Keeping your personal data safe is central to the GM Care Record

Personal information (or Personal Data) means any information about an individual from which that person can be identified. The Personal Data that is shared includes:

Identifying Data:
Forename, Surname, Address, Date of Birth, Gender, Age, Postal Address, Postcode, Telephone Number and NHS Number.

Other categories of Personal Data:
This includes:

• A list of diagnosed conditions – to make sure your clinical and care staff have an accurate record of your care
• Medication – so everyone treating you can see what medicines you have been prescribed
• Allergies – to make sure you’re not prescribed or given any medicines you can have an adverse reaction to
• Test results – to speed up treatment and care and to ensure tests are not repeated
• Referrals, clinical letters and discharge information – to make sure the people caring for you have all the information they need about other care and treatment you are having elsewhere
• Care plans (where available) – for health and care workers involved in your care to view a joined-up plan of care and the wishes you’ve asked for in relation to your care
• Relevant information about people that care for you and know you well.
• Basic details about associated people e.g. children, partners, carers, relatives etc.

To process personal data or identifiable data lawfully we are required to have a purpose or reason for processing that data. Below is a breakdown of the common legal bases that are used for the GM Care Record and the relevant legislation.

GDPR (UK):
The General Data Protection Regulations (UK) requires us to have a legal basis for processing information that can be used to identify an individual, including pseudonymised data, but not anonymised data. For further information please visit: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

To process personal data, as defined by the GDPR (UK) the following lawful bases from Article 6 are used, and may be used for either data related to individual care or data related to secondary uses:

6.1(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

In certain circumstances the following may be used when sharing information is necessary to protect an individual from harm:

6.1(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person

Additionally when more sensitive data is processed, we require a further legal basis as laid out by Article 9. Sensitive data is defined by GDPR (UK) as special categories of personal data requiring further protection, for example racial or ethnic origin and health data. The following lawful bases from Article 9 are typically used:

For the purposes of improving individual care the condition which lifts the prohibition on processing of the special category of data is:

9.2(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.

If the data processed for the purposes of planning NHS Services, improving patient safety or evaluating government and NHS Policy is still considered to be personal data under GDPR the condition which lifts the prohibition on processing of the special category of data is:

9.2(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy

If the data processed for the purposes of research (for example to understand more about disease, or develop new treatments) is still considered to be personal data under GDPR the condition which lifts the prohibition on processing of the special category of data is:

9.2(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject

In certain circumstances the following may be used when sharing information is necessary to protect an individual from harm:

9.2(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent

Data Protection Act 2018 (DPA):
The DPA 2018 is legislation that further defines sections of the GDPR specifically for the UK.

Schedule 1, Part 1, condition(s) for processing:

(2) Health or social care                       

For health or social care:

(d) provision of health care or treatment

(e) provision of social care

Schedule 1, Part 1 makes further reference to the legal basis in the GDPR and whether or not the condition is met for the DPA.

In relation to Secondary Uses (Secondary Use Definition)

Schedule 1, Part 1, condition(s) for processing:

(2) Health or social care                       

(3) Public health

(4) Research

For health or social care:

(d) provision of health care or treatment

(e) provision of social care

(f) management of health care systems or services or social care systems or services

For the purpose of public health:

(b)(i) by or under responsibility of a health professional                

(b)(ii) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law

For research purposes:

(a)  is necessary for archiving purposes, scientific or historical research purposes or statistical purposes

(b)  is carried out in accordance with Article 89(1) of the GDPR, and

(c)  is in the public interest

Common Law Duty of Confidentiality (CLDC):
The Common Law Duty of Confidentiality is not a codified piece of legislation but is an amalgamation of case law that allows data to be processed via specific legal gateways.

For individual care purposes implied consent is used as a reasonable expectation for the use of health and care records.

For uses beyond health and care the following gateways may be used:

Explicit Consent – Requesting consent directly from the individual that the record refers to.

Overriding Public Interest – When sharing the information can be clearly evidenced to be of overwhelming interest to public safety.

Other Statutory or Legal Duty – In the cases of court orders for instance or required by routes such as those below:

Confidentiality Advisory Board for section 251 approval – Section 251 of the NHS Act 2006 allows the use of confidential patient information for audit or medical research when it is not possible to use anonymised information and when seeking consent is not practical. An application needs to be made for this approval.

Control of Patient Information Notice – A notice from the secretary of state for health that disclosure is required for the public benefit, as an example this was used during the Covid-19 Pandemic.

Further Related Legislation:
The Health and Social Care (Safety and Quality) Act 2015 inserted a legal Duty to Share Information In Part 9 of the Health and Social Care Act 2012.

Official authority:

Personal Data will only be shared between the health and social care organisations that are signed up to the GM Care Record Data Protection Impact Assessment (DPIA). These include:

• Primary care (e.g. your GP practice)
• Community services
• Mental health services
• Local authority social care departments
• Secondary care (e.g. hospitals)
• Specialist services (e.g. ambulances)

The GM Care Record makes your patient information easily accessible for the purposes of your care and treatment.

A record of care is held on each organisation’s secure electronic system (local record) e.g. a GP practice will have their own system for recording patient information. Graphnet, a supplier of healthcare systems, has designed a secure system that integrates data from those multiple electronic health and social care systems to provide a live and read-only summary of that data to a health or social care worker when required for the purposes of your individual care.

Data is presented as a read-only view; meaning that the Personal Data from an organisation’s local record is not changed. The data remains within each organisation’s database and staff using the GM care record are allowed a read-view access only. Access to your data depends on the professional having access in their own clinical/care systems – so professionals can only see information regarding patients that are being referred for treatment or have been treated by them.

As the GM Care Record is an integrated digital care record that pulls together vital patient data from several health and social care providers, only data currently visible in each of the local systems will be visible in the GM Care Record. Each partner organisation feeding data into the GM Care Record has local retention rules set by the NHS Records Management Code of Practice for Health and Social Care.

Within the governance framework for the GM Care Record, the system supplier is also contractually obliged to comply with any requests by the partners to remove/delete data when instructed to do so.

Under the Data Protection Legislation, you have the right to:

• be informed of our uses of your data (the purpose of this privacy notice)
• request copies of your personal information, commonly referred to as a Subject Access Request (SAR)
• have any factual inaccuracies corrected
• request the restriction or suppression of your personal data. This is not an absolute right and only applies in certain circumstances
• not be subject to automated decision making or profiling. There is no automated decision making or profiling in the GM Care Record
• complain about the handling of your data to an organisations data protection officer or to the regulator
• also have the right to object to processing of your personal data in certain circumstances.

Details of how to exercise your rights are shown below.

To access your Personal Data, you should contact your local appropriate organisation (Appendix A at the end of this page) and their Data Protection Officer.

If this data contains errors, you can exercise your right to correct this information via the Data Protection Officer.

Please contact your local appropriate health or social care organisation (Appendix A at the end of this page) and their Data Protection Officer to raise a complaint.

You can get further advice or report a concern directly to:

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Telephone: 0303 123 1113 (local rate) or 01625 545745 (national rate)
Online: https://ico.org.uk/concerns/handling/
Further information about the way in which the NHS uses personal information and your rights is published by NHS Digital:

The NHS Care Record Guarantee
The NHS Care Record Guarantee for England sets out the rules that govern how patient information is used in the NHS, what control the patient can have over this, the rights individuals have to request copies of their data and how data is protected under Data Protection Legislation.
http://systems.digital.nhs.uk/infogov/links/nhscrg.pdf

The NHS Constitution
The NHS Constitution establishes the principles and values of the NHS in England. It sets out the rights patients, the public and staff are entitled to. These rights cover how patients access health services, the quality of care you’ll receive, the treatments and programmes available to you, confidentiality, information and your right to complain if things go wrong.
https://www.gov.uk/government/publications/the-nhs-constitution-for-england

NHS Digital
NHS Digital collects health information from the records health and social care providers keep about the care and treatment they give, to promote health or support improvements in the delivery of care services in England.
http://content.digital.nhs.uk/article/4963/What-we-collect

National Data Opt-Out
The national data opt-out is a service that allows patients to opt out of their confidential patient information being used for research and planning. Visit the website below to find out more information or to opt-out of having your patient information being used for research and planning.
https://www.nhs.uk/your-nhs-data-matters/