GDPR stands for General Data Protection Regulations and is a new European Directive. It will not only apply to the UK and EU; it covers anywhere in the world in which data about EU citizens is processed.
What does this mean for patients?
The change in GDPR mean that we must get explicit permission from patients when using their data. This is to protect your right to privacy, and we may ask you to provide consent to do certain things including recording certain information about you for your clinical records. Individuals have the right to withdraw consent at any time.
- Data must be processed lawfully, fairly and transparently
- It must be collected for a specific, explicit and legitimate purpose
- It must be limited to what is necessary for the purposes for which it is processed
- Information must be accurate and kept up to date
- Data must be held securely
- It can only be retained for as long as necessary for the reasons it was collected
There are also stronger rights for patients regarding the information that practices/organisations hold about them including:
- Being informed about how data is used
- Patients having access to their own data
- Patients can request to have incorrect information changed
- Patients can restrict how their data is used
- Patients can move their data from one health organisation to another
- The right to object to patient information being processed (in certain circumstances)
For more information about specific policies and notices head to our Privacy Notice page
| Data Controller | Sutton PCNs (on behalf of your practice) |
| Data Protection Officer | Please contact your own GP practice for this information |
| Purpose of Processing your personal information | Direct Care is care delivered to the individual alone, most of which is provided in the surgery. After a patient agrees to a referral for direct care elsewhere, such as a referral to a specialist in a hospital, necessary and relevant information about the patient, their circumstances and their problem will need to be shared with the other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care. The practice performs computerised searches of some or all of our records to identify individuals who may be at increased risk of certain conditions or diagnoses i.e. Diabetes, heart disease, risk of falling). Your records may be amongst those searched. This is often called “risk stratification”. These searches are sometimes carried out by Data Processors who link our records to other records that they access, such as hospital attendance records. The results of these searches and assessment may then be shared with other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care. |
| Lawful Basis for Processing your personal information | The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR: Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” |
| Recipient or categories of recipients of your personal data | The data will be shared with health and care professionals and support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care. In addition, personal data may be shared which is sent to or may be received from providers such as our 8to8 hubs (who provide some evening and weekend appointments on behalf of the practice), 111, out of hours services, local social services and care services, or other services the Wandsworth clinical commissioning group has commissioned. In all cases, we ensure the data is supplied is appropriate and within the law. |
| Your right to object | You have the right to object to some or all the information being processed, which is detailed under Article 21. Please contact the Data Controller or the practice manager. You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance. |
| Your right to access and correction | You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law. |
| How long do we hold your personal data for? | We retain your personal data in line with both national guidance and law. |
| Your right to complain | Use of personal data is overseen by the Information Commissioners Office, often known as the ICO. You have to complain or raise concerns with the ICO and they can be contacted via their website: https://ico.org.uk/make-a-complaint/ Or you can also call their helpline Tel: 0303 123 1113 (local rate) 01625 545 745 (national rate) |
We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.
