This notice explains how St Martin’s Practice will collect, look after, use or otherwise process your personal data. “Personal data” is information relating to you as a living, identifiable individual. This page of information is our "Privacy Notice" (also called "Fair Processing Notice").

How can be my information be viewed outside of St Martin’s Practice Your health information can be shared both locally and nationally at differing levels of detail.

(1) Sharing your medical record (your personal data) through SystmOne our clinical computer system

Why do we share your personal data through SystmOne our clinical computer system?

Being able to see your detailed medical record allows for an overall picture of your health and wellbeing to be assessed. This then helps us to diagnose and prescribe appropriate courses of treatment to you. This means that the most safe and efficient care is provided to you. We do not want you to have to repeat your medical history and remember every detail, which may or may not be relevant, to every health and social care professional involved in your care. Lack of access to your information may lead to misdiagnosis, inappropriate prescribing of medication or tests and/or ineffective treatment.

We share information through SystmOne our clinical computer system only with health and care organisations who are providing you with direct clinical care. The term ‘Direct Care’ means a clinical health activity concerned with the prevention and investigation and treatment of illness. It includes supporting your ability to function and improve your participation in life and society. It also includes the assurance of safe and high quality care and treatment undertaken by one or more registered and regulated health or social care professionals and their team with whom you have a legitimate relationship for your care purposes. It does not include access to information for purposes such as insurance, advertising or marketing.

How we share your personal data through SystmOne our clinical computer system

As your GP practice we have set the following practice settings for all our registered patients whose detailed electronic health (and where applicable social care) record is in our possession and within the clinical computer system, SystmOne. However, we recognise that each of our patients have differing health and social care needs and you may wish to control yourself how your personal data is shared. This can be done via ‘Your Choices’ stated below.

We assume that you are happy to share your detailed electronic health (and where applicable social care) record to anyone that cares for you. This is also known as implied consent. We therefore make your record available to all NHS commissioned services and local authorities that provide direct care (see above for definition) using the clinical record computer system, SystmOne. This allows any authorized individual at these types of organisations to retrieve your electronic record once you are registered for care with that organisation. However, such individuals should only legitimately access your record to provide you with direct care services. They must also record your permission to view your record.

These are the types of organisation which are involved in direct patient care and therefore we have given access to your electronic record:

• GP practices
• Community services (for example, physiotherapy, diabetic clinics, district nursing, rehabilitation centres)
• Referral triage centres (services determining which organisation should care for you)
• Child Health
• Urgent Care (for example, A&E, Minor Injury Units (MIU) and Out of Hours services)
• Community Hospitals
• Palliative Care
• Care Homes
• Offender Health (care providers within organisations such as Prisons and Custody Suites)
• NHS Hospitals
• NHS Mental Health Services
• Social Care– registered and regulated professionals within social care organisations coordinating care (not social care providers)
• Community Pharmacy

To find out more about these types of organisation please go to the following webpage: http://www.tpp-uk.com/products/systmone/modules or talk to our Information Governance lead.

If you are not happy for us to share your electronic record using implied consent, then please let us know as soon as possible so that we can ensure that your wishes are met. You can choose to refuse your permission for any organisation having access to your GP record.

Organisations we make your record available to, but subject to a verification process

Verification only applies to other types of health and social care organisations which are not mentioned above. All other types of NHS commissioned services and local authorities providing direct care services using SystmOne, must go through a verification process with you. A PIN number will be sent to your phone and/or email address (it’s similar to the verification (security) process you may be familiar with using for internet banking). Without this PIN number, that organisation will be unable to access your electronic record, unless you put that organisation on your personal sharing list or ask us to add them to our sharing list.

You will only be required to provide the PIN number to that particular organisation once. As soon as the verification code is provided, the individuals at that organisation will continue to have access to your record to treat you for that particular matter until you change your mind and ask it to record refusal of your permission. Only staff with the appropriate job functions, granted to them by the organisation and only those providing you with direct care, should legitimately access your record in this way.

Your choice

You may not agree with the types of health and social care organisations we have chosen to have access to your detailed electronic health (and where applicable social care) record. You can therefore control this yourself. Your choice will override our settings. You have the following options:

• No organisations require you to use a verification process (ie provide a security code). This option is our practice default – so unless you tell us otherwise then this is how your records are shared. We allow all NHS commissioned services and local authorities providing health and social care services, using the clinical record computer system, SystmOne, to access your record. This allows any individual at these organisations, provided they have the appropriate authority, and provided you are registered with them for direct care, to retrieve your electronic record. These individuals should only legitimately access your record to provide you with direct care and they should always request and gain your consent before doing so.

• Dissent/Refusal of your permission - You can refuse your permission for your record to become available to all NHS commissioned services and local authorities providing health and social care services, using the clinical record computer system, SystmOne,, which prevents us sharing your clinical record to any other organisation involved in your care. Please carefully consider the benefits of sharing your record, mentioned above before choosing this option. If you are considering this option then we would be very happy to talk to you more about it to help you make your choice.
• All organisations require you to provide a security code - You can require that all health and social care organisations must go though a verification process with you ie ask you for a PIN number on your first visit to that service. This allows you to verify/confirm that each individual organisation should have access to your record, as they are legitimately involved in your care. You will require access to either a mobile phone or email account, as a PIN will be sent to you.
• Custom lists - You can put together your own personal lists for access, adding organisations to each of the 3 lists i.e. does not require a security code (allowed list), requires a security code (verification list) and cannot access (prohibited list). The functionality for each list will act as described above, but it is you who can determine the level of access, which applies to them. This should be done in conjunction with us to ensure you understand the full implications of your decisions.
• Marking items as private – If you have had a consultation about a particularly sensitive matter, you can ask for this section of your record to be marked as private. That way, even if you consent for another service to see your record, that consultation will not be shown outside the organisation that recorded it. However, if the consent override function is used, then consultations marked as private can be accessed by the other service/organisation performing the override. When deciding which option to choose it is important to consider that your detailed record allows for an overall picture of your health and wellbeing to be assessed. This in turn helps health and social care professionals diagnose and prescribe appropriate courses of treatment to you. This ensures that the most safe and efficient care is provided. It will prevent you from having to repeat your medical history and remember every detail, which may or may not be relevant, to every health and social care professional involved in your care. Lack of access to your information may lead to misdiagnosis, inappropriate prescribing of medication or tests and/or ineffective treatment. You can make the above changes at any time by contacting us. Please see the SystmOnline eDSM functional guide for patients here

Available audits

Audits are useful for your understanding about the types of organisation and individual(s) who are viewing your record. They allow you to raise any concerns about potential illegitimate or unnecessary access of your personal data with the relevant person or organisation.. The ability to audit record access is a significant benefit of electronic records over paper records as it allows for a visible trail to be available to you in the following ways:

• Alerts - You can opt to receive an alert via SMS or email every time an individual at any health and social care organisation attempts to record your consent to view your record. This means that you can be confident that the appropriate people are viewing your record and you can raise concerns with any organisation where you feel this is not the case.
• SystmOnline Record Audit – You can view which organisations have accessed your electronic health (and where applicable social care) record within SystmOnline. Ability to access this audit in SystmOnline is controlled by your GP. Any concerns about access can be raised with the relevant organisation. Please see the SystmOnline eDSM functional guide for patients which can be accessed [Insert organisation location]
• Record Sharing List – You can ask your GP practice to show you a list of all health and social care organisations currently caring for you and whether they have recorded your consent or dissent to view your record. If you disagree with the consent options recorded then you [or your GP] should contact those organisations and ask them to amend the setting.

(2) For direct care locally in Leeds: Leeds Care Record

Patients in Leeds are able to benefit from the sharing of information via the Leeds Care Record. This shares contact details, diagnosis list, medications, allergies, test results, referrals & letters and care plans between health professionals in Leeds. Information is shared by GP practices, the Hospital trusts, Community and Mental Health services, and Social Care.

You have the right to object to your Leeds Care Record being shared by contacting them directly. Details are available via their website.

Download a leaflet on Leeds Care Record

This is also available in an Easy read version

You can opt in and out of these sharing agreements whenever you choose. Details of these schemes are as follows:

(3) Nationally for direct care: Summary Care Record –
sharing your information for your care across the NHS.

Your core Summary Care Record is created when you register at a GP practice (although you should be given the option to opt in/out during your registration). If you do not express a preference, it is currently assumed that your consent is implied.

The Summary Care Record shares only your contact details, medications and allergies with other healthcare professionals involved in your care.

You can also choose to share a Summary Care Record with Additional Information. This shares contact details, medications, allergies, diagnosis list, care plans, end of life care and immunisations with other healthcare professionals. Sensitive data is excluded. A Summary Care Record with Additional Information will only be created for you if you explicitly choose this option. Only the most up to date information is shared for each category (EMISWeb). All current and past information is shared for each category (SystmOne).

Choosing to share a summary care record with additional information is thought to be of great benefit if you are admitted to hospital locally or elsewhere in the UK.

You can opt out of sharing any of your information in a Summary Care Record. If you decide not to share this will not affect your entitlement to care. However, it could result in the delivery of your care being less efficient as other health professionals will not have access to these parts of your medical history.

Further details are available in this leaflet

This is also available in an Easy Read version

 You can change your mind about your Summary Care Record at any time.

To register or change your Summary Care Record preferences, please complete this form and return it to us.

Summary Care Record consent form

(4) Nationally: Using your health and care information for planning & research

Your health and care information is used to improve your individual care. It is also used to help the NHS research new treatments, decide where to put GP clinics and plan for the number of doctors and nurses in your local hospital. Wherever possible the NHS tries to use data that does not identify you, but sometimes it is necessary to use your confidential patient information.

The NHS, local authorities, university and hospital researchers, medical colleges and pharmaceutical companies researching new treatments can all use your information for planning & research.

You can choose to opt out of sharing your confidential patient information for research and planning. There may still be times when your confidential patient information is used: for example, during an epidemic where there might be a risk to you or to other people’s health. Also, you can also still consent to take part in a specific research project. Choosing this opt-out will not affect your care and treatment as your confidential patient information will still be used for your individual care. You will still be invited for screening services, such as screenings for bowel cancer.

You do not need to do anything if you are happy about how your confidential patient information is used. If you do not want your confidential patient information to be used for research and planning, you can choose to opt out securely online or through a telephone service.

NHS Digital has developed a system to support the national data opt-out which gives patients more control over how identifiable health and care information is used for reasons other than their individual care and treatment. The system offers you the opportunity to make an informed choice about whether you wish your personally identifiable data to be used for purposes beyond their direct care such as for research and planning purposes. Now that this national data opt-out is launched, it will no longer be possible to change preferences via local GP practices.

If you wish to use this opt out system then (1) it is available via the NHS App (now available in the App store) or (2) here: nhs.uk/your-nhs-data-matters or (3) call the National Data Opt Out team on 0300 3035678.

In the past, you may have already chosen to prevent your identifiable data leaving NHS Digital, known as a Type 2 opt-out. You may have arranged this directly with your GP practice. All existing Type 2 opt-outs have been converted to this new national data opt-out and this was confirmed by a letter to all individuals aged 13 or over with an existing Type 2 in place.

More information about health and care records in general can be found on the NHS website here: NHS Choices

If you have any queries or concerns about how your information is handled, please do not hesitate to contact Camilla Hawkes, Practice Manager, for further information.

Page updated: 11.2.20