Practice Policies

Practice Policies

Confidentiality & Medical Records

We are committed to protecting your privacy and maintaining the confidentiality of your personal and health information.

This Practice processes personal data in accordance with:

• The UK General Data Protection Regulation (UK GDPR)

• The Data Protection Act 2018

• The Access to Health Records Act 1990 (for deceased patients)

• The NHS Records Management Code of Practice

We are the Data Controller for the personal data we hold about you.

How We Use Your Information

We process your personal information to:

• Provide you with direct medical care and treatment

• Coordinate your care with hospitals, community services and other healthcare providers

• Support public health and safeguarding obligations

• Comply with legal and regulatory requirements

• Plan and improve NHS services

Lawful Basis for Processing

Under UK GDPR, we process your data under:

• Article 6(1)(e) – Public task (provision of healthcare)

• Article 9(2)(h) – Management of health or social care systems and services

Where consent is required (for example, certain referrals or information sharing outside direct care), this will be obtained from you.

Sharing Your Information

Your information may be shared where necessary and lawful with:

• NHS hospitals and community services

• Integrated Care Boards (ICBs)

• Social care services

• Public health authorities

• Regulatory bodies where required

We only share the minimum necessary information and ensure appropriate safeguards are in place.

Anonymised or pseudonymised information may be used for service planning and research. If you wish to opt out of your confidential patient information being used for research and planning, you can register a National Data Opt-Out preference (details available via NHS Digital).

Access to Your Records

You have the right to request access to your medical records.

Requests should be made in writing to the Practice Manager.

Under UK GDPR:

• Subject Access Requests are normally provided free of charge.

• We will respond within one calendar month.

• A fee may only be charged if a request is manifestly unfounded or excessive.

For deceased patients, access requests are handled in accordance with the Access to Health Records Act 1990.

No information will be released without appropriate authority unless we are legally obliged to do so.

Data Security

All staff, including reception and administrative staff, require access to your information to perform their roles. All staff are bound by strict confidentiality obligations and receive regular information governance training.

We maintain appropriate technical and organisational measures to protect your data from loss, unauthorised access, or misuse.

Data Retention

Medical records are retained in line with the NHS Records Management Code of Practice.

Freedom of Information

Information about the Practice required under the Freedom of Information Act 2000 can be requested in writing from the Practice Manager.

Complaints

We aim to provide the highest standard of care.

If you have concerns about our service, please contact the Practice Manager in the first instance. Further written information about our complaints procedure is available on request.

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office
www.ico.org.uk

Violence Policy

The NHS operates a zero-tolerance policy regarding violence and abuse.

The Practice may remove patients from the list where there is actual or threatened physical violence or verbal abuse that causes fear for staff or patient safety. Any such removal will be confirmed in writing and recorded in the patient’s medical record.

Data Protection Officer

Our Data Protection Officer is Dr M Razak and can be contacted via:

gmicb-tameside.hamiltonhcp.managers@nhs.net