What Information Do We Collect?

Your healthcare records contain information about your health and any treatment and care you have received, such as:

• Your name, address, date of birth and next of kin;
• Your NHS Number;
• Your medical history;
• Test results;
• Relevant information collected by other health professionals.

This information may be held electronically, on paper or a mixture of both, and is collected to ensure you receive the best possible care, help protect the health of the general public and enable us to manage delivery of NHS services.

What is Health Risk Screening?

Your GP Practice will be screening the electronic health records of patients aged 18 and over already diagnosed with a range of long term conditions. This information will enable us to determine whether you are at risk of an unplanned hospital admission in the next 12 months and will enable us to support you to manage your condition more effectively.

How Do We Use This Information?

The information will help us identify whether you could benefit from the assistance of a multi-disciplinary care team made up of other healthcare providers, social care professionals, a district nurse or support from voluntary sector organisations. Your information will be shared with this team so that we can identify the best support for you.

Do I Need to Do Anything to Give My Permission?

No. You do not need to do anything if you are happy to give your permission for health risk screening. However if details from your healthcare records need to be shared as part of a clinical care discussion within the multi-disciplinary care team, we will contact you to obtain your consent.

What if I DO NOT Want to Give My Permission?

If you have any concerns or wish to opt out of health risk screening you should speak to your Practice Manager. The Practice will ensure that your decision is recorded so your records will not be included in any screening process and/or multidisciplinary care team discussion.

If you require any further information or would like to ask any questions please contact the practice.

Introduction

Information Governance (IG) is a set of multi-disciplinary structures, policies, procedures, processes and controls implemented to manage information at an organisational level. Information Governance supports Acle Medical Partnership’s immediate and future regulatory, legal, risk, environmental and operational requirements.

Information is a vital asset, both in terms of the commercial development and the efficient management of services and resources. It plays a key part in governance, service planning and performance management.

It is therefore of critical importance to ensure that information is appropriately managed, and that policies, procedures and management accountability and structures provide a robust governance framework for information management.

Acle Medical Partnership recognises the need for an appropriate balance between openness and confidentiality in the management and use of information. Acle Medical Partnership fully supports the principles of clinical and corporate governance and recognises the power of public accountability, but equally places importance on the confidentiality of, and the security arrangements to safeguard, both personal information about patients, the public and staff and commercially sensitive information. Acle Medical Partnership also recognises the need to share information with commissioners, partners and other third parties in a controlled manner consistent with the established lawful basis.

This overarching Information Governance Policy and the associated protocols sets out Acle Medical Partnership’s policy with respect to the governance of;

• Privacy
• Information and Cyber Security
• Data Quality and Records Management

Statutory Mandatory Framework

This policy serves to support Acle Medical Partnership to navigate and comply with the complex framework within which Information Governance operates.

This framework includes but is not limited to;

• NHS Act 2006
• Health and Social Care Act 2012
• Data Protection Act 2018
• Human Rights Act 1998
• Common Law Duty of Confidence
• Computer Misuse Act 1990
• General Data Protection Regulations (EU) 2016/679)
• Mental Health Capacity Act 2005
• Children Act 1989
• DH Records Management Code of Practice
• DH Information Security Code of Practice
• DH Confidentiality Code of Practice

Accountable Parties

Practice Manager

The Acle Medical Partnership has overall responsibility for Information Governance at Acle Medical Partnership. As the senior accountable officer, he/she is responsible for the management of the organisation and for ensuring appropriate mechanisms are in place to provide the necessary assurance to internal and external stakeholders.

Acle Medical Partnership has a particular responsibility for ensuring that Acle Medical Partnership meets its corporate legal responsibilities, and for the adoption of internal and external governance requirements.

Senior Information Risk Owner (SIRO)

The SIRO;

• leads and fosters a culture that values, protects and uses information for the success of the organisation and benefit of its customers.
• owns the organisation’s overall information risk policy and risk assessment processes and ensuring they are implemented consistently by Information Asset Owners / Administrators.
• owns the organisation’s information incident management framework.

Information Asset Owners (IAOs)

The IAO will;

• Hold local responsibility for information risk management, devolved to the relevant directors, department leads by the SIRO.
• Business function leads within Acle Medical Partnership have overall responsibility for the management of risks generated by their information assets and are supported on a daily basis by Information Asset Administrators.

Caldicott Guardian Function

The Caldicott Guardian will;

• produce procedures, guidelines and protocols to support staff in the appropriate management of patient information.
• provide a point of escalation and specialist advice for staff with respect to information sharing, acting as the conscience of the organisation.
• bring to the attention of the relevant manager any occasion where the appropriate procedures, guidelines and protocols may have not been followed and raise concerns about any inappropriate uses made of patient information where necessary.

Data Protection Officer (DPO)

The DPO Will;

• inform and advise the organisation and its employees about their obligations to comply with the data protection legislation.
• monitor compliance with the data protection legislation, including managing internal data protection activities, advise on data protection impact assessments; train staff and conduct internal audits.
• be the first point of contact for supervisory authorities and for individuals whose data is processed (employees, patients etc).

All Staff

All staff, whether clinical or administrative, who create, receive and use data have information governance responsibilities. Employees have a contractual and legal obligation to read and comply with all company policies and to attend mandatory training to support the appropriate management of information.

Openness

• Non-confidential information related to Acle Medical Partnership and its services will be available to the public through a variety of media, in line with Acle Medical Partnership’s overall commitment to transparency.
• Acle Medical Partnership will adopt and maintain clear procedures and arrangements for liaison with the press and broadcasting media.
• Acle Medical Partnership will adopt and maintain an Information Rights and Access Protocol and a Freedom of Information Protocol to provide guidance for handling queries from data subjects and the public.

Privacy and Information Rights

• Acle Medical Partnership is committed to the privacy of its patients, staff and the public. Acle Medical Partnership will undertake or commission annual assessments and audits of its compliance with privacy legislation and will adopt and maintain protocol for completion of Data Protection Impact Assessments.
• Acle Medical Partnership regards all Personal Data relating to staff as confidential except where national policy on accountability and openness requires otherwise.
• Acle Medical Partnership will adopt and maintain protocols to ensure compliance with the Data Protection Act, General Data Protection Regulations, Human Rights Act and the common-law confidentiality.
• Acle Medical Partnership will establish and maintain protocols for the controlled and appropriate sharing of personal information with other agencies, taking account of relevant legislation (e.g. Data Protection Act, Human Rights Act).
• Acle Medical Partnership will ensure that contractual or best practice documents are in place for routine sharing of information between sharing partners.

Information Security

• Acle Medical Partnership will adopt and maintain protocols for the effective and secure management of its information assets and resources.
• Acle Medical Partnership will undertake or commission annual assessments and audits of its information and IT security arrangements.
• Acle Medical Partnership will promote effective information and cyber security practice to its staff through policies, procedures and training.
• Acle Medical Partnership will establish and maintain incident reporting procedures and will monitor and investigate all reported instances of actual or potential breaches of information and cyber security.

Information Quality and Records Management

• Acle Medical Partnership will establish and maintain protocols and procedures for information quality assurance and the effective management of records.
• Acle Medical Partnership will undertake or commission annual assessments and audits of its information quality and records management arrangements.
• Managers will be expected to take ownership of, and seek to improve, the quality of information within their services.
• Wherever possible, information quality will be assured at the point of collection.
• Data standards will be set through clear and consistent definition of data items, in accordance with national standards..
• Acle Medical Partnership will promote information quality and effective records management through protocols, procedures/user manuals and training.

Associated Protocols

This policy should be read in conjunction with;

• Risk Management Policy
• Change Management Policy
• Information Rights and Access Protocol
• Information Sharing and Privacy Protocol
• Information Lifecycle and Data Quality Protocol
• Information / Cyber Security Protocol
• Information Incident Protocol
• Information Risk and Audit Protocol
• Data Protection Impact Assessment Protocol
• Freedom of Information Protocol

Audit Schedule

Compliance with this policy will be audited and the results fed into the Plan, Do, Check, Act Cycle described in the Information Risk and Audit Protocol.

The Acle Medical Partnership welcomes you as a patient. The various services which we provide are set out in our practice leaflet. As an extension to this our Practice and Patient Agreement determines what you can expect from us and what we in return expect from you, so that we can provide the best service for the greatest number of our patients.

The care of your health is a partnership between yourself and the practice team. The success of this partnership depends on:

• Establishing a shared responsibility to prevent problems before they occur rather than trying to put them right later.
• Having a clear understanding of each other’s needs.
• Developing regular feedback on how you feel about our services.

Only by such co-operation will we be able to improve our services and achieve the ultimate goal of a healthier community.

Our Responsibilities To You

Registration

At registration your health needs will be discussed with you vital information obtained to enable us to care for you until your medical records arrive.

Appointments

• In this practice we run an appointment system. You will be given a time at which the doctor or nurse hopes to be able to see you.
• We aim to see you on time, but some consultations take longer than others and we have no way of knowing about this in advance.
• If there is a patient with an emergency or a serious problem we will give them priority.
• Where there is a prolonged delay an explanation will be given by the receptionist.
• We will always see you on the day if you have an urgent need but not necessarily with a doctor of your choice.

Medical Matters

• You will be treated as a partner in the care and attention you receive to give you the best possible service.
• Following discussion you will receive the most appropriate care given by suitably qualified people. No care or treatment will be given without your informed consent.
• It is our job to give you treatment and advice. In the interest of your health it is important for you to understand all the information given to you.

Enquiries

• Please keep your phone call brief and avoid calling during the peak morning time for non-urgent matters.
• If you have not heard from us and would like the results of your test please phone after 14:00 at least one week following your test. We do not generally have access to test results ordered by the hospital. These will be discussed at your next hospital appointment.
• Please do not ask for or arrange a specialist appointment without first discussing the matter fully with your own doctor.
• If you later decide you no longer need an appointment made for you, please inform both the hospital and us.
• We will try to answer the phone promptly and to ensure that sufficient staff are available to do this.
• If you have undergone tests or X-rays through the practice we will inform you if you need a further appointment.
• If we consider that you need a second opinion or treatment not available in the practice we will try to inform you of the best way of achieving this.
• We will provide you with information about how to make suggestions or complaints about the care we offer.
• We want to improve services and aim to satisfy the majority of our patients; we therefore welcome your comments.

Confidentiality and Courtesy

• You will be treated as an individual and given courtesy and respect at all times.
• You have the right to see your health records, which will be kept confidential, subject to any limitations in the law.
• We will preserve your right to confidentiality at all times. Any enquiries we receive about you by another person will only be given if we have your written permission, this applies to other professionals (solicitors, insurance companies) and members of your family.
• We will give you full information about the services we offer. Every effort will be made to ensure that you receive the information, which directly affects your health and the care being offered.
• People involved in your care will give you their names and ensure that you know how to contact them.

Emergency and Urgent Needs

We will arrange a home visit as appropriate for those patients who are too ill or infirm to be brought to the surgery.

We have arranged for a doctor to be available for emergencies occurring outside surgery hours. It is unlikely to be a doctor from this practice.

Your Responsibilities To Us

Appointments

• Please do everything you can to keep appointments. Tell us straight away if you cannot attend your appointment to enable us to offer the appointment to another patient.
• Please try to be punctual. If you arrive later than your appointment time you may not be seen as this may cause delays and inconvenience to other patients.
• Please ask for more than one appointment if you want more than one patient to be seen or if you have a number of complex problems to discuss.
• If we are running late, please be patient, on another occasion it might be you that needs the extra time. Please do not blame the receptionist.
• Please only ask for an appointment on the day if you have an urgent medical need that will not wait until the next available routine appointment. Every year the doctors and nurses undertake over 43,000 consultations.

Medical Matters

Being a partner means we have responsibilities to each other and you need to work with us to achieve the best possible outcome for your health.

In return we would ask you to try and follow the medical advice offered, and to take any medication as advised.

Please ask the doctor, nurse or other health care professional involved with your care questions if you are unsure of anything.

Confidentiality and Courtesy

• We ask that you treat doctors, nurses and all practice staff with the same courtesy and respect. This courtesy is also requested for their families.
• The receptionist will need to obtain authority from the doctor for you to view your records on the practice premises and in accordance with the Access to Health Records Act. You may be charged a fee.
• We ask that you preserve the rights of doctors and staff confidentiality by not discussing your health problems or issues affecting the surgery outside the surgery. Please use the appropriate comments system in the practice during opening hours.
• Please read our practice leaflet, which will help you get the best out of the services we offer. In addition, we constantly aim to improve services and changes will be notified on the patient information board.
• Please let us know if you change your name or address and telephone numbers, especially if ex-directory so we can contact you if necessary.

Emergency and Urgent Needs

• Please ask for a home visit only when patients are too ill to visit the surgery. If you are requesting on behalf of someone else please make sure you have discussed this with them first.
• Please ensure requests for a home visit reach the surgery before 10:30, unless an emergency arises later.

About your Summary Care Record

Your Summary Care Record contains important information about any medicines you are taking, any allergies you suffer from and any bad reactions to medicines that you have previously experienced.

Allowing authorised healthcare staff to have access to this information will improve decision making by doctors and other healthcare professionals and has prevented mistakes being made when patients are being cared for in an emergency or when their GP practice is closed.

Your Summary Care Record also includes your name, address, date of birth and your unique NHS Number to help identify you correctly.

You may want to add other details about your care to your Summary Care Record. This will only happen if both you and your GP agree to do this. You should discuss your wishes with your GP practice.

Healthcare staff will have access to this information, so that they can provide safer care, whenever or wherever you need it, anywhere in England.

FAQs

Who can see my Summary Care Record?

Healthcare staff who have access to your Summary Care Record:

• need to be directly involved in caring for you,
• need to have an NHS Smartcard with a chip and passcode,
• will only see the information they need to do their job and,
• will have their details recorded every time they look at your record.

Healthcare staff will ask for your permission every time they need to look at your Summary Care Record. If they cannot ask you (for example if you are unconscious or otherwise unable to communicate), healthcare staff may look at your record without asking you, because they consider that this is in your best interest.

If they have to do this, this decision will be recorded and checked to ensure that the access was appropriate.

What are my choices?

You can choose to have a Summary Care Record or you can choose to opt out.

If you choose to have a Summary Care Record and are registered with a GP practice, you do not need to do anything as a Summary Care Record is created for you.

If you choose to opt out of having a Summary Care Record and do not want a SCR, you need to let your GP practice know by filling in and returning an opt-out form.

If you are unsure if you have already opted out, you should talk to the staff at your GP practice. You can change your mind at any time by simply informing your GP practice and either filling in an opt-out form, or asking your GP practice to create a Summary Care Record for you.

Children and the Summary Care Record

If you are the parent or guardian of a child under 16, you should make this information available to them and support the child to come to a decision as to whether to have a Summary Care Record or not.

If you believe that your child should opt-out of having a Summary Care Record, we strongly recommend that you discuss this with your child’s GP. This will allow your child’s GP to highlight the consequences of opting-out, prior to you finalising your decision.

Where can I get more information?

For more information about Summary Care Records you can

• talk to the staff at your GP practice,
• phone the Health and Social Care Information Centre on 0300 303 5678,
• Read the NHS Summary Care Record patient information.

We are very pleased to announce that from September 2015 Acle Medical Centre have been taking part in the teaching of Medical students. A group of 10 students in their second year of study will come to the practice on some Fridays throughout the year. The students will be in the surgery seeing patients and gaining knowledge and experience of working in Primary Care.

• This medical practice has been approved as meeting the high standards required for the teaching of medical students.
• Teaching, taking place in this practice, is regularly inspected to ensure quality.
• So far, GP surgeries in our region have helped Norwich Medical School to train more that 14,000 doctors.

Seeing Patients

The Medical Students will need to gain experience, seeing and talking to real life patients within a consultation. Each Medical Student is bound by the same confidentiality duty as all other NHS Staff. The students will not discuss your
personal details with anyone. They may discuss the things they have learnt with fellow students in their group and medical teachers for educational purposes.

If a student is working with your doctor or nurse on the day of an appointment, you will be advised and have the right to object to their presence if you so wish.

Can you see Medical Students?

We would really appreciate your help with teaching the next generation of doctors. If you have any of the following conditions and are willing to take part please let reception know and we may be in contact:

• Heart Conditions
• Lung Conditions
• Chest Conditions
• Skin Conditions
• Blood Disorders

Each patient will be seen by 2 medical students for around 45 minutes. The whole group is supervised by Dr Chandler and Dr Thallon. This will not be like a normal consultation as the students will not be able to advise upon or treat your condition.

The Registrar will on occasion be making video recordings of patient consultations. Under no circumstances will a recording be made without the patient’s consent. Intimate physical examinations will not be recorded.

If you require any more information you can ask reception.