Purposes for processing
NHS England is responsible for commissioning high quality primary care services for the population of England. NHS England’s commissioning policy is to move towards more place based, clinically led commissioning and is sharing or delegating commissioning of primary medical care services to Clinical Commissioning Groups (CCGs). NHS England retains responsibility for payment of GPs, Dentists and Opticians. NHS England and delegated CCGS also have responsibility for the assignment of unregistered patients to GP practices, and for the management of list transfers when practices close.
General Practice
GP Payments
NHS England is responsible for paying GP Practices for their services. GP practices are paid on the basis of the number of patients on their list. This is obtained from the registered patient list held by NHS Digital on behalf of NHS England. In addition to this GPs are paid for their performance under the Quality and Outcomes Framework (QOF). NHS Digital collects information under directions from NHS England about General Practice (GP) achievement under QOF. This information is used to calculate GP payments for the current financial year, and to set aspiration payments for the following year. NHS Digital run other QOF reporting collections throughout the year, not related to payment. The QOF data is extracted by NHS Digital from GP Practice systems. The data extracted is in the form of numbers for the QOF indicators and does not include personal data.
Disclosures of personal data to NHS England
NHS England may require access to personal data held by GP practices in circ*mstances described in the Confidentiality and Disclosure of Information: GMS, PMS and APMS Code of Practice. This is established under directions from the Secretary of State for Health. These circ*mstances are:
- Where NHS England is investigating and assuring the quality and provision of clinical care, for example in relation to a complaint.
- Where it is needed in relation to the management of the contract, for example where remedial action, or termination of the contract/agreement is being considered (e.g. because of poor record keeping)
- Where NHS England considers there is a serious risk to patient health or safety
- Investigation of potential fraud or any other potential criminal activity
Patient assignments and list transfers
The process from managing patient assignments is described in the Primary Medical Care Policy and Guidance Manual. NHS England or a CCG will receive the names, addresses and other personal details (not health information) of unregistered patients who have requested registration at a GP Practice. NHS England or a delegated CCG will receive the personal details of patients registered at a GP practice that has closed or is due to close in order to offer alternative registration.
Unregistered patients
NHS England is responsible for the manual records of patients who are not currently registered with a GP Practice, and the deceased. These records are held by Primary Care Support England on our behalf.
GP contracts
GP contracts are held in NHS England’s local offices. The contract includes the name of the contract holder(s).
Community Pharmacy
NHS England is responsible for putting arrangements in place so that drugs and appliances ordered on NHS prescriptions can be supplied to patients. These are known as ‘Pharmaceutical Services’ and are provided by pharmacy contractors (such as retail pharmacy outlets), dispensing appliance contractors, and dispensing doctors (collectively referred to as ‘contractors’ in this section of this privacy notice).
Pharmaceutical lists
In order to provide Pharmaceutical Services, pharmacy and dispensing appliance contractors must first be included in a list for their local area, called a pharmaceutical list, which is managed by NHS England. The management of pharmaceutical lists by NHS England is laid down in the National Health Service (Pharmaceutical and Local Pharmaceutical Services) Regulations 2013.
NHS England will receive personal data and process it as is necessary for the purposes of managing pharmaceutical lists in accordance with the Regulations. In particular, such personal data may:
- include details about contractors (including directors of a company or partners of a partnership), contractors’ staff, referees, applicants wishing to join the pharmaceutical list, and third parties making submissions on an application;
- be obtained from the individual to whom it relates (for example, an individual pharmacist applying to join a pharmaceutical list) or from a third party (for example, a company wishing to be included in a pharmaceutical list which provides details about its directors and superintendent pharmacist);
- be shared with third parties where appropriate (e.g. notification of decisions as required by the Regulations).
Certain individuals involved in providing Community Pharmacy services must submit information about their fitness to practise to NHS England, which may include special categories of personal data and data relating to criminal convictions and offences. This information may also be obtained from or shared with other organisations, such as the General Pharmaceutical Council (GPhC), in accordance with the Regulations. NHS England will use this information to consider whether a person is fit to practise and take action where there are concerns.
NHS England has a contract with Primary Care Support England (PCSE) to administer applications in relation to the pharmaceutical lists on behalf of NHS England.
Dispensing doctors
Dispensing doctors (GPs who may dispense drugs and appliances directly to patients where certain conditions are met) are included in a separate list managed by NHS England.
Patients may make an application to NHS England to request that their GP provide them with dispensing services. These applications contain the personal data of patients and may also include special categories of personal data. NHS England may obtain and process such personal data for the purposes of determining the application.
Local Pharmaceutical Services
Some contractors are locally commissioned to provide Local Pharmaceutical Services (LPS) and are included in separate lists managed by NHS England. NHS England may obtain and process personal data for the purposes of managing LPS contractors in a similar manner to that outlined above.
Payment for Community Pharmacy services
Contractors are paid for the number of prescriptions that they dispense. Each month they send their prescriptions to the NHS Business Services Authority (NHS BSA) who acts on behalf of the Department of Health and Social Care. These are sent either electronically or by courier for paper documents. A small number of prescriptions are shared with NHS England and other relevant organisations where this is necessary for the purposes of investigating possible prescription errors or fraud. These prescriptions contain the personal data of patients, including special categories of personal data.
Medicines Usage Reviews
This is a service usually provided in a pharmacy to help a patient use their medication more effectively. However, in some cases a pharmacy will need to seek permission from NHS England to provide this service by telephone or in a patient’s own home. This will require the pharmacy to share the patient’s name and address with NHS England.
Dentists
Payment of dentists
Dentists are paid by the NHS Business Services Authority (NHS BSA) acting for the Department of Health and Social Care. NHS England receives service activity figures, which do not include personal data, from NHS BSA for reconciliation and adjustment for under-payments.
Appeals
A patient may appeal to NHS England about any aspect of their dental care. For example, if a patient is assessed that he or she doesn’t meet criteria for a NHS funded specialist service. The appeal information includes personal details and specific details of clinical condition.
Contracts
Commissioning contracts for dentists are held in NHS England’s local offices, and these may identify the individual responsible for delivery.
Opticians
Payment to opticians
Opticians send payment forms to Primary Care Support England. These include patient name, address, date of birth, whether an eye test was done, and the voucher issued. PCSE produces a statement for each optician which is sent to NHS England for payment. These statements do not contain personal data relating to patients.
Annual checklist
NHS England’s local offices employ optometry advisors checking compliance of premises to delivery optical services. Compliance reports include the name of the practice owner.
Ophthalmic Post Payment Verification Process
Primary Care Support England provide NHS England with a report including name, date of birth and address of patients who have had a test, which is sent to the NHS England local office. The purpose of this is to identify ophthalmic contractor outliers and possible inappropriate claims for payment. Some payment forms and other data about the ophthalmic services you have received may be shared with NHS England and the NHS Business Services Authority where there is a need to investigate possible errors on the forms, payment errors or fraud.
Contracts
NHS England local offices hold contracts with opticians and information about applicants from new opticians. Application documents include correspondence, references, CVs, disclosure and barring checks and financial information.
Legal basis for processing
For GDPR purposes NHS England’s lawful basis for processing isArticle 6(1)(e) – ‘…exercise of official authority…’. For special categories (health) data the basis isArticle 9(2)(h) – ‘…health or social care…’.
