Commissioning, Planning, Risk Stratification and Research Privacy Notice

St Andrew’s Medical Centre uses data insightfully for research, auditing and healthcare planning (population health management).

We are required by law to provide you with the following information about how we handle your information. Our full list of privacy notices

St Andrew’s Medical Centre
133 London Road,
Southborough,
Tunbridge Wells,
Kent
TN4 0NA

If data from many patients are linked up or pooled, researchers and doctors can look for patterns in the data, helping them to develop new ways of predicting illness, and identify ways to improve clinical care. This information can be used to help:

• Understand more about disease risk and causes
• Improve diagnosis
• Develop new treatments and prevent diseases
• Plan NHS and GP services
• Improve patient safety
• Evaluate government and NHS policy

• Pseudonymised data: Information about individuals but with identifying details (such as name or NHS number) replaced with a unique code.
• Anonymised data: Information about individuals but with identifying details removed.
• Aggregated data: Anonymised information grouped together so that it does not identify individuals.

In certain circumstances, where we have a lawful basis it may be necessary to use:

• Demographics: Name, address, date of birth, postcode, and NHS number.
• Medical history

These purposes are supported under the following sections of the UK General Data Protection Regulations:

• Article 6(1)(c): Necessary for compliance with a legal obligation to which the controller is subject
• Article 6(1)(e): Necessary for the performance of a task carried out in the public interest or in the exercise of official authority
• Article 9(2)(h): Necessary for preventative or occupational medicine, medical diagnosis, provision or management of health or social care
• Article 9(2)(g): Necessary for reasons of substantial public interest, with safeguards under domestic law
• Article 9(2)(i): Necessary for public health interests, including quality and safety of care
• Article 9(2)(j): Necessary for archiving, scientific or historical research, or statistical purposes under Article 89(1)

Data Protection Act 2018:

• Schedule 1, Part 1(2): Health and social care purposes
• Schedule 1, Part 1(3): Public health
• Schedule 1, Part 1(4): Research etc.
• Schedule 1, Part 2(6): Statutory and government purposes

The Practice recognises your rights under the Common Law Duty of Confidentiality. Consent is still required for those outside your care team to access patient information unless Section 251 support applies via the Confidentiality Advisory Group.

Your information will be passed, with all identifiers removed, to a collaborative programme called the Kent & Medway Shared Health and Care Analytics Board. It will be used for population health management purposes beyond your individual care, including planning services, managing finances, early treatment of illnesses (known as risk stratification), coordinating and improving patient and service user movement through the health and care system, research, and public health enhancement.

St Andrew’s Medical Centre is a partner organisation in the Kent and Medway Care Record (KMCR). The KMCR is an electronic care record that links your health and social care information held in different provider systems to one platform. This allows health and social care professionals with KMCR access to view the most up-to-date information to ensure you receive the best possible care and support.

To enable this sharing of information, organisations using the KMCR have agreements in place that permit the sharing of personal and special category data.

For further information about the Kent and Medway Care Record and how your data is used

NHS Digital collects data from practices to support vital health and care planning and research. This information is used insightfully to better understand what causes ill health and, importantly, what can be done to prevent or treat it and provide better care.

The Secretary of State for Health and Social Care issued notices under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI), requiring organisations to share confidential patient information with authorised entities for COVID-19 purposes.

Further guidance on processing personal data after the expiration of the COPI Notice

Your information is passed, with all identifiers removed, to NHS Kent and Medway for public health management. This enables the practice to identify the appropriate level of care and services for distinct groups of patients. It involves assigning a risk status to patients and using this information to guide care and improve overall health outcomes.

The National Data Opt-Out is a service that enables patients to opt out of their confidential information being used for research and planning.

National Data Opt-Out

It is worth noting that in a small number of exceptional circumstances, senior health care professionals may decide to share information in the public interest, in which case the National Data Opt-Out does not apply.

The Confidentiality Advisory Group (CAG) considers applications for the use of patient data without consent under the Control of Patient Information Regulations 2002, Section 251 of the NHS Act 2006:

• Regulation 2 – for diagnosis and treatment of cancer
• Regulation 5 – for general medical and research purposes

Specific exemptions to the National Data Opt-Out policy apply to:

• Public Health England National Disease Registers
• Assuring Transformation
• National patient experience surveys

NHS Digital, as the national safe haven for health and care data with powers under the Health and Social Care Act 2012, may require data under s259. The National Data Opt-Out does not apply in such cases.

The National Data Opt-Out is a service that enables patients to opt out of their confidential information being used for research and planning.

National Data Opt-Out

For further details on your rights and how to complain