This practice keeps medical records confidential and complies with the General Data Protection Regulation (GDPR) and Data Protection Act 2018
We hold your medical record so that we can provide you with safe care and treatment.
We will also use your information so that this practice can check and review the quality of the care we provide. This helps us to improve our services to you.
The confidentiality of your information is very important to us and we comply with date protection legislations and medical confidentiality guidelines of our professional bodies (namely the General Medical Council).
- We will share relevant information from your medical record with other health care professionals when they provide you with care. For example, when you are referred to a consultant, or when we send details about your prescription to your chosen pharmacy. We recommend that we share the care given to you here with your NHS GP – however we will only do this with your consent and would provide you with copies of all correspondence.
- You have the right to object to information being shared for your own care. Please speak to the practice manager if you wish to object. You also have the right to have any mistakes or errors corrected.
Other important information about how your information is used to provide you with healthcare at Private GP.com Ltd
Registering for care at Private GP.com Ltd
- All patients who receive care are registered on our computer system and/or in a locked manual filing system
- This database holds your name, address, date of birth, telephone number, email address, confirmation that ID has been checked and your regular (NHS) GP – you will be asked to indicate if you consent to Private GP Services sharing clinical information with your regular GP (please note you may change this decision at anytime). This database does not hold information about the care you receive. The information is only accessible to authorised practice members
The database is held by Private GP Services –. Personal data about you is held in the practice’s computer system and/or in a locked manual filing system. The information is only accessible to authorised practice members. Our computer system has secure audit trails and we back up information routinely. The practice has a confidentiality policy that all staff adhere to.
- Our data is web based and held securely via our IT providers: Advanced Computer Software Group
What personal data do we hold apart from that collected when registering at Privategp.com Ltd
As a medical practice we will hold medical records and information about you in order to treat you appropriately and in a timely manner.
To provide patients with a high standard of medical care, we need to hold personal information. This personal data can include:
- Past and current medical conditions; personal details such as age, address, telephone number, email, next of kin, NHS GP (as outlined above in the ‘Registering for care’ section
- X-rays and clinical photographs
- Information about your treatment that we have provided or propose and its cost
- Notes of conversations or incidents that might occur for which a record needs to be kept
- Records of consent to treatment
- Any correspondence relating to you from yourself or other health care professionals
Why do we hold information about you?
We need to keep comprehensive and accurate personal data about patients to provide you with safe and appropriate medical care. We will ask you yearly to update your medical history and contact details
Identifying patients who might be at risk of certain diseases
- Your medical records will be searched by a computer programme so that we can identify patients who might be at risk from certain diseases or conditions such as diabetes or hypertension.
- This means we can offer patients additional care or support as early as possible.
- This information will also be anonymised for audit purposes to monitor and measure the quality of the care we deliver.
- For more information please speak to the practice manager
Safeguarding
- Sometimes we need to share information so that other people, including healthcare staff, children or others with safeguarding needs, are protected from risk of harm.
- These circ*mstances are rare.
- We do not need your consent or agreement to do this.
- Please see our safeguarding policies for more information:
Please ask us if you wish to see our Safeguarding Policy
We are required by law to provide you with the following information about how we handle your information.
Data Controller contact details
Dr Julia Piper
Privategp.com Ltd
Data Protection Officer contact details
We are a small Practice and therefore there is no requirement for us to have a data controller currently. This will be reviewed every 3 years.
Purpose of the processing
- To give direct health to individual patients.
- For example, when a patient agrees to a referral for direct care, such as to a hospital, relevant information about the patient will be shared with the other healthcare staff to enable them to give appropriate advice, investigations, treatments and/or care.
- To check and review the quality of care. (This is called audit and clinical governance).
- To advise patients of changes to services or new services
Lawful basis for processing
These purposes are supported under the following sections of the GDPR:
Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’; and
Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”
- Healthcare staff will also respect and comply with their obligations under the common law duty of confidence.
Recipient or categories of recipients of the processed data
Disclosure of information
To provide proper and safe medical care we may need to disclose personal information about you including to:
- Healthcare professionals and staff in this practice
- Hospitals (if required, e.g. referral or emergency transfer)
- Out of hours services
- Diagnostic and treatment centres;
- Other organisations involved in the provision of direct care to individual patients
- Regulatory bodies e.g Care Quality Commission
Information would only be shared with your consent and you would be copied into all correspondence if you wished.
Disclosure will take place on a ‘need-to-know’ basis. Only those individuals or organisations who need to know to provide care for you will be given the information.
In very limited circ*mstances or when required by law or a court order, personal data may have to be disclosed to a third party not connected with your health care. The practice would take legal advice before disclosing data in these very limited circ*mstances and where possible you will be informed of these requests for disclosure
Requesting your consent under GDPR
We will continue to obtain consent from you as a patient be it implied, verbal or written for the treatment or procedures undertaken at Privategp.com ltd. This will be inline with the General Medical Council’s guidelines and will be recorded appropriately in your medical records.
In addition to this
We require your consent under GDPR to communicate with you by phone or email or post.
We will
- Ask you to opt-in to any marketing or other communications
- Offer choices as to how to communicate with you should you so wish
- Offer you the option to withdraw consent to that communication at any time
Collection of personal information when visiting our website
You can access most of the pages on our website without giving us your personal information although you may choose to do so, for example when you submit an enquiry. Users are requested not to send confidential details or debit/credit card numbers by email unless specifically asked by us to do so.
When you submit personal information, you consent to our use of the information as set above under ‘Requesting your consent under GDPR’.
Use of personal information
We will use personal information given to us in accordance with these terms and conditions, and with any additional statements appearing on forms used for submitting personal information. We will not disclose personal information to any third parties without obtaining your prior consent, unless we are required by law to do so.
If you submit an enquiry, we will use your personal information to administer and respond to your enquiry. We will store securely the information you supply and our response. We may produce reports on enquiries to enable us to monitor and develop our service but reports will be based on anonymous data; we will not identify individuals in our reports.
If you comment or complain about our services, we may use your details to investigate your comments.
Rights to object
- You have the right to object to information being shared between those who are providing you with direct care.
- This may affect the care you receive – please speak to the practice.
- You are not able to object when information is legitimately shared for safeguarding reasons.
- In appropriate circ*mstances it is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm.
- The information will be shared with the local safeguarding service, the Leicestershire and Rutland Safeguarding Board.
Right to access and correct
- You have the right to access your medical record and have any errors or mistakes corrected. Please speak to a member of staff.
- We are not aware of any circ*mstances in which you will have the right to delete correct information from your medical record; although you are free to obtain your own legal advice if you believe there is no lawful purpose for which we hold the information and contact us if you hold a different view.
Data we get from other organisations
We may receive information about your health from other organisations who are involved in providing you with health following a referral from Privategp.com Ltd. For example, if you go to hospital for treatment or an operation the hospital will send us a letter to let us know what happens. This means your medical record at this practice is kept up-to date when you receive care from other parts of the health service.
Note: Although obliged to share patient information with your NHS GP (with your consent) currently independent doctors do not have access to care and treatment records you receive elsewhere (NHS or private).
Retention period
GP medical records will be kept in line with the law and national guidance. The practice manager will advise you as to how long hard copy medical records are legally be required to be kept by us, digital medical records will be stored indefinitely until government regulations change.
Access to your medical records
You have the right of access to the data that we hold about you and to receive a copy. Parents may access their child’s records if this is in the child’s best interests and not contrary to a competent child’s wishes. Formal applications for access must be in writing to the practice manager.
Use of personal information
We will use personal information given to us in accordance with these terms and conditions, and with any additional statements appearing on forms used for submitting personal information. We will not disclose personal information to any third parties without obtaining your prior consent, unless we are required by law to do so.
If you submit an enquiry, we will use your personal information to administer and respond to your enquiry. We will store securely the information you supply and our response. We may produce reports on enquiries to enable us to monitor and develop our service but reports will be based on anonymous data; we will not identify individuals in our reports.
If you comment or complain about our services, we may use your details to investigate your comments.
If you do not agree
If you do not wish personal data that we hold about you to be disclosed or used in the way that is described in this Code of Practice, please discuss the matter with your doctor. You have the right to object; however, this may affect our ability to provide you with medical care.
You have a right to withdraw your consent at any time, however this will not be retrospective.
Contact details
Dr Julia Piper, Registered Provider CEO, GP
Privategp.com Ltd
3 Knighton Grange Road
Stoneygate
Leicester
LE2 2LF
Cookies and Internet Protocol (IP) logging
When you visit our website, our server will record your computer’s IP address (the unique numerical address given to every computer connected to the Internet) and the time and duration of your visit.
This website uses cookies, a piece of data that may be stored on your computer when you visit a website; these cookies store the anonymised IP address (the last digit group of the IP is removed before storage).
Cookies and your IP address will be used to track the pages you visit on our website. We will use this information to analyse the way our site is used, and to administer and improve the accessibility of our site. We will not use it for any other purpose. You may disable the use of cookies in your Internet browser without affecting your use of our website.
Links
From time to time our website may contain links to other sites. We are not responsible for the content or privacy practices of third parties that run other websites.
Right to complain
You have the right to complain to the Information Commissioner’s Office.
For further details about your rights under the Data Protection Act, please
Visit the Information Commissioners Office website
www.ico.org.uk
Telephone: 0303 123 1113
Email online form: https://ico.org.uk/global/contact-us/email/
Write: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, England, UK.
FAQs
It generally gives patients the right to examine and obtain a copy of their own health records and request corrections. It empowers individuals to control certain uses and disclosures of their health information.
Do patients have a right to privacy? ›
The Privacy Rule, a Federal law, gives you rights over your health information and sets rules and limits on who can look at and receive your health information. The Privacy Rule applies to all forms of individuals' protected health information, whether electronic, written, or oral.
Does HIPAA apply to private individuals? ›
Individuals and non-healthcare persons may still be penalized for HIPAA violations. Individuals and non-medical practitioners are still bound to abide by HIPAA rules, especially if they work under companies that are business associates of a covered entity. The key question is whether the individual has access to PHI.
What is a violation of patient privacy? ›
Snooping on Healthcare Records
Accessing the health records of patients for reasons other than those permitted by the Privacy Rule – treatment, payment, and healthcare operations – is a violation of patient privacy.
Which of the following is not a patient right under the privacy rule? ›
One issue not covered by the patient rights under the Privacy Rule is a right to question why certain information is included in – or omitted from – a designated record set.
What is the most important aspect of patient privacy? ›
Patient confidentiality is necessary for building trust between patients and medical professionals. Patients are more likely to disclose health information if they trust their healthcare practitioners. Trust-based physician-patient relationships can lead to better interactions and higher-quality health visits.
What are the three rights under the Privacy Act? ›
The Privacy Act provides protections to individuals in three primary ways. It provides individuals with: the right to request their records, subject to Privacy Act exemptions; the right to request a change to their records that are not accurate, relevant, timely or complete; and.
What is patient's right to privacy and confidentiality? ›
Right to Privacy and Confidentiality.
The patient has the right to demand that all information, communication and records pertaining to his care be treated as confidential.
Is privacy a right or a privilege? ›
Privacy is a fundamental human right recognized in the UN Declaration of Human Rights, the International Convenant on Civil and Political Rights and in many other international and regional treaties. Privacy underpins human dignity and other key values such as freedom of association and freedom of speech.
Does HIPAA only apply to patients in private practice? ›
HIPAA does not protect all health information. Nor does it apply to every person who may see or use health information. HIPAA only applies to covered entities and their business associates.
HIPAA Exceptions Defined
To public health authorities to prevent or control disease, disability or injury. To foreign government agencies upon direction of a public health authority. To individuals who may be at risk of disease. To family or others caring for an individual, including notifying the public.
What information can be shared without violating HIPAA? ›
What information can be shared without violating HIPAA? All information can be shared without violating HIPAA provided it is shared for a permissible use or disclosure or the entity sharing the information has obtained a written authorization from the subject of the information.
What are some examples of violation of patient confidentiality? ›
Breach of this duty includes the following:
- Accessing confidential information, in any form, without a "need to know" to perform assigned duties. ...
- Assisting an unauthorized user to gain access to secured information.
- Leaving confidential information unattended in a non-secure area.
5 Most Common HIPAA Privacy Violations
- Losing Devices. ...
- Getting Hacked. ...
- Employees Dishonestly Accessing Files. ...
- Improper Filing and Disposing of Documents. ...
- Releasing Patient Information After the Authorization Period Expires.
Types and examples of invasion of privacy
- Misappropriating a person's name or likeness. This occurs when a business uses a person's name or image in marketing materials without consent. ...
- Intruding on someone's seclusion. ...
- Portraying someone in a false light. ...
- Publicly disclosing private facts.
Patients' Rights Charter
- Healthy and safe environment.
- Participation in decision-making.
- Access to health care.
- Knowledge of one's health.
- Insurance/medical aid scheme.
- Choice of health services.
- Treated by a named health care provider.
- Confidentiality and privacy.
The HIPAA Privacy Rule generally provides individuals with a legal, enforceable right to see and receive copies, upon request, of the information in their medical and other health records maintained by their healthcare providers and health plans.
What falls under the right to privacy? ›
Legally, the right of privacy is a basic law which includes: The right of persons to be free from unwarranted publicity. Unwarranted appropriation of one's personality. Publicizing one's private affairs without a legitimate public concern.
When can doctor-patient confidentiality be broken? ›
Exceptions to Doctor-Patient Confidentiality
A physician or other medical personnel is treating injuries that could prompt a criminal investigation (gunshot wounds, suspected child abuse, intoxication-related car accident injuries, etc.) The patient is a danger to themselves or others.
What are the limits of patient confidentiality? ›
What Constitutes a Breach of Confidentiality? A breach of confidentiality occurs when a patient's private information is disclosed to a third party without their consent. There are limited exceptions to this, including disclosures to state health officials and court orders requiring medical records to be produced.
4 ways of protecting patient privacy
- Build a security culture in your organization.
- Perform a security risk assessment.
- Create a PHI security improvement plan.
- Encrypt all patient data.
Those four types are 1) intrusion on a person's seclusion or solitude; 2) public disclosure of embarrassing private facts about a person; 3) publicity that places a person in a false light in the public eye; and 4) appropriation, for the defendant's advantage, of the person's name or likeness. 1.
Can someone share my personal information without my consent? ›
No. Organisations don't always need your consent to use your personal data. They can use it without consent if they have a valid reason. These reasons are known in the law as a 'lawful basis', and there are six lawful bases organisations can use.
Is Hipaa the same as Privacy Act? ›
The difference between HIPAA and the Privacy Act of 1974 is that HIPAA applies to both public and private Covered Entities (generally health plans, health care clearinghouses, and health care providers), while the Privacy Act of 1974 applies to all federal agencies regardless of function.
What is considered as a breach of privacy and confidentiality for patients? ›
Unauthorised collection, access, use or disclosure of personal information is regarded as a breach of the Privacy Act.
What is considered confidential patient information? ›
Essentially any information that is patient-identifiable, even the patient's address, is confidential and must be protected. Only when the patient has agreed may it be used or disclosed for specific purposes.
What is doctor patient confidentiality called? ›
Physician-patient privilege–also called doctor-patient privilege–is a protection that ensures the privacy and confidentiality of communications between a medical professional and their patient.
What are the 8 rights to privacy? ›
Under Chapter IV of the Act, there are eight (8) rights that belong to data subjects, namely: the right to be informed; the right to access; the right to object; the right to erasure and blocking; the right to rectify; the right to file a complaint; the right to damages; and the right to data portability.
What is the 14th Amendment right to privacy? ›
Extending the Right to Privacy
sexual conduct." Relying upon the Fourteenth Amendment's guarantee of due process, the Court held: "The petitioners are entitled to respect for their private lives. The State cannot demean their existence or control their destiny by making their private sexual conduct a crime.
What is the punishment for violation of right to privacy? ›
A violation of privacy is defined in Section 66-E as disregarding the privacy of a person by intentionally or knowingly taking, publishing, or broadcasting an image of his or her private areas without his/her consent. The punishment is up to 3 years of imprisonment or fine up to rupees two lakhs or both.
Examples of research using only RHI and thus not subject to HIPAA include: use of aggregated (non-individual) data; diagnostic tests from which results are not entered into the medical record and are not disclosed to the subject; and testing conducted without any PHI identifiers.
What is one exception to confidentiality? ›
Most of the mandatory exceptions to confidentiality are well known and understood. They include reporting child, elder and dependent adult abuse, and the so-called "duty to protect." However, there are other, lesserknown exceptions also required by law.
In which situation can PHI not be legally disclosed? ›
The major exception to the need for specific authorization for the release of PHI is that medical care providers may release information to other providers and entities who are participating in the patient's care, and to business that provide services for those providers.
What are the 5 specific reasons that private health information may be disclosed without written permission from a patient? ›
Exceptions Under the HIPAA Privacy Rule for Disclosure of PHI Without Patient Authorization
- Preventing a Serious and Imminent Threat. ...
- Treating the Patient. ...
- Ensuring Public Health and Safety. ...
- Notifying Family, Friends, and Others Involved in Care. ...
- Notifying Media and the Public.
The Three Exceptions to a HIPAA Breach
- Unintentional Acquisition, Access, or Use. ...
- Inadvertent Disclosure to an Authorized Person. ...
- Inability to Retain PHI.
The incident will need to be investigated, a HIPAA risk assessment may need to be performed, and a report of the breach may need to be sent to the Department of Health and Human Services' Office for Civil Rights (OCR) and the affected individual. You should explain that a mistake was made and what has happened.
What information can be disclosed without consent of the patient? ›
You may only disclose confidential information in the public interest without the patient's consent, or if consent has been withheld, where the benefits to an individual or society of disclosing outweigh the public and patient's interest in keeping the information confidential.
What kind of patient information can you share? ›
In all cases, the health care provider may share or discuss only the information that the person involved needs to know about the patient's care or payment for care.
Can you discuss patient without saying their name? ›
Is it a HIPAA violation to talk about a patient without saying their name? HIPAA violation: yes, because someone might still be able to identify that person hearing the information. Going down an elevator, physicians are always reminded not to discuss care even without patient identifiers.
What are five examples of breach of confidentiality? ›
Examples of Workplace Confidentiality Violations
- Disclosure of Employees' Personal Information. ...
- Client Information Is Obtained by Third Parties. ...
- Loss of Trust. ...
- Negative Impacts on Your Business. ...
- Civil Lawsuits. ...
- Criminal Charges.
Also, learn about the most common HIPAA violations here.
- Anthem, Inc. ...
- Memorial Healthcare System (MHS) - $5.5 Million Settlement for Internal PHI Breach. ...
- NY-Presbyterian Hospital / Columbia University Medical Center - $4.8 Million Fine for Data Leak. ...
- Advocate Health Care (AHC) - $5.55 Million Fine.
The most common patient confidentiality breaches fall into two categories: employee mistakes and unsecured access to PHI.
Does talking about a patient violate HIPAA? ›
Does talking about a patient violate HIPAA? Talking about a patient can violate HIPAA depending on who is doing the talking, who they are talking to, and whether the conversation relates to a patient´s individually identifiable health information.
What is an example of invasion of privacy in healthcare? ›
Examples of invasions of privacy regarding medical information may include: Sharing the results of a test in front of family members or other patients without your permission. Taking pictures of an undressed patient under anesthesia. Mentioning a patient's medical history in a document that is open to the public.
What are the 3 ethical issues with privacy? ›
Freedom from unauthorized access to private data. Inappropriate use of data. Accuracy and completeness when collecting data about a person or persons (corporations included) by technology. Availability of data content, and the data subject's legal right to access; ownership.
What are some of the main rules of privacy? ›
The Six Privacy Principles of the GDPR
- Lawfulness, Fairness, and Transparency.
- Limitations on Purposes of Collection, Processing, and Storage.
- Data Minimization.
- Accuracy of Data.
- Data Storage Limits.
- Integrity and Confidentiality.
Protecting patients involved in research from harm and preserving their rights is essential to ethical research. The primary justification for protecting personal privacy is to protect the interests of individuals.
What does the Privacy Act of 1974 allow patients to do? ›
It provides individuals with: the right to request their records, subject to Privacy Act exemptions; the right to request a change to their records that are not accurate, relevant, timely or complete; and.
How do you ensure privacy for your patients? ›
5 important ways to maintain patient confidentiality
- Create thorough policies and confidentiality agreements. ...
- Provide regular training. ...
- Make sure all information is stored on secure systems. ...
- No mobile phones. ...
- Think about printing.
7 Things to Look for in Privacy Policies
- How does it collect information? ...
- Who has access to your information? ...
- What are your options? ...
- What are the security measures of the site? ...
- How long will the site store your information? ...
- Does the policy contain contact details in case you have questions or concerns?
Your privacy statement should be clear, direct, and easy to understand. Keep technical jargon and legal terminology to a minimum. If you decide to modify how you use personal information, you must inform your users. A company's privacy policy is only as strong as the staff that implements it.
What should privacy policy include? ›
A privacy policy on a website is a statement explaining how you collect and use your web visitors' data. It should lay out what type of information you collect from users or visitors, your reasons for doing so, and what use you put it to. Your privacy policy should also explain the methods you use to collect data.
When can doctor patient confidentiality be broken? ›
Exceptions to Doctor-Patient Confidentiality
A physician or other medical personnel is treating injuries that could prompt a criminal investigation (gunshot wounds, suspected child abuse, intoxication-related car accident injuries, etc.) The patient is a danger to themselves or others.
How is your private information protected under the Privacy Act? ›
Under the Privacy Act's disclosure provision, agencies generally are prohibited from disclosing records by any means of communication – written, oral, electronic, or mechanical – without the written consent of the individual, subject to twelve exceptions.
What are the HIPAA guidelines for patient privacy? ›
With limited exceptions, the HIPAA Privacy Rule (the Privacy Rule) provides individuals with a legal, enforceable right to see and receive copies upon request of the information in their medical and other health records maintained by their health care providers and health plans.
