Subject Access Request

Under the Data Protection Act (DPA), the General Data Protection Regulations (GDPR) and (for deceased individuals) the Access to Health Records Act 1990, you have a legal right to apply for access to health information held about you. This includes your NHS records held by a GP.
A health record contains information about your mental and physical health recorded by a healthcare professional as part of your care.
Who can make an Access Request?
An application for access to personal data may be made to the Practice by any of the following:-
  • an individual
  • a person authorised by the individual in writing to make the application on an individual’s behalf e.g. solicitor, family member, carer
  • a person having parental responsibility for the individual where he/she is a child.
  • a person appointed by a court to manage the affairs of an individual who is deemed incompetent
  • individuals who hold a health and welfare Lasting Power of Attorney
  • where the individual has died, the personal representative and any person who may have a claim arising out of the individual’s death (the executor of the deceased’s will; someone who has been appointed as an Administrator of the Estate by the Courts; someone who has the written consent of either of the above to be given access, someone who is in the process of challenging the deceased’s will)
The Police may, on occasion, request access to personal data of individuals. Whilst there is an exemption in the Data Protection Act which permits the Practice to disclose information to support the prevention and detection of crime, the Police have no automatic right to access; however they can obtain a Court Order.
Parental responsibility for a child is defined in the Children’s Act 1989 as ‘all the rights, duties, powers, responsibilities and authority, which by law a parent of a child has in relation to a child and his property’. Although not defined specifically, responsibilities would include safeguarding and promoting a child’s health, development and welfare, including if relevant their employment records. Included in the parental rights which would fulfil the parental responsibilities above are:
  • having the child live with the person with responsibility, or having a say in where the child lives;
  • if the child is not living with her/him, having a personal relationship and regular contact with the child;
  • controlling, guiding and directing the child’s upbringing.
Foster parents are not ordinarily awarded parental responsibility for a child. It is more likely that this responsibility rests with the child’s social worker and appropriate evidence of identity should be sought in the usual way.
The law regards young people aged 16 or 17 to be adults for the purposes of consent to treatment and the right to confidentiality. Therefore, if a 16 year old wishes a medical practitioner to keep their information confidential then that wish must be respected. In some certain cases, children under the age of 16 who have the capacity and understanding to take decisions about their own treatment are also entitled to decide whether personal information may be passed on and generally to have their confidence respected.
Where a child is considered capable of making decisions, e.g. about his/her employment or medical treatment, the consent of the child must be sought before a person with parental responsibility may be given access. Where, in the view of the appropriate professional, the child is not capable of understanding the nature of the application, the holder of the record is entitled to deny access if it is not felt to be in the patient’s best interests.
The identity and consent of the applicant must always be established.
The applicant does not have to give a reason for applying for access.
The Practice is a Data Controller and can only provide information held by the organisation. Data controllers in their own right must be applied to directly, the Practice will not transfer requests from one organisation to another.
Application
Individuals wishing to exercise their right of access should:
  • Make a written application to the Practice holding the records, including via email
  • Provide such further information as the Practice may require to sufficiently identify the individual
An individual may also raise a request using the SAR form: SAR Form
Fees and Response Time
Under GDPR the Practice musts provide information free of charge. However, we can charge a “reasonable fee” when a request is manifestly unfounded or excessive, particularly if it is repetitive.
The fee must be based on the administrative cost of providing the information only.
The request must be complied with without delay and at least within one calendar month of receipt of the request. This period can be extended for a further two months where requests are complex or numerous, however the Practice must inform the individual within one month of receipt of the request and explain why the extension is necessary.
The identity of an individual who provided/recorded information should not be disclosed, nor should the identity of any other person/s referred to in the record(s) of the individual requesting access, unless explicit consent has been given.
Exemptions
Access may be denied or restricted where:
  • The record contains information which relates to or identifies a third party that is not a care professional and has not consented to the disclosure. If possible, the individual should be provided with access to that part of the record which does not contain the third party information
  • Access to all or part of the record will prejudice the carrying out of social work by reason of the fact that serious harm to the physical or mental well-being of the individual or any other person is likely. If possible the individual should be provided with access to that part of the record that does not post the risk of serious harm
  • Access to all or part of the record will seriously harm the physical or mental well-being of the individual or any other person. If possible the individual should be provided with access to that part of the record that does not pose the risk of serious harm
  • If an assessment identifies that to comply with a SAR would involve disproportionate effort under section 8(2)(a) of the Data Protection Act
There is no requirement to disclose to the applicant the fact that certain information may have been withheld.
In addition, Article 23 of the GDPR enables Members States, such as the United Kingdom to introduce further exemptions from the GDPR’s transparency obligations and individual rights. The Data Protection Officer can provide further information regarding exemptions applicable at the time of receipt of the subject access request.
Complaints and Appeals
The applicant has the right to appeal against the decision of the Practice to refuse access to their information. This appeal should be made to the Practice Manager.
If an applicant is unhappy with the outcome of their access request, the following complaints channels should be offered:
  • meet with the applicant to resolve the complaint locally
  • Advise a patient to make a complaint through the complaint’s process
  • Advise a member of staff to consult with their trade union representative
If individuals remain unhappy with the Practice response, they have the right to appeal to the Information Commissioner’s Office: www.ico.org.uk/Global/contact_us
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Email: casework@ico.gsi.gov.uk

Connect Care

Connect Care: How We use your Information

What is Connect Care?

In the past health and social care workers from the local organisations involved in your care did not have a system in place to share important information about your care automatically. This meant that GPs, hospital staff, district nurses, occupational therapists, and others involved in your care did not always have immediate access to all the information needed to provide timely and efficient care.

To address this, in 2015 a new local electronic record system was launched; this system is called Connect Care. Connect Care allows important information about you to be shared securely so that it can be viewed quickly and safely by staff directly involved in your care, such as GPs, hospital staff, district nurses, occupational therapists and social workers. This will enable them to make more informed decisions about your care and treatment.

Do I have a Choice?

Yes. To find out what your options are, please visit the Connect Care website: www.lewishamandgreenwich.nhs.uk/connectcare.

Where can I find out more about Connect Care?

Please visit the Connect Care website www.lewishamandgreenwich.nhs.uk/connectcare.

Setting a national opt-out preference

Commissioned by the Secretary of State for Health Dame Fiona Caldicott, the National Data Guardian for Health Care (NDG) has reviewed data security and data sharing in the health and social care system. The so-called ‘Caldicott review’ provides for people to be able to make an informed choice about whether to share data or not.

Patients and public who decide they do not want their personally identifiable data used for planning and research purposes will be able to set their national opt-out preference.

As of the 25th May 2018, residents have the right to opt out of your personal confidential information being used for the following purposes.

  • Providing local services and running the NHS and social care
  • Supporting research and improving treatment of care

To set an opt-out preference, NHS Digital will offer digital (online) and non-digital national data opt-out systems. For further information and support relating to opt-outs, please contact NHS Digital or by phoning 0300 303 5678.

Exceptional circumstances
The opt-out will not apply where there is a mandatory legal requirement or an overriding public interest. These will be areas where there is a legal duty to share information (for example a fraud investigation) or an overriding public interest (for example to tackle the ebola virus).

Please view the Connect Care information leaflet here.

Patient Data

Under the Data Protection Act 1998, you are entitled to access your clinical records or any other personal information held about you. Please ask reception for charges.

Zero Tolerance Notice

We treat our patients with courtesy and respect and ask for the same in return. We ask that you treat your GP and all other Practice Staff courteously without violence, abuse or harassment.
GPs and their staff have the right to care for others without fear of being attacked or abused.  Any behaviour whether that be verbal, physical or in writing, which causes staff to feel uncomfortable, embarrassed or threatened, is totally unacceptable.
The Zero Tolerance policy includes abuse, aggression or threats made in person, over the telephone or in written communication, including on social media. The Practice considers threatening behaviour to be:
  • Attempted or actual aggressive, threatening or physical actions made towards any member of staff
  • The use of aggressive, threatening or abusive language, (including raising of the voice, swearing, shouting or in writing) which threatens or intimidates staff
This policy applies throughout the premises. It also applies to any employee or partner away from the practice but only in so far as it relates to the business of the practice.
Any instance or threat of physical abuse will be reported to the police. The offender will be removed from the premises by the police. The patient will then be removed from the practice list.
Instances of abusive/threatening behaviour will be reported to the Practice Manager and a warning letter will be sent to the patient. The patient may contact the Practice Manager to discuss this warning letter if they wish to do so. If there is any further incident, the patient will be sent a Final Warning Letter informing them of their breach of the Zero Tolerance Policy and their removal from the Practice list.
We hope you understand the reason for this policy which is designed to keep our staff and other patients safe at all times.

Comments, Complaints & Suggestions

Whilst we constantly strive to provide good, friendly and efficient services, we realise that occasionally things do not go as smoothly as we would like. We are always pleased to receive constructive criticism, so if you have any suggestions or are unhappy about any aspect of our services please bring it to the notice of the doctor and not the receptionists, or preferably, ask to make an appointment with the Practice Manager.

Complaints about any aspect of the service provided at Slade Green Medical Centre or Colyers Lane Medical Centre should be forwarded to the Practice Manager in writing. All complaints received are dealt with according to the NHS complaints procedure.

Patients can also get help and advice about making a complaint from NHS England by telephone 0300 311 2233.

If you are happy with us please tell others – if you are not – tell us.

Please view our Complaint Procedure here.

Chaperone Policy

We have both male and female doctors in the practice. There are occasions when patients need to be examined by doctors which may involve intimate examinations.

This practice is committed to putting patients at ease whenever possible, and if you wish for a chaperone to be present during your examination please to not hesitate to ask the doctor for a chaperone.

It may not be possible for such a chaperone to be provided immediately and you may need to return for the examination to be carried out at a mutually convenient time.

Privacy Notice: Enhanced Access

Primary Care Networks (PCNs) are a key part of the NHS Long Term Plan, with all general practices being required to be in a network. This practice is part of the North Bexley Primary Care Network.

North Bexley Primary Care Network is made up of a number GP Practices created to work collaboratively to ensure the health care system within our area works effectively by sharing knowledge and resources.

From 1st October 2022, existing GP Extended Access Services/Hubs and GP Surgency Enhanced hours merged to provide a new enhanced delivery model to patients. The new offer was based on Primary Care Networks providing bookable appointments outside of ‘core hours’ within the Enhanced Access period of 6.30pm-8pm weekday evenings and 9am-5pm on Saturdays, utilising the full multi-disciplinary team, and offering a range of general practice services, including ‘routine’ services such as screening, vaccinations and health checks, in line with patient preference and need.

To enable us to provide our Enhanced Access Service to you, GPs from other local practices and staff from Bexley’s GP Federation, Bexley Health Neighbourhood Care will at times have access to your full GP record but only when providing direct care to you.

People who have access to your information will only normally have access to that which they need to fulfil their roles, for instance admin staff will normally only see your name, address, contact details, appointment history and registration details in order to book appointments, the practice nurses will normally have access to your immunisation, treatment, significant active and important past histories, your allergies and relevant recent contacts whilst the GP you see or speak to will normally have access to everything in your record.

1) Controller contact details Slade Green Medical Centre – 156 Bridge Road, Slade Green DA8 2HS – 01322 334884
2) Data Protection Officer contact details

 

Danielle Gibbons

GP Data Protection Officer

Email: gpdpo@selondonics.nhs.uk

3) Purpose of the processing To provide our patients with direct care.
4) The Lawfulness Conditions and Special Categories The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere  is supported under the following Article 6 and 9 conditions of the GDPR:

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.

Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” 

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”

5) Recipient or categories of recipients of the shared data The data will be shared with:

Bexley Health Neighbourhood Care

6) Rights to object You have the right under Article 21 of the GDPR to object to your personal information being processed. Please contact the Practice if you wish to object to the processing of your data. You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance.

GP Practices process personal data under Article 6(1)(c) on a lawful and legitimate basis where the organisation is obliged under law to comply with

  • The General Data Protection Regulations (GDPR)
  • The Freedom of Information Act
  • The NHS Constitution
  • The Local Authority Social Services and National Health Service Complaints (England) Regulations 2009

By complying with these laws, the Practice has compelling legitimate grounds for the processing which override the interests, rights and freedoms in the right to object.

7) Right to access and correct Under GDPR and the Data Protection Act 2018, you have the right to see or be given a copy of any personal data we hold about you. To gain access to a copy of your information, you will need to make a Subject Access Request (SAR) to the Practice.

You also have the right to have incorrect data held about you corrected.

8) Retention period The data will be retained for the period as specified in the national NHS records retention schedule.
9)  Right to Complain. You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/global/contact-us/

or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)

There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Please view our Enhanced Access Privacy Notice here.

Data Protection (GDPR)

Confidentiality & Medical Records

Our practice is registered under The Data Protection Act. All our staffs are bound by a duty of confidentiality. Your medical records are kept on a computer system which is secure. Doctors and other staff may view your medical record only when required clinically.

The practice complies with data protection and access to medical records legislation. Identifiable information about you will be shared with others in the following circumstances:

  • To provide further medical treatment for you e.g. from district nurses and hospital services.
  • To help you get other services e.g. from the social work department. This requires your consent.
  • When we have a duty to others e.g. in child protection cases anonymised patient information will also be used at local and national level to help the Health Board and Government plan services e.g. for diabetic care.

Freedom of Information

Information about the General Practitioners and the practice required for disclosure under this act can be made available to the public. All requests for such information should be made to the practice manager.

Access to Records

In accordance with the Data Protection Act 1998 and Access to Health Records Act, patients may request to see their medical records. Such requests should be made through the practice manager and may be subject to an administration charge. No information will be released without the patient consent unless we are legally obliged to do so.

Further Information

Privacy Notice: GDPR
Data Protection – How we use your information

Summary Care Record

There is a new Central NHS Computer System called the Summary Care Record (SCR). It is an electronic record which contains information about the medicines you take, allergies you suffer from and any bad reactions to medicines you have had.

Why do I need a Summary Care Record?

Storing information in one place makes it easier for healthcare staff to treat you in an emergency, or when your GP practice is closed.

This information could make a difference to how a doctor decides to care for you, for example which medicines they choose to prescribe for you.

Who can see it?

Only healthcare staff involved in your care can see your Summary Care Record.

How do I know if I have one?

Over half of the population of England now have a Summary Care Record. You can find out whether Summary Care Records have come to your area by asking your GP.

Do I have to have one?

No, it is not compulsory. If you choose to opt out of the scheme, then you will need to complete a form and bring it along to the surgery.

More Information

For further information visit the NHS Care records website.

Statement of Purpose

Our Mission
Our mission is to provide accessible, quality care to all patients. We continuously improve standards of medical care and customer service, promote health and wellness initiatives for employees and patients, and provide the highest quality care with compassion, respect, and dedication.
Our Vision
Our vision is to create a compassionate and safe environment where patients receive exceptional care. We strive for continuous improvement, leveraging teamwork to enhance patient outcomes and well-being.
Aims and Objectives
To provide the best possible quality service for our patients within a confidential and safe environment.
To show our patients courtesy and respect at all times irrespective of ethnic origin, religious belief, personal attributes or the nature of the health problem.
To treat all our patients as individuals and with the same respect as we would wish for ourselves and our families.
To involve our patients in decisions regarding their treatment and to be transparent in the care we provide.
To focus on prevention of disease by promoting good health and well being to our patients through education and information.
To work in partnership with other healthcare professionals in the care of our patients to tackle the causes of, as well as provide the treatment for ill health.
To encourage our patients to get involved in the practice through both the patient participation group.
To ensure that all member of the team have the right skills and training to carry out their duties competently.
To take care of our staff by offering them support to do their jobs and protect them against abuse.
Have a zero tolerance of all forms of abuse.