PRIVACY NOTICE

PRIVACY NOTICE 2024

PRIVACY NOTICE AGED 13-16 2024

Call recording policy

All calls (inbound and outbound) at Three Shires Medical Practice are recorded for training and monitoring purposes, as notified on calling the practice on our main numbers.

 Introduction

This policy outlines Three Shires Medical Practice’s call recording process. The purpose of call recording is to provide a record of incoming and outgoing calls which can:

• Identify practice staff training needs
• Keep accurate medical records for you, which might include voice data where deemed relevant.
• Protect practice staff from nuisance or abusive calls
• Establish facts relating to incoming/outgoing calls made (e.g. complaints/disciplinary issues)
• Identify any issues in practice processes with a view to improving them

Purpose

The purpose of this policy is to ensure that call recording is managed in line with General Data Protection Regulations (GDPR) & Data Retention requirements. This will generally involve the recording of telephone conversations which is subject to the Telecommunications Act 1984.

Three Shires Medical Practice will make every reasonable effort to advise callers that their call may be recorded and for what purpose the recording may be used. This will normally be via a pre-recorded message within the telephone system. The voice file will be stored within the telephone system to which the same rules of confidentiality will apply.

Where a patient requests to listen to a recording then this should be allowed within the general provisional of data subject access (SAR) under General Data Protection Regulations.

Scope

This policy applies to all practice staff including any contracted or temporary workers.  All calls via the telephone systems used in the practice will be recorded, including:

• All external incoming calls
• All external outgoing calls made by practice staff
• All internal incoming and outgoing calls made by the practice staff
• Call transfers

A patient (and staff) can request the call not to be recorded at any time during a live call.

Note

• Outbound calls to a patient, will be automatically recorded, but we do not need to notify the patient that the call will be recorded, as this message is mentioned on the pre-recorded message when a patient calls the practice, as well in the policy on our website which is viewable to the public.

Playback / Monitoring of Recorded Calls

Monitoring of the call recordings will be undertaken by allocated Supervisors on the phone software.  Any playback of recordings will take place in a private setting.

All recordings will be stored securely for 3 months and access to these should be controlled and managed by the Practice Manager and by the Supervisors, who has been appointed by the Practice Manager.  Access to the recordings will be by request to the Practice Manager or Surgery Manager.

Subject Access Requests (SAR)

Subject Access Requests can be made in writing by a patient to have access to their telephone calls with Three Shires Medical Practice, if available, it should be noted that recordings are only kept for 3 months.

Confidentiality

The General Data Protection Regulations allows access to information that is held about them and their personal data. This includes recorded telephone calls. Recordings should be stored in such a way that will enable easy access to the information relating to one or more individuals.

Requests for copies of telephone conversations can be made under the GDPR as a “Subject Access Request (SAR)”. This must be done in writing and after assessing whether the information can be released, the requestor can be invited to the practice premises to hear the recording.

If there is a request from an external body relating to the detection or prevention of a crime (e.g. police), then requests for information should be directed to the Practice Manager responsible for GDPR to carry out the request for the recording.

X-On satisfy the security requirements for:

 ISO 27001 Security Standards certification

ISO 9001 Quality Management System Standards certification

X-on are a Crown Commercial Service Supplier and have been assessed against the NHS Information Governance Toolkit.

See X-on Surgery Connect website for full details.

Dr R Greenway 17/6/2024

Automatic Prospective Online Records Access -Practice Statement
Update October 2023

NHS digital has proposed that from 1st November 2023 all patients will be able to access full prospective data from their record, with full historic access to follow shortly. This has been delayed since 2022.

Your GP medical record contains consultation notes based on conversations between you, your GP and their team: medicines prescribed to you; all test results including hospital investigations; allergies; vaccines; and your medical conditions along with documents that may have been sent from local hospitals, clinics or other agencies, eg the police. There is likely to be sensitive and personal information within your medical record.

We and many other practices are concerned that sufficient safeguards are not yet in place to guarantee the security of patient data, and avoid risks of data breach in certain situations.
We have also been asked to make "judgement based exceptions" preventing patients with certain conditions from accessing their data by default (e.g. Learning Disabilities) which we believe may be discriminatory and will potentially damage the relationship between GPs and Patients.

There is also a risk that for example results from hospitals will become visible to patients before seen by GPs , and before explanations are possible which may cause distress to patients.
There is potential risk of online accounts being opened up without consent, or knowledge of the GP practice for less tech savvy (older/ vulnerable) patients. P

We were are early adopter of online patient access, and around 4500 patients are already registered online so we are supportive of technology ,and providing patient access. However, we are legally the data controller for the records that we hold and take our responsibilities seriously, and have legal duties under the data protection act 2018. We have performed a data protection impact assessment that has highlighted risks, many of which cannot be mitigated. The BMA has published concerns which align with ours.

We have raised our concerns locally and nationally and to our MP, as have other practices. It is possible that it will be further delayed nationally , but if it isn't we propose to switch off automatic access until we are confident that data safeguards are in place, and that staff are adequately trained. This will not affect existing users in any way. We will update when we hear more about the national decision.

Just to clarify, we are in favour of patients accessing and operating their record, and have been an early adopter of online access. Around 50 % of our patients actively use online platforms (e.g. NHS app ) to communicate with the practice. If you haven't got online access yet -you can register with NHS app easily. For those who would like access, we are happy to explain the different levels you might like. We may ask for identification. We have an application form on our website -which outlines the benefits and risks of more extensive access. 

Many thanks

Dr Richard Greenway

On Behalf of the Partners

Update 17/10/2023