Further Data Protection Guidance for our NHS 111, GP Out Of Hours and Urgent Care services

How will our NHS 111, GP Out Of Hours and Urgent Care services use the information we hold about you?

Vocare Ltd provides NHS 111, GP Out Of Hours and Urgent Care services.

When you contact us as a patient, we collect information about you and keep records about the service we provide. We may also record information about you if you contact us for any other reason.

We are the “data controller” and process your personal data in accordance with the General Data Protection Regulations.

NHS health records may be electronic, telephony, on paper or a mixture of all and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Your records are backed up securely in line with Vocare Ltd.’s Data Protection standards. We ensure that the information we hold is kept in secure locations, is protected by appropriate security and access is restricted to authorised personnel.

When we are using more sensitive types of personal information, including health information, our legal basis is usually that the use is necessary:

  • for the provision of health or social care or treatment or the management of health or social care systems and services; or
  • for reasons of public interest in the area of public health; or
  • for reasons of substantial public interest for aims that are proportionate and respect people’s rights, for example research; or
  • in order to protect the vital interests of an individual; or
  • for the establishment, exercise or defense of legal claims or in the case of a court order.
  • Ethnicity

On rare occasions we will rely on your explicit consent as our legal basis for using your personal information such as for patient surveys. When we do this we will explain what it means, and the rights that are available, to you. If consent is required, all patients have the right to withdraw their consent at any time.

We are also required to record details of your ethnicity and other information to help us monitor the equality of the services we provide. To provide you with urgent (non-emergency) medical help and advice through our services, we will collect information about you to help us identify you and provide you with appropriate medical help and advice. We will record information about your condition and the advice we have provided. This information will be recorded on a computer system.

To enable us to meet the needs of patients with complex health or emotional needs or who cannot manage their healthcare themselves, a patient’s GP may pass our service some specific information to enable us to provide the most appropriate medical help and advice. The GP should involve the patient in the decision to provide us with this information

If you make a complaint or an enquiry about the service we have provided, or have contact with us on another matter, we will keep a record of all the relevant details in a file for reference purposes.

Clinical Records

The health care professional involved in your treatment or care may ask us for information about your use of our services or the treatment you received. We will be careful about sharing information in these circumstances and will only do so once we are satisfied that they need this information in order to provide care to you.

If you ring our service in order to provide you with appropriate care we may need to share some health information about you with your GP and additionally with other health or social care providers.

If you do not wish information about you to be shared we will give you the opportunity to say so, however this may impact on the services and support that can be provided to you.

Telephone Calls

All calls that are recorded are for the purposes of patient care, staff training and incident management.

Your information may be used to:

Help staff review the care and advice they provide to ensure it is of the highest standard

  • Teach and train staff
  • Protect the health of the public
  • Provide statistics, performance and planning information
  • Investigate complaints, legal claims or untoward incidents

When information is needed to manage the wider health service, careful measures are taken to ensure that individual patients cannot be identified. Your name, address and other information that identifies you is removed.

Data Processors

Vocare Ltd uses a small number of delivery partners (or data processors*) to carry out specific business functions on behalf of Vocare’s services which involve the processing of personal data.

  • SELDOC
  • Medvivo
  • Imperial Health Care Trust

We also make sure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed. by the Data Protection Act 2018

Vocare Ltd will only use an approved data processor where: –

  • There is a written contract in place which stipulates that the data processor can only act in accordance with instructions from Vocare Ltd. They are not able to do anything else with that data.
  • The contract also creates a legal requirement for the data processor to act in accordance with the Principle F of the General Data Protection Regulations i.e. the ‘Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data’.
  • Vocare Ltd is satisfied that the data processor has provided sufficient guarantees in respect of the technical and organisational security measures governing the processing to be carried out.

Vocare Ltd takes all reasonable steps to ensure our data processors continue to remain compliant with technical and organisational security measures.

* A data processor is a person or organisation who processes personal data on behalf of a data controller, rather than on their own behalf.


When will our NHS 111, GP Out Of Hours and Urgent Care services disclose your information?

Your personal health information may be given to other people who need to know relevant information about your health – for example the local ambulance service, your local hospital, your own GP.

Vocare Ltd will not share your personal health information with people such as relatives, carer’s or friends without your permission. However, there are exceptions:

  • If you are a child, and a health professional doesn’t think you can make decisions about your healthcare, someone with parental responsibility for you may be allowed to see your records and discuss your care.
  • If you are an adult who cannot make decisions for yourself, or cannot tell others your decisions, the law allows someone to see your records and discuss your care, if:
  • you have given them a power of attorney, or
  • a court has appointed someone to deal with decision-making.

In these cases, the person is allowed to see your health information:

  • will only be able to see information that is necessary for them to make particular decisions for you about your health care, and
  • will not receive information that staff feel would be harmful to your health or the health of others.

Sometimes the law allows Vocare Ltd to share your personal health information without your permission, for example, to investigate a serious crime or to protect a child.

Sometimes the law requires us to pass on information: for example, notification of births and deaths. This is only provided after formal permission has been given by a qualified health professional.

We share information in line with the legislation from the Health and Social Care Act 2015 and we process/share your information under the Data Protection Act 2018 legislation and the new GDPR legislation.

Caldicott Principles

Vocare Ltd has a legal duty of confidence to their patients and the GDPR Act 2018 further defines how we can collect and handle personal information. Vocare Ltd also has an additional set of guidelines, known as the Caldicott Principles, which apply to the use of patient information.

Vocare Ltd has appointed a Caldicott Guardian to ensure patient information is handled in accordance with legal obligations.

We have appointed our Executive Medical Director as Caldicott Guardian in acknowledgement of how seriously we take the protection of your right to confidentiality. Our Executive Medical Director is a senior member of our Board who understands the requirements for protecting the confidentiality of patient information as well as enabling appropriate information-sharing. We will seek your consent before we release information that identifies you to any third party for any other reason than those set out in this guidance. Vocare’s commitment is that we will only use records about you in ways which respect your rights and promote your health and wellbeing.