Overview

GP Connect allows Merseycare Julie Ann to view relevant information from a service users GP record when they are receiving care away from their registered GP practice. This information is only accessed by authorised health and social care professional and only when needed to provide direct care.

From a privacy, confidentiality and data protection perspective, GP Connect provides a secure method for sharing, it reduces the need to use less secure or less efficient methods of transferring information, such as email or telephone and help ensure that information is shared safely and appropriately for direct care.

GP Connect Key Points

· GP Connect can only be used by Merseycare Julie Ann for direct care purposes.

· Individuals can opt out of their GP patient record being shared via GP Connect by contacting their GP practice and completing a type 1 opt- out form.

· Access to GP Connect is governed by role-based access control (RBAC) and organisational controls; only people who need to see the GP patient record for a service users direct care should be able to see it.

· As an authorised user of GP Connect Merseycare Julie Ann must comply with the National Data Sharing Arrangement (NDSA) and end-user agreement that sets out our responsibilities and obligations.

· All individuals who have access to the GP patient record using GP Connect must agree to terms and conditions of use.

· As a user of GP Connect Merseycare Julie Ann has demonstrated a robust compliance process and has maintained approval from NHS England, supported by evidence of strong cyber and data security measure as required under the NDSA.

GP Connect is for direct care use only*

GP Connect enables Merseycare Julie Ann to view relevant information from a service users GP record when it is needed for their direct care. It provides secure, read only access to information that may otherwise be difficult obtain promptly, for example, where different IT systems are used.

Information accessed through GP connect must only be used to support the individuals direct care and must not be shared or used for any secondary purposes.

To access GP patient records Merseycare Julie Ann must:

· Comply with all obligations and requirements set out in the National Data Sharing Agreement (NDSA) including any associated NHS England acceptance, assurance and governance requirements.

· Have a valid and up to date Data Security and Protection Toolkit (DSPT) submission.

· Have documented and verifiable consent from service users, obtained and managed in line with organisational policy. · Use only IT systems that have been assured by NHS England for GP Connect with full audit trail and logging capability.

· Have strict Role based access controls in place, ensuring only authorised personnel may access GP connect.

· Have a documented Standard Operating Procedure and supporting policies governing the use of GP connect.

· Ensure that all authorised users must adhere to the organisational policies, access conditions and acceptable use requirements relating to GP connect.

· Ensure that GP Connect is only be used for the direct care of the individual service user, any secondary uses are strictly prohibited.

NB: The use of GP Connect for indirect care or any purposes beyond direct care is strictly prohibited, except where information is shared for the statutory medical examiners use case.

Use of GP Connect

Examples of organisations that maybe permitted to view GP patient records through GP connect for the purpose of delivering direct care includes:

· GP surgeries that patients are not registered at – for example, if they need to see a doctor when they are away from home.

· Secondary care services, including hospitals, outpatient departments, acute setting if the service users need to attend A&E or are having an operation.

· GP hubs/primary care networks (PCNs)/integrated care systems (ICSs), partnerships between healthcare providers and local authorities · Assured Local ‘shared care’ record systems

· Ambulance trusts, including paramedics so they can view GP patient records in an emergency.

· Community Healthcare professionals such as community nurses.

· Acute and emergency care service providers

· NHS 111

· Pharmacies, where involved in the individuals direct care.

· Optometrist’s services

· Dentistry services

· Mental health trusts

· Hospices

· Medical examiners for the statutory purposes only · Adult and children’s social care providers using NHS assured digital social care record

· Care and nursing homes using assured solutions.

All access to GP patient records through GP Connect is recorded in an audit trail at the service users GP practice and within the Merseycare Julie Ann . These audit logs record

who accessed the record, when, and for what purpose, to ensure compliance with the National Data Sharing Arrangement and data-protection requirements.

Who uses GP Connect?

NHS England has developed a GP Connect Data Transparency Portal which provides information on the health and care settings that use GP Connect and the purpose for which each organisation uses a GP connect product.

As a registered user of GP Connect Merseycare Julie Ann has agreed to the terms and conditions of the GP connect products we are approved to use. “Products” refers to the specific GP Connect capabilities assured by NHS England, such as Access Record: HTML and Access Record: Structured.

Organisations that use GP Connect are described by NHS England as ‘providers’ and ‘consumers’, depending on the capacity in which they operate:

•  Provider – A GP practice that makes available GP patient records via the GP Connect service.
• Consumer – An organisation such as Merseycare Julie Ann that accesses the GP patients record made available by providers solely for the purpose of delivering direct care.

Legal basis for sharing using GP Connect

Accessing and processing personal data through GP Connect is undertaken solely for the purpose of delivering direct care to the service user. The following lawful bases under the UK GDPR and Data Protection laws apply, as set out in Merseycare Julie Ann GP Connect Policy:

Article 6 – Lawfulness of processing (personal data)

Processing of personal data for GP Connect may rely on the following legal bases:

• 6(1)(a) Consent
• 6(1)(b) processing is necessary for the performance of a contract such as with them for private clients and to fulfil our obligations to them.
• 6(1)(c) Legal obligation – Processing is necessary for compliance with a legal obligation (applicable in defined circumstances such as safeguarding or statutory requests).
• 6(1)(d) Vital interests – Processing is necessary to protect the vital interests of the data subject (used only in emergencies).
• 6(1)(f) processing is necessary for the purposes of the legitimate interests pursued by the controller – a legitimate interests assessment (LIA) for all new processing activities will need to be completed but this is not so different from a DPIA (see attached). This, consent and article 9(2)(h), I consider are your main day to day lawful reasons for processing.

Article 9 – Special category data (health information)

For processing health information and other special category data, the following legal bases apply:

• 9(2)(a) explicit consent given to processing for one or more specified purposes
• 9(2)(c) Vital Interests – Processing is necessary to protect the vital interests of the data subject where consent cannot be obtained.
• 9(2)(h) Health or Social Care Provision – Processing is necessary for the provision of health or social care.

Medical examiners use

As a provider of adult social care, Merseycare Julie Ann is legally required to provide medical examiners with relevant medical records relating to deceased individuals for the purposes of reviewing a death. Although UK GDPR does not apply to information about people who have died, the Common Law Duty of Confidentiality continues to apply, meaning information must still be handled lawfully and appropriately.

Medical examiners have a legal right to access the records of deceased persons under the Access to Health Records Act 1990, and providers have a statutory obligation to supply this information. In this context the usual duty of confidentiality is overridden by law.

This is the only permitted exception to the direct care only requirement under the National Data Sharing Arrangement (NDSA).

Confidentiality

Confidentiality and trust are fundamental to the relationship between individuals and the professional involved in their care. Information held within a GP patient record is confidential, and any access through GP Connect must take place only for the purpose of delivering direct care, in line with the National Data Sharing Agreement (NDSA).

GP Connect does not operate on implied consent alone, Instead, access must be based on a valid lawful basis under UK laws, and within Merseycare Julie Ann documented consent from the service users, as required by the organisational GP Connect policy.

Consent is not required when information is shared for a direct care purpose. If a patient does not want their information to be shared using GP Connect, they can opt out.

The NDSA requires that any information accessed for direct care must remain confidential and must not be used or disclosed for any secondary purposes, this includes the prohibition on activities such as training, quality improvement, analytics, performance management or any organisation or system level uses.

As a provider of adult social care and a GP Connect consumer Merseycare Julie Ann acts as a data controller. This places a legal responsibility on us to ensure that service users are fully informed about how their personal data including data accessed through GP Connect may be processed. Our transparency notices must be clear and explain this in a fair and accessible way.

Merseycare Julie Ann maintains the confidentiality of GP Connect information by ensuring that:

• Access to GP Connect is restricted by multi-factor authentication and role-based access controls (RBAC) – meaning only designated and authorised users can view GP patient records via GP Connect.
• Audit trails and access logs are maintained within both the GP practice and Merseycare Julie Ann , recording who accessed a record, when and for what purpose.
• GP Connect is accessed only through an NHS England approved digital social care system (Access Care Planning) which is an assured platform for GP Connect integration.
• All staff comply with the NDSA, the organisation’s GP Connect Policy, the Data Protection Act 2018, UK GDPR, and the Common Law Duty of Confidentiality.

Merseycare Julie Ann is responsible for ensuring that GP Connect data is handled Lawfully, securely, and confidentially at all times, any unauthorised access, inappropriate disclosure, or use of information for purpose outside direct care constitutes a breach of the NDSA and may result in serious disciplinary and regulatory consequences.

Data rights

Under UK Data Protection laws, Service users have rights regarding how their personal data is processed, When GP Connect is used, these rights apply to information accessed, Viewed or recorded by Merseycare Julie Ann , except where a lawful exemption applies, the following rights are relevant under the lawful bases applied in the GP Connect policy:

The right to be informed – Service users have the right to clear, accessible information about how their data is processed. This Requirement is met through Merseycare Julie Ann GP Connect privacy notice and transparency Notice, which explains how GP Connect may be used for the delivery of direct care.

The right to object – Because GP Connect processing is based on Public Tasks (Article 6(1)(e)) Service users may object to their GP record being accessed by refusing or withdrawing consent. Note: If a service user objects Merseycare Julie Ann cannot access GP Connect unless a statutory exception (e.g., Safeguarding, or vital interests)

applies. A Type 1 opt-out from must be completed and submitted to their GP Practice to formally object. A service users can refuse or withdraw consent directly to Merseycare Julie Ann without the type 1 opt-out form being submitted and Merseycare Julie Ann must follow this procedure as set out in the GP Connect policy.

The right of access – Service users have the right to obtain copies of personal data that Merseycare Julie Ann has recorded, including any information that was viewed through GP Connect and then documented in assessment, Care plans or records.

They also have the rights, including the rights:

• Why their data was accessed.
• What data was accessed.
• Which authorised users accessed it.
• The lawful basis under which it was processed.

GP practices retain responsibility for the GP patient record itself, therefore access to the GP record must be requested directly from the GP Practice.

The right to rectification – if information that Merseycare Julie Ann has recorded is found to be inaccurate, the service users may request correction, if an inaccuracy relates to the underlying GP patient record, the request must be made directly to the GP practice because GP Connect is read only and cannot be amended.

The right to restrict processing – Service users may request that processing is restricted for example:

• Whilst an objection is being considered.
• While rectification of inaccurate data pending.

If processing is restricted, GP Connect access must not occur, and the service users Opt-out status must be honoured.

Where Merseycare Julie Ann records information obtained via GP Connect in its own documentation, that information becomes part of the service user’s care record and falls under Merseycare Julie Ann ’s wider privacy rights obligations.

More information regarding data rights that has been shared or viewed can be found within Merseycare Julie Ann GP Connect privacy notice.

Including GP Connect in Data Protection impact assessments and Privacy notices.

Under UK Data Protection legislation, organisations must complete a Data Protection Impact Assessment (DPIA) when processing is likely to result in a high risk to individuals, this includes the processing of special category health data accessed through GP Connect. In line with the requirement, and as set out in Merseycare Julie Ann GP Connect policy, a DPIA has been completed for of GP Connect.

Merseycare Julie Ann ’s privacy notices have also been updated to explain how GP Connect may be used to access relevant GP information for the purposes of delivering direct care.

NHS England’s role as a data controller

NHS England acts as a controller for the messages that are transmitted through the GP Connect service. This means NHS England is responsible for ensuring information sent between provider (GP Practice) and Consumer systems (such as Merseycare Julie Ann is transferred securely, accurately and safely across NHS England infrastructure during transmission.

NHS England does not collect, store, or retain the content of GP Connect messages. They are responsible solely for the secure transport layer of the GP Connect service.

NHS England is not the controller of the content of the GP Patient record. GP Practices remain the data controllers of the GP patient record itself, as they determine the purposes and means of processing that data, when Merseycare Julie Ann accesses a GP record through GP Connect, this access occurs under the authority of the GP practice as the originating controller and under the terms of the National Data Sharing Agreement (NDSA).

NHS England therefore:

•  controls the infrastructure and the transfer mechanism,
• does not control the clinical content being accessed,
• and does not store or reuse GP record information.

The data controllers for GP Connect are:

•  GP practices – controllers of the GP patient record (the “provider”).
• Merseycare Julie Ann – controller of any information added to its own records after viewing GP Connect data (the “consumer”).
• NHS England – controller for the technical transport layer only, ensuring secure transmission.

This structure ensures that responsibilities for confidentiality, accuracy, and lawful processing remain clear and consistent with Data Protection law and the NDSA.

Opting out of GP Connect

Service users can choose not to have their GP information accessed through GP Connect. They may opt out in either of the following ways:

• By contacting their GP practice and completing the Type 1 Opt-Out process, which prevents their GP information from being shared via GP Connect.
• By informing MerseyCare Julie Ann directly—verbally or in writing—that they no longer consent to Merseycare Julie Ann accessing their GP record. When this happens, Merseycare Julie Ann must stop accessing GP Connect immediately and ensure the GP record is unlinked in our system.

Opting out does not affect the care a service user receives, but it does mean that Merseycare Julie Ann will not be able to view their GP record through GP Connect.

National Data Opt-out

The National Data Opt-out allows people to opt out of their confidential patient information being used for research and planning. This opt-out does not apply to GP Connect because GP Connect is used only for direct care.

Service users who do not want Merseycare Julie Ann to access their GP record through GP Connect should follow the GP Connect opt Out process described earlier in this.