Author	Samantha Pearce	
Revision Date	October 2020	
Version Number	Version 3	

GDPR PRIVACY NOTICE

As a result of a revision of the Data Protection Act 1988, the new General Data Protection Regulation (GDPR) requires Cadbury Heath Healthcare to ensure that our patients and employees are aware of what personal data we hold on them, how we collect that data and with whom it is shared.

Our Data Controller is:  Cadbury Heath Healthcare
The GDPR Lead is: Kath Horne
The Caldicott Guardian is: Dr Cheryl Atter
The Data Protection Officer is:  Samantha Pearce

How we use your personal information

This fair processing notice explains why Cadbury Heath Healthcare collects information about you and how that information may be used. 

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare. 

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of paper records and computerised data to ensure that your information is kept confidential and secure. 

Records which we hold about you may include the following information; 

• Details about you, such as your address, carer, legal representative, emergency contact details 
• any contact the surgery has had with you, such as appointments, clinic visits, emergency 
  appointments, etc. 
• Notes and reports about your health 
• Details about your treatment and care 
• Results of investigations such as laboratory tests, x-rays etc 
• Relevant information from other health professionals, relatives or those who care for you 

To ensure you receive the best possible care, your records are used to facilitate the care you receive. 

Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing any personal data for this purpose. 

The surgery may also use your clinical information to conduct internal clinical audits to monitor the quality of the service we provide. All information is collated anonymously and is not shared with outside agencies.

Risk Stratification 

Risk stratification tools are increasingly being used in the NHS to help determine a person’s risk of suffering a particular condition, preventing an unplanned admission or identifying a need for intervention. 

Information about you is collected from a number of sources including Cadbury Heath Healthcare. A risk score is then arrived at through an analysis of your information using software managed by EMIS Health, and is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary your GP may be able to offer you additional services. 

Medicines Management 

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost effective treatments. 

How do we maintain the confidentiality of your records? 

We are committed to protecting your privacy and will only use information collected lawfully in accordance with: 

• General Data Protection Regulations (GDPR)
• Data Protection Act 1998 
• Human Rights Act 1998 
• Common Law Duty of Confidentiality 
• Health and Social Care Act 2012 
• NHS Codes of Confidentiality, Information Security and Records Management 

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential. 

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the new General Data Protection Regulations (GDPR)

Who are our partner organisations that we share data with for Direct Care purposes? 

We hold your Patient data under a duty of confidence. We generally operate on the basis of implied consent to use patient data for the purposes of direct care. This does not change under the new GDPR Regulations.

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations; 

• NHS Trusts / Foundation Trusts 
• Other GP Surgeries 
• BNSSG CCG
• Independent Contractors such as dentists, opticians, pharmacists 
• Private and Voluntary Sector Providers
• Sirona Care & Health
• Bristol Community Health (BCH)
• Severnside Integrated Urgent Care Service (Brisdoc Healthcare Services & Care UK)
• Avon & Wiltshire Mental Health Partnership
• Child Health Information Service (SW CHIS)
• Ambulance Trusts 
• Social Care Services 
• Health and Social Care Information Centre (HSCIC) 
• Local Authorities 
• Education Services 
• Fire and Rescue Services 
• Police & Judicial Services
• Bluebay Medical Systems

CQC – Care Quality Commission.  The CQC use personal data (information that relates to and identifies living people) and other information to help carry out their role as the regulator of health and adult social care services in England.  Under data protection laws, providers are required to be clear with people about how and why any data they hold on them might be accessed and used.  If you would like to read more information about the CQC and how they use your data please use the link privacy notice, or use the weblink https://www.cqc.org.uk/about-us/our-policies/privacy-statement.

Population Health Management - 
 
What is Population Health Management?
This work is aimed at improving the health of an entire population.  
It is about improving the physical and mental health outcomes and wellbeing of people and making sure that access to services is fair and equal. It helps to reduce the occurrence of ill-health and looks at all the wider factors that affect health and care.
The project requires health care organisations to work together with communities and partner agencies. The organisations will share information with each other in order to get a view of health and services for the population in a particular area.
In your area, a population health management programme has been introduced. The programme will combine information from GP practices, community service providers, hospitals and other health and care providers.
How Will my Personal Data be Used?
The information will include information about your health care.
The information will be combined and anything that can identify you (like your name or NHS Number) will be removed and replaced with a code.
This means that the people working with the data will only see the code and cannot see which patient the information relates to.
If we see that an individual might benefit from some additional care or support, we will send the information back to your GP or hospital provider and they will use the code to identify you and offer you services.
The information will be used for a number of healthcare related activities such as;

•	improving the quality and standards of care provided
•	research into the development of new treatments 
•	preventing illness and diseases
•	monitoring safety
•	planning services
Who Will My Personal Data Be Shared With?
Your GP and hospital providers will send the information they hold on their systems to the South Central and West Commissioning Support Unit, who are part of NHS England.
They will link all the information together in order to review and make decisions about the whole population or particular patients that might need support. During this process any identifiable data will be removed berore it is shared with Optum Healthcare.
Both the Commissioning Support Unit and Optum are required to protect your information and maintain confidentiality in the same way that your doctor or hospital provider is.

Is Using My Information in This Way Lawful?
Health Care Providers are permitted by data protection law to use information where it is ‘necessary for medical purposes’. This includes caring for you directly as well as management of health services more generally.
Some of the work that happens at a national level with your information is required by other parts of the law. For more information, speak to our Data Protection Officer.
Sharing and using your information in this way helps to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law and in the majority of cases, anonymised data is used so that you cannot be identified.
What will Happen to My Information When the Project is Finished?
Once the 20-week programme has completed the information will be securely destroyed.
Can I Object?
You have a right to object to information being used in this way.
You also have a number of other information rights. See our main privacy policy for more information.
To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.

Access to personal information 

You have a right under the Data Protection Act 1998 to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. 

In order to request this, you need to do the following: 

• Your request must be made in writing to the GP – for information from the hospital you should write direct to them 
• We are required to respond to you within 30 days
• In extreme circumstances, it may be appropriate to refer some areas of your medical record to your registered GP initially before providing the information to you. In this circumstance the named GP responsible for the care of you will discuss with you the reasons why this is necessary.
• You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located.

Right to withdraw consent for us to share your personal information (Opt-Out)
You have the right to refuse/withdraw consent to information sharing at any time. We will fully explain the possible consequences to you, which could include delays in you receiving care.
If you are happy for your data to be extracted and used for the purposes described in this privacy notice then you do not need to do anything.  If you do not want your information to be used for any purpose beyond providing your care you can choose to opt-out. We will respect your decision if you do not wish your information to be used for any purpose other than your care but in some circumstances we may still be legally required to disclose your data. 
There are several forms of opt- outs available at different levels:
Type 1 opt-out.  
If you do not want personal confidential information that identifies you to be shared outside your GP practice you can register a ‘Type 1 opt-out’ with your GP practice. This prevents your personal confidential information from being used except for your direct health care needs and in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease. If you do not want your information to be used for any purpose beyond providing your care you can choose to opt-out. If you wish to do so, please let us know so we can code your record appropriately to stop your records from being shared outside of your GP Practice.
National data opt-out
The national data opt-out was introduced on 25 May 2018 and replaces the previous ‘type 2’ opt-out.  NHS Digital collects information from a range of places where people receive care, such as hospitals and community services.  The new programme provides a facility for individuals to opt-out from the use of their data for research or planning purposes.  For anyone who had an existing type 2 opt-out, it will have been automatically converted to a national data opt-out from 25 May 2018 and you will receive a letter giving you more information and a leaflet explaining the new national data opt-out.
Cadbury Heath Healthcare will be compliant with the National Data Opt-Out Policy on 31/03/20. 
The national data opt-out choice can be viewed or changed at any time by using the online service at www.nhs.uk/your-nhs-data-matters

Retention Periods

Cadbury Heath Healthcare has a separate policy that details the retention periods for all documents concerning your health, which is available on request. Your medical record both computerised and paper remains with the health centre until your death.  Should you leave the surgery, your paper record is transferred to your new GP surgery and a copy of your electronic record is also sent. Your data collected during your time registered at Cadbury Heath Healthcare remains accessible from our surgery, however, this is an audited and monitored action and only ever accessed with express consent from the patient.

Right to withdraw consent for us to share your personal information

You have the right to refuse/withdraw consent to information sharing at any time. We will fully explain the possible consequences to you, which could include delays in you receiving care.

Statutory disclosures

Sometimes we are duty bound by laws to disclose information to organisations such as the Care Quality Commission, the Driver and Vehicle Licencing Agency, the General Medical Council, Her Majesty’s Revenue and Customs and Counter Fraud Services.  In these circumstances we will always try to inform you before we are required to disclose and we only disclose the minimum information that the law requires us to do so.

Lawful basis for processing:

The use of personal data for providing care is supported under the following Article 6 and 9 conditions of the GDPR:

•	Article 6(1)(e)’…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’;and 
•	Article 9(2)(h)’…necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…’

Notification 

The Data Protection Act 1998 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information. 
This information is publicly available on the Information Commissioners Office website www.ico.org.uk

Cadbury Heath Healthcare is registered with the Information Commissioners Office (ICO). 

Objections / Complaints 

Should you have any concerns about how your information is managed at the GP Surgery, please contact 
•	Kath Horne, GDPR Lead
•	Dr Cheryl Atter, Caldicott Guardian
•	Samantha Pearce, Data Protection Officer for our surgery

If you are still unhappy following a review by us, you can then complain directly to the Information Commissioners Office (ICO) via their website (www.ico.gov.uk). 

If you are happy for your data to be extracted and used for the purposes described in this privacy notice then you do not need to do anything. If you have any concerns about how your data is shared then please contact the practice. 

Should you require this document in larger font or translated into a different language please enquire at Reception.