Purposes for processing

NHS England has a legal duty to keep a list of all patients registered with GP Practices in England. This list is held in the National Health Application and Infrastructure Services (NHAIS) systems.  These systems also hold data about patients registered with GPs in Wales and the Isle of Man. NHS Digital, and other service agencies around the country manage these systems on behalf of NHS England.

The data are used to provide Primary Care Support Services. NHS England has a contract with Capita Business Services Ltd, operating as Primary Care Support England to provide these services which include:

• Moving paper patient records between practices and into storage when patients leave or move practices
• Storing paper records of unregistered and deceased patients
• Sending letters to patient to inform them of their NHS number when one is first allocated
• Providing the cervical cytology call and recall administrative service on behalf of Public Health England
• delivering prior notification lists of patients eligible for screening to GPs
• processing new patient registrations and de-registrations at GP practices to maintain accurate lists of numbers of patients at GP Practices–
• Making payments to NHS Ophthalmic practitioners for NHS services provided
• Making payments to GP practices based on lists of registered patients, and specific payments for childhood vaccinations and immunisations
• Writing to patients on behalf of Primary Care commissioners with regards to provision of primary care services or assignment to a GP Practice list.
• Writing to patients when they have been removed from their GP Practice list
• Conducting audits and reconciliations of GP Practice lists to ensure list sizes are accurate.

The data from the NHAIS list is used to update the Personal Demographics Service (PDS). This provides information for hospitals, Public Health England Cancer Screening Programmes, Child Health systems and other health providers making sure that they know their patients’ current GP Practice and can access other essential information such as the Summary Care Record.

NHS England Regional Local Teams (RLTs) and integrated care systems (ICSs) (where delegated) may also undertake necessary processing of a limited subset of these data (e.g. patient name, address, postcode and NHS number) for example when managing practice closures and list dispersals (the process used to allocate patients to neighbouring GP Practices). This processing is necessary to inform patients of their reregistration options and ‘Choice’ as required under the NHS Constitution.

Sources of the data

The data are transferred automatically from GP practice systems in to the NHAIS systems. The data is also updated by Primary Care Support England after notifications from data subjects themselves.

Categories of personal data

The categories of personal data held on the systems are:

• Name – including any previous names, unless name changes are the result of adoption, gender reassignment or witness protection schemes
• Current and historic addresses and whether the address is a registered nursing home
• Dates of Birth
• Gender
• Place of Birth
• NHS number
• Cervical Screening history
• Special allocation scheme status
• Current and Previous GP practice details
• GPs Banking details

Categories of recipients

Statistical information (numbers) produced from NHAIS systems is shared with other organisations to enable them to fulfil their statutory obligations, for example the Office of National Statistics, Public Health England and local authorities for their public health purposes. Personal data may also be shared with the approval of NHS England’s Caldicott Guardian when he is assured that confidentiality is respected, for example when hospitals need to update their records for direct care purposes or to support specific research projects with ethical and or Health Research Authority approval.

Legal basis for processing

For GDPR purposes NHS England’s basis for lawful processing is Article 6(1)(e) – ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) – ‘…health or social care…’