PART 5DATA PROTECTION, RECORDS, INFORMATION, NOTIFICATIONS AND RIGHTS OF ENTRY
Interpretation
34.—(1) Subject to sub-paragraph (3), for the purposes of this Part—
(a)“electronic patient records” means records of the provider’s attendance on its patients created by way of data entries on a computer and electronically held and controlled by the provider;
(b)“patient records” means records of the provider’s attendance on and treatment of its patients by way of electronic patient records or on forms supplied by the Health Board to the provider;
(c)“practice data” means data about a provider’s practice and which may include any information or data about employees, sub-contractors, remuneration, finances, workloads, and contracts other than personal data within patient records; and
(d)the meaning of “data controller”, “personal data”, “processing” and “supervisory authority” is to be construed in accordance with the 1998 Act.
(2) The meaning of “data controller”, “data protection officer”, “personal data”, “processing” and “supervisory authority” is to be construed in accordance with the GDPR.
(3) Sub-paragraph (1)(d) ceases to have effect on 25th May 2018.
(4) No provision of this Part is to be construed as creating a duty, obligation or right which is contrary to any duty, obligation or right created by the 1998 Act and any directly applicable EU instrument relating to data protection.
(5) The Health Board and the provider, when processing any data under this Part, must comply with any relevant direction, or guidance issued by the Scottish Ministers.
(6) The Health Board and the provider must include within the agreement—
(a)terms which have the effect of the obligations mentioned in paragraph 35; and
(b)a term that requires the Health Board and the provider to act jointly as data controllers in relation to the processing of patient records.
Provider and Health Board Obligations
35.—(1) The provider must—
(a)take all reasonable steps to ensure the accuracy of patient records;
(b)verify the accuracy of any templates and notices provided to it by the Health Board in accordance with sub-paragraph (2)(b), and once verified, use such templates and notices;
(c)comply with the Health Board’s current policies concerning data security, personal data or IT security notified by the Health Board to the provider under sub-paragraph (2)(c);
(d)maintain a record of all of the provider’s processing activities carried out in performance of the agreement and make the records available to the Health Board on request;
(e)where the Health Board and the provider have not appointed a jointly designated data protection officer; the provider must nominate a person with responsibility for working together with the Health Board’s data protection officer in matters relating to the protection of personal data and the implementation of the Health Board’s guidance, templates and policies on such matters set out under paragraph (2)(b); and
(f)ensure that any person under its direction who has access to patient records has undergone adequate data protection training.
(2) The Health Board must—
(a)take all reasonable steps to confirm the accuracy of patient records provided to or accessed by it;
(b)provide to the provider, guidance, templates, and privacy notices, relating to the provider’s processing of personal data and the provider’s maintenance of a record in accordance with sub-paragraph (1)(d);
(c)notify the provider timeously of its current policies regarding data security, personal data security and IT security processes;
(d)maintain a record of its processing activities carried out in relation to a provider’s patient records;
(e)where the Health Board and provider agree, appoint a jointly designated data protection officer;
(f)ensure that any of its employees who have access to the provider’s patient records and practice data has undergone adequate data protection training; and
(g)make available appropriate data protection training to the provider and its employees.
Records
36.—(1) The provider must keep adequate patient records of its attendance on and treatment of its patients and must do so—
(a)on forms to be supplied to it for the purpose by the Health Board; or
(b)with the written consent of the Health Board, by way of electronic patient records; or
(c)in a combination of those two ways.
(2) The provider must include in patient records referred to in sub-paragraph (1), clinical reports sent in accordance with paragraph 6 of schedule 1 or from any other health care professional who has provided clinical services to a person on its list of patients.
(3) The consent of the Health Board required by sub-paragraph (1)(b) must not be withheld or withdrawn provided the Health Board is satisfied, and continues to be satisfied, that—
(a)the provider ensures that the computer system upon which the provider proposes to keep the electronic patient records is accredited by the Scottish Ministers or another person on their behalf as suitable for that purpose in accordance with a relevant standard issued by the Scottish Ministers;
(b)the security measures, audit and system management functions incorporated into the computer system as accredited in accordance with sub-paragraph (a) have been enabled; and
(c)the agreement signed by the provider contains an obligation requiring the provider to have regard to any guidelines issued by the Scottish Ministers and notified in writing, to the provider by the Health Board concerning good practice in the keeping of electronic patient records.
(4) Where a patient’s records are electronic patient records, the provider must, as soon as possible following a request from the Health Board, allow the Health Board to access the information recorded on the provider’s computer system by means of the audit function referred to in sub‑paragraph (3)(b) to the extent necessary for the Health Board to confirm that the audit function is enabled and functioning correctly.
(5) The provider must send the complete patient record relating to a person mentioned in sub-paragraph 5(a) or (b) to the Health Board—
(a)where a person on its list dies, before the end of the period of 14 days beginning with the date on which it was informed by the Health Board of the death, or (in any other case) before the end of the period of one month beginning with the date on which it learned of the death; or
(b)in any other case where the person is no longer registered with the provider, as soon as possible, at the request of the Health Board.
(6) To the extent that a patient’s records are electronic patient records, the provider complies with sub-paragraph (5) if it sends to the Health Board a copy of those records—
(a)in written form; or
(b)with the written consent of the Health Board, in any other form.
(7) The consent of the Health Board to the transmission of information other than in written form for the purposes of sub-paragraph (6)(b) must not be withheld or withdrawn provided it is satisfied, and continues to be satisfied, with—
(a)the provider’s proposals as to how the record will be transmitted;
(b)the provider’s proposals as to the format of the transmitted record;
(c)how the provider will ensure that the record received by the Health Board is identical to that transmitted; and
(d)how a written copy of the record can be produced by the Health Board.
(8) A provider with electronic patient records must not disable, or attempt to disable, either the security measures or the audit and system management functions referred to in sub‑paragraph (3)(b).
Processing and access of data
37.—(1) Subject to paragraphs (2) and (4), the provider must on the request of the Health Board—
(a)allow the Health Board to access practice data and patient records;
(b)produce or disclose practice data and data within patient records to the Health Board or to any person authorised in writing by the Health Board; and
(c)produce or disclose any other information to the Health Board which is reasonably required in connection with the Health Board’s functions.
(2) A request under sub-paragraph (1) must be made—
(a)after consideration of whether the relevant information could be so provided in compliance with the 1998 Act, and any directly applicable EU instrument relating to data protection;
(b)in accordance with directions given to the Health Board by the Scottish Ministers under section 2(5) of the Act that have been consulted upon by a body representative of general medical practitioners providing primary medical services in accordance with a general medical services contract or a section 17C arrangement; and
(c)for a purpose mentioned in sub-paragraph (3).
(3) The purposes mentioned in sub-paragraph (2)(c) are—
(a)medical diagnosis of or provision of healthcare to patients;
(b)the planning, including workforce planning, and management of health and social care services; or
(c)where information is reasonably required in connection with the agreement.
(4) The provider must produce any information relating to a request made in accordance with sub-paragraph (1)(b)—
(a)by such date as has been agreed as reasonable between the provider and the Health Board; or
(b)in the absence of such agreement, within 28 days of the request being made.
(5) In this paragraph—
(a)“access” includes access by way of any computerised system, information management & technology system or software; and
(b)“disclose” includes the provision of information by electronic means.
Confidentiality of personal data
38. The provider must nominate a person with responsibility for practices and procedures relating to the confidentiality of personal data held by it and also data protection generally.
GP IT Services
39.—(1) The Health Board will provide, maintain and where necessary, upgrade any integrated information management and technology systems used by the provider for provision of services under the agreement and any telecommunication links between these systems and the systems used by the Health Board, a Special Health Board, the Agency, or Healthcare Improvement Scotland, in accordance with any relevant guidance (including standards) issued from time to time by the Scottish Ministers.
(2) The Health Board and provider must take into account any relevant guidance issued by the Scottish Ministers for the purposes of this paragraph and this Part.
(3) On the expiry or termination of the agreement, the provider must immediately return to the Health Board any integrated information management and technology systems and telecommunication links purchased or provided by the Health Board for the purposes of this paragraph in its possession unless otherwise agreed between the Health Board and provider.
Patient online appointment services
40.—(1) A provider must provide its registered patients with—
(a)an optional online appointment service; and
(b)an optional online repeat prescription service; and
(c)an optional online repeat prescription information service,
in a manner which is capable of being electronically integrated with the computer systems of the provider’s practice and using appropriate systems authorised by the Health Board .
(2) The requirements in sub-paragraph (1) do not apply where the provider does not have access to computer systems and software which would enable it to provide the services listed in that sub-paragraph.
(3) If the provider provides an optional online appointment service, the provider must regularly consider whether it is desirable, in order to meet the reasonable needs of its registered patients, to increase the proportion of appointments which are made available to registered patients through that service and if it is so desirable, to increase the proportion of appointments accordingly
(4) If a provider provides any of the services referred to in sub-paragraph (1), the provider must promote that service to its registered patients—
(a)in practice leaflets in accordance with paragraph 11 of schedule 6; and
(b)if the provider has a website, on that website.
(5) In this paragraph—
(a)“online appointment service” means a facility which allows patients to book view, amend and cancel appointments online;
(b)“repeat prescription service” means a facility which allows patients to order repeat prescriptions for drugs, medicines or appliances online; and
(c)“online repeat prescription information service” means a facility which allows patients to view online, and print, a list of any drugs, medicines or appliances in respect of which the patient has a repeat prescription.
Practice leaflet
41. The provider must—
(a)compile a document (in this paragraph called a practice leaflet) which includes the information specified in schedule 6;
(b)review its practice leaflet at least once in every period of twelve months and make any amendments necessary to maintain its accuracy; and
(c)make available a copy of the leaflet, and any subsequent updates, to its patients and prospective patients.
Inquiries about prescriptions and referrals
42.—(1) The provider must, subject to sub-paragraphs (2) and (3), sufficiently answer any inquiries whether oral or in writing from the Health Board concerning—
(a)any prescription form issued by a prescriber;
(b)the considerations by reference to which prescribers issue such forms;
(c)the referral, by or on behalf of the provider, of any patient to any other services provided under the Act; or
(d)the considerations by which the provider makes such referrals or provides for them to be made on its behalf.
(2) An inquiry referred to in sub-paragraph (1) may only be made for the purpose either of obtaining information to assist the Health Board to discharge its functions or of assisting the provider in the discharge of its obligations under the agreement.
(3) The provider will not be obliged to answer any inquiry referred to in sub-paragraph (1) unless it is made—
(a)in the case of sub-paragraph (1)(a) or (1)(b), by an appropriately qualified health care professional;
(b)in the case of sub-paragraph (1)(c) or (1)(d), by an appropriately qualified medical practitioner,
appointed in either case by the Health Board to assist the Board in the exercise of its functions under this paragraph and that person produces, on request, written evidence that the person is authorised by the Health Board to make such an inquiry on its behalf.
Provision of information to a medical officer etc
43.—(1) The provider must, if satisfied that the patient has given explicit consents—
(a)supply in writing to any person specified in sub-paragraph (3), within such reasonable period as that person may specify, such clinical information as any of the persons mentioned in sub-paragraph (3)(a) to (d) considers relevant about a patient to whom the provider or a person acting on behalf of the provider has issued or has refused to issue a medical certificate; and
(b)answer any inquiries by any person mentioned in sub-paragraph (3) about—
(i)a prescription form or medical certificate issued or created by, or on behalf of, the provider; or
(ii)any statement which the provider or a person acting on behalf of that provider has made in a report.
(2) For the purposes of being satisfied that a patient has given explicit consent, a provider may rely on an assurance in writing from any person mentioned in sub-paragraph (3) that the explicit consent of the patient has been obtained, unless the provider has reason to believe that the patient does not consent.
(3) For the purposes of sub-paragraph (1) and (2), the persons are—
(a)a medical officer;
(b)a nursing officer;
(c)an occupational therapist;
(d)a physiotherapist; or
(e)an officer of the Department for Work and Pensions who is acting on behalf of, and at the direction of, any person specified in sub-paragraphs (a) to (d).
(4) In this paragraph—
(a)“medical officer” means a medical practitioner who is—
(i)employed or engaged by the Department for Work and Pensions; or
(ii)provided by an organisation under a contract entered into with the Secretary of State for Work and Pensions;
(b)“nursing officer” means a health care professional who is registered on the Nursing and Midwifery Register and—
(i)employed or engaged by the Department for Work and Pensions; or
(ii)provided by an organisation under a contract entered into with the Secretary of State for Work and Pensions;
(c)“occupational therapist” means a health care professional who is registered in the part of the register maintained by the Health Professions Council under article 5 of the Health and Social Work Professions Order 2001(1) relating to occupational therapists and—
(i)employed or engaged by the Department for Work and Pensions; or
(ii)provided by an organisation under a contract entered into with the Secretary of State for Work and Pensions; and
(d)“physiotherapist” means a health care professional who is registered in the part of the register maintained by the Health Professions Council under article 5 of the Health and Social Work Professions Order 2001 relating to physiotherapists and—
(i)employed or engaged by the Department for Work and Pensions; or
(ii)provided by an organisation under a contract entered into with the Secretary of State for Work and Pensions.
Annual return and review
44.—(1) The provider must submit an annual return relating to the agreement to the Health Board.
(2) One such return may be requested by the Health Board at any time during each financial year in relation to such period (not including any period covered by a previous annual return) as may be specified in the request.
(3) The provider must submit the completed return to the Health Board—
(a)by such date as has been agreed as reasonable between the provider and the Health Board; or
(b)in the absence of such agreement, within 28 days of the request being made.
(4) Without prejudice to the generality of sub-paragraph (1)—
(a)in the case of agreements entered into on or after 22nd December 2010, the provider must include in the annual return a statement confirming that the provider meets the conditions of section 17CA(3) and (4) of the Act(2); and
(b)in all cases the provider must include in the annual return a statement confirming that any sub-contractor satisfies the requirements of paragraph 33(3)(e), and such details as the Health Board considers appropriate.
(5) Following receipt of the return referred to in sub-paragraph (1), the Health Board must arrange with the provider an annual review of its performance in relation to the agreement.
(6) Either the provider or the Health Board may, it if wishes to do so, invite the area medical committee for the area of the Health Board to participate in the annual review.
(7) The Health Board must prepare a draft record of the review referred to in sub-paragraph (2) for comment by the provider and, having regard to such comments, must produce a final written record of the review.
(8) A copy of the final record referred to in sub-paragraph (7) must be sent to the provider.
(9) In this paragraph, “financial year” means a period of twelve months ending with 31st March.
Notifications to the Health Board
45. In addition to any requirements of notification elsewhere in these Regulations, the provider must notify the Health Board in writing, as soon as reasonably practicable, of—
(a)any serious incident that in the reasonable opinion of the provider affects or is likely to affect the provider’s performance of its obligations under the agreement;
(b)any circumstances which give rise to the Health Board’s right to terminate the agreement under paragraph 68, 69 and 70;
(c)any appointments system which it proposes to operate and the proposed discontinuance of any such system;
(d)where the provider has a provider’s list of patients, any change of which it is aware in the address of a registered patient; and
(e)the death of any patient of which it is aware.
Notifications to the Health Board
46. The provider must, unless it is impracticable for it to do so, notify the Health Board in writing within 28 days of any occurrence requiring a change in the information about it published by the Health Board in accordance with regulations made under section 2C(3) of the Act (functions of Health Boards: primary medical services)(3).
Notice provisions specific to agreements with one or more companies limited by shares
47.—(1) This paragraph applies to agreements entered into prior to 22nd December 2010.
(2) Where a company limited by shares is a party to the agreement, the provider must give notice to the Health Board forthwith when—
(a)any share in the company is transmitted or transferred (whether legally or beneficially) to another person on a date after the agreement has come into force;
(b)a new director or secretary is appointed;
(c)the company passes a resolution or a court of competent jurisdiction makes an order that one or more of those companies be wound up;
(d)circumstances arise which might entitle a creditor or a court to appoint a receiver, administrator or administrative receiver for the company;
(e)circumstances arise which would enable the court to make a winding up order in respect of the company; or
(f)the company is unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986(4).
(3) A notice under sub-paragraph (2)(a) must confirm that the new shareholder, or, as the case may be, the personal representative of a deceased shareholder—
(a)where the company is a qualifying body, within the meaning of section 17D(2)(5) of the Act, is a person falling within section 17D(1)(a) to (d) of the Act as in force at 21st December 2010 (persons with whom agreements may be made); and
(b)satisfies the condition imposed on shareholders by virtue of regulation 4 (general conditions relating to providers).
(4) A notice under sub-paragraph (1)(b) must confirm that the new director or, as the case may be, secretary meets the conditions imposed on directors and secretaries by virtue of regulation 4.
Notice provisions specific to an agreement with one or more companies
48.—(1) This paragraph applies to agreements entered into on or after 22nd December 2010.
(2) Where a company is a party to the agreement, the provider must give notice in writing to the Health Board forthwith when—
(a)a member, director or secretary of the company ceases to be a member, director or secretary of the company or informs the other members of the company that that person intends to cease to be a member, director or secretary of the company, and the date upon which he or she ceased, or will cease, to be a member, director or secretary of the company;
(b)a new member, director or secretary becomes a member, director or secretary of the company;
(c)the company passes a resolution or a court of competent jurisdiction makes an order that the company be wound up;
(d)circumstances arise which might entitle a creditor or a court to appoint a receiver, administrator or administrative receiver for the company;
(e)circumstances arise which would enable the court to make a winding up order in respect of the company; or
(f)the company is unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986.
(3) A notice under sub-paragraph (2)(b) must—
(a)state the date the new member, director or secretary became a member, director or secretary of the company;
(b)confirm that the new member is an individual who satisfies the conditions imposed on members by virtue of section 17CA(3) and (4) of the Act(6) and the conditions imposed by regulations 4 and 5; and
(c)confirm that the new director or, as the case may be, secretary satisfies the conditions imposed on directors and secretaries by virtue of regulation 4.
Notice provisions specific to an agreement with one or more partnerships
49.—(1) Where a partnership is party to the agreement, the provider must give notice to the Health Board without delay—
(a)when a partner leaves or informs the other members of the partnership of which they are a member, that the partner intends to leave the partnership, and the notice must state the date upon which the partner left or will leave the partnership;
(b)when a new partner joins a partnership.
(2) A notice under sub-paragraph (1)(b) must—
(a)state the date that the new partner joined the partnership;
(b)in the case of an agreement entered into prior to 22nd December 2010—
(i)confirm that the new partner satisfies the conditions imposed by regulation 3 of the 2004 Regulations (general conditions relating to providers) as in force at 21st December 2010; and
(ii)state whether the new partner is a general or a limited partner;
(c)in the case of an agreement entered into on or after 22nd December 2010—
(i)confirm that the new partner is an individual who satisfies the conditions imposed on members by virtue of section 17CA(3) and (4) of the Act; and
(ii)satisfies the conditions imposed by regulations 4 and 5; and
(d)state whether the new partner is a general or a limited partner.
Notice provisions specific to an agreement with persons practising with one or more limited liability partnership
50.—(1) Where a limited liability partnership is party to the agreement, the provider must give notice to the Health Board without delay—
(a)when a member ceases to be a member, or informs the other members of the limited liability partnership that the member intends to cease to be a member, of the limited liability partnership, and the notice must state the date upon which the member ceased, or will cease, to be a member of the limited liability partnership;
(b)when a new member joins the limited liability partnership.
(2) A notice under sub-paragraph (1)(b) must—
(a)state the date that the new member joined the limited liability partnership; and
(b)confirm that the new member is an individual who satisfies the conditions imposed on members by virtue of section 17CA(3) and (4) of the Act and the conditions imposed by regulations 4 and 5.
Notification of deaths
51.—(1) The provider must report, in writing, to the Health Board, the death on the provider’s practice premises of any patient no later than the end of the first working day after the date on which the death occurred.
(2) The report must include—
(a)the patient’s full name;
(b)the patient’s National Health Service number where known;
(c)the date and place of death;
(d)a brief description of the circumstances, as known, surrounding the death;
(e)the name of any medical practitioner or other person treating the patient whilst on the practice premises; and
(f)the name, where known, of any other person who was present at the time of the death.
(3) The provider must send a copy of the report referred to in sub-paragraph (1) to any other Health Board in whose area the deceased was resident at the time of the patient’s death.
Notifications to patients following variation of the agreement
52. Where the agreement is varied in accordance with Part 8 of this schedule and, as a result of that variation—
(a)there is to be a change in the range of services provided to the provider’s patients; or
(b)where the provider has a provider’s list of patients, patients who are on that list are to be removed from that list,
the Health Board must notify those patients in writing of the variation and its effect and inform them of the steps they can take to obtain elsewhere the services in question or, as the case may be, register elsewhere for the provision of essential services (or their equivalent).
Entry and inspection by the Health Board
53.—(1) Subject to the conditions in sub-paragraph (2), the provider must allow persons authorised in writing by the Health Board to enter and inspect the practice premises at any reasonable time.
(2) The conditions referred to in sub-paragraph (1) are that—
(a)reasonable notice of the intended entry has been given;
(b)written evidence of the authority of the person seeking entry is produced to the provider on request; and
(c)entry is not made to any premises or part of the premises used as residential accommodation without the consent of the resident.
(3) Either the provider or the Health Board may, if it wishes to do so, invite the area medical committee for the area of the Board to be present at an inspection of the practice premises which takes place under this paragraph.
S.I. 2002/254 which was relevantly amended by S.I. 2009/1182. The title of this Order is the Health and Social Work Professions Order 2001 in accordance with section 213(4) of the Health and Social Care Act 2012 c.7.
Section 17CA(3) and (4) were inserted by section 38 of the Tobacco and Primary Medical Services (Scotland) Act 2010 (asp 3).
Section 2C was inserted into the Act by section 1(2) of the 2004 Act.
Section 17D was inserted by section 21 of the National Health Service (Primary Care) Act 1997 (c.46), and relevantly amended by section 2(3) of the 2004 Act, paragraph 6 of schedule 2(2) of the Tobacco and Primary Care Act 2010 (asp 3) and S.S.I. 2006/30.
Section 17CA was inserted into the Act by section 38 of the Tobacco and Medical Services (Scotland) Act 2010 (asp 3).