Purposes for processing
Online consultations allow a GP’s patients to contact their Practice without having to wait on the phone or take time to come into the practice in person especially if a patient is not sure whether they need a face to face consultation. Online consultations enable patients to use a secure online system to ask questions, report symptoms and we can then respond by signposting patients to the right person e.g. a doctor or to appropriate service or support.
As this service is online, GPs need to ensure that they continue to provide patients with a confidential and high-quality service. To do so, they need to properly identify patients and accurately note their request and responses. If they were prevented from using this essential information, then they would be unable to provide the service securely and confidentially.
NHS England has commissioned the eConsult platform for GPs to use and has instructed NHS Digital to integrate it into the NHS App. NHS England bears responsibility for contracting with and assuring eConsult but will not receive any patient data from GPs through the provision of this service.
Sources of data
Data will be captured directly from patients using the eConsult platform, as provided by their GP practice.
Categories of personal data and recipients
Information which is not needed for the service is not collected. The platform collects and uses the following information relating to their patients to identify and deal with their requests.
- Identity and Contact Information: includes name, gender, date of birth, NHS number, email address and telephone number, postal address.
- Special Categories of Personal Information: your health information such as your symptoms, conditions, medication and other details which are already held in your GP records and / or which you provide through the online consultation process.
Data provided by patients will be processed by eConsult and, where patients utilise the NHS login or NHS App, NHS Digital. It will then be shared with the patient’s GP. NHS England will not receive any personal data associated with the platform.
Legal basis for processing
For GDPR purposes NHS England’s and the GPs’ lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’. For processing special categories (health) data the basis is Article 9(2)(h) – ‘…health or social care…’.
NHS England and the GP practices are joint Data Controllers for this platform. Under Joint Controller arrangements, NHS England is responsible for managing the commercial relationship with eConsult and undertaking data protection assurance. GPs are responsible for their patients’ data and all associated obligations under GDPR.9
The data will be processed via eConsult (and NHS Digital, if utilising NHS login or accessing the platform via the NHS App). Both NHS Digital and eConsult have been commissioned as Data Processors on behalf of NHS England.