April 2024 update

Hello all, welcome to our latest monthly update.

1. Privacy Notices. An element of GDPR is that organisations must inform people they hold information on about how it is used. Key to doing this is having a comprehensive Privacy Notice that sets out the ways in which individuals personal information is processed. There are a number of templates that can be used and an internet search will also find a number of examples that you could use as a good starting point. In addition to medical records you should ensure that issues such as recording of telephone calls or CCTV images, which will be local to each Practice, are correctly recorded. We have seen some examples recently where patients have been asking for call recordings or CCTV images and so its very important that issues such as retention periods are considered and set out on the Privacy Notice. Finally please note that the Privacy Notice must be easy to access generally with a link from the bottom of the first page of your website.
2. ICO Registration. All organisations that process personal data must be registered with the Information Commissioners Office. You are reminded that this is an annual requirement so please check that you are compliant. Full details of the process are here.
3. Hold on Record Destruction. It has been noted that a number of staff at the ICB and NHS England have added a note to their signature blocks that says “Please note: there is a Legal Hold on the destruction of all records across NHSEI in compliance with ongoing inquiries. No records should be destroyed until further notice”. Be advised that this does not apply to the routine management of patient records across Primary Care.
4. Folder Access Rights and Permissions. N3i have started a large scale project to review all the access rights and permissions of users across our infrastructure. You will be contacted individually when your Practice is due for review and be provided with clear guidance about how to complete the required tasks.
5. Data Security & Protection Toolkit. A reminder that the annual DSPT assessment is due at the end of June. We will be hosting a webinar about it in early May.
6. Police introduce new forms for information sharing requests. An updated version of the National Police Chiefs Council information sharing request form was introduced on 12 April 2024 and will be rolled out by the police in the coming weeks. This is a standardised form which will be used by the police when requesting information from health and care organisations (except where there is a court order). We will be updating our own police guidance to reference the new form in due course.

Finally I have a favour to ask please. We’d like some of our practice staff to leave us a review on our new Practice Index page here, if you have any feedback to add about our service please click the green ‘add review’ button on the right hand side of the page.