Confidentiality & Data Sharing
Please read our Privacy Statement (3 page pdf, published 25/5/18 & updated 17/2/20 under GDPR, the General Data Protection Regulation)
We ask for information about you only so you can receive the best possible care and treatment - please read the NHS website information about your NHS Health record if you have any questions about this.
Patient records are kept electronically on our practice systems. As the data controller of patients' personal confidential data, GP practices have a duty to protect the data they hold. Read more about how we handle your information, including using data for audit and research.
Everyone working in the NHS has a legal duty to maintain the highest level of confidentiality about patient information. We only pass information concerning you to people who have a genuine need for it. Whenever we can we shall remove details that identify you as an individual.
Your GP medical records may be made available to other organisations - see below for details including methods for opting-out if you do not want to share your personal data in these ways.
All these systems are based upon the national Personal Demographics Service database (PDS). This is the national electronic database of NHS patient demographic details such as name, address, date of birth and NHS Number. The PDS enables a patient to be readily identified by the NHS quickly and accurately; it does not hold any clinical or sensitive data.
You cannot opt-out of your information being held on the PDS database however in special circumstances there is a process for flagging a record as ‘sensitive’ which means that healthcare professionals will only be able to see NHS Number, name, date of birth and gender - no other demographic details will be displayed. If you require your record flagging, or for this flag to be removed, contact us and we will liaise with NHS Digital to action this as appropriate. This can be useful, e.g. for victims of domestic violence or people in a witness protection program, however flagging your record is not an action to be undertaken lightly - your demographic information will still be held nationally and having your details unavailable locally will mean you cannot be referred to hospital consultants or other NHS services via the e-Referral service, or have your prescriptions electronically transferred to a pharmacy via the EPS service.
The NHS wants to make sure you and your family have the best care now and in the future. Your health and adult social care information supports your individual care but can also be used to help the NHS to research, plan and improve health and care services in England. If you don't want your confidential patient information to be used for for reasons beyond your individual care and treatment, you can opt out of this though please note that there are some circumstances where opt-outs will not apply - see the National Data Opt-out Service Privacy Notice for more information. In particular, please note there are separate opt-outs for the National Cancer Registration and Analysis Service (NCRAS) and National Congenital Anomaly and Rare Disease Registration Service (NCARDRS)
This England-wide data opt-out service is run by NHS Digital and replaces the failed care.data project. If you previously opted out under care.data you should have received a letter from NHS Digital by August 2018 explaining that your opt-out will be transferred to the new programme - see the Understanding Patient Data website for more information. It is also worth reading this comparison of the two projects. You can update your choice by visiting the website nhs.uk/your-nhs-data-matters or by calling 0300 330 9412
Compliance with opt-outs for data extraction from our clinical systems is managed by EMIS, our clinical system provider.
An England-wide system that takes information from patient's GP record and makes it available to clinicians anywhere in the country.
The core SCR record is limited to Medication and Allergies however patients who are frail or have complex health needs may wish to provide consent for additional SCR data release, which adds additional information and supporting free text onto their core Summary Care Record, including significant medical history, reason for medication and end of life care information. More information is available in the SCR leaflet (2 page pdf). Please discuss with your GP if you would like consent for additional SCR data release recorded on your record.
If you have registered for Online Services with a minimum of Core record access, you will be able to check what is accessible on your core SCR record.
An information letter and opt-out form for SCR was posted to patients in August 2013. If you have not previously received the opt-out form, this can be obtained from the NHS website Health Records webpage. If you do not want your data available within the SCR, you will need to complete the opt-out form and return it to the Practice to action. You can complete this form on behalf of another patient. Forms completed on behalf of children under the age of 16 will be reviewed by the GP who may wish to discuss the decision further with you and who ultimately may over-ride a parent/carer’s wishes if the decision is deemed to be not in the child's best interests.
A local system that makes the summary information from a patient’s record available to hospitals and Out of Hours services in the BNSSG area (Bristol, North Somerset & South Gloucestershire).
Information about this system was included on the reverse of the August 2013 SCR letter. You can obtain more information by visiting the Connecting Care website which includes a link to the opt-out form you will need to complete if you do not want your data available within the Connecting Care record. This form must be returned to Connecting Care to action, NOT to us. You can complete this form on behalf of another patient.
4. EMIS data-sharing agreements
The IT system we use for your medical records is EMISWeb. This is a hosted system, which means your data is held on the EMIS servers in Leeds and is accessed by us via N3, a secure broadband network which is only accessible to the NHS. If signed EMIS data-sharing agreements are in place, other NHS organisations can also view this patient data over their N3 connection and/or the practice can view your data held on another organisation's EMISWeb system.
You can now see which organisations have viewed your shared record in the last 12 months via Online Services - a link in the brown menu bar at the bottom once you have logged in, takes you to "GP Shared Record History" (note this is only available to patients who have access to either their medical record or repeat prescribing).
The practice currently has agreements to share patient data with:
a) Bristol Community Health (BCH - the organisation that employs District Nurses amongst other staff)
On 2nd July 2015, Bristol Community Health moved to using EMISWeb, having migrated from another computer system called RIO. District Nurses working with patients from this practice previously accessed patient records on our EMIS system. A data-sharing agreement is now in place so that we can each see data recorded for our patients on each other's EMIS system.
b) One Care (a GP-led organisation that represents practices in Bristol, North Somerset and South Gloucestershire)
Data-sharing with the One Care consortium has been in place since 2015. This allows your medical record to be available to staff from One Care who are treating you, such as in the GP Out of Hours service, and to book patients into Improved Access appointments at another GP practice.
Before anyone can view your EMIS shared record they must have a legitimate relationship with you. Access to shared records is recorded and your consent should be obtained by the person accessing your medical record.
If you do not want your EMIS data to be shared in this way, let the practice or any other organisation using EMIS know – a flag can be set in any of your EMIS records which will stop all sharing from taking place.
The practice is also signed up to share data with local NHS commissioning organisations via EMIS Search & Report. This involves sharing the results of specific searches set up to identify the numbers of patients meeting the search criteria - patient-identifiable data is not shared.
5. Other National data sharing initiatives
a) This practice participates in the National Diabetes Audit - see information leaflet (2 page pdf). An annual extraction of data using your NHS number and date of birth to link information from your GP record and hospital records to assess diabetes care. If you do not want information taken from your GP records for this audit, please let us know - we will need to add a code to your record to ensure your data is not extracted.
b) We share information with the Diabetic Eye Screening service - see Public Health England (PHE) Screening for more information. A monthly list of all our patients aged 12 and over with diabetes is shared so that everyone eligible can be invited for screening by the Bristol & Weston Diabetic Eye Screening Programme in a timely fashion. If you are diabetic and do not want your information shared with the Screening service, please let us know - we will need to add a code to your record to ensure your data is not extracted, however we would strongly advise attending screening appointments in order to reduce the risk of sight loss.