Patient confidentiality and privacy

This Privacy Notice explains what information we collect about you, how we store this information, how long we retain it and with whom and for which legal purpose we may share it. Guardian Medical Centre also publishes a number of specific notices which are available at the bottom of this page.

Guardian Medical Centre employs more than 25 staff and is located at:

Guardian Medical Centre

Guardian Street

Warrington

WA5 1UD

Our medical centre is registered with the Information Commissioner’s Office (ICO) to process personal and special categories of information under the Data Protection Act 2018.

Our Information Commissioner's Office registration number is: Z6955785

The staff caring for you need to collect and maintain information about your health, treatment and care, so that you can be given the best possible care. This personal information can be held in a variety of formats, including paper records, electronically on computer systems, in video and audio files.

Any personal information we hold about you is processed for the purposes of ‘provision of health or social care or treatment or the management of health of social care systems and services under chapter 2, section 9 of the Data Protection Act 2018.For further information on this legislation please visit:  http://www.legislation.gov.uk

Personal information about you is collected in a number of ways. This can be from referral details from our staff, other 3rd parties or hospitals, directly from you or your authorised representative.

We will likely hold the following basic personal information about you: your name, address (including correspondence), telephone numbers, date of birth, next of kin contacts, etc. We might also hold your email address, marital status, occupation, overseas status, place of birth and preferred name or maiden name.

In addition to the above, we may hold sensitive personal information about you which could include            notes and reports about your health, treatment and care, including:

  • your medical conditions
  • results of investigations, such as x-rays and laboratory tests
  • future care you may need
  • personal information from people who care for and know you, such as relatives and health or social care professionals
  • other personal information such as smoking status and any learning disabilities
  • Your religion and ethnic origin
  • Whether or not you are subject to any protection orders regarding your health, wellbeing and human rights (safeguarding status).

It is important for us to have a complete picture of you as this will assist staff to deliver appropriate treatment and care plans in accordance with your needs. 

Your records are used to directly, manage and deliver healthcare to you to make sure that:

  • The staff involved in your care have accurate and up to date information to assess and advice on the most appropriate care for you.
  • Staff have the information they need to be able to assess and improve the quality and type of care you receive.
  • Appropriate information is available if you see another healthcare professional, or are referred to a specialist or another part of the NHS, social care or health provider.

The personal information we collect about you may also be used to:

  • Remind you about your appointments and send you relevant correspondence.
  • review the care we provide to ensure it is of the highest standard and quality, e.g. through audit or service improvement;
  • support the funding of your care, e.g. with commissioning organisations;
  • prepare statistics on NHS performance to meet the needs of the population or for the Department of Health and other regulatory bodies;
  • help to train and educate healthcare professionals;
  • report and investigate complaints, claims and untoward incidents;
  • report events to the appropriate authorities when we are required to do so by law;
  • review your suitability for research study or clinical trial
  • contact you with regards to patient satisfaction surveys relating to services you have used within our hospital so as to further improve our services to patients

We may share non identifiable statistical information with Central & West Warrington Healthcare Network (a collaboration of six NHS GP practices in Warrington) to evaluate the local health demographic and assess services according to population health priorities.

Where possible, we will always look to anonymise/ pseudonymise your personal information so as to protect patient confidentiality, unless there is a legal basis that permits us to use it and we will only use/ share the minimum information necessary. 

We may need to share relevant personal information with other NHS organisations. For example, we may share your information for healthcare purposes with health authorities such as NHS England, Public Health England, NHS Practice, other general practitioners (GPs), ambulance services, primary care agencies, etc.  We will also share information with other parts of the NHS and those contracted to provide services to the NHS in order to support your healthcare needs. 

The NHS needs data about the patients it treats in order to plan and deliver its services and to ensure that care and treatment provided is safe and effective. The General Practice Data for Planning and Research data collection will help the NHS to improve health and care services for everyone by collecting patient data that can be used to do this. For example patient data can help the NHS to:

  • monitor the long-term safety and effectiveness of care
  • plan how to deliver better health and care services
  • prevent the spread of infectious diseases
  • identify new treatments and medicines through health research

GP practices already share patient data for these purposes, but this new data collection will be more efficient and effective.

We have agreed to share the patient data we look after in our practice with NHS Digital who will securely store, analyse, publish and share this patient data to improve health and care services for everyone. This includes:

  • informing and developing health and social care policy
  • planning and commissioning health and care services
  • taking steps to protect public health (including managing and monitoring the coronavirus pandemic)
  • in exceptional circumstances, providing you with individual care 
  • enabling healthcare and scientific research

This means that we can get on with looking after our patients and NHS Digital can provide controlled access to patient data to the NHS and other organisations who need to use it to improve health and care for everyone.

Contributing to research projects will benefit us all as better and safer treatments are introduced more quickly and effectively without compromising your privacy and confidentiality.

NHS Digital has engaged with the British Medical Association (BMA)Royal College of GPs (RCGP) and the National Data Guardian (NDG) to ensure relevant safeguards are in place for patients and GP practices.

To view further information please click here to navigate to the NHS Digital Webpage which provides up to date information on the Data Collection.

We may need to share information from your health records with other non-NHS organisations from which you are also receiving care, such as Social Services or private care homes. However, we will not disclose any health information to third parties without your explicit consent unless there are circumstances, such as when the health or safety of others is at risk or where current legislation permits or requires it.

There are occasions where the medical centre is required by law to share information provided to us with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.

There may also be situations where we are under a duty to share your information, due to a legal requirement. This includes, but is not limited to, disclosure under a court order, sharing with the Care Quality Commission for inspection purposes, the police for the prevention or detection of crime or where there is an overriding public interest to prevent abuse or serious harm to others and other public bodies (e.g. HMRC for the misuse of public funds in order to prevent and detect fraud).

For any request to transfer your data internationally outside the UK/EU, we will make sure that an adequate level of protection is satisfied before the transfer.

The medical centre is required to protect your personal information, inform you of how your personal information will be used, and allow you to decide if and how your personal information can be shared. Personal information you provide to the medical centre in confidence will only be used for the purposes explained to you and to which you have consented. Unless, there are exceptional circumstances, such as when the health or safety of others is at risk, where the law requires it or there is an overriding public interest to do so. Where there is cause to do this, the medical centre will always do its best to notify you of this sharing.

Your personal information is held in both paper and electronic forms for specified periods of time as set out in the NHS Records Management Code of Practice for Health and Social Care and National Archives Requirements.

We hold and process your information in accordance with the Data Protection Act 2018 as amended by the GDPR 2016, as explained above. In addition, everyone working for the NHS must comply with the Common Law Duty of Confidentiality and various national and professional standards and requirements. 

We have a duty to:

  • maintain full and accurate records of the care we provide to you;
  • keep records about you confidential and secure;
  • provide information in a format that is accessible to you.

Some services in the medical centre provide the option to communicate with patients via email. Please be aware that we cannot guarantee the security of this information whilst in transit, and by requesting this service you are accepting this risk.

Further information can be found in our Data Security and Protection policy/Information Governance policy. 

All records held by the medical centre will be kept for the duration specified by national guidance from the Department of Health. The Records Management Code of Practice for Health and Social Care 2016.

Records Management Code of Practice for Health and Social Care 2016

We will keep a copy of your information in our medical centre for as long as you are registered with us, and If you leave the medical centre we will ensure that a copy of anything we hold is passed on to your new GP.  Your record status will be marked as ‘inactive’ in our clinical system but it will not be deleted”.

Confidential information is securely destroyed in accordance with this code of practice.

If we need to use your personal information for any reasons beyond those stated above, we will discuss this with you and ask for your explicit consent. The Data Protection Act 2018 gives you certain rights, including the right to:

 

  • Request access to the personal data we hold about you, e.g. in health records.  The way in which you can access your own health records is further explained in our Access to Health Record Policy and Disclosure of Personal Data Procedure
  • Request the correction of inaccurate or incomplete information recorded in our health records, subject to certain safeguards.  This is also explained in our “Access to Health Record Policy and Disclosure of Personal Data Procedure”.
  • Object to the use of your personal information: In certain circumstances you may also have the right to ‘object’ to the processing (i.e. sharing) of your information. Where the Practice processes personal data about you on the basis of being required to do so for the performance of a task in the public interest/exercise of official authority, you have a right to object to the processing.  You must have an objection on grounds relating to your particular situation. If you raise an objection, we will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims
  • Refuse/withdraw consent to the sharing of your health records: Under the Data Protection Act 2018, we are authorised to process, i.e. share, your health records ‘for the management of healthcare systems and services’. Your consent will only be required if we intend to share your health records beyond these purposes, as explained above (e.g. research).  Any consent form you will be asked to sign will give you the option to ‘refuse’ consent and will explain how you can ‘withdraw’ any given consent at a later time. The consent form will also warn you about the possible consequences of such refusal/withdrawal.
  • Request your personal information to be transferred to other providers on certain occasions.

Phone Call Recording – Call recording occurs either in relation to patient care or may be stored to provide an accurate and objective record for the protection of staff and patients alike as it may be used in cases of legal defence or prosecution.

Video Communications – Changes in the provision of healthcare outside of the usual methods this is delivered has been instituted in many NHS organisations. For this purpose video consultations may sometimes be recorded to provide an accurate record of the healthcare provided.

While the recording of these consultations proceeds under the Legal Basis’ noted elsewhere in this privacy notice, service users may be asked for their consent to continue with a recorded consultation. Please be aware that this consent does not form the Legal Basis for which this data is processed but is requested to allow service users to opt-out of care provided in this manner. 

Opting out of NHS Digital collecting your data (Type 1 Opt-out)

If you do not want your identifiable patient data to be shared outside of your GP practice for purposes except for your own care, you can register an opt-out with your GP practice. This is known as a Type 1 Opt-out.

Type 1 Opt-outs were introduced in 2013 for data sharing from GP practices, but may be discontinued in the future as a new opt-out has since been introduced to cover the broader health and care system, called the National Data Opt-out. If this happens people who have registered a Type 1 Opt-out will be informed.

NHS Digital will not collect any patient data for patients who have already registered a Type 1 Opt-out in line with current policy. If this changes patients who have registered a Type 1 Opt-out will be informed.

If you do not want your patient data shared with NHS Digital, you can register a Type 1 Opt-out with your GP practice. You can register a Type 1 Opt-out at any time. You can also change your mind at any time and withdraw a Type 1 Opt-out.

A start date for the Data sharing with NHS Digital will be announced.

If you have already registered a Type 1 Opt-out with your GP practice your data will not be shared with NHS Digital.

If you wish to register a Type 1 Opt-out with your GP practice before data sharing starts with NHS Digital, this should be done by returning this form to your GP practice as soon as possible to allow time for processing it. If you have previously registered a Type 1 Opt-out and you would like to withdraw this, you can also use the form to do this. You can send the form by post or email to your GP practice or call 0300 3035678 for a form to be sent out to you.

If you register a Type 1 Opt-out after your patient data has already been shared with NHS Digital, no more of your data will be shared with NHS Digital. NHS Digital will however still hold the patient data which was shared with us before you registered the Type 1 Opt-out.

If you do not want NHS Digital to share your identifiable patient data (personally identifiable data in the diagram above) with anyone else for purposes beyond your own care, then you can also register a National Data Opt-out. There is more about National Data Opt-outs and when they apply in the National Data Opt-out section below.

National Data Opt-out (opting out of NHS Digital sharing your data)

This applies to identifiable patient data about your health (personally identifiable data in the diagram above), which is called confidential patient information. If you don’t want your confidential patient information to be shared by NHS Digital for purposes except your own care - GP data, you can register a National Data Opt-out

If you have registered a National Data Opt-out, NHS Digital won’t share any confidential patient information about you with other organisations unless there is an exemption to this, such as where there is a legal requirement or where it is in the public interest to do so, such as helping to manage contagious diseases like coronavirus. You can find out more about exemptions on the NHS website

Please contact the Practice Information Governance Lead:

Dr Julian Poulton

Guardian Medical Centre

Guardian Street

Warrington

Cheshire

WA5 1UD

Malcolm Gandy

Mid-Mersey Digital Alliance (Information Governance Team)

St Alexandra Business Park

Court Building

Prescot Road

St Helens

WA10 3TP

IG@midmerseyda.nhs.uk 

The Information Commissioner’s Office (ICO) is the body that regulates the medical centre under Data Protection and Freedom of Information legislation. https://ico.org.uk/.

If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the ICO at:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number

Fax: 01625 524 510

Email: casework@ico.org.uk

Accessibility tools

Return to header