Privacy Policy and Information

Targeted Lung Health Check programme

If you're aged between 55 and 74 and have ever smoked, you may be offered an NHS lung health check.

The Government has announced that the NHS will roll out targeted lung screening across England. Currently, lung health checks are only available in some parts of England. They will be available everywhere by 2029.

Targeted Lung Health Check programme will be coming to Basingstoke in January 2025. Invites will be sent to Basingstoke patients at the beginning of December 2024 by NHS Hampshire hospitals. You can learn more here Lung Health Checks

Adult Privacy Information

Child Privacy Information

Health records play a vital role in the health care of patients – both storing important clinical information that is essential to your care and being used to improve public health and services.

 

Why we collect information about you

We aim to provide you with the highest quality health care. In order to do this we must keep records about you, your health and the care we have provided or plan to provide to you.

Your doctors and other health professionals caring for you (such as nurses, health visitors, physiotherapists, clinical pharmacists, midwives, occupational therapists, dieticians, speech and language therapists and others) keep records about your health and treatment so that they are able to provide you with the best possible care.

These records are called your ‘health care record’ and may be stored in paper form or on central computer databases; they may include:

  • basic details about you, such as your address, date of birth, telephone number, mobile phone number, email address and next of kin
  • contact we have had with you, such as clinical visits
  • notes and reports about your health
  • details and records about your treatment and care
  • Vaccinations, results of x-rays, laboratory tests etc.

The information in your health care record comes from a variety of sources including:

  • Information patients have provided about themselves
  • Information provided by family members or carers
  • Information from other health care professionals (both private and NHS)
  • Information from other services such as the ambulance service, the police, the armed forces, adult and childrens services or county councils.
  • Information from private companies such as insurance companies or lawyers

Information sharing

Information about you will be shared with others in the following circumstances:

  • to provide further medical care for you (for example from district nurses, hospital staff and other community service providers)
  • to help you get other services you require (for example from district councils or social work department, as well as ambulance/hospital transport services)
  • when we have a duty to others (for example in child protection safeguarding cases or when anonymized patient information is used to plan services at a local or national level by the NHS)
  • with your consent to help your when you are dealing with government agencies such as DWP, HSE, DVLA, The British Forces, or private organisations such as insurance companies and care homes.
  • if we are required to do so by legislation

Our guiding principle is that we hold your records in strict confidence

We have a duty to:

  • maintain full and accurate records of the care we provide to you
  • keep records about you confidential, secure and accurate
  • Provide information in a format that is accessible to you (for example, in large type if you are partially sighted)

We will not share information that identifies you for any reason unless:

  • the information is required for you to access medical care
  • you ask us to do so
  • we ask and you give us specific permission
  • we have to do this by law
  • we have special permission for health or research purposes
  • we have special permission because the interests of the public are thought to be of greater importance than your confidentiality

How your records are used to help you

Your health care record is used to ensure that:

  • health care professionals looking after you have accurate and up-to-date information about you to help them decide on any future care you may require
  • full information is available should you see another doctor or be referred to a specialist or another part of the NHS
  • there is a good basis for assessing the type and quality of care you have received
  • Your concerns can be properly investigated if you need to complain

And is used to help the NHS

  • looking after the health of the general public as well as yourself, e.g. notifying central NHS groups of outbreaks of infectious diseases in order to control these
  • reporting events to the appropriate authorities when we are required to do so by law, e.g. child protection, notification of deaths
  • paying your care provider (GP or hospital) for the care you have received
  • the audit of NHS accounts and clinical audit of the quality of services provided
  • reporting, investigating and dealing with complaints, claims and untoward incidents
  • planning services to ensure we meet the needs of our population in the future
  • Preparing statistics on our performance for the Department of Health.
  • reviewing our care to make sure that it is of the highest standard
  • teaching and training health care professionals
  • Conducting health research and development

 

Anticipating and planning your care in advance (risk stratification)

This is a process that helps your GP to help you manage your health.

By using selected information from your health records, a secure NHS computer system can look at recent medical details and at your existing health conditions. This will alert your doctor to the likelihood of a possible deterioration in your health. The clinical team at the surgery can use the information to help you get early care and treatment where it is needed.

The information will only be seen by qualified health workers involved in your care. Our security systems will protect your health information and patient confidentiality at all times.

Financial validation

The Clinical Commissioning Group (CCG) has contracted NHS South, Central & West Clinical Support Unit (CSU) to use limited information about individual patients to validate financial invoices received for your healthcare. This service ensures that the invoice is accurate and genuine and supports our CCG in ensuring public monies are spent appropriately.

This service is performed in a secure environment and will be carried out by a limited number of authorised NHS South, Central & West CSU staff. These activities and all identifiable information will remain within a Controlled Environment for Finance (CEfF) approved by NHS England.

How the NHS keeps your information safe

Everyone working for the NHS has a duty to keep your information confidential and secure.

However, from time to time, there may be a need to share some or all of your information with other health care professionals or NHS organisations so that we can work together to provide the best possible care.

We will only ever share your information if it is in the best interests for your NHS care.

We will not disclose any information that identifies you to anyone outside your care team without your express permission unless in exceptional circumstances, such as where we are required to do so by law.

Third party processors

In order to deliver the best possible service, the practice will share data (where required) with other NHS bodies such as other GP practices and hospitals. In addition the practice will use carefully selected third party service providers. When we use a third party service provider to process data on our behalf then we will always have an appropriate agreement in place to ensure that they keep the data secure, that they do not use or share information other than in accordance with our instructions and that they are operating appropriately. Examples of functions that may be carried out by third parties includes:

  • Companies that provide IT services & support, including our core clinical systems; systems which manage patient facing services (such as our website and service accessible through the same); data hosting service providers; systems which facilitate appointment bookings or electronic prescription services; document management services etc.
  • Delivery services (for example if we were to arrange for delivery of any medicines to you).
  • Payment providers (if for example you were paying for a prescription or a service such as travel vaccinations).

 

The NHS Care Record Guarantee

This sets out the rules that govern how patient information is used in the NHS and what control you can have over this. It covers:

  • people's access to their own records
  • controls on others' access
  • how access will be monitored and policed
  • options people have to further limit access
  • access in an emergency
  • What happens when someone cannot make decisions for themselves

Everyone who works for the NHS or for organisations delivering services under contract to the NHS has to comply with this guarantee which was first published in 2005 and is regularly reviewed by the National Information Governance Board to ensure it remains clear and continues to reflect the law and best practice. It was last reviewed in January 2011.

Please read the NHS Care Record Guarantee version 5 (2011) for more information.

Your rights

A number of organisations (both within and outside the NHS) are commissioned to provide healthcare services to you and we may need to share your information with them in order for them to provide those services.

You have the right to tell us that you don’t want your information shared.  You will need to tell us who you don’t want to share your information with and we won’t share your information, unless we have reason to believe you are at risk or if we have another legal requirement to share your information.

If you have any concerns about how your information may be shared, please discuss them with your health care provider, e.g. GP, hospital consultant or dentist.

You have the right to confidentiality under the Data Protection Act 2018, the Human Rights Act 1998 and the common law duty of confidence. The Disability Discrimination and the Race Relations Acts may also apply.

You also have the right to ask for a copy of the records about you:

  • Your request must be made in writing (e-mail is acceptable) to the organisation holding your information.
  • The organisation is required to respond to you within 30 days. You will need to give adequate information (e.g. full name, address, date of birth, NHS number) and you will be required to provide identification before any information is released to you.
  • If a request is not manifestly excessive or unfounded, there is no longer a fee for this. However if the request is either excessive or repeated, it could either be declined or there may be a fee charged.

If you think that there are inaccuracies in your record, you have the right to request that these be corrected or annotated.

If you have any concerns about how your information may be shared, please discuss them with your health care provider, e.g. GP, hospital consultant or dentist.

How the NHS keeps your records confidential

Everyone working for the NHS has a legal duty to keep information about you confidential.

Your information is legally protected by the Data Protection Act (May 2018) and the Caldicott Principles and by the European General Data Protection Regulation.

The practice complies with the National and European data protection legislation. All our employees signed a confidentiality agreement and will only access information that is necessary in order to help us care for patients. Reception, office and administration staff require access to your medical records in order to do their jobs. These members of staff are bound by the same rules of confidentiality as medical staff.

The practice may record telephone calls for the purposes of patient and staff care, security and dispute resolution.  Such recordings will comply with the practices data protection processes.

Records will be kept in line with the Department of Health Records Management Code of Practice which determines the minimum length of time that records should be kept for.

How you can arrange to see your own health records

The Data Protection Act (2018) and the European General Data Protection Regulation entitles you to view the information contained in your health care record.

Please contact the following organisations to see or obtain a copy of your records:

  • For your GP health care records, please contact your GP practice directly.
  • In some cases, if you have received hospital treatment this may not be included in the health care records that your GP practice holds, so please contact the hospital directly.

You will need to apply in writing to either your GP practice or hospital trust as appropriate, and they will contact you to advise you of the process.

 

Privacy Notice Assessments for Specific Activities

In line with EU General Data Protection Regulations (GDPR), individual Privacy Notice assessments are available for the activities that we perform in order to enable us to deliver a high standard of health care for our patients. Please contact the practice if you wish to see a copy  The areas covered include:

Privacy Notice: Area or activity addressed

Purpose of processing of information

GDPR lawful basis for processing of information

Ambulance service

Provision of direct care

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Core summary care record

Provision of direct care

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Court Order

To enable provision of information to the court, when instructed by a “court order”.

Article 6(1)(c)– Legal Obligation

Article 9(2)(h) – Provision and Management of Health

Care Quality Commission (CQC)

To enable the CQC to access medical records for the purposes of assessment or investigation.

Article 6(1)(c) – Legal Obligation

Article 9(2)(h) – Provision of Health

Diabetes education

To permit patients newly diagnosed with diabetes to be referred for a structured education programme about the condition

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Diabetes retinal screening

Enable patients with diabetes mellitus to receive invitations for diabetic eye screening

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Disclosure to police or children services

Informing the appropriate agencies when there is concern that children or young people are at risk of abuse or neglect, in order to protect them.

Article 6(1)(d) – Vital Interests

Article 9(2)(h) – Management of Health

Communication, Mail or E-mailing clinicians or service providers

Enables our staff to communicate with clinicians or service providers (such as NHS trusts)

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

E-mailing patients

Enables our staff to communicate with patients via email

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Emergencies

Enables our staff to provide relevant and necessary information to another healthcare professional or organisation, when further life-saving medical care is required by a patient and they are unable to give consent.

Article 6(1)(d) – Vital Interests

Article 9(2)(h) – Provision of health care

EMIS web – electronic record

To enable the staff to record relevant information about our patients within their GP electronic record

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Enriched summary care record

Provision of direct care

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Electronic prescribing service

Provision of direct care

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Female Genital Mutilation [FGM]

Legal obligation to enable the NHS to prevent this and support  women and girls who have had or who are at risk of FGM

Article 6(1)(c) – Legal Obligation

Article 9(2)(h) – Provision of Health

General Medical Council

To enable The GMC access to a patient’s medical records for the purposes of an investigation into a doctor’s fitness to practise.

Article 6(1)(c)– Legal Obligation

Article 9(2)(g) – Public interest

Hampshire and Isle Of Wight Fire Service

To enable safety home visits from the Fire Service for vulnerable patients.

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Healthier You,

Pre-diabetes

 

To enable patients diagnosed with pre-diabetes mellitus to be invited to the NHS Diabetes Prevention Programme.

 

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

CHIE

[Care & Health Information Exchange]

Provision of direct care

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Home Oxygen Provision

To enable patients to receive home oxygen

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Health Service Ombudsman (HSO)

To enable the HSO to receive information concerning a patient for the purposes of an investigation.

 

Article 6(1)(c)– Legal Obligation

Article 9(2)(g) – Public interest

ICE Pathology Database

Provision of direct care

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Integrated care team and community staff

Provision of direct care

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Individual GP Level Data

A mandatory national monitoring system to enable NHS Digital to provide GPs with clinical information on the care provision for their patients.

Article 6(1)(c) – Legal Obligation

Article 9(2)(h) – Management of health

Lord Wandsworth Health Centre Staff

To enable access to GP records, by Lord Wandsworth Health Centre staff in order to care for patients.

Provision of Direct Care.

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

MJog and SMS texts

To enable staff at Dr Assadourian and Partners to communicate with patients via text (SMS)

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

National Diabetes Audit

A national monitoring system, auditing the care of patients with diabetes


Article 6(1)(c) – Legal Obligation

Article 9(2)(h) – Management of Health

NHS Counter Fraud

Investigations into fraud in the NHS may require access to confidential patient information.


Article 6(1)(c) – Legal Obligation

Article 9(2)(g) – Public interest

NHS Health Checks

To enable Hampshire County Council to invite patients on our behalf to undergo an NHS Health Check at the surgery.


Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of Health

Out of Hours Care

To enable information to be shared about patients, when clinically necessary, with the out of hours care providers, for the purpose of provision of direct health care to the data subject.

 

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Open Exeter

To enable staff working for us to access the Open Exeter database, in order to access required health related information such as patients’ vaccinations, smear data etc.


Article 6(1)(e) – Official Authority

Article 9(2)(h) – Management of health

Other disclosures to government representatives

To enable the provision of information to an officer of the government (e.g. Job centre plus, DWP etc.); the patient having given consent

 

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Management of Health or Social Care Systems and Services

Other disclosures to the DVLA

To enable the provision of information to the DVLA; the patient having given consent

Article 6(1)(e) – Official Authority

Article 9(2)(g) – Public Interest

Other disclosures to the Police

With patient Consent

Or if there is an overriding public interest issue

Article 6(1)(e) – Public interest or Official Authority

Article 9(2)(g) – Public Interest

Other third party disclosures (Armed forces, solicitors, insurance companies, employers etc.)

With consent to provide information to other third parties such as The British Armed Forces, solicitors, insurance companies etc.

Article 6(1)(a) – Consent

Article 9(2)(a) – Explicit Consent

Other third party disclosures (data processing company MediData Exchange Ltd to enable the provision of SAR to solicitors or reports for insurance companies.)

With patient consent

Article 6(1)(a) – Consent

Article 9(2)(a) – Explicit Consent

Patient Online Services

To enable patients to securely access their GP record online and be able to book appointments, request repeat medication and view their medical information.

Article 6(1)(e) - Official Authority

Article 9(2)(h) – Provision of Health

Pharmacy communication

To enable communication with a pharmacy or providers of appliances/feeds

on behalf of patients

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Population Health Management

To enable working together in order to:

Understand the health and care needs of the care system’s population, including health inequalities

Provide support to where it will have the most impact

Identify early actions to keep people well, not only focusing on people in direct contact with services, but looking to join up care across different partners.

 

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Provision of Health Care

To enable staff to provide Health Care Services to patients

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Public Health

To enable healthcare professionals to provide information about individuals to Public Health England, when medically required.

Article 6(1)(c)– Legal Obligation

Article 9(2)(g) – Public interest – Public health

Research

To enable healthcare professionals to provide information, derived from GP records, about individuals to accredited research organisations

Article 6(1)(a) – Consent

Article 9(2)(a) – Explicit Consent

Risk stratification

To enable the practice to identify patients most at risk of certain medical/illness outcomes and to target them with medical or social care input, if appropriate.

Article 6(1)(e) -  Official Authority

Article 9(2)(h) -  Provision of health

S17 – Childrens services

The provision of information from GP records concerning children and families in order to safeguard and promote the welfare of who are “in need”

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Management of Health

S45 – Adult services

The provision of information from GP records about adults who may be at risk of harm (abuse or neglect)

This is a mandatory provision of information under Section 45 of the Care Act 2014

Article 6(1)(c) – Legal Obligation

Article 9(2)(h) – Management of Health

S47 – Children’s services

The provision of information from GP records concerning children and families where a child is taken into Police protection, and is the subject of an Emergency Protection Order or there are reasonable grounds to suspect that a child is suffering or is likely to suffer Significant H

This is a mandatory provision of information under Section 47 of the Children Act 1989

Article 6(1)(c) – Legal Obligation

Article 9(2)(h) – Management of Health

Scanning

To enable the practice to digitally scan part or all paper medical records/letters/results/communications into the electronic GP record.

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Sharing information for direct healthcare/referrals

To enable healthcare staff to provide all relevant and necessary information to another healthcare professional or organisation, when further medical care is required by the data subject.

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health

Statutory disclosures to government representatives

To enable staff to provide the officer of the government (e.g. the HSE, HMRC, NHS Pensions etc.) with information about the data subject when legally required to do so.

Article 6(1)(c) – Legal Obligation

Article 9(2)(g) – Public Interest

Statutory DVLA disclosure

To enable the provision of information to the DVLA; if there is an overriding public interest.

Article 6(1)(e) – Public Interest

Article 9(2)(g) – Public Interest

Statutory disclosure to the police

To enable the provision of information to the police, officer of the law or court; if there is a legal obligation to do so.

Article 6(1)(c) – Legal Obligation

Article 9(2)(g) – Public Interest

Tier 2 Urology Service

To provide and receive all relevant and necessary information to/from appropriate clinicians in the provision of a Tier 2 Urology service.

Article 6(1)(e) – Official Authority

Article 9(2)(h) – Provision of health