Data Protection and Patient Privacy Policy – Patient Information

Indigo Medical employs more than 40 staff and operates from three sites:

Indigo House, 2-8 Oxford Road, St Helier, Jersey JE1 4HB

Little Grove Clinic, La Rue de Haut, St Lawrence, Jersey JE3 1JZ

Leodis Surgery, La Route des Quennevais, St Brelade, Jersey JE3 8LL

Our Practice is registered with the Jersey Office of the Information Commissioner (JOIC) to process personal and special category information under the Data Protection (Jersey) Law 2018 and our registration number is 68565.

Our clinical and administration team caring for you will need to collect and maintain information about your health, treatment and care so that you can be given the best possible healthcare from us.

This personal information may be held in a variety of formats, including paper records, electronically on computer systems, in pictures, and video or audio files.

Any personal information we hold about you is processed for the purposes of ‘Employment and Social Fields’ (Article 8) ‘Medical Purposes’ (Article 15) and ‘Public Health’ (Article 16) of the Data Protection (Jersey) Law 2018.

Personal information about you is collected in a number of ways. This can be from registration forms, referral details from our clinical or administration team, other third party healthcare providers or hospitals, directly from you or your authorised representative.

We will likely hold the following basic personal information about you: 

• name, former names and preferred names 
• address
• telephone number
• email address
• bank account details (where charges apply)
• social security number and other unique identifiers
• date of birth
• non-binary or gender expression
• medical history and diagnoses
• observation charts and test results
• next of kin information
• correspondence and communication, via email, telephone calls and letters
• family, lifestyle and social circumstance or safeguarding status
• physical or mental health condition
• racial or ethnic origin
• religious or other beliefs of a similar nature
• sexual life

It is important for us to have a complete picture of you as this will assist staff to deliver appropriate treatment and care plans in accordance with your needs.

Your records are used to directly, manage and deliver healthcare to you to ensure that:

• the staff involved in your care have accurate and up to date information to assess and advise on the most appropriate care for you.
• staff have the information they need to be able to assess and improve the quality and type of care you receive.
• appropriate information is available if you see another healthcare professional, or are referred to a specialist or Health and Community Services, or other health provider in Jersey, UK or elsewhere.

The personal information we collect about you may also be used to:

• Remind you about your appointments and send you relevant correspondence
• Review the care we provide to ensure it is of the highest standard and quality, e.g. through audit or service improvement
• Refer you to a secondary care provider, such as Health and Community Services
• Request tests and receive results from external testing providers, such as HCS Pathology and Radiology
• Support the funding of your care, e.g. with commissioning organisations;
• Prepare statistics on Primary Care performance to meet the needs of the population or for Health and Community Services and or other regulatory bodies, such as the Jersey Care Commission;
• Help to train and educate healthcare professionals;
• Report and investigate complaints, claims and untoward incidents, in collaboration with the Primary Care Governance Team and Responsible Officer;
• Report events to the appropriate authorities, such as the GMC, when we are required to do so by code of practice, or by law;
• Contact you with regards to patient satisfaction surveys relating to services you have used within our organisation so as to further improve our services to patients
• Where possible, we will always look to anonymise/pseudonymise your personal information so as to protect patient confidentiality, unless there is a legal basis that permits us to use it. and we will only use/share the minimum information necessary.

The manner in which Primary Care use and share health and social care data is informed by the Caldicott Principles, a framework for determining ethical and appropriate processing. 

When making decisions about how and why we use and share data, we consider whether:

• the purpose of the processing can be justified; is the requirement clearly defined and documented?
• it is necessary to use the data: do we need to identify individuals?
• we are using the minimum necessary information to fulfil the purpose 
• do the people processing the data ‘need to know’? 
• everyone involved is aware of their responsibilities and obligations
• the processing of the data complies with relevant privacy legislation
• the duty to share for care and treatment is as important as the duty to protect patient confidentiality 
• we are adequately informing patients about how their data is used and the reasons why

More information about the Caldicott Principles can be found here

We may share relevant personal and special category information with other health and social care organisations and external organisations. For example, we may share your information for healthcare purposes with Health and Community Services (HCS), Customer and Local Services (CLS), and Children. Young People, Education and Skills (CYPES), , NHS UK, the Out of Hours Service (JDOC), other general practitioners (GPs), ambulance services, private consultants, or external secondary or tertiary care  providers, etc. 

Health and Community Services

Information is shared regularly with Health and Community Services and other Government departments in order to deliver services and collaboratively care and treat islanders, for example:

• We refer patients to secondary services where we believe you will benefit from further investigation and care, including mental health services and specialists, such as orthopaedic or the diabetes centre.
• We request services and receive results from HCS in relation to pathology and radiology testing and imaging in order to review your needs and determine further treatment, where necessary 
• We receive discharge summaries and responses to referrals in order that we are aware of interaction between services and can deliver good outcomes to patients. This includes primary care receiving medicine discharge records following admissions so that safe medication regimes can be maintained across service providers. 
• We are provided with vaccination and test events so that we can maintain a record of illness and your immunisations and to ensure that you are appropriately protected from illness. This includes the sharing of Covid test and Covid-19 and seasonal flu data with us.
• We provide to HCS Safeguarding Teams information in order to ensure that they can adequately deliver care to vulnerable people in the community.
• We provide a view of limited data to acute services in HCS, in the form of the Summary Care Record:

The Summary Care Record 

• In acute areas of HCS, such as hospital pharmacy and the Emergency Department, healthcare professionals have access to the GP Summary Care Record. This provides a limited view of primary care interaction, medicine administration and demographic, as well as known allergies held within your primary care record. 
• The purpose of this share is to ensure that healthcare professionals are able to make decisions based on a holistic view of the patient and improve outcomes. It reduces significantly delays to care due to manual information sharing processes, such as telephone calls and reduces the risks associated with medicine administration across numerous providers.
  
• We provide data to HCS in order to help administer vaccination and screening programmes, more details about which can be found below:

Use of your information for screening programme purposes 

• Screening is a way of finding out if people have a higher chance of having a health problem, so that early treatment can be offered or information given to help them make informed decisions.
• HCS will contact you directly should you be eligible for screening programmes. 
• We will use automated data processing in the form of data extraction tools and coded searches to identify individuals who are eligible for screening tests and referrals. 
• We will provide information to HCS so that they can accurately identify those that are diagnosed with diabetes. This enables us to contact individuals directly to offer tests to identify diabetic retinopathy, which can cause sight loss if not detected early. 
• In all cases, you will have the ability to opt out of programmes when contacted by the HCS screening teams. However, as we consider screening a vital element of preventative healthcare, HCS reserves the right to contact you again after a period of time in order to secure your participation. You may also contact the programmes directly should you change your mind.   

Use of your information for immunisation or preventative programme purposes

• Immunisations, such as the Covid-19 vaccination programme, are often delivered in phases, ensuring that those most vulnerable to the effect of diseases are offered the opportunity to protect themselves as a priority. Eligibility is often determined based on diagnoses, conditions, or age and as such, it is vital that the most accurate and up to data sets are used. 
• Where required, HCS request demographic data from us based on the eligibility criteria. The data shared is limited to the demographic details of the patient, and does not state the reason for their eligibility. For example, HCS may ask for data relating to those that have a particular type of cancer, have received radiotherapy in the last 6 months, or have a severe liver condition. We provide the names and contact details but not the specific reason as to why the individual is eligible.
• The data is shared securely to those that are administering the programme, and used only for that purpose. Individuals are under no obligation to opt-in to a vaccination or preventative programme.

Digital Health

The 2017 Digital Health Strategy outlined collaborative strategies that would be implemented in order to improve the effectiveness of data sharing and improve the outcomes for patients. 

HCS and the Primary Care Body are currently working with other government departments and care providers to deliver the Jersey Health Demographic Service and the Jersey Care Record. 

In discovery phase currently, both projects will see data shared to those that ‘need to know’ in order to deliver platforms and databases designed to support your care and treatment. More information about how your data will be processed and shared for these purposes will be found here, once completed.

Other data sharing

We will not disclose any health information to third parties who are not enabling care and treatment, without your explicit consent, unless there are circumstances, such as when the health or safety of others is at risk or where current legislation permits or requires it. 

There are occasions where the Practice may be required by law to share information provided to us with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud. 

This includes, but is not limited to, disclosure under a court order, sharing with the Jersey Primary Care Governance Team for inspection purposes i.e. to support the role of the Responsible Officer, the police for the prevention or detection of crime or where there is an overriding public interest to prevent abuse or serious harm to others and other public bodies (e.g. Customer and Local Services for the misuse of public funds in order to prevent and detect fraud).

Transferring information to countries within the European Economic Area (EEA) is seen as relatively safe because these countries have strong data protection laws in place. There is a list of countries outside of the EEA that are also deemed safe. If we need to transfer your information outside of the EEA or to a country which is not on the list of safe countries, we will take extra steps to keep your information safe.

The Practice is required to protect your personal information, and inform you of how your personal information will be used. 

Your personal information is held in both paper and electronic forms for specified periods of time as set out in the Information Government Alliance Records Management Code of Practice for Health and Social Care. Whilst this is UK legislation for NHS Providers, it is used in Jersey as a ‘Best Practice Solution’ in the void of our own similar procedures. 

We hold and process your information in accordance with the Data Protection (Jersey) Law 2018 and where appropriate the General Data Protection Regulation. In addition, everyone working for our Practice must comply with the Contractual Duty of Confidentiality and various national and professional standards and requirements.

We have a duty to:

• maintain full and accurate records of the care we provide to you;
• keep records about you confidential and secure;
• provide information in a format that is accessible to you.

Some services in the Practice provide the option to communicate with patients via email, SMS text or other electronic communications. Please be aware that the Practice cannot guarantee the security of this information whilst in transit, and by requesting this service you are accepting this risk.

If we need to use your personal information for any reasons beyond those stated above, we will discuss this with you and ask for your explicit consent. The Data Protection (Jersey) Law 2018 gives you certain rights, including the right to:

Right to Access

Request access to the personal data we hold about you, e.g. in health records. The way in which you can access your own health records is further explained in our “patient access to medical records policy and request form” which is on our website.

Right to Accuracy 

Request the correction of inaccurate or incomplete information recorded in our health records, subject to certain safeguards.

Right to Restrict

You have the right to request that we restrict the processing of your personal information. You can exercise this right in instances where you believe the information being processed is inaccurate, out of date, or there are no legitimate grounds for the processing. We will always seek to comply with your request but we may be required to continue to process your information in order to comply with a legal requirement, to deliver medical care, and fulfil the function of social services and social care.

Right to Withdraw Consent

Where you have been asked to give your consent to process your information, you have the right to withdraw your consent to the further processing of your personal data. However, this may cause delays or prevent us delivering a service to you. We will always seek to comply with your request but we may be required to hold or process your information in order to comply with a legal requirement, to deliver medical care and treatment, and fulfil the function of social services and social care.

Under the Data Protection (Jersey) Law 2018, we are authorised to process data for the purposes of ‘Employment and Social Fields’ (Article 8) ‘Medical Purposes’ (Article 15) and ‘Public Health’ (Article 16). 

Your consent will only be required if we intend to share your health records beyond these purposes, as explained above (e.g. research). Any consent form you will be asked to sign will give you the option to ‘refuse’ consent and will explain how you can ‘withdraw’ any given consent at a later time. The consent form will also warn you about the possible consequences of such refusal/withdrawal.

Right to Portability

You can request your personal information to be transferred to other providers.

Right to Object 

You have the right to object to us processing your data, preventing us from using it. However, this right applies only when we are processing your data for a task carried out in the public interest, an exercise of official authority, our legitimate interests, scientific research or for statistical purposes or for direct marketing purposes.  

Right to Complain 

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter and respond to you accordingly where appropriate.

Who is the Data Protection Officer?

Please Contact:

Sarah Peppin – Practice Manager       

indigomedical@indigo.gpnet.je 

Indigo Medical

Indigo House, 2-8 Oxford Road, St Helier, Jersey JE1 4HB

01534 730541

How to contact the Jersey Office of the Information Commissioner

The Jersey Office of the Information Commissioner (JOIC) is the body that regulates the Practice under Data Protection legislation. If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the JOIC at:

Jersey Office of the Information Commissioner

2nd Floor

5 Castle Street

St Helier

JE2 3BT

Email: Email: Enquiries@jerseyoic.org  

Telephone: 01534 716530

If you decide at any time and for whatever reason to transfer to another practice we will transfer your medical records to your new doctor on receipt of your signed consent from your new doctor.

We hope this information has explained any issues that might arise. If you have any questions please speak to your doctor, any member of the administration team or alternatively ask to speak to the Practice Manager.