Appendix A

Who we share your information with and why

Integrated Care Board (ICB)

• Purpose: Anonymous information is shared to plan and design care services within the locality.
• Legal Basis: non identifiable data only.
• Data Processor: Southampton ICB (formerly known as Clinical Commissioning Group – CCG)

CSU – Individual Funding Requests  (IFR)

• Purpose: We may need to share your information with the IFR team for the funding of treatment that is not normally covered in the standard contract.
• Legal Basis: The clinical professional who first identifies that you may need the treatment will explain to you the information that is needed to be collected and processed in order to assess your needs and commission your care; they will gain your explicit consent to share this.
• Data processor: We ask NHS South, Central and West Commissioning Support Unit (CSU) to do this on our behalf.

Summary Care Records (SCR)

• Purpose: The NHS in England uses a national electronic record called the Summary Care Record (SCR) to support patient care. It contains key information from your GP record. Your SCR provides authorised healthcare staff with faster, secure access to essential information about you in an emergency or when you need unplanned care, where such information would otherwise be unavailable.
• Legal Basis: Direct Care The relevant COPI notice states that its purpose: “…is to require organisations to process confidential patient information for the purposes set out in Regulation 3(1) of COPI to support the Secretary of State’s response to Covid-19 (Covid-19 Purpose). “Processing” for these purposes is defined in Regulation 3(2) and includes dissemination of confidential patient information to persons and organisations permitted to process confidential patient information under Regulation 3(3) of COPI.” Full details of the Summary Care Record supplementary privacy notice can be found here Patients have the right to opt out of having their information shared with the SCR by completion of the form which can be downloaded here and returned to the practice. Please note that by opting out of having your information shared with the Summary Care Record could result in a delay care that may be required in an emergency.
• Processor: NHS England and NHS Digital via GP connect 

Care and Health Information Exchange (CHIE) 

• Purpose: To provide Healthcare Professionals with complete, accurate and up to date information. This information comes from a variety of sources including GP practices, community providers, acute hospitals and social care providers. CHIE is used by GP out of hours, acute hospital doctors, ambulance service, GPs and others on caring for patients in Hampshire and Dorset – you may opt out of having your information shared on this system.
• Legal Basis: This service is for your direct care and in an emergency.
• Data Processor: NHS SCW

Community Staff: Complex Care Team, Home Visiting Service, District Nurses, Community Matrons, Leg Ulcer Service, Heart Failure Service, Multi-Disciplinary Team, Palliative Care Nurses, Midwives, Health Visitor, Diabetes Team

• Purpose: We will enable the Community Nursing Team to have access to your medical record to allow you to receive care from the community nurses for the services listed.
• Legal Basis: These services are for your direct care and is fully consented, permission to share your medical record will be gained prior to an appointment being made in the service
• Data Processor: Your registered surgery will continue to be responsible for your full medical record 

Care Quality Commission (CQC)

• CQC has powers under the Health and Social Care Act 2008 to access and use information where they consider it is necessary to carry out their functions as a regulator.
• CQC relies on its legal powers to access information rather than consent, therefore may use its powers to access records even in cases where objections have been raised.
• CQC Privacy Notice is available on the CQC website 

 Care and Health Information Archive (CHIA)

• Purpose: Is a database used for analysing trends in population health in order to identify better ways of treating patients. CHIA is a physically separate database, which receives some data from CHIE. Prior to this transfer from CHIE to CHIA patient identifiers are removed from the data. This includes names, initials, addresses, dates of birth and postcodes. NHS numbers are encrypted in the extract and cannot be read. This process is called ‘pseudonymisation’. This subset of data does not include information typed in by hand, so there is no possibility of it containing references to family members or other people. It contains only coded entries for things like allergies and prescribed drugs. It is not possible to identify any patient by looking at the ‘pseudonymised’ data on the CHIA database. People who have access to CHIA do not have access to CHIE. Data in CHIA is used to plan how health and care services will be delivered in future, based on what types of diseases are being recorded and how many are being referred to hospital etc. Data is also used to help research into new treatments for diseases.
• Legal Basis: You can opt out of this service
• Data Processor: NHS SCW

General Practice Data for Planning and Research (GPDPR) 

• Purpose: Patients personal confidential data will be extracted and shared with NHS Digital in order to support vital health and care planning and research. Further information can be found here.

Patients may opt out of having their information shared for Planning or Research by applying a National Data opt out or a Type 1 opt out. Details of how to opt Out can be found on our Privacy Notice. For the National Data opt out patients are required to register their preference here.

• Legal Basis : The legal basis for this activity can be found here.
• Processor: NHS Digital

Other GP practices 

• Purpose: We will enable other GPs and staff in other GP practices to have access to your medical record to allow you to receive acute medical care within that service.
• Legal Basis: This service is for your direct care and is fully consented, permission to share your medical record will be gained prior to an appointment being made in the service and again once you are in the consultation.
• Data Processor: Your registered surgery will continue to be responsible for your full medical record.

 Pharmacists from the ICB Medicines Optimisation Team

• Purpose: To provide monitoring and advice in line with the national directive for prescribing. Anonymous data is collected by the ICB.
• Legal Basis: Direct care.
• Data Processor: Southampton ICB

MASH – Multi Agency Safeguarding Board - Safeguarding Children, Safeguarding Adults

• Purpose: We share information with health and social care authorities for safeguarding issues.
• Legal Basis: Because of public Interest issues, e.g., to protect the safety and welfare of Safeguarding we will rely on a statutory basis rather than consent to share information for this use.
• Data Processor: Multi Agency Safeguarding Authorities.

National Registries

• National Registries (such as the Learning Disabilities Register) have statutory permission under Section 251 of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user. 

Risk Stratification 

• Purpose: Risk stratification is a process for identifying and managing patients who are at high risk of emergency hospital admission. Risk stratification tools use various combinations of historic information about patients, for example, age, gender, diagnoses and patterns of hospital attendance and admission and primary care data collected from GP practice record systems. GPs will be able to identify which of their patients are at risk in order to offer a preventative service to them.
• Legal Basis: Risk stratification has been approved by the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority NHS England encourages GPs to use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable hospital admissions and to promote quality improvement in GP practices.
• Data Processors: NHS South, Central and West Commissioning Support Unit (CSU) to assist us with providing Risk Stratification tools.
• Data Processing activities for Risk Stratification: The GP practice instructs its GP IT system supplier to provide primary care data identifiable by your NHS Number.
• Opting Out: If you do not wish information about you to be included in our risk stratification programme, please contact the GP Practice. They can add a code to your records that will stop your information from being used for this purpose. Further information about risk stratification is available from here

Quality monitoring, concerns, and serious incidents

• Purpose: We need to ensure that the health services you receive are safe, effective and of excellent quality. Sometimes concerns are raised about the care provided or an incident has happened that we need to investigate. You may not have made a complaint to us directly but the health care professional looking after you may decide that we need to know in order to help make improvements.
• Legal Basis: The health care professional raising the concern or reporting the incident should make every attempt to talk to you about this and gain your consent to share information about you with us. Sometimes they can do this without telling us who you are. We have a statutory duty under the Health and Social Care Act 2012, Part 1, Section 26, in securing continuous improvement in the quality of services provided.
• Data Processor: We share your information with health care professionals’ that may include details of the care you have received and any concerns about that care. In order to look into these concerns, we may need to talk to other organisations such as Fareham & Gosport and SE Hants ICB as well as other public bodies and Government agencies such as NHS Improvement, the Care Quality Commission, NHS England as well as the providers of your care.

Commissioning, planning, contract monitoring and evaluation

• Purpose: We share aggregated, anonymous, patient data about services we have provided.
   
• Legal Basis: Our legal basis for collecting and processing information for this purpose is statutory.   We set our reporting requirements as part of our contracts with NHS service providers and do not ask them to give us identifiable data about you. 
   
  If patient level data was required for clarity and extensive evaluation of a service, consent will be gained for the surgery to share this information.
   
• Data Processor: Various organisations, ICB, third party organisations commissioned by the NHS to perform actuarial services, NHS England
   
• eConsult: Anonymised aggregated numbers of contacts are shared for the online consultation tool.

 Surveys & asking for your feedback

Sometimes we may offer you the opportunity to take part in a survey, that the practice is running or the Friends & Family Feedback. We will not generally ask you to give us any personal confidential information as part of any survey. 

• Legal Basis: You are under no obligation to take part and where you do, we consider your participation as consent to hold and use the responses you give us.
• Data Processor: Survey Monkey, We Love Surveys, Fourteen Fish Feedback, Tree View Designs

Research​​​​​​​

• Purpose: To support research-oriented proposals and activities in our commissioning system
• Legal Basis: Your consent will be obtained by the organisation holding your records before identifiable information about you is disclosed for any research. If this is not possible then the organisation wishing to use your information will need to seek formal approval from The Independent Group Advising on the Release of Data (IGARD) 

     We may write to you offering you the opportunity to take part in research, for which your consent will be sought in advance.

Screening

• Purpose: To support disease monitoring and health prevention for specific patients
• Legal Basis: Your consent is sought either implicitly or explicitly. You are invited to be screened either by the practice or the screening provider directly.  You can choose to consent or dissent at any point in the screening

Hampshire County Council

• Purpose: To support disease monitoring and health prevention for specific patients

• Legal Basis: Your consent is sought either implicitly or explicitly. You are 
  invited to be screened either by the practice or the screening provider directly.  

  You can choose to consent or dissent at any point in the screening

Medication & Prescribing

• Purpose: Prescriptions containing personal identifiable and health data will be shared with chemists/pharmacies, in order to provide patients with essential medication or treatment as their health needs dictate. 

  This process is achieved either by face-to-face contact with the patient or electronically. Where patients have specified a nominated pharmacy, they may wish their repeat or acute prescriptions to be ordered and sent directly to the pharmacy making a more efficient process. 

  Arrangements can also be made with the pharmacy to deliver medication 

• Legal Basis: Article 6(1)(e); “necessary… in the exercise of official authority vested in the controller’ And Article 9(2)(h) as stated below

  Patients will be required to nominate a preferred pharmacy.

Pinnacle - Outcomes4Health

• Purpose: To support Covid Vaccination Clinics ‘data entry of vaccinations. Pinnacle interacts with TPP.
• Legal Basis: Your consent is sought either implicitly or explicitly. You are invited to be vaccinated by the practice or centrally through the DHSC. You can choose to consent or dissent at any point.