This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.
This privacy notice applies to personal information processed by or on behalf of the Taurus Healthcare.
This Notice explains
The General Data Protection Regulation (GDPR) became law on 24th May 2016. This is a single EU-wide regulation on the protection of confidential and sensitive information. It enters into force in the UK on the 25th May 2018, repealing the Data Protection Act (1998).
For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), and the Data Protection Act 2018 (currently in Bill format before Parliament) the business responsible for your personal data is Taurus Healthcare Ltd.
This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights
How we use your information and the law.
Taurus Healthcare Ltd will be what’s known as the ‘Controller’ of the personal data you provide to us.
We collect basic personal data about you which does not include any special types of information or location-based information. This does however include name, address, contact details such as email and mobile number etc.
We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sex during the services we provide to you and or linked to your healthcare through other health providers or third parties.
Why do we need your information?
The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.
NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which Taurus Healthcare hold about you may include the following information;
• Details about you, such as your address, carer, legal representative, emergency contact details
• Any contact Taurus Healthcare has had with you, such as appointments, clinic visits, emergency appointments, etc.
• Notes and reports about your health
• Details about your treatment and care
• Results of investigations such as laboratory tests, x-rays etc
• Relevant information from other health professionals, relatives or those who care for you
To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the business for clinical audit to monitor the quality of the service provided.
How do we lawfully use your data?
We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services, under the General Data Protection Regulation we will be lawfully using your information in accordance with: -
Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”
Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems
This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.
Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts, GP practices and from Taurus Healthcare. A risk score is then arrived at through an analysis of your de-identified information. It is only provided back to the data controller in an identifiable form. Risk stratification enables us to focus on preventing ill health and not just the treatment of sickness. If necessary, we may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way.
Taurus Healthcare may conduct Medicines Management Reviews of medications prescribed to patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.
We are dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently and conscientiously applied with the wellbeing of all, at the heart of what we do.
Our legal basis for processing For the General Data Protection Regulation (GDPR) purposes is: -
Article 6(1)(e) ‘…exercise of official authority…’.
For the processing of special categories data, the basis is: -
Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’
Categories of personal data
The data collected by us in the event of a safeguarding situation will be as much personal information as is necessary or possible to obtain in order to handle the situation. In addition to some basic demographic and contact details, we will also process details of what the safeguarding concern is. This is likely to be special category information (such as health information).
Sources of the data
We will either receive or collect information when someone contacts the organisation with safeguarding concerns or we believe there may be safeguarding concerns and make enquiries to relevant providers.
Recipients of personal data
The information is used by Taurus Healthcare when handling a safeguarding incident or concern. We may share information accordingly to ensure duty of care and investigation as required with other partners such as local authorities, the police or healthcare professionals (i.e. their GP or mental health team).
How do we maintain the confidentiality of your records?
We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.
We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.
Our policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.
All employees and sub-contractors engaged by us are asked to sign a confidentiality agreement. We will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for Taurus Healthcare Ltd an appropriate contract (art 24-28) will be established for the processing of your information.
In Certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer in writing if you wish to withdraw your consent. In some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.
Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – Taurus Healthcare will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of Taurus Healthcare sharing any of your information for research purposes.
With your consent we would also like to use your information to
We would however like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions were authorised research facilities would like you to take part on innovations, research, improving services or identifying trends.
At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place.
This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the DPO as below.
Where do we store your information Electronically?
All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information may be located on servers within the European Union.
No 3rd parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place. We have a Data Protection regime in place to oversee the effective and secure processing of your personal and or special category (sensitive, confidential) data.
Who are our partner organisations?
We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;
You will be informed who your data will be shared with and in some cases asked for consent for this to happen when this is required.
Taurus Healthcare operates a Clinical Computer System on which NHS Staff record information securely. This information can then be shared with other clinicians so that everyone caring for you is fully informed about your medical history, including allergies and medication.
To provide around the clock safe care, unless you have asked us not to, we will make information available to trusted organisations. Wherever possible, their staff will ask your consent before your information is viewed.
We consider patient consent as being the key factor in dealing with your health information.
Shared Care Records
To support your care and improve the sharing of relevant information to our partner organisations when they are involved in looking after you, we will share information to other systems. The general principle is that information is passed to these systems unless you request this does not happen, but that system users should ask for your consent before viewing your record.
We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by Taurus Healthcare are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for Taurus Healthcare Ltd an appropriate contract (art 24-28) will be established for the processing of your information.
Herefordshire One Record
Patients in Hereford are able to benefit from the sharing of information to better manage their care via the Herefordshire One Record.
This includes sharing; contact details, diagnosis, medications, allergies, test results, referrals & letters and care plans between health professionals in Hereford.
GP information is shared with:
· Wye Valley NHS Trust (including community services)
· St Michaels Hospice
· 2Gether NHS Foundation Trust
· Taurus Healthcare Ltd (Federation of GP’s)
Further information about Herefordshire One Record can be found by going to the following link
Sharing your information without consent
We will normally ask you for your consent, but there are times when we may be required by law to share your information without your consent, for example:
How long will we store your information?
We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.
More information on records retention can be found online at (https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016)
How can you access, amend move the personal data that you have given to us?
Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.
Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example for a research project), or consent to market to you, you may withdraw your consent at any time.
Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to "erase" your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will Delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.
Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP to GP data transfer and transfer of your hard copy notes.
Access to your personal information
Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information Taurus Healthcare holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:
• Your request should be made to Taurus Healthcare – for information from the hospital you should write direct to them
• There is no charge to have a copy of the information held about you
• We are required to respond to you within one month
• You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.
What should you do if your personal information changes?
You should tell us so that we can update our records please contact us as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), Taurus Healthcare will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.
Objections / Complaints
Should you have any concerns about how your information is managed, please contact the Quality Department or the Data Protection Officer as below.
Suite 1, Berrows Business Centre,
Data Protection Officer:
Taurus Healthcare Ltd Data Protection Officer is Paul Couldrey of PCIG Consulting Limited. Any queries regarding Data Protection issues should be addressed to him at: -
Postal: PCIG Consulting Limited
7 Westacre Drive
If you are still unhappy following a review by the Quality Department, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK supervisory Authority as below.
Tel: 01625 545745
If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the Data Protection Officer.
If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below.
It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Data Protection Officer.
Staff Privacy Notice
Taurus Healthcare is committed to protecting and safeguarding your data privacy rights.
The General Data Protection Regulations (GDPR) became law on the 24th May 2016. This is a single EU-wide regulation on the protection of confidential and sensitive information. It enters into force in the UK on the 25th May 2018, repealing the Data Protection Act (1998).
For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), and the Data Protection Act 2018 (currently in Bill format before Parliament) the company responsible for your personal data is Taurus Healthcare.
This privacy notice describes how we collect, use and process your personal information before, during and after your working relationship with us, in accordance with data protection law, including the General Data Protection Regulation (GDPR). It applies to all prospective employees, employees, workers and contractors.
Taurus Healthcare is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
This notice applies to applicants, current and former employees, workers and contractors. This notice does not form part of any contract of employment or other contract to provide services. This notice can be updated at any time and we will inform you if this occurs.
It is important that you read this notice, together with any other privacy notice that is provided on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.
Data protection principles
The data protection law says that the personal information we hold about you must be:
Information we hold about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
We collect, store, and use the following categories of personal information about you.
When you are employed by us
How is your personal information collected?
We collect personal information about prospective employees, employees, workers and contractors through the application and recruitment process, either directly from candidates or sometimes from a third party such as an employment agency. These third parties include:
The legal basis for collecting, using and holding your data
Processing is necessary:
When you are employed by us
It is necessary for the performance of a contract to which you are a party. This concerns:
Providing employment-related benefits to you including:
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. This concerns providing information to enable overall management of the Civil Service, monitoring equality of opportunity in line with our Public Sector Equality Duty, transparency duties, and to prevent fraud.
It is necessary to comply with a legal obligation placed on us as the data controller. This concerns providing tax and salary information to HMRC, and dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work.
When you cease to be employed by us
It is necessary for the performance of a contract to which you are a party. This concerns continuing obligations to pay pensions and death benefit, and processing exits from the organisation including redundancy and ill health retirement.
The legal basis for collecting, using and holding sensitive and criminal convictions personal information
Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
When you apply for a job with us
Where it is necessary for reasons of substantial public interest for the exercise of our functions. This concerns information about criminal convictions/allegations and offences to conduct baseline security clearance checks.
When you are employed by us
Where it relates to our, or your, employment-related legal rights, including processing health data to make reasonable adjustments. This also concerns:
Where it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people. This is why we collect information about your race or national or ethnic origin, religious beliefs, or your sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.
Where it is necessary for reasons of substantial public interest for the exercise of our functions. This concerns information about criminal convictions/allegations that disclose to us.
It is necessary for the establishment, exercise or defence of legal claims, for example to deal with employment tribunal cases.
Do we need your consent?
We do not need your consent if we use your personal information for one of the other reasons outlined above. Where we do ask for your consent in future, you will be given information at the same time about what we intend to do with it (with your permission).
We will in some circumstances have to share your data with third parties, including third party service providers, external auditors, internal auditors and other Civil Service bodies.
We require third parties to respect the security of your data and to treat it in accordance with the law.
We will in some circumstances transfer your personal information outside the EU.
If we do, you can expect a similar degree of protection in respect of your personal information.
Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you; where it is in the public interest to do so or where it is necessary for the performance of our functions as a Government Department or a function of the Crown. This will, in some circumstances, involve sharing special categories of personal data and, where relevant, data about criminal convictions/allegations.
Which third-party service providers process my personal information?
“Third parties” includes third-party service providers (including contractors and designated agents) and other entities within the Civil Service. The following activities are carried out by our third-party service providers:
How secure is my information with third-party service providers?
All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
When might you share my personal information with other organisations within the Civil Service?
We will share your personal information with other Civil Service organisations as part of our regular reporting activities on departmental performance, in the context of a business reorganisation or restructuring exercise, for system maintenance support and hosting of data; business planning/talent management initiatives, succession planning, publication of transparency data, statistical analysis; and general management and functioning of the Civil Service, including the development and continued work of the Civil Service Professions. Personal data is also shared with the Office for National Statistics, mainly for statistical purposes.
What about other third parties?
If required, we will need to share your personal information with a regulator or National Audit Office, or to otherwise comply with the law.
Transferring information outside the EU
As your personal data is stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the European Economic Area. Where that is the case it will be subject to equivalent legal protection through the use of Model Contract Clauses.
Some of your personal data may be processed offshore by our services provider, Shared Services Connected Limited (SSCL). SSCL use Centres of Excellence in the UK and in India to manage our back office services. Your personal data receives the same level of protection when processed offshore as it does onshore. This protection is delivered by the use of standard data protection clauses adopted by the European Commission, and used in their entirety in the contract with SSCL. A copy of the model contract clauses are published on the Commission website. More information on the offshoring process can be found on the Cabinet Office Intranet
We have put in place measures to protect the security of your information. Details of these measures are available on the intranet.
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
How long will you use my information for?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy. Our data retention policy can be found within our Cabinet Office Employee Document Retention Schedule.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we will anonymise your personal information so that it can no longer be associated with you, in which case we will use such information without further notice to you. Once you are no longer an employee, worker or contractor of the company we will retain and securely destroy your personal information in accordance with our data retention policy. Our data retention policy can be found within our Cabinet Office Employee Document Retention Schedule.
Rights of access, correction, erasure, and restriction
Your duty to inform us of changes
It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.
Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the HR Information Management mailbox at email@example.com.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we are allowed under the law to charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we can refuse to comply with the request in such circumstances.
What we need from you
We sometimes need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Data Protection Officer
The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information. If you have any concerns about how your personal data has been handled, please contact the DPO.
The contact details for the data controller’s Data Protection Officer are:
Stephen Jones, Data Protection Officer
If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:
Information Commissioner's Office
Telephone: 0303 123 1113
Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.
The data controller for your personal data is the Cabinet Office. If you have any questions about this privacy notice, please contact Cabinet Office HR at firstname.lastname@example.org.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We will also notify you in other ways from time to time about the processing of your personal information.
COVID-19 Privacy Notice
Due to the unprecedented challenges that the NHS and we, Taurus Healthcare Ltd face due to the worldwide COVID-19 pandemic, there is a greater need for public bodies to require additional collection and sharing of personal data to protect against serious threats to public health.
In order to look after your healthcare needs in the most efficient way we, Taurus Healthcare Ltd may therefore need to share your personal information, including medical records, with staff from other GP Practices including Practices within our Primary Care Network, as well as other health organisations (i.e. Clinical Commissioning Groups, Commissioning Support Units, Local authorities etc.) and bodies engaged in disease surveillance for the purposes of research, protecting public health, providing healthcare services to the public and monitoring and managing the Covid-19 outbreak and incidents of exposure.
The Secretary of State has served notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) to require organisations to process confidential patient information in the manner set out below for purposes set out in Regulation 3(1) of COPI.
PURPOSE OF THIS NOTICE
The purpose of this Notice is to require organisations such as Taurus Healthcare Ltd to process confidential patient information for the purposes set out in Regulation 3(1) of COPI to support the Secretary of State’s response to Covid-19 (Covid-19 Purpose). “Processing” for these purposes is defined in Regulation 3(2) and includes dissemination of confidential patient information to persons and organisations permitted to process confidential patient information under Regulation 3(3) of COPI.
This Notice is necessary to require organisations such as Taurus Healthcare Ltd to lawfully and efficiently process confidential patient information as set out in Regulation 3(2) of COPI for purposes defined in regulation 3(1), for the purposes of research, protecting public health, providing healthcare services to the public and monitoring and managing the Covid-19 outbreak and incidents of exposure.
REQUIREMENT TO PROCESS CONFIDENTIAL PATIENT INFORMATION
The Secretary of State has served notice to recipients under Regulation 3(4) that requires Taurus Healthcare Ltd to process confidential patient information, including disseminating to a person or organisation permitted to process confidential patient information under Regulation 3(3) of COPI.
Taurus Healthcare Ltd is only required to process such confidential patient information:
A Covid-19 Purpose includes but is not limited to the following:
RECORDING OF PROCESSING
A record will be kept by Taurus Healthcare Ltd of all data processed under this Notice.
SENDING PUBLIC HEALTH MESSAGES
Data protection and electronic communication laws will not stop Taurus Healthcare Ltd from sending public health messages to you, either by phone, text or email as these messages are not direct marketing.
It may also be necessary, where the latest technology allows Taurus Healthcare Ltd to do so, to use your information and health data to facilitate digital consultations and diagnoses and we will always do this with your security in mind.
RESEARCH AND PANDEMIC PLANNING
The Secretary of State has directed NHS Digital to collect, process and analyse data in connection with COVID-19 to support the Secretary of State’s response to COVID-19 and support various COVID-19 purposes set out in the COVID-19 Public Health Directions 2020, 17 March 2020 (as amended) (COVID-19 Direction) and below. This enables NHS Digital to collect data and analyse and link the data for COVID-19 purposes with other data held by NHS Digital.
The purpose of the data collection is also to respond to the intense demand for General Practice data to be shared in support of vital planning and research for COVID-19 purposes, including under the general legal notice issued by the Secretary of State under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI).
NHS Digital has therefore been requested by the joint co-chairs of the Joint GP IT Committee (JGPITC) (the BMA and RCGP) to provide a tactical solution during the period of the COVID-19 pandemic to meet this demand and to relieve the growing burden and responsibility on General Practices. On 15 April 2020 the BMA and RCGP therefore gave their support via JGPITC to NHS Digital’s proposal to use the General Practice Extraction Service (GPES) to deliver a data collection from General Practices, at scale and pace, as a tactical solution to support the COVID-19 response in the pandemic emergency period.
It is a requirement of the JGPITC that all requests by organisations to access and use this data will need to be made via the NHSX SPOC COVID-19 request process, that will triage and prioritise these requests and refer appropriate requests on to the NHS Digital Data Access Request Service (DARS). NHS Digital will consult with representatives of the BMA and the RCGP on all requests for access to the data. An outline of the process for this agreed with the BMA and the RCGP is published here.
Requests by organisations to access record level data from this collection will also be subject to Independent Group Advising on the Release of Data (IGARD) consideration. Data applicants will need to demonstrate they have a lawful basis to access the data for COVID-19 purposes.
BENEFITS OF THIS SHARING
Organisations, including the Government, health and social care organisations and researchers need access to this vital data for a range of COVID-19 purposes, to help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives. COVID-19 purposes for which this data may be analysed and used may include:
Data may be analysed and linked to other data held by NHS Digital or held by other organisations to which access to the data is granted for COVID-19 purposes, through the process described above.
Data will be collected nationally from all GP Practices by NHS Digital every fortnight. All requests to access this data will be triaged through the NHSX SPOC COVID-19 request process and assessed and fulfilled by NHS Digital through DARS. This will significantly reduce the burden on General Practice at a time when demand on resources is high, enabling General Practice to focus on delivering health care and support to patients. It will also reduce compliance burden and risk for General Practice associated with sharing data and complying with the terms of the general legal notice issued under COPI, which applies to General Practices.
LEGAL BASIS FOR THIS COLLECTION
NHS Digital has been directed by the Secretary of State under section 254 of the 2012 Act under the COVID-19 Direction to establish and operate a system for the collection and analysis of the information specified for this service: GPES Data for Pandemic Planning and Research (COVID-19). A copy of the COVID-19 Direction is published here:
Details of the information to be collected can be found on the NHS Digital website – Specification of this DPN. Type 1 objections will be upheld in collecting this data from General Practices and therefore the data for those patients who have registered a Type 1 objection with their GP will not be collected. The Type 1 objection prevents an individual’s personal identifiable confidential information from being shared outside of their GP Practice except when it is being used for the purposes of their direct care. The National Data Opt-Out will not apply to the collection of the data, as this is a collection which is required by law.
This information is required by NHS Digital under section 259(1)(a) of the 2012 Act to comply with the COVID-19 Direction. In line with section 259(5) of the 2012 Act, all organisations in England that are within the scope of this Notice, as identified below under Health and Social Care Bodies within the scope of the collection, must comply with the requirement and provide information to NHS Digital in the form, manner and for the period specified in this Notice. This Notice is issued in accordance with the procedure published as part of NHS Digital’s duty under section 259(8) of the 2012 Act.
In August 2020, the NHS announced that the seasonal national flu immunisation programme criteria for 2020 - 2021 will be expanded to include patients on the SPL. Therefore, to provide information that will support the identification of patients at moderate or high risk of complications from flu, a revision to the weekly extract of data has taken place. This, version three of the extract for the purpose of maintaining and updating the SPL, will continue until the expiry of the COVID-19 Direction. This is currently 31 March 2022 but will be reviewed in September 2020 and every six months thereafter. The frequency of the data collection may change in response to demand.
Data collection extracted on a weekly basis week commencing 13 April 2020
Revised weekly data collection. The first collection is due week commencing 28 September 220
All patients with defined long-term medical conditions which pose a COVID-19 risk, identified as clinically extremely vulnerable to that risk and/or on certain drug treatments as below:
All patients with defined long-term medical conditions which pose a COVID-19 risk, identified as clinically extremely vulnerable/potentially clinically vulnerable to that risk and/or on certain drug treatments as below:
Medical Conditions that provide information on clinically vulnerable patients
Medical Conditions that provide information on clinically vulnerable patients
Patients with a COVID-19 activity code
Patients with a COVID-19 activity code
Clinically vulnerable patients (eligible for seasonal flu vaccination)
Other Potentially clinically Vulnerable patients
Additional Data items for Patients from the above groups
The Secretary of State has directed NHS Digital to collect, process and analyse data in connection with COVID-19 to support the Secretary of State’s response to COVID-19 and support various COVID-19 purposes set out in the COVID-19 Public Health Directions 2020, 17 March 2020 (COVID-19 Direction) (as amended) (COVID-19) Direction) and below.
This enables NHS Digital to collect data and analyse and link the data for COVID-19 purposes with other data held by NHS Digital. The rationale for changing the data extraction is that the initial data collection was based on an existing specification for flu vaccination eligibility. This data extraction was then refined in order to more accurately reflect the patients who are clinically extremely vulnerable to COVID-19 and also to minimise the data we are collecting. A further refinement of the data extraction has taken place leading to the inclusion of new data being extracted. This will provide information to inform vaccination programmes. This General Practice Extraction
Service (GPES) data will be extracted weekly and be used to assist in producing a weekly update of the SPL. The objective of this collection is on an ongoing basis to identify patients registered at General Practices who may be:
Further information on the flu programme can be found here:
The extract may also be used for future direct care purposes relating to the COVID-19 outbreak. The methodology NHS Digital has used to produce the SPL is explained in detail and is published on the NHS Digital SPL website page here:
Patients added to the SPL will be contacted by post, email (and/or SMS message where this is necessary) by the NHS on behalf of the Chief Medical Officer, Chris Whitty, to:
Requests by organisations to access record level data from this collection will be subject to Independent Group Advising on the Release of Data (IGARD) consideration. Data applicants will need to demonstrate they have a lawful basis to access the data for COVID-19 purposes.
BENEFITS OF THE COLLECTION
Organisations, including Government, health and social care organisations need to access this vital data for a range of COVID-19 purposes, to help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives. COVID-19 purposes for which this data may be analysed and used may include:
It will enable the SPL to be updated weekly to identify new patients and changes to patients on the List and will enable support provisions to be more dynamic and responsive to both social and clinical need.
It will also enable vital planning, commissioning, and research to be carried out for COVID-19 purposes. If patients facing the greatest risk follow advice, it is hoped that this will contribute to the delay and mitigation of the spread of COVID-19 and save lives.
VISITORS TO THE PRACTICE
We have an obligation to protect our staff and employees’ health, so it is reasonable for staff at Taurus Healthcare Ltd to ask any visitors to our organisation to tell us if they have visited a particular country, or are experiencing COVID-19 symptoms. This must only be in pre-approved circumstances and we would also ask all patients to consider government advice on the NHS 111 website and not attend the practice.
Where it is necessary for us to collect information and specific health data about visitors to our practice, we will not collect more information than we need, and we will ensure that any information collected is treated with the appropriate safeguards.
REVIEW AND EXPIRY OF THIS NOTICE
This Notice will be reviewed on or before 31 March 2021 and may be extended by The Secretary of State. If no further notice is sent to Taurus Healthcare Ltd by The Secretary of State this Notice will expire on 31 March 2021.