Privacy Policy - Surrey Heath Community Providers

Fair Processing Notice (Privacy Notice)

Your Personal Information – what you need to know

Who we are and what we do

Surrey Heath Community Providers Ltd (SHCP) is responsible for securing some of the NHS services, in primary medical care (GP) services. These include the locally commissioned services and the integrated access (extended access service). We also have a performance monitoring role for these services, which includes ensuring that the highest quality of healthcare is provided and responding to any concerns from our patients on services offered. For further information please refer to the ‘services’ page on our Website:

http://www.surreyheathcommunityproviders.co.uk/

Our Commitment to Data Privacy and Confidentiality Issues

We are committed to protecting your privacy and will only process data in accordance with the Data Protection Legislation. This includes the General Data Protection Regulation (EU) 2016/679 (GDPR), the Data Protection Act (DPA) 2018, the Law Enforcement Directive (Directive (EU) 2016/680) (LED) and any applicable national Laws implementing them as amended from time to time. The legislation requires us to process personal data only if there is a legitimate basis for doing so and that any processing must be fair and lawful.

In addition, consideration will also be given to all applicable Law concerning privacy, confidentiality, the processing and sharing of personal data including the Human Rights Act 1998, the Health and Social Care Act 2012 as amended by the Health and Social Care (Safety and Quality) Act 2015, the common law duty of confidentiality and the Privacy and Electronic Communications (EC Directive) Regulations.

Using your information

We need to use information about our patients and population to enable us to provide and support the direct care of individuals and to ensure we commission services which meet their needs.

In undertaking our role SHCP holds some information about you and this document outlines how that information is used, who we may share that information with, how we keep it secure (confidential) and what your rights are in relation to this. Within the health sector, we follow the common law duty of confidence, which means that where identifiable information about you has been given in confidence, it should be treated as confidential and only shared for the purpose of providing direct healthcare.

SHCP has a senior member of staff responsible for protecting the confidentiality of patient information. This person is called the Caldicott Guardian.

The details of our Caldicott Guardian are as follows:

Dr Sarah Stradling – Clinical Director

Tel: 07930 558 321

Email: shcp.hrenquiries@nhs.net

They are supported by another senior member of staff who is responsible for information risk and information security, this person is called the Senior Information Risk Owner (SIRO).

The contact details of our SIRO are as follows:

Ian Friend – Corporate Governance Officer / Director

Email: shcp.hrenquiries@nhs.net

Tel: 07766 818498

The above two roles are also supported by our Data Protection Officer (DPO). The DPO is responsible for monitoring compliance with Data Protection legislations (GDPR & DPA 2018), Information Governance (IG) policies, providing advice and guidance, raising awareness, training and audits. The DPO acts as a contact point for the ICO, employees and the public. They co-operate with the ICO and will consult on any other matter relevant to Data Protection. The contact details of our DPO are as follows:

Tel: 07879 837703

Email: lucy.hunt11@nhs.net

Surrey Heath Community Providers Ltd is a Data Controller and is registered with the Information Commissioner’s Office (ICO) to collect data for a variety of purposes. Our registration number is ZA464533 and a copy of the registration is available through the ICO website.

What kind of information do we use?

We use the following types of information/data:

Personal Data – means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Special Categories of Personal Data – this term describes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
Confidential Patient Information – this term describes information or data relating to their health and other matters disclosed to another (e.g. patient to clinician) in circumstances where it is reasonable to expect that the information will be held in confidence. Including both information ‘given in confidence’ and ‘that which is owed a duty of confidence’. As described in the Confidentiality: NHS code of Practice: Department of Health guidance on confidentiality 2003.

Pseudonymised – The process of distinguishing individuals in a dataset by using a unique identifier which does not reveal their ‘real world’ identity.

Anonymised – Data in a form that does not identify individuals and where identification through its combination with other data is not likely to take place

Aggregated – Statistical data about several individuals that has been combined to show general trends or values without identifying individuals within the data.

What do we use your Personal and Special categories of Personal Data for?

SHCP professionals who provide you with medical care maintain records about your health and about any treatment or care you have or have received previously. These records help to provide you with the best possible healthcare.

The information we hold is on secure, NHS-approved systems and part of your GP Practice records. This may include:

Details about you, such as your address, carer, legal representative, emergency contact details.
We also record:
- Any contact SCHP has had with you
- Notes and reports about your health
- Details about your treatment, medication and care
- Relevant information from other health professionals
- Information from relatives or those who care for you
Information held about you may be used to help protect the health of the public and to help us manage NHS services. Information may be used within SHCP for clinical audit to monitor the quality of the service provided.
Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified.

What do we use non-identifiable data for?

We use pseudonymised, anonymised and aggregated data to plan health care services and help support Clinical Commissioning Groups for commissioned services. Specifically we use it to:

check the quality and efficiency of the health services we provide/commission
prepare performance reports on the services we provide/commission
review the care being provided to make sure it is of the highest standard
Evaluate the services we provide/commission or have been commissioned on our behalf
To support the regional and national initiatives through the Integrated Care Systems (ICS)

Do we share your information with other organisations?

We commission NHS funded health services for you from a number of organisations, both within and outside the NHS (see Appendix A for details). We may also share anonymised statistical information for the purpose of improving local services, for example understanding how our populations health and how the services provided compare with similar services in other geographical areas e.g. to share good practice. We do not share information outside of the European Economic Area (EEA)

We would not share information that identifies you unless we have a fair and lawful basis such as:

It is for Direct Care
You have given us permission;
We need to act to protect children and vulnerable adults;
When a formal court order has been served upon us;
When we are lawfully required to report certain information to the appropriate authorities e.g. to prevent fraud or a serious crime;
Emergency Planning reasons such as for protecting the health and safety of others;
When permission is given by the Secretary of State or the Health Research Authority on the advice of the Confidentiality Advisory Group to process confidential information without the explicit consent of individuals

How we process information

Data may be anonymised and linked with other data so that it can be used to improve health care and development and monitor NHS performance. Where data is used for these statistical purposes, stringent measures are taken to ensure individual patients cannot be identified.

We may also contract with other organisations to process data, some of which could identify a person. These organisations are known as Data Processors. We ensure external data processors that support us are legally and contractually bound to operate and are required to prove that robust security arrangements are in place.

A full list of details including the legal basis and purposes for processing information can be found in Appendix A.

What safeguards are in place to ensure data that identifies me is secure?

The NHS Digital Code of Practice on Confidential Information applies to all of our staff and anyone acting on behalf of SHCP. Each are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. Each are expected to make sure information is kept confidential and undertake annual training on how to do this. This is monitored by SHCP and can be enforced through disciplinary procedures.

We also ensure the information we hold is kept in secure locations, restrict access to information to authorised personnel only, protect personal and confidential information held on equipment such as laptops with encryption (which codes data so that unauthorised users cannot see or make sense of it).

How long do we hold information for?

All records held by SHCP will be kept for the duration specified by national guidance from NHS Digital,Records Management Code of Practice 2021. Once information that we hold has been identified for destruction it will be disposed of in the most appropriate way for the type of information it is. Personal confidential and commercially sensitive information will be disposed of by approved and secure confidential waste procedures. We keep a record of retention schedules within our information asset registers, in line with the Code.

Your right to opt out of data sharing and processing

The NHS Constitution states ‘You have a right to request that your personal and confidential information is not used beyond your own care and treatment and to have your objections considered’. For further information please visit: The NHS Constitution

National data opt-out. The national data opt-out was introduced on 25 May 2018, enabling patients to opt-out from the use of their data for research or planning purposes, in line with the recommendations of the National Data Guardian in her Review of Data Security, Consent and Opt-Outs.

The national data opt-out replaces the previous ‘type 2’ opt-out, which required NHS Digital not to share a patient’s confidential patient information for purposes beyond their individual care. Any patient that had a type 2 opt-out recorded on or before 11 October 2018 has had it automatically converted to a national data opt-out. Those aged 13 or over were sent a letter giving them more information and a leaflet explaining the national data opt-out. For more information go to National data opt out programme

Gaining access to the data we hold about you

The SHCP does not directly provide health care services. If you wish to have sight of, or obtain copies of your own personal health care records you will need to apply to your GP Practice, the hospital or NHS Organisation which provided your health care.

If SHCP are holding information from which you can be identified, you have the right to:

View this or request copies of the records by making a Right of Access request under the General Data Protection Regulation.
request information is corrected/rectified
have the information updated where it is no longer accurate
where applicable, request information is erased
where applicable, request for your data to be made portable
where applicable, ask us to stop processing information about you where we are not required to do so by law

Everybody has the right to see, or have a copy, of data we hold that can identify you, with some exceptions. You do not need to give a reason to see your data. If you want to access your data you must make the request in writing or verbally. Under special circumstances, some information may be withheld.

For further information on how to make a request please visit our policies and procedures page on our website – http://www.surreyheathcommunityproviders.co.uk/

Automated Decision Making

SHCP will not make decisions based solely on automated processing

What is the right to know?

The Freedom of Information Act 2000 (FOIA) gives people a general right of access to information held by or on behalf of public authorities, promoting a culture of openness and accountability across the public sector. You can request any information that the SHCP holds, that does not fall under an exemption. You may not ask for information that is covered by the Data Protection Legislation under FOIA. However you can request this under a right of access request – see section above ‘Gaining access to the data we hold about you’.

Your request must be in writing and can be either posted or emailed to;

By Email: shcp.hrenquiries@nhs.net

By Post: Freedom of Information

Surrey Heath Community Providers Ltd

1^st Floor

Theta House

Lyons Way

Frimley

Camberley

Surrey

GU16 7ER

Information Commissioners Office

For independent advice about data protection, privacy, data sharing issues and your rights you can contact:

By post: Information Commissioner’s Office

Wycliffe House,

Water Lane,

Wilmslow,

Cheshire,

SK9 5AF

By telephone: 0303 123 1113 (local rate) or 01625 545 745

By email: casework@ico.org.uk or Visit the ICO website.

Complaints or questions

We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. You can contact us by

By email: shcp.hrenquiries@nhs.net

By Post: Freedom of Information

Surrey Heath Community Providers Ltd

1^st Floor

Theta House

Lyons Way

Frimley

Camberley

Surrey

GU16 7ER

Links to other websites

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Changes to this privacy notice

We keep our privacy notice under regular review. This Fair Processing Notice was last updated in November 2023.

Further information

Further information about the way in which the NHS uses personal confidential data and your rights in that respect can be found in:

The NHS Care Record Guarantee: This guarantee is a commitment that NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and promote your health and wellbeing.

http://systems.hscic.gov.uk/rasmartcards/documents/crg.pdf

The NHS Constitution: The Constitution establishes the principles and values of the NHS in England. It sets out rights to which patients, public and staff are entitled, and pledges which the NHS is committed to achieve, together with responsibilities, which the public, patients and staff owe to one another to ensure that the NHS operates fairly and effectively

https://www.gov.uk/government/publications/the-nhs-constitution-for-england

To share or not to share? Information Governance Review: This was an independent review of information about service users shared across the health and care system led by Dame Fiona Caldicott and was conducted in 2012.

https://www.gov.uk/government/publications/the-information-governance- review

NHS Commissioning Board – Better Data, Informed Commissioning, Driving Improved Outcomes: Clinical Data Sets: Provides further information about the data flowing within the NHS to support commissioning.

http://www.england.nhs.uk/wp-content/uploads/2012/12/clinical-datasets.pdf

NHS Digital – Guide to Confidentiality: NHS Digital are the trusted national provider of high-quality information, data and IT systems for health and social care and are responsible for collecting data from across the health and social care system.

http://digital.nhs.uk/patientconf

Information Commissioner’s Office (ICO): The ICO is the Regulator for GDPR and offer independent advice and guidance on the law and personal data, including your rights and how to access your personal information.

http://www.ico.org.uk

Health Research Authority: The HRA protects and promotes the interests of patients and the public in health and social care research.

http://www.hra.nhs.uk

Annex A

Activity	Rationale
Primary Care Network	Purpose – Supporting and building on primary care services and enable greater provision of proactive, personalised, coordinated and more integrated health and social care. This will provide the ability to work in a more integrated way, resulting in provision of better care for the patients and savings for the NHS whilst providing proactive care for the people and communities Legal Basis – GDPR article 6(1)e statutory function under the PCN DES agreement, article 9(2)h direct care. Data Processor – We process this information on behalf of the PCN and the lead controller.
Remote Care And Monitoring	Purpose: Remote Care and Monitoring management. Including managing complex and frail patients, care home patients and patients with long-term conditions over the winter months. Legal Basis: 1.Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care”; Joint Controller: Frimley Health Foundation Trust Data Processor: Docobo (4D Data Centre)
Quality review of Learning Disability and Serious Mental illness Health checks	Purpose: To provide Frimley ICB redacted (anonymised) information relating to Learning Disability Health checks. To reduce the health inequalities experienced by people who have a learning disability, including premature deaths. Work is aimed at providing quality assurance and learning to the ICB, and to improve training to primary care to maximise the benefit to patients. Legal Basis: this activity is being undertaken for Direct Care, under UK GDPR Article 1. Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” 2. Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services” Processor: Frimley ICB
Mental Health Practitioner (ARRS) Service	Purpose: To address the potential range of biopsychosocial needs of people with mental health problems as part of a multi-disciplinary team. And support the aims within the NHS Long Term Plan to expand community mental health services. Legal Basis: this activity is being undertaken for Direct Care, under UK GDPR Article 1. Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” 2. Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services” Data Processor – GP Practices and Surrey and Borders Partnership (SABP) will all act as joint data processors on behalf of the practices SABP will individually and collectively act as data controllers in their own right for the separate information they collect in connection to their contracts. GP Practices will remain Data Controllers for Clinical records held on EMIS.
Secure Shredding	Purpose: SHCP have commissioned the services of a third party organisation to perform secure shredding of all confidential waste. All documentation that contains any confidential information will be stored in a secure, locked bin before being shredded in a secure location. There are robust processes in place to protect confidential information prior to shredding. Legal Basis: under UK GDPR Article 6 1 (b) will apply – contractual obligation Article 9 2 (h) Health data Processor : Restore Ltd
Telephony	Purpose: Personal Confidential data will be shared and stored within an external system for the purpose of managing telephone calls. All incoming and outgoing calls will be recorded and may be used as part of a patients medical record. Patients may request a copy of their telephone recording if held via the SARs process. Legal Basis: under UK GDPR Article 6 1 (e) Public Task and Article 9 2 (h) Health Data Provider: X-ON Surgery Connect.
Speech and Language Therapy service	Purpose: Personal confidential data will be shared with the Speech and Language Therapy service in order to provide a full and accurate service to patients who require this service. No other patients data will be shared during this service. Patients will have agreed to be referred into the service and understand that their record will be accessed by the service provider. Legal Basis: this activity is being provided under the auspice of Direct Care. Under GDPR the Article 6 1 (e) Public Task And Article 9 (h) Health Data will apply Processor: Central Surrey Health Ltd
Social Prescribing service	Purpose – The Social Prescribing services forms part of the five-year framework for GP contract reform as an NHS commitment to provide additional roles through the personalised care service. The PCN lead Surrey Heath Community Providers (SHCP) are delivering the social prescribing service by building on the already in existence service provided by Surrey Heath Borough Council, Citizens Advice Surrey Heath (CASH) and directly through SHCP, GP Practices will remain data controllers for their clinical records. Legal Basis – GDPR article 6(1)e statutory function under GP & Social Prescribers Contracts with each provider, article 9(2)h direct care. Data Processor – EMIS, SHCP (lead processor), CASH & SHBC (sub-processors) will all act as data processors on behalf of the practices. SHBC have commissioned the system, Elemental, to store and assist with the processing of patient data for those patient referred into the service. SHCP, CASH & SHBC will individually and collectively act as data controllers in their own right for the separate information they collect in connection to their contracts. SHBC will be the data controller for their website and online referral page for the service. GP Practices will remain Data Controllers for Clinical records held on EMIS
First Contact Physio service	Purpose – The First Contact service forms part of the five-year framework for GP contract reform as an NHS commitment to provide additional roles through the personalised care service. The PCN lead Surrey Heath Community Providers (SHCP) are delivering the FCP service by using an already existence service provided by Surrey Physio, GP Practices will remain data controllers for their clinical records. Legal Basis – GDPR article 6(1)e statutory function under GP & First Contact Physio Contracts with each provider, article 9(2)h direct care. Data Processor – EMIS, GP practices GP Practices will remain Data Controllers for Clinical records held on EMIS.
Mental Health Integrated Care Service	Purpose – The mental Health Service forms part of the five-year framework for GP contract reform as an NHS commitment to provide additional roles through the personalised care service. The PCN lead Surrey Heath Community Providers (SHCP) are delivering the Mental health service with Surrey and Borders Partnership (SABP) and directly through SHCP, GP Practices will remain data controllers for their clinical records. Legal Basis – GDPR article 6(1)e statutory function under GP & SABP Contrac ts with each provider, article 9(2)h direct care. Data Processor – EMIS, SHCP (lead processor), SABP (sub-processors) will all act as data processors on behalf of the practices SABP will individually and collectively act as data controllers in their own right for the separate information they collect in connection to their contracts. GP Practices will remain Data Controllers for Clinical records held on EMIS.
Quality monitoring, concerns and serious incidents	Purpose – We need to ensure that the health services you receive are safe, effective and of excellent quality. Sometimes concerns are raised about the care provided or an incident has happened that we need to investigate. You may not have made a complaint to us directly but the health care professional looking after you may decide that we need to know in order to help make improvements. Legal Basis – SHCP We have a statutory duty under the Health and Social Care Act 2012, Part 1, Section 26, in securing continuous improvement in the quality of services provided. and will rely on your explicit consent as the basis to undertake such activities. Data Processor – We process this information ourselves.
Freedom of Information (FOI) requests	Purpose – To process personal information in relation to FOI requests made by an individual to enable response to be provided. Legal Basis – FOI Act. Data Processor – We process this information ourselves.
Individual Funding Requests (IFR)	Purpose – We may need to process and share your personal information with the IFR team for the funding of treatment that is not normally covered in the standard contract. Legal Basis – The clinical professional who first identifies that you may need the treatment will explain to you the information that is needed to be collected and processed in order to assess your needs and commission your care; they will gain your explicit consent to share this. Data processor – NHS Surrey Downs CCG to do this on behalf of Surrey Heath CCG.
Safeguarding	Purpose – Safeguarding means protecting peoples’ health, wellbeing and human rights, and enabling them to live free from harm, abuse and neglect. It is a key part of providing high-quality health and social care. SHCP will participate in Serious Case Reviews undertaken by either the local Children’s Safeguarding Boards or the Adult Safeguarding Boards for continued learning, to minimize risk and to improve services. Legal Basis – SHCP has a statutory responsibility under the Children Act 2004, Care Act 2014 and safeguarding provision within the Data Protection Act 2018 – Schedule 1, Part 2, subsections 18 and 19 to ensure the safety of all children, and the safety of adults at risk of abuse and neglect. Data Processor – We may undertake these ourselves or refer you to the local CCG.
Patient and Public Involvement	Purpose – If you have asked us to keep you regularly informed and up to date about the work of SHCP or if you are actively involved in our engagement and consultation activities or patient participation groups, we will collect and process data which you have agreed to share with us. Where you submit your details to us for involvement purposes, we will only use your information for this purpose. You can opt out at any time by contacting us using our contact details at the end of this document. Legal Basis – Explicit consent is used for this purpose. Data Processor – We process this information ourselves.
Commissioning, planning and contract monitoring	Purpose – To collect NHS data about services we have commissioned to provide services to you. We also work with other local CCG’s, and GP Federations and often hold joint contracts and commission joint services to make best use of the money available to us. We set our reporting requirements as part of our contracts with NHS service providers and do not ask them to give us identifiable data about you. Legal Basis – Our legal basis for collecting and processing information for this purpose is statutory under the Health & Social Care Act 2012 chapter A2 establishment and duties. Data Processor – We process this information ourselves
Infection Control	Purpose SHCP has an obligation for carrying out Infection Control surveillances. This work is undertaken by a clinical member of Staff with support from Practices and Acute Trusts to provide the relevant information for the investigation to be undertaken and outcomes derived. Legal Basis The Health Service (Control of Patient Information) Regulations 2000. Paragraph 3 enables the lawful processing of patient information in relation to diagnosing, recognising trends, controlling, preventing, monitoring and managing communicable diseases and other risks to public health. http://www.legislation.gov.uk/uksi/2002/1438/made?view=plain Mandatory Health Care Associated Infection Surveillance: Data Quality Statement April 2016 (PHE) Benefits The surveillance reports produces actions and lessons learnt that both support direct improved care of patients but also to continuously improve the safety of patients and be focused on clinical learning. Data Processor – We process this information ourselves
Cabinet Office	Purpose The Cabinet Office is responsible for carrying out data matching exercises. Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out. We participate in the Cabinet Office’s National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise, as detailed here. Legal Basis The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under GDPR. Data matching by the Cabinet Office is subject to a Code of Practice. View further information on the Cabinet Office’s legal powers and the reasons why it matches particular information. https://www.gov.uk/government/publications/code-of-data-matching-practice-for-national-fraud-initiative
National Registries	National Registries (such as the Learning Disabilities Register) have statutory permission under Section 251 of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user.
Research	Purpose – Data may be collected for the purpose of research. Research can be undertaken using information that does not identify you (anonymised). The law does not require your consent to be obtained in this case but information should be made available to you where your anonymised data is used for the purposes of research. Information can be made available either in waiting rooms, using information leaflets, published on notice boards, waiting room screens and/or an organisations website. Where identifiable data is needed for research, you may be approached by an organisation who has provided you with care and asked if you wish to participate in a research study. Where identifiable data is required, an organisation must obtain explicit consent. A member of the research team will discuss the research study with you and will provide you with information on what the study is about, what information they wish to collect, how to opt out and who to contact for more information. If you do not wish your information to be used for research, whether identifiable or non-identifiable, please let your GP Practice know. They will add a code to your records that will stop your information from being used for research. Legal Basis – Your consent will be obtained by the organisation holding your records before identifiable information about you is disclosed for any research. If this is not possible then the organisation wishing to use your information will need to seek formal approval from the Confidentiality Advisory Group (CAG). For further information please visit the NHS Health Research Authority website https://www.hra.nhs.uk/.
Clinical Commissioning Groups	Activities – Contract monitoring and commissioning of services Legal Basis – NHS Act 2006 & Health and Social Care Act 2012
Surveys and asking for your feedback	Sometimes we may offer you the opportunity to take part in a survey that the practice is running. We will not generally ask you to give us any personal confidential information as part of any survey. Legal Basis – you are under no obligation to take part and where you do, we consider your participation as consent to hold and use the responses you give us. Data Processor – Survey Monkey
Extended hours	Purpose – To provide additional clinical appointment to the population with the geographical area of Surrey Heath. Legal Basis – Direct Care (Data Protection Legislation, Article 6 1(3) & 9 2(h) Data Processor – Surrey Heath GP Practices are contracted to provide the additional hours on Saturdays, NHUC are contracted by SHCP to provide the additional hours during Sunday opening
Acute and Community Providers	Purpose – To improve the health outcomes of patients SHCP receives data and information from various Controllers in the Acute and Community environment, including but not limited to Frimley Heath Foundation Trust, Surrey and Boarders, and Clinical Partners. Legal Basis – Direct Care (Data Protection Legislation, Article 6 1(3) & 9 2(h) Data Processor – We process this information ourselves
Pharmacists	Purpose – to provide monitoring and advice in line with the national directive for prescribing to GP Practices. Anonymous data is collected by SHCP. Legal Basis – Direct Care (Data Protection Legislation, Article 6 1(3) & 9 2(h) Data Processor – We do this ourselves using GP systems.
National Registries	National Registries (such as the Learning Disabilities Register) have statutory permission under Section 251 of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user.
Public Health England	Purpose – National objective to improve health outcomes of patients in the UK nad to communicate communicable diseases. Legal Basis – Direct Care (Data Protection Legislation, Article 6 1(3) & 9 2(g & h) Data Processor – Public Health England
Adult Eating Disorder Service	Purpose – Surrey and Borders Partnership (SABP) as part of their assessment of referrals to the Adults Eating Disorder (AED) service, undertook a health assessment to help identify any physical concerns. Due to the current waiting list for SABP AED services, people waiting to have an assessment are to be offered a physical health check monitoring undertaken by Surrey Heath Primary Care Network (SHCP) This is to ensure: • monitoring is provided while on the waiting list. • any physical health implications could be identified/flagged to SABP at an earlier stage. Legal Basis – 1.GDPR Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care”; Data Processor – Surrey Heath Community Providers Limited. EMIS Web Consultation Write Back will copy any consultation notes, clinical codes, medications and clinical documents from the PCN Hub (Emis Web Clinical Services) back to the patients GP Care Record. GP Practices will remain Data Controllers for Clinical records held on EMIS.
Rapid Health	Purpose – Rapid Health is an advanced healthcare management system designed to streamline and enhance the delivery of medical services. Elements being used include:- Self Help (symptom search with links to NHS information) Patient Direct Booking (link generator and ask to self-book for pre-qualified appointments) Smart Direct Booking (eligibility testing for appointments such as immunisations) Smart Triage (workflows to assess and prioritise patient admin and medical requests) Legal Basis – ` 1.GDPR Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services”; Data Processor – Rapid Health
Patient Pod	Purpose – To collect and process patient personal data through the Patient Pod platform, including Blood Pressure, height, weight, alcohol status, smoking status and physical activity. We collect data from direct interaction with the user when they use the Patient Pod terminal and respond to set questions in the touch screen Legal Basis – ` 1.GDPR Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services”; As an additional safeguard, the data subject has given explicit consent Data Processor – Patient Pod and EMIS (to read and write to the Patients clinical records held at their GP Practice.
General Practice Solutions	Purpose – To assist with coding of medical documents onto patient medical records Legal Basis – GDPR Article 6(1)e. General practices are responsible for delivering healthcare in the public interest, and the accurate maintenance of patient records is essential to this role. Article 9(2)h. Document processing services are integral to maintaining accurate patient records, which in turn supports the delivery of safe and effective care, thus providing a legitimate legal basis for processing such data. Article 6(1)(c. Outsourcing document processing services to third-party providers, such as General Practice Solutions, may be undertaken in compliance with these obligations, provided that confidentiality and data protection standards are adhered to. Data Processor – Surrey Heath Community Providers Limited, and General Practice Solutions as Sub-Processor
Gynaecology Service	Purpose – Due to the current waiting list for Gynaecology services in secondary care, and to improve the quality, referrals from GP practices will be passed to SHCP where the patient will be triaged by a Doctor. Where appropriate, patients will then be referred onwards to Frimley Health Foundation Trust. The benefits of the service will be to deliver a better service, increase appropriate referrals, and reduce waiting times at FHFT. Legal Basis – 1.GDPR Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care”; Data Processor – Surrey Heath Community Providers Limited. EMIS Web Consultation Write Back will copy any consultation notes, clinical codes, medications and clinical documents from the PCN Hub (Emis Web Clinical Services) back to the patients GP Care Record. GP Practices will remain Data Controllers for Clinical records held on EMIS.
Spirometry / FeNO Diagnostic Service	Purpose – Due to the current waiting list for Spirometry diagnostic services in Primary care, Surrey Heath Community Providers Ltd will be providing the relevant support and staffing to establish access to high quality Spirometry / FeNO diagnostic services for prioritised patients in Primary Care across Frimley ICB. The high-level objectives of the service are: to provide timely, accessible testing to prioritised patients to ensure the quality and accuracy of testing to record and report on relevant agreed data sets. Legal Basis – 1.GDPR Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care”; Data Processor – Surrey Heath Community Providers Limited. EMIS Web Consultation Write Back will copy any consultation notes, clinical codes, medications and clinical documents from the PCN Hub (Emis Web Clinical Services) back to the patients GP Care Record. GP Practices will remain Data Controllers for Clinical records held on EMIS.
Malnutrition / Hydration Project	Purpose Enable people to stay well, safe and independent at home for longer, the project supports healthier nutritional and hydration patterns and behaviours. Provide the right care in the right place at the right time the project supports proactive intervention, before people become increasingly dependent on health and care services; therefore ‘at the right time Addressing health inequalities and support the priorities of Health & Wellbeing boards The high-level objectives of the service are: To provide people with knowledge and understanding to enable them to make simple sustainable changes to calorie and fluid intake. To improve wellbeing and reduce the demand on health and social care services including Urgent & Emergency Care Legal Basis – 1.GDPR Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care”; Data Processor – Surrey Heath Community Providers Limited. EMIS Web will be used to generate searches in order to identify relevant patients GP Practices will remain Data Controllers for Clinical records held on EMIS.
Heidi Health – AI Medical Scribe Platform	Purpose: SHCP intends to use ‘Heidi’ to process and transcribe clinical conversations, either between a clinician and patients or of a clinician dictating their clinical findings/management plan during, before or following patient consultations. The technology looks to capture relevant details such as different speakers, medical terminology and symptomatology. Legal Basis: Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services” Data Processor : Heidi Health
Other organisations who provide support services for us	Purpose –SHCP will use the services of additional organisations (other than those listed above), who will provide additional expertise to support the work of the CCG. Legal Basis – We have entered into contracts with other organisations to provide some services for us or on our behalf. These organisations may process or be in the vicinity of SHCP data and could be identified as ‘processors’. Information that we may hold about you will not be shared or made available to any of these organisations. Below are their details and a brief description of the functions they carry out on our behalf: IRIS – Provide Payroll services to SHCP Peninsular – Provide HR and Health and Safety services to SHCP SCW – Provide training services to SHCP AZETS – Provide accounting service to SHCP For further details, please contact SHCP. http://www.surreyheathcommunityproviders.co.uk/contact/
Community Dermatology Project	Purpose Dermatology services in the acute sector have been under significant pressure due to increasing GP referral demands and lack of consultant capacity, which has translated into long waiting times for routine appointments and increased use of the Urgent Suspected Cancer route to manage increasing urgent demand. Key deliverables are:- provide an alternative route for patients to be treated where input by a consultant dermatologist is not necessary but where a more specialised knowledge of dermatology, than would be typically available within primary care, is required grow and strengthen local capacity by developing confidence, through interworking and relationship building between primary and secondary care clinicians, to provide the best outcomes for patients ensure patients are better managed in primary care by upskilled local GPwSI/GPwERs (holding diploma accreditation) who will work closely with local dermatology consultants to provide capacity and joined-up patient care Legal Basis – 1.GDPR Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care”; Data Processor – Surrey Heath Community Providers Limited, Xyla (Acacium Group), GP Practices will remain Data Controllers for Clinical records held on EMIS.
EMIS GP Sharing (HCRG Care)	Purpose – To support clinicians in sharing relevant and appropriate clinical information between the GP practice and the Surrey Children’s services within HCRG Care Group for the purposes of Direct Care, using the EMIS clinical information system. To deliver health care to patients Support services managed by HCRG Care Group & GP Practices To allow appropriate data sharing of care records This will be a two-way sharing initiative Legal Basis – 1.GDPR Article 6(1)e “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”; 2.Article 9(2)h “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care”; Data Processor – Surrey Heath Community Providers Limited. GP Practices will remain Data Controllers for Clinical records held on EMIS.