22   Coronavirus Pandemic – Data Protection

The ICO recognises the unprecedented challenges the NHS and other health professionals faced during the Coronavirus (COVID-19) pandemic, and in response, the health and social care system took action to manage and mitigate the spread and impact of the virus. As part of this response, a Control of Patient Information Notice (COPI Notice) was issued. Under this notice, it was agreed that GP Connect should be enabled across all GP practices to share patient data nationally for direct care purposes. There was also a change to policy for Summary Care Record Additional Information to be made available by default, unless the patient had previously informed the NHS they did not wish their information to be shared. These changes made improved patient safety and were received positively by both patients and healthcare professionals.

The COPI Notice was the simplest and quickest way to communicate the changes during a time of national crisis, and this notice was renewed on 1^st November 2022 to help support General Practice in the event of increasing COVID infection cases during the winter months. Organisations are only required to process such confidential patient information where the confidential patient information to be processed is required for a COVID-19 purpose and will be processed solely for that COVID-19 purpose in accordance with Regulation 7 of COPI. The current active COPI notice expires on 30^th April 2023.

However, the legal basis under which GP Connect and Summary Care Record Additional Information operated was not affected by COPI and remains in place; Article 6(1)(e) and Article 9(2)(h) of the UK GDPR (General Data Protection Regulation). For Common Law Duty of Confidentiality, implied consent with opt out is used.

Patients who have previously opted-out of sharing their data via GP Connect, having a Summary Care record, or declined to provide consent to share their Additional Information will have their preference respected and applied as part of any policy change. Patients can also express a consent preference for their Summary Care Record and may change their mind at any time.

Please be assured that these services are used for direct patient care, provided by health and social care staff working in care teams, which may include doctors, nurses, and a wide range of staff of professional registers including social workers. Care teams may also contain members of staff who are not registered with a regulatory body but may need to access a proportion of this data to provide care safely. In such circumstances where you tell us you’re experiencing Covid-19 symptoms we may need to collect specific health data about you.  Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards. 

If you are concerned about how your information is being used, please contact our DPO using the contact details provided in this Privacy Notice.

We may amend this section of the privacy notice at any time if there are further updates to the COPI notice and NHS response to COVID-19 cases. The date at the bottom of this section will be amended each time this notice is updated.

This Privacy Notice was last updated 29/11/2022 by the Data Protection Officer Liberty Apted ALMC liberty@almc.co.uk