Privacy Notice

1. Introduction

1.1. Policy Statement

This policy outlines how Arundel Surgery will provide information to patients regarding how patient data is processed for the provision of direct care, research, audit and screening programmes.

This policy is to be read in conjunction with the organisation’s UK General Data Protection Regulation (UK GDPR) Policy.

1.2. Status

The organisation aims to design and implement policies and procedures that meet the diverse needs of our service and workforce, ensuring that none are placed at a disadvantage over others, in accordance with the Equality Act 2010. Consideration has been given to the impact this policy might have regarding the individual protected characteristics of those to whom it applies.

This document and any procedures contained within it are non-contractual and may be modified or withdrawn at any time. For the avoidance of doubt, it does not form part of your contract of employment. Furthermore, this document applies to all employees of the organisation and other individuals performing functions in relation to the practice such as agency workers, locums and contractors.

2. Compliance with regulations

2.1 UK GDPR

This organisation will ensure that any personal data is processed in accordance with Article 5 of the UK GDPR and information about how this is done will be provided to patients in a format that is compliant with Article 12 of the UK GDPR.

2.2 Communicating privacy information

The BMA advises that this organisation must provide information to patients about how their data is processed in the form of a practice privacy notice. This organisation will display a privacy notice in the waiting room and on its website. A privacy notice template is available at Annex A. Note the template was sourced from the BMA.

2.3 What data will be collected?

The following data will be collected:

Patient details (name, date of birth, NHS number)
Address and NOK information
Medical notes (paper and electronic)
Details of treatment and care, including medications
Results of tests (pathology, X-ray, etc.)
Any other pertinent information

2.4 National data opt-out programme

NHS Digital explains that the national data opt-out allows patients to choose if they do not want their confidential patient information to be used for purposes beyond their individual care and treatment. See here for more information.

NHS Digital provides detailed guidance for opt-outs, including those patients in secure settings. Additional information for patients is available from NHS England. Make a choice about sharing data from your health records.

This organisation will ensure patients are compliant with the national data opt-out policy by following this guidance. See here for more information.

3. General practice data for planning and research data collection

3.1. Overview

NHS Digital advises that the General Practice Data for Planning and Research (GPDPR) programme has been designed to help the NHS:

Monitor the long-term safety and effectiveness of care
Plan how to deliver better health and care services
Prevent the spread of infectious diseases
Identify new treatments and medicines through health research

See here for more information.

NHS Digital’s About the GPDPR programme and Looking after your data provides additional information on data sharing.

Further information is available within the National data opt-out guidance.

4. Further Information

4.1. Available Resources

The following resources are available for staff at this organisation:

National Data Guardian for Health and Care – review of data security, consent and opt-outs
National data opt-out – data protection impact assessment
National data opt-out training
Guidance for health and care staff
Supporting your patients – information and resources
Information for GP practices
ICO privacy notice checklist