Who is responsible for my information?
Laurel Bank Surgery is the Data Controller for your information and is responsible for looking after your record while you are a registered patient. The person with the key responsibility for data protection and security is Aaron Linden, Data Protection Officer (Leedsccg.dpo@nhs.net).
Why do we collect information about you?
As health professionals, we maintain records about you in order to support your care. By registering with the practice, your existing records will be transferred to us from your previous practice so that we can keep them up to date while you are our patient. If you do not have a previous medical record (a new-born child or coming from overseas, for example), we will create a medical record for you. We take great care to ensure that your information is kept securely, that it is up to date, accurate and used appropriately. All of our staff are trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to.
What information do we hold about you?
- Details about you, such as your name, address, carers, biological gender, gender identity, ethnic origin, date of birth, legal representatives and emergency contact details
- Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
- Notes and reports about your health
- Details about your treatment and care
- Results of investigations such as laboratory tests, x-rays, etc.
- Relevant information from other health professionals, relatives or those who care for you
How is my information stored?
Our practice uses a clinical records programme called Emis. With effect from 10th June 2019, EMIS will start storing its data in a highly secure, third party cloud hosted environment, namely Amazon Web Services (“AWS”). The data will remain in the UK at all times and will be fully encrypted both in transit and at rest. In doing this, there will be no change to the control of access to your data and the hosted service provider will not have any access to the decryption keys. AWS is one of the world’s largest cloud companies, already supporting numerous public sector clients (including the NHS), and it offers the very highest levels of security and support.
Any information held in paper records is stored securely at the practice. We use a combination of working practices and technology to ensure that your information is kept confidential and secure.
What is the legal basis that we use to process your information?
We are required to tell you the legal basis that is used for the various ways we process and use your data. The following table sets the main ways your personal data may be used and the corresponding legal basis and category of data. Each purpose is covered in more detail within this notice to explain what these mean in more practical terms.
| Purpose of using personal data | Legal basis of processing | Special category of data |
| Provision of direct care and related administrative purposes e.g., e-referrals to hospitals or other care providers | GDPR Article 6(1)(e) – the performance of a task carried out in the public interest | GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. |
| For commissioning and healthcare planning purposes e.g., collection of mental health data set via NHS Digital or local
| GDPR Article 6(1)(c) – compliance with a legal obligation
| GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health |
| For planning and running the NHS (other mandatory flow) e.g., CQC powers to require information and records | GDPR Article 6(1)(c) – compliance with a legal obligation (the GP practice) Regulation 6(1)(e) – the performance of a task carried out in the public interest (CQC) | GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health |
| For planning & running the NHS – national clinical audits | GDPR Article 6(1)(e) – the performance of a task carried out in the public interest | GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health |
| For research | GDPR Article 6(1)(f) – legitimate interests…except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject. GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 6(1)(a) – explicit consent | GDPR Article 9(2)(j) – scientific or historical research purposes or statistical purposes |
| For safeguarding or other legal duties | GDPR Article 6(1)(e) – the performance of a task carried out in the public interest Regulation 6(1)(c) – compliance with a legal obligation | GDPR Article 9(2)(b) – purposes of carrying out the obligations of ..social protection law. |
| When you request us to share your information e.g., subject access requests
| GDPR Article 6(1)(a) – explicit consent | GDPR Article 9(1)(a) – explicit consent |
When is my information shared?
We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
- Data Protection legislation
- Human Rights Act 1998
- Common Law Duty of Confidentiality
- Health and Social Care Act 2012
- NHS Codes of Confidentiality, Information Security and Records Management
- Information: To Share or Not to Share Review
How long does the practice hold my information?
As long as you are registered as a patient at Laurel Bank Surgery your paper records are held at the practice along with your GP electronic record. If you register with a new practice, they will initiate the process to transfer your records. The electronic record is transferred to the new practice across a secure NHS data-sharing network and all practices aim to process such transfers within a maximum of 8 working days. The paper records are then transferred via Primary Care Services England (operated on behalf of NHS England by Capita) which can take longer. Primary Care Services England also look after the records of any patient not currently registered with a practice and the records of anyone who has died.
Once your records have been forwarded to your new practice (or after your death forwarded to Primary Care Services England), a cached version of your electronic record is retained in the practice and classified as “inactive”. If anyone has a reason to access an inactive record, they are required to formally record that reason and this action is audited regularly to ensure that all access to inactive records is valid and appropriate. We may access this for clinical audit (measuring performance), serious incident reviews, or statutory report completion (e.g., for HM Coroner).
Change of Details
It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.
How can I see what information you hold about me?
You have a right under data protection legislation to request to see what information the practice holds about you, this is called a Subject Access Request. You also have the right to ask for inaccuracies to be corrected and in some circumstances you have the right to request that we stop processing your data. Some of these rights are not automatic and we reserve the right to discuss with you why we might not comply with a request from you to exercise them.
Subject Access Requests
The practice is registered with the Information Commissioner’s Office. We comply with the Data Protection Act 2018 and General Data Protection Regulation (GDPR), which replaced the Data Protection Act 1998 on 25th March 2018. The practice’s appointed Data Protection Office is Aaron Linden at NHS Leeds CCG.
If you would like to view or have copies of your medical record, please contact us by telephone on 0113 2953900, email at Lbs.reception@nhs.net or in person at Reception. We will need photographic ID to verify your identity. Your request will be processed within one calendar month.
Please note:
- There will be no longer be a charge to either view or to obtain copies of your medical records.
- If the GP is of the opinion that viewing information on your medical record may cause significant harm to you or someone else, this information may be withheld. However, this is rare, and any decision to withhold information must be justifiable.
- The Practice has an agreed policy regarding data protection and security which is reviewed annually.
- All staff are fully trained in Data Security.
In some circumstances there may be a charge to have a printed copy of the information held about you. If this is the case, this will be discussed with you before any charge is made.
If you would like to make a Subject Access Request or have any further questions, please contact Reception on 0113 2953900 or by email to LBS.reception@nhs.net. Alternatively, please contact Parveen Manku, Practice Manager on 0113 295 3900 or by email at pmanku@nhs.net
View our Data Security Policy
