Privacy Notice

 

BACK TO MAIN INDEX

 

The Kent and Medway NHS and Social Care Partnership Trust keeps data on you relating to who you are, where you live, what you do, your family, possibly your friends, your employers, your habits, your problems and diagnoses, the reasons you seek help, your appointments, where you are seen and when you are seen, who by, referrals to and from specialists and other healthcare providers, tests carried out both here and in other places, investigations and scans, treatments and outcomes of treatments, your treatment history, the observations and opinions of other healthcare workers, within and without the NHS as well as comments and aide memoires reasonably made by healthcare professionals in this organisation who are appropriately involved in your health care. 

 

When registering for NHS care within KMPT, all patients who receive care are registered on a organisational database, which is held by KMPT and hosted by Servelec,, a third party company which has legal responsibilities to protect your information. This system is called OpenRiO

We work as a partnership organisation for mental health services and may need to share some clinical information with other groups of professionals involved in the provision of care. In order to enable us to do this safety and securely, KMPT have joined together with the Clinical Commissioning Groups, Hospital Trusts, Community Trusts and GP Practices based within the Kent and Medway area to commission the Kent and Medway Care Record. The system provided by Graphnet, brings together patient/clients information across health and social care organisations in a secure manner, giving a summary of your information from within a number of local records.

The Kent and Medway Care Record allows authorised workers in health and social care, easy access to your information that is critical to support decision-making about your care and treatment.

It shares important information about your health and care including:

  • Any current health or care issues
  • Your medications
  • Allergies you may have
  • Results of any recent tests that you may have had
  • Details on any plans created for your care or treatment
  • Information on any social care or carer support you may receive

The Kent and Medway Care Record pulls your information from several important areas of health and care including:

  • Primary care e.g. GP practices
  • Community services
  • Mental health services
  • Social care
  • Secondary care e.g. hospitals
  • Specialist services e.g. South East Ambulance services

Please be reassured, that only those with a legitimate need to access your information for direct care purposes will be able to. Every time someone accesses your record they will leave what we call an ‘audit trail’. These ‘audit trails’ are monitored regularly and if anyone is found to have accessed your record inappropriately, then disciplinary action will be taken.

You have the right to object to our sharing your data in these circumstances but we have an overriding responsibility to do what is in your best interests. Please see below.

We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.

1. Data Controller contact details Kent and Medway NHS and Social Care Partnership Trust Head Office, Farm Villa, Hermitage Lane, Maidstone, Kent, ME16 9PH
2. Data Protection Officer contact details Leanne McDougall
Head of Information Governance and Records Management, St Michaels House, St Michaels Road, Sittingbourne, Kent, ME10 3DW
3. Purpose of Processing We need to collect and record information about you in order to provide the right kind of services to meet your needs. Appropriate collection and sharing of information is an essential part of the provision of your safe and effective care. You could be put at risk if we do not have access to relevant, accurate and up to date information about you. 
4. Lawful basis for processing The processing (sharing) of Personal Data for these purposes is permitted under Articles 6(1) d and 6(1) (e) of the EU General Data Protection Regulation 2016/679 (GDPR) and UK Data Protection Act 2018 (DPA):
  • Vital Interest: processing is necessary in order to protect the vital interests of the data subject or of another natural person.
  • Public Task: the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The processing (sharing) of special categories of Personal Data via the Kent and Medway Care Record system is permitted under Article 9 (2) (h) and Article 10 of the GDPR and the UK Data Protection Act 2018 (DPA):
  • Direct Care and Administration: processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards
5. Recipient or categories of
recipients of the processed
data

Personal Data (including special category data) will only be shared between the health and social care organisations which have signed the Kent and Medway Care Record Joint Controller or Data Sharing Agreement, and authorised data processors for the purposes of providing health and social care. These currently include:

  • Dartford and Gravesham NHS Trust (D&G)
  • East Kent Hospitals University NHS Foundation Trust (EKHUFT)
  • Medway Maritime Hospital - Medway NHS Foundation Trust (MFT)
  • Maidstone and Tunbridge Wells NHS Trust (MTW)
  • Kent and Medway Partnership NHS and Social Care Partnership Trust (KMPT)
  • North East London Foundation Trust (NELFT)
  • Kent Community Health NHS Foundation Trust (KCHFT)
  • Virgin Care Services
  • Medway Community Healthcare (MCH)
  • General Practitioners
  • South East Coast Ambulance Service (SECAmb)
  • Integrated Care 24 (IC24)
  • Out of Hours providers (currently IC24, SECAmb and MCH)
  • Kent and Medway Clinical Commissioning Group (KMCCG)
  • Kent County Council (children and adults services) (KCC)
  • Medway Council (children and adults services) (MWC)

In the future it is likely that the Kent and Medway Care Record will be extended to a wider range of health and care providers.

This may include:

  • Other Providers of community health services
  • Community Pharmacies (Chemists)
  • Hospices.
6. Rights to object You also have the right to object of sharing Personal Data via KM Care Record (the right to object to processing). However, the NHS strongly recommends the sharing of data and real-world experience demonstrates that it leads to higher quality and safer care. An objection to sharing your information will mean that your data will not be shared for any kind of direct care, including extended hours GP access and emergencies. We ask you to think carefully before making this decision as sharing your health and social care information will make it easier for services to provide the best treatment and care for you. If you chose to object, we may still need to share data for your care, but it will be using less immediate methods such as email. For example, with KM Care Record, your GP can refer you to a hospital consultant who can then see all the data they may need, but if you are objecting they can only see what the GP has included within their email referral. If you do wish to object, you should therefore contact the clinician involved in your care, or the other organisations involved in your care and understand what it means for you. You may also contact KCHFT at kentchft.dataprotectionofficer@nhs.net If you choose to object: You may have to answer questions repeatedly because your full history may not be available to the care professional assessing you. Decisions about your care may take longer, even in emergency situations, as history needs to be confirmed. Some medical tests may get repeated unnecessarily e.g. if you had a blood test with your hospital consultant, your GP may not be able to see this.
7. Right to access and
correction		 To access your Personal Data you should contact the Kent Community Health NHS Foundation Trust (KCHFT) Legal team by emailing them at kcht.legal@nhs.net You have a right to see or obtain a copy of personal information that we hold about you in accordance with General Data Protection Regulation 2016/679 (GDPR), and the UK Data Protection Act 2018 (DPA). All requests for access to personal information must be submitted in writing. Please note proof of identity will be required for us to be able to assist you. If you believe that the data received in response to the request contains errors, you should contact the relevant KM Care Record partner’s Data Protection Officer (details of these will be provided to you with our response).
8. Retention Period As KM Care Record is used to share data contained within a local record the retention of data is set by individual providers who follow the NHS Records Management Code of Practice for Health and Social Care 2020.
9. Right to Complain  You can get further advice or report a concern directly to: In the first instance – the KCHFT Data Protection Officer (via email) at kentchft.dataprotectionofficer@nhs.net.
You also have the right to contact the UK’s data protection supervisory authority (Information Commissioner’s Office) by: Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone: 0303 123 1113 (local rate) or 01625 545745 (national rate)
Visit the ICO Website
Further information about the way in which the NHS uses personal information and your rights is published by NHS Digital: