The practice is registered with the Information Commissioner’s Office for the purposes of data protection. We will not release information about you without your prior consent unless we are legally obliged to do so. We may share information with other staff or organisations who provide you with healthcare to ensure you get the best treatment possible. See our Fair Processing Notice below.

In accordance with data protection legislation you may access your medical records. If you wish to access your records please apply in writing to the practice manager. A form is available from reception.

Online Access to Patient Records

We offer patients the facility to :

• book, view, amend and cancel GP appointments online
• order, view and print a list of their repeat medication online
• view online, export and print information relating to allergies, adverse reactions, immunisations, test results and coded data from their medical record

If you would like to sign up for online access please speak to one of our receptionists who can set this up for you.

Although we endeavour to give you the best possible service, there may be times when you feel you have received less than this. If you have any concerns regarding the service you have received, or simply require more information, please ask to arrange an appointment with the Practice Manager. If you are not satisfied following a consultation with one of the GPs, you may make an appointment with another GP within the practice for a second opinion.

We have to respect our duty of confidentiality to our patients and if you are complaining on behalf of someone else we do need their consent. Our reception staff can provide you with a consent form. Where the patient is incapable of providing consent due to illness or accident it may still be possible to deal with the complaint. Please provide as many details as possible on the form.

If you feel you would still like to make a formal complaint please contact the Practice Manager, preferably in writing, as soon as possible after the event and ideally within a few days, as this helps us to establish what happened more easily. In any event, this should be within 12 months of the incident or within 12 months of you discovering the incident.

We look to settle complaints as soon as possible. We will acknowledge your complaint within 2 working days and aim to have looked into the matter within 10 working days. Occasionally if we have to make a lot of enquiries it may take up to 4 weeks to get back to you with a reply, but we will keep you informed. We will carry out a full investigation of the matter and reply in writing or offer you a meeting to discuss the complaint, investigations and our findings if you so wish.

At your request, where your complaint involves more than one organisation we will liaise with that organisation to provide you with one coordinated response.

We hope that at the end of our investigation you will feel satisfied that we have dealt with your complaint thoroughly. If you are dissatisfied with the outcome you have the right to approach the Ombudsman.

The contact details are:

The Parliamentary and Health Service Ombudsman
Millbank Tower
Millbank
London
SW1P 4QP

Tel: 0345 0154033

A copy of our complaints information leaflet is available from reception.

This practice is supporting vital coronavirus (COVID-19) planning and research by sharing your data with NHS Digital. This transparency notice supplements our main practice privacy notice.

The health and social care system is facing significant pressures due to the coronavirus (COVID-19) outbreak. Health and care information is essential to deliver care to individuals, to support health, social care and other public services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the coronavirus outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations.

This practice is supporting vital coronavirus planning and research by sharing your data with NHS Digital, the national safe haven for health and social care data in England.

Our Legal Basis for Sharing Data With NHS Digital

NHS Digital has been legally directed to collect and analyse patient data from all GP practices in England to support the coronavirus response for the duration of the outbreak. NHS Digital will become the controller under the General Data Protection Regulation 2016 (GDPR) of the personal data collected and analysed jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse this data under the COVID-19 Public Health Directions 2020 (COVID-19 Direction).

All GP practices in England are legally required to share data with NHS Digital for this purpose under the Health and Social Care Act 2012 (2012 Act). More information about this requirement is contained in the data provision notice issued by NHS Digital to GP practices.

Under GDPR our legal basis for sharing this personal data with NHS Digital is Article 6(1)(c) – legal obligation. Our legal basis for sharing personal data relating to health, is Article 9(2)(g) – substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the COVID-19 Direction.

The type of personal data we are sharing with NHS Digital

The data being shared with NHS Digital will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. The data contains NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death for those patients. It will also include coded health data which is held in your GP record such as details of:

• diagnoses and findings
• medications and other prescribed items
• investigations, tests and results
• treatments and outcomes
• vaccinations and immunisations

We will not share details for any patient who has registered a Type 1 objection with the practice.  Where a Type 1 objection has been registered, we will not share your personal identifiable confidential information outside of the GP practice, except when it is being used for the purposes of your care and treatment or where there is a legal requirement to do so. Although there is a legal requirement to do so here, NHS Digital has agreed with the National Data Guardian, the British Medical Association and the Royal College of General Practitioners to respect Type 1 objections.

How NHS Digital will use and share your data

NHS Digital will analyse the data they collect and securely and lawfully share data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only. These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials. The British Medical Association, the Royal College of General Practitioners and the National Data Guardian are all supportive of this initiative.

NHS Digital has various legal powers to share data for purposes relating to the coronavirus response. It is also required to share data in certain circumstances set out in the COVID-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).

Legal notices under the COPI Regulations have also been issued to other health and social care organisations requiring those organisations to process and share confidential patient information to respond to the coronavirus outbreak. Any information used or shared during the outbreak under these legal notices or the COPI Regulations will be limited to the period of the outbreak unless there is another legal basis for organisations to continue to use the information.

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared. Organisations using your data will also need to have a clear legal basis to do so and will enter into a data sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital Transparency Notice for GP Data for Pandemic Planning and Research (COVID-19).

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your rights over your personal data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see:

• the NHS Digital GPES Data for Pandemic Planning and Research (COVID-19) Transparency Notice
• the NHS Digital Coronavirus (COVID-19) Response Transparency Notice
• the NHS Digital General Transparency Notice
• how NHS Digital looks after your health and care information

How we Use Your Information

Our GP practice holds information about you and this document outlines how that information is used, with whom we may share that information, how we keep it secure (confidential) and what your rights are in relation to this. The Health Care Professionals (HCP) who provide you with care, maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP surgery, Community clinics or staff etc.).

These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both and we use a combination of working practices and technology to ensure that your information is kept confidential and secure.

What Kind of Information do we Use?

• Details about you, such as address and next of kin and carer information etc
• Any contact the surgery has had with you such as appointments, clinic visits, emergency appointments and so on
• Notes and reports about your health
• Details about your treatment and care
• Results of investigations such as laboratory tests, x-rays etc.
• Relevant information from other HCPs, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive.  Information held about you may be used to help protect the health of the public and to help us manage the NHS.  Information may be used for clinical audit to monitor the quality of the service provided and to plan NHS services. Some of this information will be held centrally and used for statistical purposes.  Where we do this, we take strict measures to ensure that individual patients cannot be identified.

Sometimes your information may be requested to be used for research purposes – the surgery or organisation concerned will always endeavour to gain your consent before releasing the information.

The NHS Care Record Guarantee for England sets out the rules that govern how patient information is used in the NHS and what control patients can have over this.

The NHS Constitution https://www.gov.uk/government/publications/the-nhs-constitution-for-england establishes the principles and values of the NHS in England. It sets out rights to which patients, public and staff are entitled, and pledges which the NHS is committed to achieve, together with responsibilities, which the public, patients and staff owe to one another to ensure that the NHS operates fairly and effectively.

What do we use Your Personal and Confidential/Sensitive Information for?

We can only use any information that may identify you (known as personal information) in accordance with the Data Protection Act 1998 and other laws such as the Health and Social Care Act 2012. http://www.legislation.gov.uk/ukpga/1998/29/contents  and http://www.legislation.gov.uk/ukpga/2012/7/contents/enacted, however only the minimum necessary identifiers are used in processing personal information for the purpose. We also have a Common Law Duty of Confidentiality to protect your information. This means that where a legal basis for using your personal or confidential information does not exist, we will not do so.

Apart from direct health care sensitive personal information may also be used in the following cases:

• To respond to patients, carers or Member of Parliament communication
• We have received consent from individuals to be able to use their information for a specific purpose.
• There is an overriding public interest in using the information e.g. in order to safeguard an individual, or to prevent a serious crime.
• There is a legal requirement that will allow us to use or provide information (e.g. a formal court order).
• For the health and safety of others, for example to report an infectious disease such as meningitis or measles.
• We have special permission for health and research purposes (granted by the Health Research Authority).
• We have special permission called a ‘section 251 agreement’ (Section 60 of the Health and Social Care Act 2001 as re-enacted by Section 251 of the NHS Act 2006) which allows the Secretary of State for Health to make regulations to set aside the common law duty of confidentiality for defined medical purposes. An example of where this is used is in risk stratification. Further information can be found on the Health Research Authority’s web site here http://www.hra.nhs.uk/about-the-hra/our-committees/section-251/what-is-section-251/

Risk Stratification

Risk stratification tools are increasingly being used in the NHS to help determine a person’s risks of suffering from a particular condition, preventing an unplanned or (re)admission and identifying a need for preventative intervention.  Information about you is collected from a number of sources including NHS Trusts and from this GP Practice.

A risk score is then arrived at through an analysis of your anonymised information using software managed by North of England Commissioning Support Service (NECS), which is based at John Snow House, Durham, DH1 3YG. The data is provided back to the GP Practice or member of your care team in an identifiable form. Risk stratification enables your GP Practice to focus on the prevention of ill health and not just the treatment of sickness.

If necessary, your GP Practice may be able to offer you additional services.

Should you have any concerns about how information is managed at your GP Practice, please write to the Practice Manager so you can discuss how the disclosure of your personal information can be limited.

 Invoice Validation

If you have received treatment within the NHS, access to your personal information is required in order to determine which Clinical Commissioning Group (CCG) should pay for the treatment or procedure you have received.  The validation of invoices is undertaken within a controlled environment for finance within the North of England CSU (NECS) which is based at John Snow House, Durham, DH1 3YG. This is carried out via a section 251 agreement and is undertaken to ensure that the ICB is paying for treatments relating to its patients only.

The dedicated NECS team receives patient level information (minimal identifiers are used for this purpose, such as NHS number, post code, date of birth) direct from the hospital providers and undertakes a number of checks to ensure that the invoice is valid and that it should be paid for by the ICB.

The ICB does not receive or see any patient level information relating to these invoices. Further information about invoice validation can be found on NHS England’s web site here https://www.england.nhs.uk/ourwork/tsd/ig/in-val/

 How do we Maintain Confidentiality of Your Records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with the Data Protection Act 1998 (which is overseen by the Information Commissioner’s Office), Human Rights Act, the Common Law Duty of Confidentiality and the NHS Codes of Confidentiality and Security. Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential. Anyone who received information from an NHS organisation has a legal duty to keep it confidential. We maintain our duty of confidentiality to you at all times.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (e.g. life or death situations) or where the law requires information to be passed on.

The NHS Digital Code of Practice on Confidential Information applies to all of our staff, and they are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. All practice staff are expected to make sure information is kept confidential and receive annual training on how to do this. This is monitored by the practice and can be enforced through disciplinary procedures.

We also ensure the information we hold is kept in secure locations, restrict access to information to authorised personnel only and protect personal and confidential information held on equipment such as laptops with encryption (which masks data so that unauthorised users cannot see or make sense of it).

We ensure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where information that could or does identify a person is processed.

We have a senior person responsible for protecting the confidentiality of patient information and enabling appropriate information sharing. This person is called the Caldicott Guardian. The Caldicott Guardian for the practice is Dr Richard Dawson. We also have a Senior Information Risk Owner (SIRO) who is responsible for owning the practice’s information risk. The SIRO is Kim Christie (practice manager).

We are registered with the Information Commissioner’s Office (ICO) as a data controller which describes the purposes for which we process personal data. A copy of the registration is available from the ICO’s web site by searching on our practice name.

Who are our Partner Organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations:

• NHS Trusts
  • Specialist Trusts
  • Independent contractors such as dentists, opticians, pharmacists
  • Private sector providers
  • Voluntary sector providers
  • Ambulance Trusts
  • Integrated Care Systems
  • Social Care and Health
  • Local Authorities
  • Education Services
  • Fire & Rescue Services
  • Police
  • Other data processors

 What Are Your Rights?

Where information from which you can be identified is held, you have the right to ask to:

• View this or request copies of the records by making a subject access request – also see below.
• request information is corrected
• have the information updated where it is no longer accurate
• ask us to stop processing information about you where we are not required to do so by law – although we will first need to explain how this may affect the care you receive.

 Access to Personal Information

You have a right under the Data Protection Act 1998 to access/view what information the surgery holds about you, and to have it amended or removed should it be inaccurate. This is known as ‘the right of subject access’. If we do hold information about you we will:

• Give you a description of it
• Tell you why we are holding it
• Tell you who it could be disclosed to, and
•  Let you have a copy of the information in an intelligible form
• If you would like to make a ‘subject access request’, please do so in writing to the Practice Manager.

 Summary Care Records (SCR)

The Summary Care Record is a national scheme to share information about the medicines you are prescribed and any allergies or other adverse reactions you have experienced. Health Professionals at other organisations will only be able to access this information with your permission. You can opt-out of the scheme; please ask at the surgery if you need more information or follow the appropriate link on our website.

Summary Care Record with Additional Information

This is a national scheme to share more detailed information including your current medical problems and your care wishes. Health Professionals at other organisations will only be able to access this information with your permission. This information will only be available to other agencies if you have given us your permission to share it.

Great North Care record (GNCR)

This is a local initiative to share medical information in the North East. The information shared is similar to that in the Summary Care Record with Additional Information. Health Professionals at other organisations will only be able to access this information with your permission. The health organisations with whom we share this information include the local hospitals, out of hours services and the ambulance service. This information will be shared unless you tell us in writing that you don’t want us to share it.

You can opt-out of this scheme – please ask at the surgery.

Your Right to Withdraw Consent

If you are happy for your data to be extracted and used for the purposes described in this Fair Processing Notice, then you do not need to do anything. If you do not want your personal data being extracted and used for the purposes described in this Fair Processing Notice, then you need to let us know as soon as possible in writing to the Practice Manager.

Please note that withdrawing your consent from sharing data may, in some circumstances, cause a delay in your receiving care.

How Long do You hold Information for?

All records held by the practice will be kept for the duration specified by national guidance from the Department of Health, The Records Management Code of Practice for Health and Social Care 2016. Confidential information is securely destroyed in accordance with this code of practice.

Your Right to Opt Out

In some instances, you are allowed to request that your confidential information is not used beyond your own care and treatment and to have your objections considered. To support this patients are able to register objections with the GP Practice to either prevent their identifiable data being released outside of the GP Practice (known as a Type 1 objection) or to prevent their identifiable data from any health and social care setting being released by NHS Digital (known as a Type 2 objection) where in either case it is for purposes other than direct patient care. If your wishes cannot be followed, you will be told the reasons (including the legal basis) for that decision.

There are certain circumstances where a person is unable to opt out but these are only where the law permits this such as in adult or children’s safeguarding situations.

You have a right in law to refuse or withdraw previously granted consent to the use of your personal information. There are possible consequences of not sharing such as the effect this may have on your care and treatment but these will be explained to you to help with making your decision.

If you wish to exercise your right to opt-out, or to speak to somebody to understand what impact this may have, if any, please contact us using the contact details at the top of this document.

What is the right to know?
The Freedom of Information Act 2000 (FOIA) gives people a general right of access to information held by or on behalf of public authorities, promoting a culture of openness and accountability across the public sector.

What sort of information can I request?
In theory, you can request any information that the practice holds, that does not fall under an exemption. You may not ask for information that is covered by the Data Protection Act. Your request must be in writing and can be either posted or emailed to the practice.

Where can I obtain further advice?
For independent advice about data protection, privacy, data sharing issues and your rights you can contact:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113 (local rate) or 01625 545 745
Email: [email protected]

Visit the ICO website here https://ico.org.uk/

Complaints or Questions?

We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate.

Please contact us using the contact details below should you have any such concerns.

Houghton Medical Group
The Health Centre
Church Street
Houghton le Spring
Tyne and Wear
DH4 4DN
Tel: 0191 5842154

NHS England require that the net earnings of doctors engaged in the practice is publicised, and the required disclosure is shown below.

However it should be noted that the prescribed method for calculating earnings is potentially misleading because it takes no account of how much time doctors spend working in the practice, and should not be used to form any judgement about GP earnings, nor to make any comparison with any other practice.

All GP practices are required to declare the mean earnings (eg. average pay) for GPs working to deliver NHS services to patients at each practice.

The average pay for GPs working in this practice in the last full financial year was £89454 before Tax and National Insurance. This is for one full time GP, five part time GPs and two locum GPs who worked in the practice for more than six months.

We are the independent champion for those who use health and social care services in Sunderland.

One of our main purposes is to understand the needs, experiences and concerns of people who use health and social care services and to speak out on their behalf. We focus on ensuring that people’s worries and concerns about current services are addressed. We work to get services right for the future.

Have your say!

Get in touch today to share your recent experiences of services, we would love to hear from you. You can also speak to us to find information about health and care services available locally.

To find out more visit:

www.healthwatchsunderland.com

Or to speak to us contact us on:

Telephone: 0191 514 7145

Email: [email protected]

All patients have an allocated named GP; your named GP is responsible for your overall care at the practice.

You can contact reception to find out who is your named GP and if you wish to change your named GP we will make reasonable efforts to accommodate your request.

From the 25^th May, the current UK Data Protection Act 1998 is being replaced by the EU General Data Protection Regulation (GDPR) and Data Protection Act 2018.

The new legislation is very similar to the 1998 Act but provides some enhanced rights for individuals around how the Practice uses your information

Why do we Need Your Information?

The NHS Act 2006 and Health and Social Care Act 2012 invests statutory functions on GP Practices to promote and provide the health service to improve quality of services, reduce inequalities, conduct research, review performance of services and deliver education & training. To do this we will need to process your information in accordance with current data protection legislation to:

Protect your vital interests;

• Pursue our legitimate interests as a provider of medical care, particularly where the individual is a child or vulnerable adult
• Performs tasks in the public’s interests
• deliver preventative medicine, medical diagnosis, medical research; and
• Manage the health and social system and services.

Should require any further information on GDPR or Data Protection Act, this can be found on the Information Commissioner’s Office (ICO) website:

• https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/

You can also contact the practice’s Data Protection Officer. When contacting the Data Protection Officer please ensure that you include the details of the practice.

Data Protection Officer: Mr James Carroll

Tel No: 0191 404 1000 Ext 3436

Email address: [email protected]

Details of our privacy notice on Direct Care relating to routine care and  referrals is shown below:

• Privacy-notice-for-direct-care

National Diabetes Audit

Our practice is taking part in the National Diabetes Audit (NDA). The NDA collects information about diabetes care from GP practices and hospitals and is used to help the NHS improve care for patients with diabetes.

It is managed by the Health and Social Care Information Centre, working with Diabetes UK and Public Health England. The information that the audit collects is controlled by law and strict rules of confidentiality. You can choose not to take part if you have any any concerns. If you do not want to take part or would like more information please contact Della at the surgery.

Clinical Practice Research Datalink

Our practice contributes to the Clinical Practice Research Datalink (CPRD). Information in patient records is important for medical research to develop new treatments and test the safety of medicines. This practice supports medical research by sending some of the information from patient records to the CPRD.

CPRD is a Government organisation that provides anonymised patient data for research to improve patient and public health. You cannot be identified from the information sent to CPRD.

If you do not want anonymised information from your patient record to be used in research you can opt out by speaking to your doctor or the practice manager.

More information can be found at www.cprd.com/public

The practice operates a Zero Tolerance policy and any patient who is violent or abusive to any member of staff will be removed from the practice list.

Our staff are here to help – please treat them with courtesy and respect.

Social Media

We are aware that in the past derogatory comments have been posted on Facebook, Houghton Post and Houghton Chit Chat about the practice and some of our staff. If any such posts are brought to our attention they could be viewed as a potential breakdown in the doctor–patient relationship, and may result in you being removed from our practice list.

We may contact the patients involved and invite them in to have a face to face discussion about the issues that they have.

We welcome all feedback, as it gives us the opportunity to review the services that we provide and where necessary or appropriate, make any changes or improvements. However, this needs to be done through the appropriate channels and we would ask that rather than posting derogatory or hurtful comments on social media, or if there are any aspects of the service that you are not entirely happy with, please speak to us about this or put your comments to us in writing giving us the opportunity to respond.

This policy has been approved by our Patient Participation Group.

YOU WOULD NOT EXPECT TO READ DEROGATORY COMMENTS ABOUT YOURSELF AT YOUR OWN PLACE OF WORK, NEITHER DO WE.