What is a Privacy Notice and why does it apply to me?

A Privacy Notice tells people how organisations use information that they hold about them. A law called the General Data Protection Regulation 2016, also known as GDPR, and the new Data Protection Act 2018 says that we need to provide you with this Privacy Notice and let you know:

• What information we hold about you
• How we keep this very important information safe and secure and where we keep it
• How we use your information
• Who we share your information with
• What your rights are
• When the law gives us permission to use your information

Why does the law give you permission to use my information?

The law gives us permission to use your information in situations where we need it to take care of you. Because information about your health is very personal, sensitive and private to you, the law is very strict about how we use it.

So, before we can use your information in the ways we have set out in this Privacy Notice, we have to have a good reason in law, which is called a ‘lawful basis’.  Not only do we have to do that, but we also have to show that your information falls into a special group or category, because it is very sensitive. By doing this the law makes sure we only use your information to look after you and that we do not use it for any other reason.

If you would like more information about this please ask to speak to our Data Protection Officer (DPO) mentioned in this Privacy Notice who will explain this in more detail.

About us

We, at the Acrefield  Surgery at 700 Field End Road , South Ruislip  HA4 0QR are responsible for collecting, storing and handling your information when you registered with us as a patient. Because we do this, the law says we are Data Controllers. Sometimes we may use your information for a particular purpose and when we do so, the law says we are Data Processors.

What information do you hold about me?

We hold information about you such as:

• Your name
• Address
• Mobile number
• Information about your parent(s) or person with parental responsibility
• All your health records
• Appointment records
• Visits to see your GP
• Treatments you have had
• Medicines prescribed for you and any other information to help us look after you

How Do You Keep It Safe?

• The law says that we must do all we can to keep your information private, safe and secure.
• We use secure computer systems and we make sure that any written information held about you is under lock and key and kept in a safe place. This includes taking great care with any passwords we use which we change on a regular basis. We also train our staff to respect your privacy and deal with your information in a manner that makes sure it is always kept and dealt with in a safe way.

What do you do with my information?

• We only usually use your information to help us care for you. That means we might need to share your information with other people who are concerned and involved with looking after your health.
• We might need to share your information with the police, courts, social services, solicitors and other people who have a right to your information, but we always make sure that they have a legal right to see it (or have a copy of it) before we provide it to them.

Who else will see my information?

• Usually only doctors, nurses and other people who work with us are allowed to see your information.
• Sometimes though, if you need to go to the hospital or be seen by a special doctor, we will share your information with them but this only so that we can take care of you.
• Sometimes we might be asked to take part in medical research that might help you in the future. We will always ask you or your parent(s) or adult with parental responsibility if we can share your information if this happens.
• Possibly the police, social services, the courts and other organisations and people who may have a legal right to see your information.

What are my rights?

• If you want to see what information we hold about you then you have a right to see it and you can ask for it.
• To ask for your information you will usually need to put your request in writing and tell us what information you want us to give you.
• We usually need to answer you within one month. Your parent(s) or adult with parental responsibility can help you with is if you need help.
• Usually we will give this to you free of charge.
• If you think there are any errors in the information we hold about you then you can ask us to correct it but the law says we can’t remove any of the information we hold about you even if you ask us to. This is because we need this information to take care of you.
• You have a right to ask us not to share your information.
• If you would like to talk to us about not sharing your information, even if this means you don’t want us to share your information with your parent(s) or adult with parental responsibility, please let us know. We will be happy to help.

Can I access my information online?

• You may be able to access your information online.
• Please ask our receptionist who will put you in touch with your GP.
• Your GP will discuss this with you and explain how to register.

What if I have a question?

A member of our staff/receptionist will be happy to talk to you about any questions you may have and we will do our best to help you.

• The Surgery has a person called a Data Protection Officer (DPO) who deals with all queries about patient information. Our receptionist may put you in touch with this person who will listen to your concerns and give you the advice you need.
• Our DPO is Dr. Ernest Norman-Williams

What if I have a serious complaint about how you look after my information?

• We will always do our best to look after your information and to answer your questions.
• If you are still not happy with something we have done with your information you can speak to our DPO.
• If our DPO has not been able to help you or if you prefer not to speak to our DPO then you have a right to pass your complaint to an organisation called the Information Commissioner’s Office (ICO) who will look into what has gone wrong. For more information visit ico.org.uk

Updates to this privacy notice

• The law says we must keep all information we provide in this Privacy Notice up to date.

This Privacy Notice was last updated on 21/3/2019 and will be reviewed on 1/4/2020.

Introduction

Closed circuit television (CCTV) is installed at the Practice premises for the purposes of staff, patient and premises security. Cameras are located at various places on the premises, and images from the cameras are recorded.

The use of CCTV falls within the scope of the Data Protection Act 1998 (“the 1998 Act”). This code of practice follows the recommendations issued by the Data Protection Commissioner in accordance with powers under Section 51 (3)(b) of the 1998 Act.

In order to comply with the requirements of the 1998 Act, data must be:

• fairly and lawfully processed
• processed for limited purposes and not in any manner incompatible with those purposes
• adequate, relevant and not excessive
• accurate
• not kept for longer than is necessary
• processed in accordance with individuals’ rights
• secure

Data Protection Statement

1. Acrefield Surgery under Section 4(4) of the Act and are Dr S Patel & Dr D Thakrar
2. CCTV is installed for the purpose of staff, patient and premises security.
3. Access to stored images will be controlled on a restricted basis within the Practice.
4. Use of images, including the provision of images to a third party, will be in accordance with the Practice’s Data Protection registration.
5. External and internal signage is displayed on the premises and on the Practice website stating of the presence of CCTV, and indicating the names of the Data Controllers and a contact number during office hours for enquiries.

Retention of Images

Images from cameras are recorded on disc/computer system (“the recordings”). Where recordings are retained for the purposes of security of staff, patient and premises, these will be held in secure storage, and access controlled. Recordings which are not required for the purposes of security of staff, patient and premises, will not be retained for longer than is necessary.

Access to Images

It is important that access to, and disclosure of, images recorded by CCTV and similar surveillance equipment is restricted and carefully controlled, not only to ensure that the rights of individuals are preserved, but also to ensure that the chain of evidence remains intact should the images be required for evidential purposes.

Access to Images by Practice Staff

Access to recorded images is restricted to Acrefield Surgery who will decide whether to allow requests for access by Data Subjects and/or third parties (see below).

Viewing of images must be documented as follows:

• the name of the person removing from secure storage, or otherwise accessing, the recordings
• the date and time of removal of the recordings
• the name(s) of the person(s) viewing the images (including the names and organisations of any third parties)
• the reason for the viewing
• the outcome, if any, of the viewing
• the date and time of replacement of the recordings

Removal of Images for Use in Legal Proceedings

In cases where recordings are removed from secure storage for use in legal proceedings, the following must be documented:

• the name of the person removing from secure storage, or otherwise accessing, the recordings
• the date and time of removal of the recordings
• the reason for removal
• any crime incident number to which the images may be relevant
• the place to which the recordings will be taken
• the signature of the collecting police officer, where appropriate
• the date and time of replacement into secure storage of the recordings

Access to Images by Third Parties

Requests for access to images will be made using the ‘Application to access to CCTV images’ form (which is at Appendix 1), accompanied by a fee of Acrefield Surgery (which is non-refundable if the request is declined).

The Data Controllers of Acrefield Surgery  will assess applications and decide whether the requested access will be permitted. Disclosure of recorded images to third parties will only be made in limited and prescribed circumstances. For example, in cases of the prevention and detection of crime, disclosure to third parties will be limited to the following:

• law enforcement agencies where the images recorded would assist in a specific criminal enquiry
• prosecution agencies
• relevant legal representatives
• the press/media, where it is decided that the public’s assistance is needed in order to assist in the identification of victim, witness or perpetrator in relation to a criminal incident. As part of that decision, the wishes of the victim of an incident should be taken into account
• people whose images have been recorded and retained (unless disclosure to the individual would prejudice criminal enquiries or criminal proceedings)

All requests for access or for disclosure should be recorded. If access or disclosure is denied, the reason should be documented as above.

Disclosure of Images to the Media

If it is decided that images will be disclosed to the media (other than in the circumstances outlined above), the images of other individuals must be disguised or blurred so that they are not readily identifiable.

If the CCTV system does not have the facilities to carry out that type of editing, an editing company may need to be used to carry it out.

If an editing company is used, then the Data Controllers must ensure that there is a contractual relationship between them and the editing company, and;

• that the editing company has given appropriate guarantees regarding the security measures they take in relation to the images
• the written contract makes it explicit that the editing company can only use the images in accordance with the instructions of the Data Controllers
• the written contract makes the security guarantees provided by the editing company explicit

Access by Data Subjects

This is a right of access, which is provided by section 7 of the 1998 Act. Requests for access to images will be made using the ‘Application to access to CCTV images’ form (which is at Appendix 1), accompanied by a fee of Acrefield Surgery  (non-refundable if the request is declined).

Individuals should also be provided with the CCTV Policy and Code of Practice leaflet [*] which describes the type of images which are recorded and retained, the purposes for which those images are recorded and retained, and information about the disclosure policy in relation to those images.

Procedures for Dealing with an Access Request

All requests for access by Data Subjects will be dealt with by the Practice Manager.

The Data Controllers will locate the images requested. The Data Controllers will determine whether disclosure to the Data Subject would entail disclosing images of third parties.

The Data Controllers will need to determine whether the images of third parties are held under a duty of confidence. In all circumstances the Practice’s indemnity insurers will be asked to advise on the desirability of releasing any information.

If third party images are not to be disclosed, the Data Controllers will arrange for the third party images to be disguised or blurred. If the CCTV system does not have the facilities to carry out that type of editing, an editing company may need to be used to carry it out. If an editing company is used, then the Data Controllers must ensure that there is a contractual relationship between them and the editing company, and that

• the editing company has given appropriate guarantees regarding the security measures they take in relation to the images
• the written contract makes it explicit that the editing company can only use the images in accordance with the instructions of the Data Controllers
• the written contract makes the security guarantees provided by the editing company explicit

The Practice Manager will provide a written response to the Data Subject within 21 days of receiving the request setting out the Data Controller’s’ decision on the request.

A copy of the request and response should be retained.

Complaints

Complaints must be in writing, and addressed to the Practice Manager. Where the complainant is a third party, and the complaint or enquiry relates to someone else, the written consent of the patient or Data Subject is required. All complaints will be acknowledged within 7 days, and a written response issued within 21 days.

Appendix 1

Data Protection Act – Application for CCTV Data Access

ALL Sections must be fully completed. Attach a separate sheet if needed.

Name and address of Applicant
Name and address of “Data Subject” – i.e. the person whose image is recorded
If the Data Subject is not the person making the application, please obtain a signed consent from the Data Subject opposite	Data Subject signature……………………………….
If it is not possible to obtain the signature of the Data Subject, please state your reasons.
Please state your reasons for requesting the image.
Date on which the requested image was taken.
Time at which the requested image was taken.
Location of the Data Subject at time image was taken (i.e. which camera or cameras.)
Full description of the individual, or alternatively, attach to this application a range of photographs to enable the Data Subject to be identified by the operator.
Please indicate whether you (the Applicant) will be satisfied by viewing the image only.

On receipt of a fully completed application and the fee of Acrefield Surgery, a response will be provided as soon as possible and in any event within 40 days. In the event of a declined application the fee is non-refundable.

March 2019

To apply for access to your medical records, write to Dr. Thakrar/Dr Patel.

You do not need to give a reason for wanting to see them.

An appointment will be arranged, and a fee will be charged when you attend.

Disability Access

The Practice building has been designed for disabled access. There is a disabled access point at the reception desk and disabled toilets.

We would ask that you let us know if you need help as your disability may not be a visible one. We would also welcome any suggestions you may have in making your visit to the surgery easier.

Loop System

We have a loop induction system at the reception desk to assist the hearing impaired.

• British Deaf Association
• The Deaf Health Charity – SignHealth
• Action Hearing Loss
• Royal Association for Deaf People
• National Deaf Children’s Society

Blind / Partially Sighted

If you or family members are blind or partially sighted we can give you a large print of our practice leaflet upon request. Please ask Reception for further information.

For more advice and support for blind people please see the following websites:

• Royal National Institute of Blind People (RIND)
• British Wireless for the Blind Fund
• British Blind Sport

Guide Dogs

Guide dogs are welcome at the surgery but we ask that you be aware of other patients and staff who may have an allergy or fear of dogs.

Further Information:

• Guide Dogs

Other Disability Websites

• BID Services
• Disability Go
• Disabled People, your Rights, Benefits, Carers and the Equality Act
• Disability Rights UK
• Living with a Disability NHS Choices
• Disability Action
• Mencap

This will enable health and care professionals to have better medical information about you when they are treating you at the point of care. This change will apply for the duration of the coronavirus pandemic only. Unless alternative arrangements have been put in place before the end of the emergency period, this change will be reversed.

All patients registered with a GP have a Summary Care Record, unless they have chosen not to have one. The information held in your Summary Care Record gives health and care professionals, away from your usual GP practice, access to information to provide you with safer care, reduce the risk of prescribing errors and improve your patient experience.

Your Summary Care Record contains basic information about allergies and medications and any reactions that you have had to medication in the past.

Some patients, including many with long term health conditions, have previously agreed to have additional information shared as part of their Summary Care Record. This additional information includes information about significant medical history (past and present), reasons for medications, care plan information and immunisations.

During the coronavirus pandemic period, your Summary Care Record will automatically have additional information included from your GP record unless you have previously told the NHS that you did not want this information to be shared.

There will also be a temporary change to include COVID-19 specific codes in relation to suspected, confirmed, Shielded Patient List and other COVID-19 related information within the additional information.

By including this additional information in your SCR, health and care staff can give you better care if you need health care away from your usual GP practice:

• in an emergency
• when you’re on holiday
• when your surgery is closed
• at outpatient clinics
• when you visit a pharmacy

Additional information is included on your SCR

In response to the coronavirus (COVID-19) pandemic we are temporarily removing the requirement to have explicit consent to share the SCR additional information. This change of requirement will be reviewed when the pandemic is over.

You can be reassured that if you have previously opted-out of having a Summary Care Record or have expressly declined to share the additional information in your Summary Care Record, your preference will continue to be respected and applied.

Additional information will include extra information from your GP record, including:

• health problems like dementia or diabetes
• details of your carer
• your treatment preferences
• communication needs, for example if you have hearing difficulties or need an interpreter

This will help medical staff care for you properly, and respect your choices, when you need care away from your GP practice. This is because having more information on your SCR means they will have a better understanding of your needs and preferences.

When you are treated away from your usual doctor’s surgery, the health care staff there can’t see your GP medical records. Looking at your SCR can speed up your care and make sure you are given the right medicines and treatment.

The only people who might see your Summary Care Record are registered and regulated healthcare professionals, for example doctors, nurses, paramedics, pharmacists and staff working under their direct supervision. Your Summary Care record will only be accessed so a healthcare professional can give you individual care. Staff working for organisations that do not provide direct care are not able to view your Summary Care Record.

Before accessing a Summary Care Record healthcare staff will always ask your permission to view it, unless it is a medical emergency and you are unable to give permission.

Protecting your SCR information

Staff will ask your permission to view your SCR (except in an emergency where you are unconscious, for example) and only staff with the right levels of security clearance can access the system, so your information is secure. You can ask an organisation to show you a record of who has looked at your SCR – this is called a Subject Access Request.

Find out how to make a subject access request.

Opting out

The purpose of SCR is to improve the care that you receive, however, if you don’t want to have an SCR you have the option to opt out. If this is your preference please inform your GP or fill in an SCR opt-out form and return it to your GP practice.

Regardless of your past decisions about your Summary Care Record consent preferences, you can change your mind at any time.

You can choose any of the following options:

1. To have a Summary Care Record with additional information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a enriched Summary Care Record if they need to provide you with direct care.
2. To have a Summary Care Record with core information only. This means that any authorised, registered and regulated health and care professionals will be able to see information about allergies and medications only in your Summary Care Record if they need to provide you with direct care.
3. To opt-out of having a Summary Care Record altogether. This means that you do not want any information shared with other authorised, registered and regulated health and care professionals involved in your direct care, including in an emergency.

To make these changes, you should inform your GP practice or complete the SCR patient consent preferences form and return it to your GP practice.

More information on your health records

Read more about your medical records.

Interpreting Service

If English is not your first language, and you have no family or friends to translate for you we can arrange a telephonic interpreter service. We need a minimum of 48 hours to arrange this. There are several languages spoken by our team who would be happy to assist.