflet explains who we are, why information is collected about you, the ways in which this information may be used, who it is shared with and how we keep it safe. It also explains how the practice uses the information we hold about you, how you go about accessing this information if you wish to see it and to have any inaccuracies corrected or erased. 

Who we are 

 Testvale Surgery is a well-established GP surgery based in Totton on the outskirts of Hampshire. Our staff of General Practitioners and Nurses provides primary medical care services to our practice population of 13150 patients and our administrative and managerial staff support the team in providing care for patients. 

WHAT INFORMATION DO WE COLLECT FROM YOU? 

 GP Records are stored electronically and on paper and include personal details about you such as your address, carers, legal representatives, emergency contact details, as well as: 

• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments and telephone calls 

• Notes and reports about your health 

• Details about your treatment and care 

• Details about any medication you are taking 

• Results of investigations such as laboratory tests, x-rays 

• Relevant information from other health professionals, relatives or those who care for you 

WHY DO WE COLLECT THIS INFORMATION? 

 Your records are used to ensure you receive the best possible care from our nurses and doctors. It enables the staff to see previous treatments, medications and enables them to make informed decisions about future decisions about your care. It helps the doctors to see lists of previous treatments and any special considerations which need to be taken into account when care is provided.  

 Important information is also collected to help us to remind you about specific treatment which you might need, such as health checks, or reminders for screening appointments such as cytology reminders.  

 Information held about you may be used to help protect the health of the public and to help us to improve NHS services. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided. 

 Staff at the practice use your information to help deliver more effective treatment to you and to help us to provide you with proactive advice and guidance. 

Who MIGHT WE share your information with? 

 There are a number of ways information collected about you is shared, which includes: 

1. Patient referrals 

With your agreement, your GP or Nurse may refer you to other services and healthcare providers not provided by the practice, or they may work with other services to provide your care in the practice. Once you have been seen for your referral, the other health care provider will normally tell us about the treatment they have provided for you and any follow up which the GPs need to provide. This information is then included in your GP record. 

1. Local Hospital, Community or Social Care Services 

 Sometimes the clinicians caring for you need to share some of your information with others who are also supporting you. This could include hospital or community based specialists, nurses, health visitors, therapists or social care services. 

1. Summary Care Record (SCR)  

 A Summary Care Record is an electronic record of important patient information, created from the GP medical records. It contains information about medication you are taking, any allergies you suffer from and any bad reactions to medications you have previously had. It can be seen and used by authorised staff in other areas of the health and care system involved in your direct care. Giving healthcare staff access to this information can prevent mistakes being made when caring for you in an emergency or when your GP practice is closed. Your Summary Care Record also includes your name, address, date of birth and your unique NHS Number to help identify you correctly. If you and your GP decide to include more information it can be added to the Summary Care Record, but only with your express permission. For more information visit https://digital.nhs.uk/summary-care-records/patients 

1. Care and Health Information Exchange (CHIE) 

 The CHIE is an electronic summary record for people living in Hampshire, Portsmouth and Southampton. GP Surgeries, hospitals, social care and community care teams collect information about you and store it electronically on separate computer systems. The Care and Health Information Exchange stores summary information from these organisations in one place so that – with your consent – professionals can view it to deliver better care to you. This record contains more information than the SCR, but is only available to organisations in Hampshire. For more information Visit  https://careandhealthinformationexchange.org.uk/  

1. National Services 

 There are some national services like the National Cancer Screening Programme that collect and keep information from across the NHS. This is how the NHS knows when to contact you about services like cervical, breast or bowel cancer screening. Often you have the right to not allow these organisations to have your information.  

You can find out more about how the NHS holds and shares your information for national programmes on the NHS Choices website. https://www.nhs.uk/using-the-nhs/about-the-nhs/your-choices-in-the-nhs/ 

1. Other NHS organisations 

 Sometimes the practice shares information with other organisations that do not directly treat you, for example, Clinical Commissioning Groups. Normally, it will not be possible to identify you from this information. This information is used to plan and improve services. The information collected includes data such as the area patients live, age, gender, ethnicity, language preference, country of birth and religion. The CCG also collects information about whether patients have long term conditions such as diabetes; blood pressure, cholesterol levels and medication. However, this information is anonymous and does not include anything written as notes by the GP and cannot be linked to you. 

1. Telephone Calls 

 All our incoming telephone calls are recorded for training and monitoring purposes for a period of 6 months. These are held on a secure, password encrypted hard drive and are deleted at the end of the retention period. 

1. General Practice Data for Planning and Research 

1. Local Data Sharing Agreements 

The practice currently has three data sharing agreements which are in place: 

1. Southern Health NHS Foundation Trust, our community services provider; 

 This agreement allows the Integrated Care Teams (community nurses, physiotherapists and occupational therapists) being able to access GP information about people on their caseload who have recently been discharged from hospital or who are housebound, or who require longer term rehabilitation from the GP record. This information can be read by the healthcare professional to improve the patients care, but they are not able to amend the GP medical record. 

1. Totton Primary Care Network 

 An agreement has been developed between Testvale Surgery and New Horizons Medical Partnership (Totton Health Centre and Forestgate Surgery) to allow sharing patient information for our social prescriber and clinical pharmacist which will be shared between the organisations. This will also make it easier for patients to be seen at any GP practice in Totton should it be necessary, for example, during extended hours periods. 

1. Southern Health Foundation Trust – Frailty Support Team 

 The SHFT Frailty Team have access to the patient records at the practice to enable them to review the clinical information to provide support to appropriate patients.  They will also maintain a record within the SHFT clinical record. The legal basis for this sharing falls under 6.1.e – under authority of a contract to deliver NHS services and 9.2.h – delivery and management of direct health care. Common Law Duty of Confidence – explicit consent 

1. Other local agreements 

 Testvale Surgery has an agreement to allow the medicines management team at West Hampshire CCG to access the clinical system to view prescribing data for the practice and to undertake medication reviews on specific patients. The medicines optimisation team also undertakes prescribing audit on behalf of the practice. This information is used to help improve quality, safety and cost effectiveness of prescribing. 

 Testvale Surgery has agreed a memorandum of understanding with West Hampshire CCG in regard to the Referral Support Service. This service assists the practice in improving the quality and accuracy of referrals made by our clinical team. All referrals (excluding urgent cancer referrals) are made through the service, which co-ordinates the most appropriate clinic for the patient to be seen in to enable the patient to be seen in the right place, first time. Additionally feedback is provided to the referring clinician where required to help improvements in future referrals. 

 Solent Mind. All patients with Serious Mental Illness are required to have a physical health check each year, this ensures their general health is managed which otherwise could deteriorate as a result of their mental illness. Solent Mind carry out some of the health checks on behalf of our practice. Legal basis – 6.1.e under the NHS Contract. Lawful basis – 9.2.h to manage patient health care. 

What do we do with your information?  

 The healthcare professionals who provide your care maintain records about your health.  This is a record of your care history and allows health care professionals to review your care to help inform future decisions about your treatment. Sharing this information helps to improve the treatment you receive, such as a hospital consultant writing to your GP.   We follow strict data sharing guidelines to keep your information safe and secure.  

HOW LONG DO WE KEEP YOUR INFORMATION? 

 Health and social care records are subject to a nationally agreed code of practice which regulates the minimum period for which records must be kept. This specifies that GP record should be retained until 10 years after the patient’s death or after the patient has permanently left the country, unless they remain in the European Union. Electronic patient records must not be destroyed or deleted for the foreseeable future. For more information, see the records management code of practice:  https://www.nhsx.nhs.uk/information-governance/guidance/records-management-code/  

How do we keep your information safe? 

 Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential. We are committed to protecting your privacy and will only use information collected lawfully in accordance with: 

• UK General Data Protection Regulation 2018 

• Data Protection Act 2018 

• Human Rights Act 1998 

• Common Law Duty of Confidentiality 

• Health and Social Care Act 2012 

• NHS Codes of Confidentiality, Information Security and Records Management 

• Information: To Share or Not to Share Review 

 We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances such as a life or death situation, or where the law requires information to be passed, or where it is in the best interest of the patient to share the information. 

YOUR INDIVIDUAL RIGHTS 

The practice does not engage in any direct marketing, profiling or use any automated decision making tools.  

1. HOW CAN I ACCESS THE INFORMATION YOU HOLD ABOUT ME? 

 You have a right under the Data Protection legislation to request access to obtain copies of all the information the surgery holds about you. You are also allowed to have information amended should it be inaccurate.  

 In order to access your medical record, you need to let the practice know by making a Subject Access Request (SAR). 

 The practice will respond to your request within one month of receipt of your request. You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located. 

 It will be very helpful to the practice if you could specify any particular information you need so we can provide the information to you as soon as possible. We have designed a form for patients to help them to identify the information they require and completing this form will help us process this information efficiently. 

 Usually there is no charge to see the information that the practice holds about you unless the request is excessive or complicated. 

 For information about your hospital medical records, you should write direct to them.  

1. HAVE INACCURACIES CORRECTED OR ERASED 

 If you feel that the personal data that the practice holds about you is inaccurate or incomplete then please let us know and we will update your records within one month of notification. If this incorrect information has been sent onwards, we will also inform any other organisations of this. If it is not possible to correct the information then we will write to you to let you know the reason behind the decision and inform you how you can complain about this.  

 If you feel information in your health record should not be there, you can ask the practice to erasure that information. We will look at each request specifically.  Please bear in mind there may well be legal reasons why we will need to keep data even if you request it to be erased.  We will explain this to you in detail in our response. 

1. DATA PORTABILITY 

 You have the right to access your data in a format which allows you to re-use and share it with other organisations should you wish. As such, we will provide your data in a structured, commonly used and machine readable form. 

1. RIGHT TO OBJECT  

 As a patient, you have the right to object to personal data about you being used or shared.  

 You also have the right to restrict the use of data the practice holds about you. If you do wish to object, please contact the practice. This will prevent your confidential information being used other than where necessary by law. 

 If you are a carer and have a Lasting Power of Attorney for health and welfare then you can also object to personal data being used or shared on behalf of the patient who lacks capacity.  

 If you do not hold a Lasting Power of Attorney then you can raise your specific concerns with the patient’s GP. If you have parental responsibility and your child is not able to make an informed decision for themselves, then you can make a decision about information sharing on behalf of your child. If your child is competent then this must be their decision.  

Do I need to do anything?  

 Note your decisions on the enclosed form and return to Reception. You can change your mind at any time, just complete another form. 

1. National Data Opt Out 

 The national data opt-out is a new service that allows patients to choose whether or not to allow their confidential patient information being used for research and planning. 

 If you don’t want your confidential patient information to be used for research and planning, you can opt out of this. If you do opt out, there are some specific situations where your data may still be used. Data that does not identify you may still also be used. 

 Your confidential patient information will still be used to support your individual care. Any preference you set using this service will not change this. 

 If you opt out, your decision will only apply within the health and care system in England. Your opt-out will not apply to your health data where you have accessed health or care services outside of England, such as in Scotland and Wales. 

 You can manage your choice by using the online service at the following address https://www.nhs.uk/your-nhs-data-matters/ or you can or request a print-and-post form to make or change your choice at any time.  

 A useful video outlining the National Data Opt Out Programme can be seen here: 

 https://www.youtube.com/watch?v=0BwUsKDqPQ8&feature=youtu.be 

Objections / Complaints 

 Should you have any concerns about how your information is managed at the practice, please contact Chris Gwyther, Practice Manager. The practice will listen to your concerns and try and act upon the concerns raised as best we are able. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website: www.ico.gov.uk 

 Changes to Privacy Policy  

We keep our privacy policy under regular review and we will place any updates on this web page. This privacy policy was last updated in February 2023.  

Purpose – To support research oriented proposals and activities in our commissioning system

Legal Basis – Your consent will be obtained by the organisation holding your records before identifiable information about you is disclosed for any research. If this is not possible then the organisation wishing to use your information will need to seek formal approval from The Independent Group Advising on the Release of Data (IGARD) Digital NHS UK – IGARD

We may write to you offering you the opportunity to take part in research, for which your consent will be sought.

As a patient, you have the right to object to personal data about you being used or shared.

You also have the right to restrict the use of data the practice holds about you. If you do wish to object, please contact the practice. This will prevent your confidential information being used other than where necessary by law.

If you are a carer and have a Lasting Power of Attorney for health and welfare then you can also object to personal data being used or shared on behalf of the patient who lacks capacity.

If you do not hold a Lasting Power of Attorney then you can raise your specific concerns with the patient’s GP. If you have parental responsibility and your child is not able to make an informed decision for themselves, then you can make a decision about information sharing on behalf of your child. If your child is competent then this must be their decision.

Introduction

Totton Primary Care Network is committed to protecting and respecting your privacy. This privacy notice explains how we collect, use, and protect your personal information during the recruitment process. By applying for a position with us, you consent to the collection and processing of your personal data in accordance with this notice.

Data Controller

The data controller responsible for your personal information is:

• Totton Primary Care Network
• Testvale Surgery, 12 Salisbury Road, Totton, Hampshire SO40 3PY
• Email: katrina.churcher@nhs.net | Telephone: 023 8086 6999

Information We Collect

As part of the recruitment process, we may collect the following personal data:

• Personal details:
  Name, address, telephone number, email address.
• Job application details:
  CV, cover letter, qualifications, work experience, and references.
• Equal opportunities monitoring information:
  Gender, age, ethnicity, disability status (if provided voluntarily).
• Health information:
  For specific roles, we may collect medical information (e.g., whether you have a disability to ensure reasonable adjustments can be made).
• Criminal records check:
  In certain circumstances, we may ask for a DBS (Disclosure and Barring Service) check or similar security clearance for specific roles.

How We Use Your Information

We will use your personal data for the following purposes:

• To assess your suitability
  for the position you have applied for.
• To communicate with you
  during the recruitment process, including interviews, assessments, and job offers.
• To comply with legal obligations
  related to employment, such as verifying your identity and conducting DBS checks.
• To comply with equal opportunities laws,
  including monitoring diversity and inclusion.

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Contractual necessity:
  To take steps at your request prior to entering an employment contract.
• Legal obligation:
  To meet employment and recruitment regulations.
• Consent:
  Where you provide voluntary information (e.g., equal opportunities data).
• Legitimate interests:
  To ensure we can assess your suitability for the role and maintain a fair recruitment process.

Sharing Your Information

We may share your information with:

• Third-party service providers
  that support our recruitment process (e.g., recruitment software platforms, background check providers).
• Regulatory authorities or government bodies
  as required by law, such as the DBS for criminal record checks.
  We will not share your personal information with any other third parties without your consent, unless required by law.

Retention of Your Information

We will keep your personal information for no longer than necessary. Typically, we will retain your data for up to 6 months after the recruitment process concludes. If you are successful in your application, your data will be retained as part of your employment record in accordance with our employee privacy notice.

Your Rights

You have the following rights concerning your personal data:

• Right to access:
  You can request copies of your personal data.
• Right to rectification:
  You can request corrections to any inaccuracies in your personal data.
• Right to erasure:
  You can request the deletion of your personal data, subject to certain conditions.
• Right to restriction:
  You can request the restriction of processing of your personal data in some cases.
• Right to object:
  You can object to the processing of your personal data for legitimate interests or marketing purposes.
• Right to data portability:
  You can request a copy of your personal data in a structured, commonly used format.

If you wish to exercise any of these rights, please contact us using the details provided at the beginning of this notice.

Security of Your Information

We implement appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. However, please note that no system is completely secure, and we cannot guarantee the security of your personal data.

Changes to This Privacy Notice

We may update this privacy notice from time to time. Any changes will be communicated to you as appropriate and will be available on our website or other appropriate channels.

Contact Us

If you have any questions or concerns about how we handle your personal data, or if you wish to exercise any of your data protection rights, please contact us at:

Totton Primary Care Network
Testvale Surgery, 12 Salisbury Road, Totton, Hampshire SO40 3PY Email: katrina.churcher@nhs.net | Telephone: 023 8086 6999

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection authority.