We have had several queries from practices around NHS111 asking practices to sign Data sharing agreements. We believe the issue is that NHS 111 is wanting full access to patient HCR via GP connect. Until we can understand the lawful nature of this and have further discussions with NHSD we would like the following information cascaded to Practices:
As you are aware under the 2019/20 GP contract, practices are obliged to make available 1 appointment per 3,000 patients per day for NHS 111 to book directly into practice appointments. This is provided that the functionality and governance exist. We have been informed that practices have been sent DSAs by NHS 111 providers to enable direct booking. Our understanding is that a DSA is not necessary for the purposes of assigning an appointment only as it does not require access to the patient’s medical record and NHS 111 appointment booking contract agreement is not an agreement for NHS 111 to access medical records. Furthermore, DSA is not required when one independent data controller (in this situation, NHS 111) is sharing personal data with another independent data controller (ie the GP practice). This also reflects usual practice in the health service when data are continuously shared between primary and secondary care for direct care purposes, such as referrals, without the requirement for a DSA. We have raised our concerns on a national level and once we have further clarity will share this with practices.
The LMC would add that practices must, of course, continue to comply with the data protection principle of transparency (amongst others). This includes maintaining up to date privacy notices to inform patients of new sharing arrangements. All practices are advised to seek the guidance of their DPO on this issue.