Polices & Procedures

1. Introduction

1.1 Policy Statement

The purpose of this document is to ensure that appropriate procedures are in place at Amersham Health Centre, to enable individuals to apply for access to information held about them, and for authorised individuals, information held about other people. This policy is written in conjunction with the following government legislation:

1. The Access to Health Records Act 1990
2. The Access to Medical Reports Act 1988
3. The General Data Protection Regulation
4. The Data Protection Act 2018
5. The Freedom of Information Act 2000
6. The Data Protection (Subject Access Modification) (Health) Order 2000

1.2 Status

This document and any procedures contained within it are contractual and therefore form part of your contract of employment. Employees will be consulted on any modifications or change to the document’s status.

1.3 Training and support

The practice will provide guidance and support to help those to whom it applies understand their rights and responsibilities under this policy. Additional support will be provided to managers and supervisors to enable them to deal more effectively with matters arising from this policy

2. Scope

2.1 Who it applies to

This document applies to all employees of the practice and other individuals performing functions in relation to the practice, such as agency workers, locums and contractors.

2.2 Why and how it applies to them

In accordance with the General Data Protection Regulation individuals have the right to access their data and any supplementary information held by Amersham Health Centre; this is commonly known as a data subject access request (DSAR). Data subjects have a right to receive:

• Confirmation that their data is being processed
• Access to their personal data
• Access to any other supplementary information held about them

This policy will outline the procedure to access health records at Amersham Health Centre as follows:

• For an individual, for information about themselves
• For access to the health records of a deceased individual
• Access to health records of an individual by an authorised person (by a court), when the individual does not have the capacity to make such a decision
• Organisations requesting information about an individual for employment or insurance purposes (governed by The Access to Medical Reports Act 1988)

The practice aims to design and implement policies and procedures that meet the diverse needs of our service and workforce, ensuring that none are placed at a disadvantage over others, in accordance with the Equality Act 2010. Consideration has been given to the impact this policy might have in regard to the individual protected characteristics of those to whom it applies.

3. Policy

3.1 Right to access

In accordance with the Access to Health Records Act 1990 individuals have the right to access health records held by a healthcare provider that has treated that individual, and/or to access a summary care record (SCR) created by the individual’s GP. The Data Protection Act (DPA 1998) gives individuals the right to ask for a copy of the information an organisation holds about them; this right is commonly known as a Data Subject Access Request (DSAR). In the case of health records, a request for information has to be made with the organisation that holds the individual’s health records, otherwise known as the data controller.

Amersham Health Centre has mechanisms in place to inform patients of their right to access the information held about them, and how long it will take for a DSAR process to be completed.

With effect from April 2016, NHS practices are, as part of their contractual obligation, to provide patients with access to coded information held within their health records. Such information includes:

• Demographics
• Allergies
• Immunisations
• Medication
• Results
• Procedures
• Values
• Problems/diagnoses
• Other (ethnicity, QOF, etc.)

There are occasions when a GP may firmly believe that it is not appropriate to share all the information contained in the individual’s record, particularly if there is potential for such information to cause harm or distress to individuals, or when the record has information relating to a third party.

Patients may request paper copies of health records and, regardless of the preferred method of access, patients and authorised third parties must initially complete a DSAR form. However, patients may request access to their health records informally: any such requests should be annotated within the individuals health record by the clinician dealing with the patient

3.2 Requests

Requests may be received from the following:

• Competent patients may apply for access to their own records or authorise third party access to their records.
• Children and young people may also apply in the same manner as other competent patients and Amersham Health Centre will not automatically presume a child or young person has capacity under the age of 16. However, those aged 12 or over are expected to have the capacity to consent to medical information being disclosed.
• Parents may apply to access their child’s health record as long as it is not in contradiction to the wishes of the competent child.
• Individuals with a responsibility for adults who lack capacity are not automatically entitled to access the individuals health records. Amersham Health Centre will ensure that the patient’s capacity is judged in relation to particular decisions being made. Any considerations to nominate an authorised individual to make proxy decisions for an individual who lacks capacity will comply with the Mental Capacity Act in England and Wales and the Adults with Incapacity Act Scotland.
• Next of kin have no rights of access to health records.
• Police are not able to access health records without first obtaining a court order or warrant. However, health professionals at Amersham Health Centre may disclose relevant information to the police if the patient has consented or if there is no overriding public interest.
• Solicitors and insurance companies in most cases will provide the patients signed consent to release information held in their health record. Amersham Health Centre will ensure that patients are fully aware of the information being provided to the solicitor who is acting for that patient. In the case of a solicitor requesting information, the BMA has provided more information here. Amersham Health Centre will ask solicitors to use the appropriate form when requesting information.
• Deceased patients retain the right of confidentiality. There are a number of considerations to be taken into account prior to disclosing the health record of a deceased patient. Such considerations are detailed in the Access to Health Records Act 1990. Under the terms of this Act, Amersham Health Centre will only grant access if you are either:

1. A personal representative (executor of the deceased person’s estate) or
2. Someone who has a claim resulting from the death

The medical records of the deceased will be passed to Primary Care Support England (PCSE) for storage. Amersham Health Centre can advise you of who you need to contact in such instances. PCSE will retain the GP records of deceased patients for ten years, after which time they will be destroyed. PCSE have provided an application form which can be used to request copies of a deceased patient’s record

In the cases of any third-party requests, Amersham Health Centre will ensure that the patient has consented to the disclosure of this information by means of a valid signature of the patient.

In accordance with the GDPR, patients are entitled to receive a response within the maximum given time frame of one calendar month from the date of submission of the DSAR. In order to ensure full compliance regarding DSARs, Amersham Health Centre will adhere to the guidance provided in the GDPR. In the case of complex or multiple requests, the data controller may extend the response time by a period of two months. In such instances, the data subject must be informed and the reasons for the extension given.

Under The Data Protection (Subject Access Modification) (Health) Order 2000, Amersham Health Centre will ensure that an appropriate healthcare professional manages all access matters. There are a number of such professionals, and wherever possible the individual most recently involved in the care of the patient will review and deal with the request. If for some reason they are unable to manage the request, an appropriate professional will assume responsibility and manage the access request.

Furthermore, to maintain GDPR compliance, the data controller at Amersham Health Centre will ensure that data is processed in accordance with Article 5 of the GDPR and will be able to demonstrate compliance with the regulation (see GDPR policy for detailed information). Data processors at Amersham Health Centre will ensure that the processing of personal data is lawful and at least one of the following applies:

• The data subject has given consent to the processing of his/her personal data for one or more specific purposes
• Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract
• Processing is necessary for compliance with a legal obligation to which the controller is subject
• Processing is necessary in order to protect the vital interests of the data subject or another natural person

3.3 Procedure for access

A DSAR form (Annex A) must be completed and passed to the data controller; all DSARs should be processed free of charge unless they are either complex, repetitive or unfounded (see GDPR Policy). The GDPR states that data subjects should be able to make access requests via email. Amersham Health Centre is compliant with this and data subjects can complete an e-access form and submit the form via email.

Upon receipt of a DSAR, Amersham Health Centre will record the DSAR within the health record of the individual to whom it relates, as well as annotating the DSAR log. Furthermore, once processed, an entry onto the health record should be made, including the date of postage or the date the record was collected by the patient or authorised individual.

Individuals will have to verify their ID at Amersham Health Centre and it is the responsibility of the data controller to verify all requests from data subjects using reasonable measures. The use of the practice’s Data Subject Access Request (DSAR) form supports the data controller in verifying the request. In addition, the data controller is permitted to ask for evidence to identify the data subject, usually by using photographic identification, i.e. a driving licence or passport

3.4 Additional Privacy Information notice

Once the relevant information has been processed and is ready for issue to the patient, it is a requirement, in accordance with Article 15 of the General Data Protection Regulation (GDPR), to provide an Additional Privacy Information notice (APIn).

3.5 Third-party requests

Third-party requests will continue to be received following the introduction of the GDPR. The data controller must be able to satisfy themselves that the person requesting the data has the authority of the data subject.

The responsibility for providing the required authority rests with the third party and is usually in the form of a written statement or consent form, signed by the data subject.

3.6 Summary

Having a robust system in place will ensure that access to health records is given only to authorised personnel. Patient confidentiality is of the utmost importance and any third-party requests must be accompanied by a valid patient signature. Staff are to adhere to this guidance at all times and where doubt exists, they are to discuss their concerns with Amersham Health Centre.

Further Information

• Annex A – Application form for access to health records

Introduction

In accordance with the General Data Protection Regulation, patients (data subjects) have the right to access their data and any supplementary information held by Amersham Health Centre; this is commonly known as a data subject access request (DSAR). Data subjects have a right to receive:

• Confirmation that their data is being processed
• Access to their personal data
• Access to any other supplementary information held about them

Options for access

As of April 2016, practices have been obliged to allow patients access to their health record online. This service will enable the patient to view coded information held in their health record. Prior to accessing this information, you will have to visit the practice and undertake an identity check before being granted access to your records.

In addition, you can make a request to be provided with copies of your health record. To do so, you must submit a Data Subject Access Request (DSAR) form; this can be submitted electronically and the DSAR form is available on the practice website. Alternatively, a paper copy of the DSAR is available from reception. You will need to submit the form online or return the completed paper copy of the DSAR to the practice. Patients do not have to pay a fee for copies of their records.

Time frame

Once the DSAR form is submitted, Amersham Health Centre will aim to process the request within 21 days; however, this may not always be possible. The maximum time permitted to process DSARs is one calendar month.

Exemptions

There may be occasions when the data controller will withhold information kept in the health record, particularly if the disclosure of such information is likely to cause undue stress or harm to you or any other person.

Data controller

At Amersham Health Centre the data controller is the Practice Manager and should you have any questions relating to accessing your medical records, please ask to discuss this with the practice manager.

Thank you for your email. If your matter is URGENT, please call Reception on 01494 434 344.

Your email will not be actioned if it relates to: 

Amersham Health Centre for the year ended 30 June 2022

NHS England example publication of GP Net Earnings for 2022/23

“All GP practices are required to declare the mean earnings (e.g. average pay) for GPs working to deliver NHS services to patients at each practice.”

The average pay for GPs who worked for six months or more in Amersham Health Centre in the last financial year was £82,766 before Tax and National Insurance. This is for 1 full-time GP, 9 part-time GP’s and 1 locum GP

Williamson West
March 2024

Your health records contain a type of data called confidential patient information. This data can be used to help with research and planning.

You can choose to stop your confidential patient information being used for research and planning. You can also make a choice for someone else like your children under the age of 13.

Your choice will only apply to the health and care system in England. This does not apply to health or care services accessed in Scotland, Wales or Northern Ireland. Below is information including the Opt Out Form.

Click here for further information and to Opt out

This will enable health and care professionals to have better medical information about you when they are treating you at the point of care. This change will apply for the duration of the coronavirus pandemic only. Unless alternative arrangements have been put in place before the end of the emergency period, this change will be reversed.

All patients registered with a GP have a Summary Care Record, unless they have chosen not to have one. The information held in your Summary Care Record gives health and care professionals, away from your usual GP practice, access to information to provide you with safer care, reduce the risk of prescribing errors and improve your patient experience.

Your Summary Care Record contains basic information about allergies and medications and any reactions that you have had to medication in the past.

Some patients, including many with long term health conditions, have previously agreed to have additional information shared as part of their Summary Care Record. This additional information includes information about significant medical history (past and present), reasons for medications, care plan information and immunisations.

During the coronavirus pandemic period, your Summary Care Record will automatically have additional information included from your GP record unless you have previously told the NHS that you did not want this information to be shared.

There will also be a temporary change to include COVID-19 specific codes in relation to suspected, confirmed, Shielded Patient List and other COVID-19 related information within the additional information.

By including this additional information in your SCR, health and care staff can give you better care if you need health care away from your usual GP practice:

• in an emergency
• when you’re on holiday
• when your surgery is closed
• at out-patient clinics
• when you visit a pharmacy

Additional information is included on your SCR

In response to the coronavirus (COVID-19) pandemic we are temporarily removing the requirement to have explicit consent to share the SCR additional information. This change of requirement will be reviewed when the pandemic is over.

You can be reassured that if you have previously opted-out of having a Summary Care Record or have expressly declined to share the additional information in your Summary Care Record, your preference will continue to be respected and applied.

Additional information will include extra information from your GP record, including:

• health problems like dementia or diabetes
• details of your carer
• your treatment preferences
• communication needs, for example if you have hearing difficulties or need an interpreter

This will help medical staff care for you properly, and respect your choices, when you need care away from your GP practice. This is because having more information on your SCR means they will have a better understanding of your needs and preferences.

When you are treated away from your usual doctor’s surgery, the health care staff there can’t see your GP medical records. Looking at your SCR can speed up your care and make sure you are given the right medicines and treatment.

The only people who might see your Summary Care Record are registered and regulated healthcare professionals, for example doctors, nurses, paramedics, pharmacists and staff working under their direct supervision. Your Summary Care record will only be accessed so a healthcare professional can give you individual care. Staff working for organisations that do not provide direct care are not able to view your Summary Care Record.

Before accessing a Summary Care Record healthcare staff will always ask your permission to view it, unless it is a medical emergency and you are unable to give permission.

Protecting your SCR information

Staff will ask your permission to view your SCR (except in an emergency where you are unconscious, for example) and only staff with the right levels of security clearance can access the system, so your information is secure. You can ask an organisation to show you a record of who has looked at your SCR – this is called a Subject Access Request.

Find out how to make a subject access request.

Opting out

The purpose of SCR is to improve the care that you receive, however, if you don’t want to have an SCR you have the option to opt out. If this is your preference please inform your GP or fill in an SCR opt-out form and return it to your GP practice.

Regardless of your past decisions about your Summary Care Record consent preferences, you can change your mind at any time. You can choose any of the following options:

1. To have a Summary Care Record with additional information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a enriched Summary Care Record if they need to provide you with direct care.
2. To have a Summary Care Record with core information only. This means that any authorised, registered and regulated health and care professionals will be able to see information about allergies and medications only in your Summary Care Record if they need to provide you with direct care.
3. To opt-out of having a Summary Care Record altogether. This means that you do not want any information shared with other authorised, registered and regulated health and care professionals involved in your direct care, including in an emergency.

To make these changes, you should inform your GP practice or complete the SCR patient consent preferences form and return it to your GP practice.

More information on your health records

Read more about your medical records.

As an employer, the practice has a duty of care for the health, safety and wellbeing of its staff. The practice also has a legal responsibility to provide a safe and secure working environment for staff. Staff mental health is as important as their physical health.

All patients and staff are expected to behave in an acceptable, respectful manner.

The practice follows the NHS guidance concerning Zero Tolerance.

Any incident in which an employee is abused, threatened or assaulted in circumstances relating to their work is unacceptable and not tolerated.

This includes the serious or persistent use of verbal abuse, aggressive tone and/or language and swearing/foul language.

Staff should not be left upset and distressed following an interaction with a patient.

All instances of actual physical abuse or threatening behaviour on any doctor or member of staff, by a patient or their relatives will be reported to the police as an assault.

We expect all patients to be responsible and avoid attending the surgery under the influence of alcohol or illegal drugs. Any alteration of prescriptions is illegal and will not be tolerated.

The General Medical Council states In Good Medical Practice that: “In rare circumstances, the trust between you (the Practice) and a patient may break down, and you may find it necessary to end the professional relationship. For example, this may occur if a patient has been violent to you or a colleague, has stolen from the premises, or has persistently acted inconsiderately or unreasonably.”

This includes unnecessarily persistent or unrealistic service demands that cause disruption. Examples of this include, but are not limited to :

• Demanding to only speak to a specific team member
• Refusing appointments with an appropriate clinician for the presenting care need i.e. insisting on a GP appointment when seeing a pharmacist or nurse prescriber is appropriate
• Refusing to access the service in the appropriate manner i.e. sending emails/texts instead of using the NHS Digital approved digital consultation service
• Demanding a same day appointment for a routine clinical need – this deprives access to urgent care services for those who genuinely need it
• Contacting individuals directly via social media or personal email instead of through the practice contact channels

The practice has a finite number of available appointments and you may be directed to a clinician who is not a GP, or your preferred GP, but who is appropriately qualified to manage the presenting care need. We provide a named GP service but we cannot always accommodate requests to speak to the same GP due to high patient demand for appointments.

If you are seriously unhappy with the quality of service you have the right to register with another practice without notifying us. Similarly, on the very rare occasions when a patient breaches this policy, we have the right to remove the patient from our Practice list.

Examples of Unacceptable Standards of Behaviour

In exceptional circumstances, a breakdown may occur between a doctor and their patient. If the breakdown is of a serious nature e.g. serious physical or verbal abuse to any member of the practice team, the doctors may feel that the doctor/patient relationship has been compromised. Steps may be taken to have the patient removed immediately from the practice list. Where possible, conciliation would always be the preferred route. Reasons for removal will be given in writing.

Where we deem an incident is not serious enough to warrant immediate removal, we will issue a first and final warning.

You will be removed from our patient list immediately when we have needed police assistance or have made a report to the police.

The following are example of when you may be issued with a first and final warning or removed from our patient list dependent on the severity of the incident.

• Violence.
• Excessive noise eg recurrent loud or intrusive conversation or shouting.
• Threatening or abusive language involving swearing or offensive remarks.
• Racial or sexual remarks.
• Aggressive, forceful tone and/or language that upsets staff.
• Malicious allegations relating to members of staff, other patients or visitors.
• Offensive gestures or behaviours.
• Abusing alcohol or drugs on practice premises.
• Drug dealing on practice premises.
• Wilful damage to practice property.
• Threats or threatening behaviour.
• Theft.
• Persistent and/or unrealistic demands on the service
• Repeated derogatory comments about the practice or individuals either verbally, in writing/digitally or on social media platforms

This list is not exhaustive and there may be other occasions where we have cause to issue a warning or remove you from our patient list.  If you are unhappy with the practice we have a complaints procedure to assist you or you have the choice to register with another practice – there really is no need for unpleasant behaviour with these options available to support you.

We trust this policy is clear and supports a mutually respectful environment for patients and staff.