Off-Site Storage of Paper Medical Records – Privacy Notice
To enable practices to utilize vacated space to meet increasing clinical needs Oxfordshire CCG has commissioned a Records Storage and Management Service which entails the off-site storage of medical records.
The solution includes, for example, the secure handling, scanning, transportation, storage and retrieval of documents.
Restore Records Management, the supplier awarded the contract, provides an enhanced safe and secure full end-to-end document management solution for the scanning and storage of documents that are sensitive in nature. The supplier has been vetted and complies with a range of accreditations including but not limited to ISO 9001 and ISO 2700.
We are required by Data Protection law to provide you with the following information about how we handle your information.
|
Data Controller contact details
|
28@Northgate - Senior Partner |
|
Data Protection Officer contact details
|
Emile Douilhet, Oxfordshire CCG. |
|
Purpose of the processing
|
Through the use of a records management system, which involves the use of indexing (based on personal data fields) and barcodes, archived records can be located at point of request and either scanned and uploaded to the supplier’s portal or transferred securely back to the practice. The service therefore relies on the sharing of data to enable effective indexing and the subsequent tracking and management of records etc.
|
|
Lawful basis for processing
|
The following provisions of the General Data Protection Regulation permit us to digitise paper medical records and utilize an off-site storage solution to hold paper medical records:
Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller...’’
Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services...’
|
|
Recipient or categories of recipients of the processed data
|
Paper medical records will be shared with Restore Records Management who utilize a records management system that incorporates document indexing in line with ISO published standards and GDPR.
|
|
Right to access and correct |
You have the right to access your medical record and have any errors or mistakes corrected. Please speak to a member of staff or look at our ‘subject access request’ policy on the practice website – |
|
Retention period
|
The commissioned service has a contract length of 12 / 24 months. Following the exit process, at contract termination, the records will be securely transferred to a determined location, with electronic Personal Data (held on tracking system) to be returned to the controller within 90 days of request. All personal data to be deleted from the supplier’s system with a certificate of destruction of the data (including back-ups and copies) to be provided for evidential purposes.
|
The practice holds medical records to provide medical treatment and advice and patients have a relationship with a GP in order for them to be provide health and care service to you. We therefore do not require your consent to transfer these papers records to an electronic format or to hold them in a secure off-site storage facility.
If you have any questions about this project, please contact our GP Partners.
Details of Supplier: Restore Records Management
Head Office:
The Databank,
Unit 5 Redhill Distribution Centre,
Salbrook Road,
Redhill, Surrey, RH1 5DY
Storage:
234 Heyford Park,
Camp Road,
Upper Heyford,
Bicester, OX25 5HA