< Back to policies & procedures

Digitisation of paper medical records - Privacy notice

 

Policy

The NHS Long Term plan published in 2019 requires the digitisation of all primary care paper medical records, commonly known as ‘Lloyd George’ records or ‘A4 medical records’.

Having paper based medical records restricts the use of technology to provide ‘joined up’ services. The current paper records will therefore be transferred to a digital format and then destroyed. This will involve the current patient paper medical records being scanned and then entered directly into a patient’s electronic medical record. 

Paxton Green Group Practice will be the Data Controller responsible for this process.

NEC Software Solutions UK Limited, whose security standards have been approved by NHS South East London Integrated Care Board (SEL ICB), will be the Data Processor responsible for the scanning and subsequent destruction of the paper medical records. 
Optum (formerly EMIS) will be the Data Processor responsible for uploading the digitised medical records into the clinical system (EMIS Web). 

As the Data Controller, the Practice is required by Data Protection legislation to provide Patients with the following information about how their information is handled.

Processing

Data Controller contact details Practice Manager
Paxton Green Group Practice,
Paxton Green Health Centre,
1 Alleyn Park,
London,
SE21 8AU
020 8670 6878
Data Protection Officer contact details John Eni-Uwubame,
GP Data Protection Officer,
NHS South East London
160 Tooley Street
London
SE1 2TZ
GPDPO@selondonics.nhs.uk
Purpose of the processing Transferring the current paper medical records into patients’ electronic medical records and then destruction of paper medical records.
Lawful basis for processing

The following provisions of the General Data Protection Regulation/Data Protection Act (2018) permit the digitisation of the existing paper medical records:

Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller…’’

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…
 
Consent Medical records, detailing treatment and advice given to patients, are held by the practice to enable the provision of a comprehensive health and care service. Consent is not required for this, nor is consent required to transfer paper medical records into a digitised format. 
Recipient or categories
of recipients of the
processed data		 The paper patient records will be shared with NEC, who will scan and digitise them before they are destroyed. The digitised medical records will then be uploaded by Optum into the EMIS Web clinical system. Patients may be able to view their digitised paper records through services such as the NHS App, if they have the appropriate level of online access.
Right to access and correction Patients have the right to access their medical record and have any errors or mistakes corrected. Any concerns should be made in writing (or by email) addressed to the Practice Manager.
Retention Period

GP medical records will be kept in accordance with the law and national guidance. Information on how long records can be kept can be found within the NHS Records Management Code of Practice. 

After written instructions have been issued by the Practice, NEC Software Solutions UK Limited will destroy the paper medical records, 90 days after they are transferred to an electronic format.
 

If you have any questions about this project, please contact the Practice Manager.

Please note that information about your rights covered by Data Protection legislation and the complaints procedure is detailed in the Practice’s Main Privacy Notice.

Details of Supplier:

NEC Software Solutions UK Limited
BizSpace, 1st Floor, iMex Centre
575-599 Maxted Road
Hemel Hempstead
HP2 7DX