SHARED INFORMATION AND CONSENT
How is your information shared
The information we hold about you is confidential and we take great care to ensure it is safe, secure and that only people with a legitimate reason for seeing is able to. However there are times when we do share information about you to organisations outside the practice. This could be as simple as sending a referral to a hospital so the consultant is able to treat you; or there may be a legal reason to share data, for example when reporting a communicable disease.
There are now three new ways that we share information about you. They are all ways to help the NHS treat you better whether in emergency care or in planning future services or treatments.
Further infomation about Shared Information
The Summary Care Record (SCR)
The Summary Care Record has been developed as a national service. It is a very short summary of any medication you currently take and any allergies you may have. This information will help healthcare staff to make better decisions on how to treat you in an emergency. It will also help to prevent mistakes. You will be asked for your permission to look at your Summary Care Record except in special circumstance, for example if you are unconscious or if there is a court order. Whenever your Care Record is accessed, a note will be made on your record giving details.
You can choose not to have a Summary Care Record if you do not want one. This will prevent healthcare staff from seeing your information. If you do choose to opt out, you can opt in again at any time.
You will be receiving a letter in the post about the Summary Care Record. It includes a booklet describing the service further and a form for you to opt out, if you wish. See further information about the national Summary Care Record.
Summary Care Record Opt Out Form
To opt out (or back in), you need to tell us in writing as we need your signature. Opt out forms can be found under each relevant section above.
The Care and Health Information Exchange (CHIE)
This is a Hampshire-wide health record. It is similar to the Summary Care Record but holds more information about you. It includes diagnoses from your GP records and letters and test results from hospitals. This is only available in Hampshire and enables healthcare staff in the local area to make even better decisions about any emergency care you may require. As with the SCR, access is only granted with your permission or in exceptional circumstances and a record of access is recorded for future reference.
You can choose to opt out of the CHIE. Information about the CHIE has been sent to each household in Hampshire in the past and posters about it are published in Hampshire Now magazine and displayed in GP surgeries.
To opt out (or back in), you need to tell us in writing as we need your signature.
Please click here for more information
Medical Interoperability Gateway (MIG)
The MIG project enables GPs to see information recorded by the community teams about a patient, and for community staff to see information recorded by the GPs without having to log onto another system or to search for the patient in another system.
Who uses MIG?
Information will be available between the following organisations within Hampshire:
- GP surgery
- Mental Health
- Children’s Services
- Older People’s Mental Health Inpatients
- Older Person’s Mental Health Community
- Adult Nursing and Therapies
Who can see my information on MIG?
Of the above, all patients will have a GP record, but not all patients will have one of the other records. The GP record will only be visible to the other service if the other service has a record of their own. Staff will only be able to access MIG with your consent, and access will be audited.
What can I do if I don’t want my record shared?
If you don’t want to have your information shared, please contact the surgery and let us know.
DocMail Policy
Park & St Francis Surgery uses a data processing company called DocMail to handle some mailings to patients. Typically this is for bulk mailings such as the invitations to attend the flu clinics where it is difficult to accommodate the administrative work involved without affecting our ability to serve patients. This is permissible under guidance from both the Information Commissioner’s Office (ICO) and the Department of Health (DoH) subject to the provisions of the Data Protection Act.
Please find below some more information about DocMail and how we work with them to ensure that we protect our patients’ personal data at all times.
1.1 What is DocMail
DocMail is provided by CFH Total Document management Ltd a secure print and mailing company who provide print and mailing services for Local Government, GPs, Dentists, Medical practices, Schools, Exam Boards and Banks etc. throughout the UK.
The system can be found online at the Docmail website and requires a secure user name and password for us to log on and upload our letters and address lists to create the printed output for despatch to Royal Mail. The system allows us to upload a letter template and mailing data for the patients we want to write to via a secure web portal.
1.2 The Data Protection Act (1998) (DPA)
Park & St Francis Surgery Healthcare Practice and DocMail are both fully compliant with the Data Protection Act.
The Information Commissioners Office issued guidance in February 2012 for organisations that outsource some of its data processing to a third party. The Data Protection Act allows outsourcing to take place but stipulates certain conditions that must be met for it to be compliant.
An organisation that processes personal data is required to handle personal data in accordance with the data protection principles. A data controller may choose to use another organisation to process personal data on its behalf – a data processor.
The data controller remains responsible for ensuring its processing complies with the DPA, whether it processes in-house or engages a data processor.
Where a data processor is used the data controller must ensure that suitable security arrangements are in place in order to comply with the seventh data protection principle.
Further extracts from the guidance are reproduced below and the entire document is available on the ICO website.
Park & St Francis Surgery Healthcare Practice has strictly adhered to this guidance in setting up the partnership with DocMail.
Park & St Francis Surgery Healthcare Practice remains the data controller and as such has the responsibility for ensuring compliance with the provisions of the Act. We are not able to pass on those responsibilities to DocMail whose role is that of a data processor.
There is a written contract between Park & St Francis Surgery Healthcare Practice and CFH – Total Document management Ltd in addition to the standard terms of business that are published on the DocMail website.
That contract stipulates that DocMail can only act in accordance with instructions from Park & St Francis Surgery Healthcare Practice i.e. they can only print and mail letters in accordance with data provided by us. They are not able to do anything else with that data.
The contract also creates a legal requirement for DocMail to act in accordance with the seventh principle of the Data Protection Act.
The Partners of Park & St Francis Surgery Healthcare Practice have satisfied themselves that DocMail have provided sufficient guarantees in respect of the technical and organisational security measures governing the processing to be carried out.
The partners have taken, and will continue to take, reasonable steps to ensure that DocMail are compliant with these security measures.
No data will pass outside of the European Union
1.3 Connecting For Health
DocMail has achieved a 100% rating in the Department of Health's Information Governance Toolkit Assessment for 2011-2012 and we meet with the terms and conditions of the DH Information Governance Assurance Statement.
1.4 Other Approvals
DocMail is also approved by the following:
Government Procurement Service for Hybrid Mail - which allows all government organisations to use DocMail.
Health Trust EuropeOutgoing Mail Solutions - which includes University Hospitals Coventry and Warwickshire NHS trust who visited our premises last week to carry out a site audit.
67 Primary Care Trusts for Medical Studies have approved the use of DocMail. 500,000 medical studies packs were sent in 2011 across 200 surgeries
Caldicott Guardian across a number areas have approved the use of DocMail when asked
Ethics Committees have approved the use of DocMail by surgeries for use in medical studies
1.5 Accreditations & Security Policies
In addition to the credentials listed above, we have been supplied with DocMail’s Corporate Policies and certifications as detailed below:
ISO 27001:2005 Information Security management System Certificate
CFH Site Security Policy
CFH Information Technology Security Policy
Information Security Policy
We have permission from DocMail to allow any patient of Park & St Francis Surgery Healthcare Practice to view them on request. Please ask at reception if you wish to do this.
1.6 Process
The data file provided to DocMail will only contain enough data to enable them to fulfil the contract. This means that it will include name and address details and, where appropriate, the date and time of an appointment as well as the name of the clinician you will be seeing or the name of a clinic you will be attending eg Flu Clinic or NHS Health Check. We will of course exercise the same discretion in writing the letters as we would if we were printing and posting them at the surgery.
The letters will be delivered to your address by Royal Mail in the normal way. The letters will carry the DocMail logo and the return address on the reverse side. This address does not identify the letter as having come from a doctor’s surgery.
DocMail delete the personal data 28 days after the mailing.
If you have any questions or require further information about this please ask to speak to the Practice Manager.
Freedom of Information
The Freedom of Information Act 2000 (FOIA) provides rights of public access to information held by public authorities. This includes GP practices. The FOIA requires every public authority to adopt and maintain a publication scheme. All requests for information should be made in writing to the Practice Manager. Responses will be made within 20 working days of receipt of the request. Please note a fee may be charged.
