Patients registered with GP practices
Purposes for processing
NHS England has a legal duty to keep and maintain a list of all patients registered with GP practices in England. This list is held in the National Health Application and Infrastructure Services (NHAIS) and Primary Care Registration Management (PCRM) systems. These systems also hold data about patients registered with GP practices in Wales and the Isle of Man.
The data are used to provide Primary Care Support Services. NHS England has a contract with Capita Business Services Ltd, operating as Primary Care Support England (PCSE) to provide these services as NHS England’s data processor which includes:
- Moving paper patient records between practices and into storage when patients leave or move practices.
- Storing paper records of unregistered and deceased patients.
- Sending letters to patient to inform them of their NHS number when one is first allocated.
- Providing the cervical cytology call and recall administrative service.
- Delivering prior notification lists of patients eligible for screening to GPs.
- Processing new patient registrations and de-registrations at GP practices to maintain accurate lists of numbers of patients at GP practices.
- Making payments to NHS ophthalmic practitioners for NHS services provided.
- Making payments to GP practices based on lists of registered patients, and specific payments for childhood vaccinations and immunisations.
- Notifying GP practices when mail has been returned from a patient’s registered address (by setting an ‘FP69 flag’) so that GP practices can contact the patient to establish if they have moved. If no response is received from the patient or GP practice within 6 months, the patient is removed from the practice’s list.
- Writing to patients on behalf of primary care commissioners with regards to provision of primary care services or assignment to a GP practice list.
- Writing to patients when they have been removed from their GP practice list.
- Conducting audits and reconciliations of GP practice lists to ensure list sizes are accurate.
The data from the NHAIS and PCRM is used to update the Personal Demographics Service (PDS). This provides information for hospitals, screening programmes, child health systems and other health providers making sure that they know their patients’ current GP practice and can access other essential information such as the National Care Records Service (formerly the Summary Care Record).
NHS England regional local teams (RLTs) and clinical commissioning groups (CCGs) (where delegated) may also undertake necessary processing of a limited subset of these data (eg patient name, address, postcode and NHS number) for example when managing practice closures and list dispersals (the process used to allocate patients to neighbouring GP practices). This processing is necessary to inform patients of their reregistration options and ‘choice’ as required under the NHS Constitution.
Sources of the data
The data are transferred automatically from GP practice systems into the NHAIS and PCRM systems. The data is also updated by Primary Care Support England after notifications from data subjects themselves.
Categories of personal data
The categories of personal data held on the systems are:
- name – including any previous names, unless name changes are the result of adoption, gender reassignment or witness protection schemes
- current and historic addresses and whether the address is a registered nursing home
- dates of birth
- gender
- place of birth
- NHS number
- cervical screening history
- special allocation scheme status
- current and previous GP practice details
- GPs banking details.
Categories of recipients
Statistical information (numbers) produced from NHAIS systems is shared with other organisations to enable them to fulfil their statutory obligations, for example the Office of National Statistics, UK Health Security Agency and local authorities for their public health purposes. Personal data may also be shared with the approval of NHS England’s Caldicott Guardian when he is assured that confidentiality is respected, for example when hospitals need to update their records for direct care purposes or to support specific research projects with ethical and or Health Research Authority approval.
Legal basis for processing
For UK GDPR purposes NHS England’s basis for lawful processing is Article 6(1)(e) – ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) – ‘…health or social care…’