The National Health Service (General Medical Services Contracts) (Scotland) Regulations 2018

PART 5 DATA PROTECTION, RECORDS, INFORMATION, NOTIFICATIONS AND RIGHTS OF ENTRY

Interpretation – general

63.—(1) For the purposes of this Part—

“electronic patient records” means records of the contractor’s attendance on its patients created by way of data entries on a computer and electronically held and controlled by the contractor;

“patient records” means records of the contractor’s attendance on and treatment of its patients created by way of electronic patient records or on forms supplied by the Health Board to the contractor;

“practice data” means data about a contractor’s practice and which may include any information or data about employees, sub-contractors, remuneration, finances, workloads, and contracts other than personal data within patient records.

(2) No provision of this Part is to be construed as creating a duty, obligation or right which is contrary to any duty, obligation or right created by the 1998 Act(1) or any directly applicable EU instrument relating to data protection.

Meaning of data controller etc.

64.—(1) The meaning of “data controller”, “personal data”, “processing” and “supervisory authority” is to be construed in accordance with the 1998 Act.

(2) The meaning of “data controller”, “data protection officer”, “personal data”, “processing” and “supervisory authority” is to be construed in accordance with the GDPR(2).

(3) Sub-paragraph (1) ceases to have effect on 25th May 2018.

Roles, responsibilities and obligations – general

65.—(1) The Health Board and the contractor, when processing any data under this Part, must comply with any relevant direction, or guidance issued by the Scottish Ministers.

(2) The Health Board and the contractor must include within the contract—

(a) terms which have the effect of the obligations mentioned in paragraphs 65 and 66; and

(b) a term that requires the Health Board and the contractor to act jointly as data controllers in relation to the processing of patient records.

Contractor’s obligations – records etc.

66.  The contractor must—

(a) take all reasonable steps to ensure the accuracy of patient records;

(b) verify the accuracy of any templates and notices provided to it by the Health Board in accordance with paragraph 67(b), and once verified, use such templates and notices;

(c) comply with the Health Board’s current policies concerning data security, personal data or IT security notified by the Health Board to the contractor under paragraph 67(c);

(d) maintain a record of all of the contractor’s processing activities carried out in performance of the contract and make the records available to the Health Board on request; and

(e) ensure that any person under its direction who has access to patient records has undergone adequate data protection training.

Health Board Obligations – records etc.

67.  The Health Board must—

(a) take all reasonable steps to confirm the accuracy of patient records provided to or accessed by it;

(b) provide to the contractor, guidance, templates, and privacy notices, relating to the contractor’s processing of personal data and the contractor’s maintenance of a record in accordance with sub-paragraph 66(d);

(c) notify the contractor timeously of its current policies regarding data security, personal data security and IT security processes;

(d) maintain a record of its processing activities carried out in relation to a contractor’s patient records;

(e) ensure that any of its employees who have access to the contractor’s patient records and practice data has undergone adequate data protection training; and

(f) make available appropriate data protection training to the contractor and its employees.

Records

68.—(1) The contractor must keep adequate patient records of its attendance on and treatment of its patients and must do so—

(a) on forms to be supplied to it for that purpose by the Health Board;

(b) with the written consent of the Health Board, by way of electronic patient records; or

(c) in a combination of those two ways.

(2) The contractor must include in patient records referred to in sub-paragraph (1) clinical reports sent in accordance with paragraph 6 of schedule 6 or from any other health care professional who has provided clinical services to a person on its list of patients.

(3) The consent of the Health Board required by sub-paragraph (1)(b) must not be withheld or withdrawn provided the Health Board is satisfied, and continues to be satisfied, that—

(a) the contractor ensures that the computer system upon which the contractor proposes to keep the electronic patient records is accredited by the Scottish Ministers or another person on their behalf as suitable for that purpose in accordance with a relevant standard issued by the Scottish Ministers;

(b) the security measures, audit and system management functions incorporated into the computer system as accredited in accordance with sub-paragraph (a) have been enabled; and

(c) the contract signed by the contractor contains an obligation requiring the contractor to have regard to any guidelines concerning good practice in the keeping of electronic patient records issued by the Scottish Ministers and notified in writing to the contractor by the Health Board.

(4) Where a patient’s records are electronic patient records, the contractor must, as soon as possible following a request from the Health Board, allow the Health Board to access the information recorded on the contractor’s computer system by means of the audit function referred to in sub‑paragraph (3)(b), to the extent necessary for the Board to confirm that the audit function is enabled and functioning correctly.

(5) The contractor must send the complete patient record relating to a person mentioned in this sub-paragraph to the Health Board—

(a) where a person on its list dies, before the end of a period of 14 days beginning with the date on which it was informed by the Health Board of the death, or (in any other case) before the end of the period of one month beginning with the date on which it learned of the death; or

(b) in any other case where the person is no longer registered with the contractor, as soon as possible, at the request of the Health Board.

(6) To the extent that a patient’s records are electronic patient records, the contractor complies with sub-paragraph (5) if it sends to the Health Board a copy of those records—

(a) in written form; or

(b) with the written consent of the Health Board, in any other form.

(7) The consent of the Health Board to the transmission of information other than in written form for the purposes of sub-paragraph (6)(b) shall not be withheld or withdrawn provided the Health Board is satisfied, and continues to be satisfied, with—

(a) the contractor’s proposals as to how the record will be transmitted;

(b) the contractor’s proposals as to the format of the transmitted record;

(c) how the contractor will ensure that the record received by the Health Board is identical to that transmitted; and

(d) how a written copy of the record can be produced by the Health Board.

(8) A contractor with electronic patient records must not disable, or attempt to disable, either the security measures or the audit and system management functions referred to in sub‑paragraph (3)(b).

Processing and access of data

69.—(1) Subject to paragraphs (2) and (4), the contractor must, on the request of the Health Board—

(a) allow the Health Board to access practice data and patient records;

(b) produce or disclose practice data and data within patient records to the Health Board or to any person authorised in writing by the Health Board; and

(c) produce or disclose any other information to the Health Board which is reasonably required in connection with the Health Board’s functions.

(2) A request under sub-paragraph (1) must be made—

(a) after consideration of whether the relevant information could be so provided in compliance with the 1998 Act, and any directly applicable EU instrument relating to data protection;

(b) in accordance with directions given to the Health Board by the Scottish Ministers under section 2(5) of the Act that have been consulted upon by a body representative of general medical practitioners providing primary medical services in accordance with a general medical services contract or a section 17C arrangement; and

(c) for a purpose mentioned in sub-paragraph (3).

(3) The purposes mentioned in sub-paragraph (2)(c) are—

(a) medical diagnosis of or provision of healthcare to patients;

(b) the planning, including workforce planning, and management of health and social care services; or

(c) where information is reasonably required in connection with the contract.

(4) The contractor must produce any information relating to a request made in accordance with sub-paragraph (1)(b)—

(a) by such date as has been agreed as reasonable between the contractor and the Health Board; or

(b) in the absence of such agreement, within 28 days of the request being made.

(5) In this paragraph—

(a) “access” includes access by way of any computerised system, integrated information management and technology system or software; and

(b) “disclose” includes the provision of information by electronic means.

Data protection officer

70.—(1) The Health Board must appoint a jointly designated data protection officer where it has agreed to do so with the contractor.

(2) Where a jointly designated data protection officer mentioned in sub-paragraph (1) has not been appointed, the contractor must nominate a person with responsibility for working together with the Health Board’s data protection officer in matters relating to the protection of personal data and the implementation of the Health Board’s guidance, templates and policies on such matters set out under paragraph 67(b).

GP IT Services

71.—(1) The Health Board will provide, maintain and where necessary, upgrade any integrated information management and technology systems used by the contractor for provision of services under the contract and any telecommunication links between these systems and the systems used by the Health Board, a Special Health Board, the Agency, or Healthcare Improvement Scotland, in accordance with any relevant guidance (including standards) issued from time to time by the Scottish Ministers.

(2) The Health Board and contractor must take into account any relevant guidance issued by the Scottish Ministers for the purposes of this paragraph and this Part.

(3) On the expiry or termination of the contract, the contractor must immediately return to the Health Board any integrated information management and technology systems and telecommunication links purchased or provided by the Health Board for the purposes of this paragraph in its possession unless otherwise agreed between the Health Board and contractor.

Patient online appointment services

72.—(1) A contractor must provide its registered patients with—

(a) an optional online appointment service;

(b) an optional online repeat prescription service; and

(c) an optional online repeat prescription information service,

in a manner which is capable of being electronically integrated with the computer systems of the contractor’s practice and using appropriate systems authorised by the Health Board.

(2) The requirements in sub-paragraph (1) do not apply where the contractor does not have access to computer systems and software which would enable it to provide the services listed in that sub-paragraph.

(3) If the contractor provides an optional online appointment service, the contractor must regularly consider whether it is desirable, in order to meet the reasonable needs of its registered patients, to increase the proportion of appointments which are made available to registered patients through that service and if it is so desirable, to increase the proportion of appointments accordingly.

(4) If a contractor provides any of the services referred to in sub-paragraph (1), the contractor must promote that service to its registered patients—

(a) in practice leaflets in accordance with paragraph 11 of schedule 8; and

(b) if the contactor has a website, on that website.

(5) In this paragraph—

(a) “online appointment service” means a facility which allows patients to book view, amend and cancel appointments online;

(b) “repeat prescription service” means a facility which allows patients to order repeat prescriptions for drugs, medicines or appliances online; and

(c) “online repeat prescription information service” means a facility which allows patients to view online, and print, a list of any drugs, medicines or appliances in respect of which the patient has a repeat prescription.

Confidentiality of personal data

73.  The contractor must nominate a person with responsibility for practices and procedures relating to the confidentiality of personal data held by it and also data protection generally.

Practice leaflet

74.  The contractor must—

(a) compile a document (in this paragraph called a practice leaflet) which includes the information specified in schedule 8;

(b) review its practice leaflet at least once in every period of twelve months and make any amendments necessary to maintain its accuracy; and

(c) make available a copy of the leaflet, and any subsequent updates, to its patients and prospective patients.

Inquiries about prescriptions and referrals

75.—(1) The contractor must, subject to sub-paragraphs (2) and (3), sufficiently answer any inquires whether oral or in writing from the Health Board concerning—

(a) any prescription form issued by a prescriber;

(b) the considerations by reference to which prescribers issue such forms;

(c) the referral by or on behalf of the contractor of any patient to any other services provided under the Act; or

(d) the considerations by which the contractor makes such referrals or provides for them to be made on its behalf.

(2) An inquiry referred to in sub-paragraph (1) may only be made for the purpose either of obtaining information to assist the Health Board to discharge its functions or of assisting the contractor in the discharge of its obligations under the contract.

(3) The contractor is not obliged to answer any inquiry referred to in sub-paragraph (1) unless it is made—

(a) in the case of sub-paragraph (1)(a) or (b), by an appropriately qualified health care professional;

(b) in the case of sub-paragraph (1)(c) or (d), by an appropriately qualified medical practitioner,

appointed in either case by the Health Board to assist the Board in the exercise of its functions under this paragraph and that person produces, on request, written evidence that the person is authorised by the Health Board to make such an inquiry on its behalf.

Provision of information to a medical officer etc

76.—(1) The contractor is to, if it is satisfied that the patient has given explicit consent—

(a) supply in writing to any person specified in sub-paragraph (3), within such reasonable period as that person may specify, such clinical information as any of the persons mentioned in sub-paragraph (3)(a) to (d) considers relevant about a patient to whom the contractor or a person acting on behalf of the contractor has issued or has refused to issue a medical certificate; and

(b) answer any inquiries by any person mentioned in sub-paragraph (3) about—

(i) a prescription form or medical certificate issued or created by, or on behalf of, the contractor; or

(ii) any statement which the contractor or a person acting on behalf of that contractor has made in a report.

(2) For the purposes of being satisfied that a patient has given explicit consent, a contractor may rely on an assurance in writing from any person mentioned to sub-paragraph (3) that the explicit consent of the patient has been obtained, unless the contractor has reason to believe that the patient does not consent.

(3) For the purposes of sub-paragraphs (1) and (2), the persons are—

(a) a medical officer;

(b) a nursing officer;

(c) an occupational therapist;

(d) a physiotherapist; or

(e) an officer of the Department for Work and Pensions who is acting on behalf of, and at the direction of, any person specified in paragraphs (a) to (d).

(4) In this paragraph—

(a) “medical officer” means a medical practitioner who is—

(i) employed or engaged by the Department for Work and Pensions; or

(ii) provided by an organisation under a contract entered into with the Secretary of State for Work and Pensions;

(b) “nursing officer” means a health care professional who is registered on the Nursing and Midwifery Register and—

(i) employed or engaged by the Department for Work and Pensions; or

(ii) provided by an organisation under a contract entered into with the Secretary of State for Work and Pensions;

(c) “occupational therapist” means a health care professional who is registered in the part of the register maintained by the Health Professions Council under article 5 of the Health and Social Work Professions Order 2001(3) relating to occupational therapists and—

(i) employed or engaged by the Department for Work and Pensions; or

(ii) provided by an organisation under a contract entered into with the Secretary of State for Work and Pensions; and

(d) “physiotherapist” means a health care professional who is registered in the part of the register maintained by the Health Professions Council under article 5 of the Health and Social Work Professions Order 2001 relating to physiotherapists and—

(i) employed or engaged by the Department for Work and Pensions; or

(ii) provided by an organisation under a contract entered into with the Secretary of State for Work and Pensions.

Annual return and review

77.—(1) The contractor must submit an annual return relating to the contract to the Health Board which requires the same categories of information from all persons who hold contracts with that Board.

(2) One such return may be requested by the Health Board at any time during each financial year in relation to such period (not including any period covered by a previous annual return) as may be specified in the request.

(3) The contractor must submit the completed return to the Health Board—

(a) by such date as has been agreed as reasonable between the contractor and the Health Board; or

(b) in the absence of such agreement, within 28 days of the request being made.

(4) Without prejudice to the generality of sub-paragraph (1), the contractor must include in the annual return a statement confirming—

(a) that the contractor satisfies the requirements of regulations 10 and 11;

(b) that neither the contractor nor any member or shareholder of the contractor falls within sub-paragraph 103(2);

(c) the details specified in sub-paragraph (5);

(d) that any sub-contractor satisfies the requirements of paragraph 62(3)(e); and,

(e) any further details as the Health Board considers appropriate.

(5) The contractor must provide details of each partner, member, shareholder, or medical practitioner (if the contractor is that medical practitioner), who falls within regulation 11(2)(a) or (b) (“a relevant individual”) confirming for each relevant individual whether—

(a) they satisfy—

(i) the requirement to have sufficient involvement in patient care under regulation 11(1), and if so whether they fall within regulation 11(2)(a), (3) or (4); or

(ii) the requirements in regulation 11(8);

(b) they comply with regulation 10;

(c) they fall within paragraph 103(2); and

(d) they are a medical practitioner.

(6) Following receipt of the return referred to in sub-paragraph (1), the Health Board must arrange with the contractor an annual review of its performance in relation to the contract.

(7) Either the contractor or the Health Board may, if it wishes to do so, invite the area medical committee for the area of the Health Board to participate in the annual review.

(8) The Health Board must prepare a draft record of the review referred to in sub-paragraph (2) for comment by the contractor and, having regard to such comments, must produce a final written record of the review.

(9) A copy of the final record referred to in sub-paragraph (8) must be sent to the contractor.

(10) In this paragraph, “financial year” means the twelve months ending with 31st March.

Notifications to the Health Board

78.  In addition to any requirements of notification elsewhere in the Regulations, the contractor must notify the Health Board in writing as soon as reasonably practicable, of—

(a) any serious incident that, in the reasonable opinion of the contractor, affects or is likely to affect the contractor’s performance of its obligations under the contract;

(b) any circumstances which give rise to the Health Board’s right to terminate the contract under paragraph 101,102 or 103(1);

(c) any appointments system which it proposes to operate and the proposed discontinuance of any such system;

(d) any change of which it is aware in the address of a registered patient; and

(e) the death of any patient of which it is aware.

Notifications to the Health Board

79.  The contractor must, unless it is impracticable for it to do so, notify the Health Board in writing within 28 days of any occurrence requiring a change in the information about it published by the Health Board in accordance with regulations made under section 2C(3) of the Act (Function of Health Boards: primary medical services)(4).

Notifications to the Health Board

80.  The contractor must notify the Health Board in writing of any person other than a registered patient or a person whom it has accepted as a temporary resident to whom it has provided the essential services described in regulation 18(6) or (8) within the period of 28 days beginning on the day that the services were provided.

Notice provisions specific to a contract with a company

81.—(1) A contractor which is a company must give notice in writing to the Health Board without delay when—

(a) any share in the contractor is transmitted or transferred (including legally or beneficially) to another person on a date after the contract has come into force, if the contractor’s contract was entered into prior to 22nd December 2010;

(b) a member of the company ceases to be a member of the company or informs the other members of the company that that person intends to cease to be a member of the company, (and the notice must state the date upon which they ceased, or will cease, to be a member, of the company), if the contractor’s contract was entered into on or after 22nd December 2010;

(c) a person becomes a member of the company, if the contractor’s contract was entered into on or after 22nd December 2010;

(d) a, director or secretary of the company ceases to be a director or secretary of the company or informs the company that that person intends to cease to be a director or secretary of the company, and the notice must state the date upon which they ceased, or will cease, to be a director or secretary of the company;

(e) a new director or secretary becomes a director or secretary of the company;

(f) the company passes a resolution or a court of competent jurisdiction makes an order that the contractor be wound up;

(g) circumstances arise which might entitle a creditor or a court to appoint a receiver, administrator or administrative receiver for the contractor;

(h) circumstances arise which would enable the court to make a winding up order in respect of the contractor; or

(i) the contractor is unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986(5).

(2) A notice under sub-paragraph (1)(a) or (c) must—

(a) confirm that the new member, shareholder, or, as the case may be, the personal representative of a deceased shareholder—

(i) satisfies the conditions specified in regulation 11(1) or (9);

(ii) meets the further conditions in regulation 10; and

(iii) does not fall within paragraph 103(2); and

(b) state the date the new member or shareholder became a member or shareholder of the company.

(3) A notice under sub-paragraph (1)(e) must—

(a) state the date the new director or secretary became a director or secretary of the company; and

(b) confirm that the new director or, as the case may be, secretary does not fall within paragraph 103(2).

Notice provisions specific to a contract with persons practising in partnership

82.—(1) A contractor which is a partnership must give notice in writing to the Health Board without delay when—

(a) a partner leaves or informs the other members of the partnership that the partner intends to leave the partnership; or

(b) a new partner joins the partnership.

(2) A notice under sub-paragraph (1)(a) must state the date upon which the partner left or will leave the partnership.

(3) A notice under sub-paragraph (1)(b) must—

(a) state the date that the new partner joined the partnership;

(b) confirm that the new partner satisfies the conditions specified in regulations 10 and 11(1) or (8) and does not fall within paragraph 103(2); and

(c) state whether the new partner is a general or a limited partner.

Notice provisions specific to a contract with persons practising in a limited liability partnership

83.—(1) A contractor which is a limited liability partnership must give notice in writing to the Health Board without delay when—

(a) a member ceases to be a member, or informs the other members of the partnership that the member intends to cease to be a member of the partnership; or

(b) a new member joins the partnership.

(2) A notice under sub-paragraph (1)(a) must state the date upon which the member ceased, or will cease, to be a member of the partnership.

(3) A notice under sub-paragraph (1)(b) must—

(a) state the date that the new member joined the limited liability partnership; and

(b) confirm that the new member satisfies the conditions specified in regulations 10 and 11(1) or (8) and does not fall within paragraph 103(2).

Notification of deaths

84.—(1) The contractor must report, in writing, to the Health Board, the death on its practice premises of any patient no later than the end of the first working day after the date on which the death occurred.

(2) The report must include—

(a) the patient’s full name;

(b) the patient’s National Health Service number where known;

(c) the date and place of death;

(d) a brief description of the circumstances, as known, surrounding the death;

(e) the name of any medical practitioner or other person treating the patient whilst on the practice premises; and

(f) the name, where known, of any other person who was present at the time of the death.

(3) The contractor must send a copy of the report referred to in sub-paragraph (1) to any other Health Board in whose area the deceased was resident at the time of the patient’s death.

Notifications to patients following variation of the contract

85.  Where the contract is varied in accordance with Part 8 of this schedule and, as a result of that variation—

(a) there is to be a change in the range of services provided to the contractor’s registered patients; or

(b) patients who are on the contractor’s list of patients are to be removed from that list,

the Health Board must notify those patients in writing of the variation and its effect and inform them of the steps they can take to obtain elsewhere the services in question or, as the case may be, register elsewhere for the provision of essential services (or their equivalent).

Entry and inspection by the Health Board

86.—(1) Subject to the conditions in sub-paragraph (2), the contractor must allow persons authorised in writing by the Health Board to enter and inspect the practice premises at any reasonable time.

(2) The conditions referred to in sub-paragraph (1) are that—

(a) reasonable notice of the intended entry has been given;

(b) written evidence of the authority of the person seeking entry is produced to the contractor on request; and

(c) entry is not made to any premises or part of the premises used as residential accommodation without the consent of the resident.

(3) Either the contractor or the Health Board may, if it wishes to do so, invite the area medical committee for the area of the Board to be present at an inspection of the practice premises which takes place under this paragraph.

(1)

1998 c.29.

(2)

OJ L 119, 4.5.2016, p.1-88.

(3)

S.I. 2002/254, as retitled by section 213(6) of the Health and Social Care Act 2012 (c.7). Article 5 was amended by S.I. 2009/1182. The title of this Order is the Health and Social Work Profession Order 2002 but it is cited as the Health and Social Work Profession Order 2001 in accordance with section 213(4) of the Health and Social care Act 2012 c.7.

(4)

Section 2C was inserted into the Act by section 1(2) of the Primary Medical Services (Scotland) Act 2004 (asp 1).

(5)

1986 c.45.