Legal

This Privacy Notice explains how and why clinicians and health workers within an optometry or dentistry setting may need to access a patients information held within their National Care Record.

To access the National Care Record, the optometry and dentistry practices involved in this pilot must comply with NHS Information Governance requirements. This includes being clear and open with you about how they will use patient data held on an NHS system and provide assurance it will only be accessed in the circumstances set out below.  

We are required under data protection legislation to notify you of the information contained in this Privacy Notice.

What is the National Care Record?

The NHS National Care Record Service (NCRS) is an electronic summary of key clinical information (including medicines, allergies and adverse reactions) about a patient, sourced from the GP record. It is used by authorised healthcare professionals (e.g. dentists and opticians) to support the patient’s care and treatment.

What information will be accessed?

The National Care Record contains important information about:

• current medication
• allergies and details of any previous reactions to medicines
• the name, address, date of birth and NHS number of the patient

 Who will have access?

Patient records are only accessible to the healthcare professionals working at the practice and those under their supervision. This is known as a “legitimate relationship”. 

A patient will be asked for their permission before the National Care Record is viewed. This will be recorded on a patient’s record held by the practice and will be checked at each appointment.

If it is not possible to ask for the patient’s permission to view the National Care Record, those healthcare professionals involved in the care may act in the best interests of their patients.

What is the legal basis for processing personal data?

Our legal bases for processing personal data for healthcare purposes is:

Public Task: When we provide services under the NHS General Optical Services contract (such as a sight test funded by the NHS).

Consent: We process personal data with a patient’s permission which can be withdrawn at any time.

The further lawful basis for processing more sensitive personal data (relating to health) known as Special Category Data is the provision of health or social care.

Who will personal information data be shared with?

Personal data will be shared internally for the purposes of managing relationships with patients to delivering the services and facilities with which patients engage.

 In some circumstances we may need to let a patient’s GP practice know we’ve prescribed an item or given a particular service.  

Securing and Protecting Personal Data

 We only use information that may identify a patient in accordance with Data Protection legislation. The legislation requires us to process personal data only if there is a legitimate basis for doing so and that any processing must be fair and lawful.

Within the health sector, we also must follow the common law duty of confidence, which means that where identifiable information about a patient has been given in confidence, it should be treated as confidential and only shared for the purpose of providing direct healthcare.

 We also ensure any patient data we hold is kept in secure locations, restrict access to information to authorised personnel only and protect personal and confidential information held on equipment such as laptops with encryption (which masks data so that unauthorised users cannot see or make sense of it).

 Right to Opt Out or Withdraw Consent

 Should a patient not want their confidential patient data accessed as part of this pilot, they can exercise their right to withdraw their consent at any time.

To withdraw consent, please speak with a member of the practice or call the practice to notify them of your wishes. There are possible consequences of not sharing such as the effect this may have on your care and treatment, but these will be explained to you to help with making your decision.

How long is personal information held for?

 All records held will be kept for the duration specified by national guidance from NHS England, Records Management Code of Practice – NHS Transformation Directorate (england.nhs.uk). Confidential information is securely destroyed in accordance with this code of practice.

Patient Rights

Should a patient wish to exercise their legal rights in respect of the data held about them, please contact the practice Data Protection Officer.

Further information about patient rights can be obtained from The Information Commissioner’s Office (ICO) has published guidance on the full range of rights.

Concerns or Complaints

 Any questions or concerns about the way in which personal data has been handled, please contact the practice.

Should this not be resolved, an individual has the right to complain to the Information Commissioner if they feel the handling of their personal data infringes data protection legislation.

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 123 1113 (local rate)