RECORD PROCESSING POLICY

This Policy recognises the following Acts:
•	General Date Protection Regulations 2018
•	Care Quality Commission (Registration) Regulations 2009
•	Health and Social Care Act 2008 (Regulated Activities) Regulations 2014
•	National Health Service Act 2006
•	Equal Opportunities Act 2010
•	Data Protection Act 2000
•	Sex Discrimination Act 1975 (As amended)
•	Sex Discrimination (Gender Reassignment) Regulations 1999
•	Race Relation Act 1976 (As amended)
•	Disability Discrimination Act 1995 (As amended)
•	Human Rights Act 1998
•	The Equality Act 2006
•	Civil Partnership Act 2004

Record of Processing Activities
                                                                                                                                      
Objective 

This Record of Processing Activities (Record) describes how King’s College London NHS Health Centre processes personal data. 

King’s College London NHS Health Centre recognise that Article 30 of the EU General Data Protection Regulation (GDPR) imposes documentation requirements on controllers and processors of data. This Record is company confidential information but we will provide it to the appropriate supervisory authority on request as required by Article 30.

Data Controller Details

The details of the practices data controller are: 

Name: Mr Declan Stow
Address: King’s College London NHS Health Centre, Bush House, South East Wing, 3rd Floor, London, WC2B 4PJ
Telephone Number: 02078481729
Website: www.kclnhshealthcentre.com  

Categories of Data Subjects  

King’s College London NHS Health Centre collects personal data from the following categories of data subjects: -
•	The Practice’s patients
•	The Practice’s customers or consumers
•	The Practice’s vendors or suppliers
•	The Practice’s employees and job applicants.

Categories of Personal Data  

King’s College London NHS Health Centre collects the following categories of personal data about its patients: - 
•	Address, legal representative, emergency contact details, student information
•	Any contact the surgery has had with the patient, such as appointments, clinic visits, emergency appointments, etc.
•	Notes and reports about the patient’s health
•	Details about the patient’s treatment and care
•	Results of investigations such as laboratory tests, x-rays etc
•	Relevant information from other health professionals, relatives or those who care for the patient
•	The patient’s records will be retained in accordance with the NHS Code of Practice for Records Management

King’s College London NHS Health Centre collects the following categories of personal data about employees and job applicants: Personal details including name and contact information including name, title, address, telephone number, personal email address, date of birth, gender, employment history, qualifications. 

Categories of Personal Data Recipients  

King’s College London NHS Health Centre discloses personal data to the following categories of recipients, some of which may be located in third countries or may be international organisations as defined in Article 4(26) of the GDPR: 

•	Business partners 
•	NHS Trusts / Foundation Trusts
•	GP’s
•	NHS Commissioning Support Units
•	Independent Contractors such as dentists, opticians, pharmacists 
•	Private Sector Providers 
•	Voluntary Sector Providers 
•	Ambulance Trusts 
•	Clinical Commissioning Groups 
•	Social Care Services 
•	NHS Digital
•	Local Authorities 
•	Education Services 
•	Fire and Rescue Services 
•	Police & Judicial Services

•	Third-party service providers, such as providers of IT system management, information security, human resources management, payroll administration

King’s College London NHS Health Centre transfers personal data to the following countries and international organisations:  None Noted.

King’s College London NHS Health Centre makes limited personal data transfers subject to the second subparagraph of Article 49(1) which are necessary for the practices compelling legitimate interests. The Practice will seek to ensure that appropriate safeguards are in place to protect personal information before making any such transfer. 

Personal Data Retention Periods  

Except as otherwise permitted or required by applicable law or regulation, the Practice only retains personal data for as long as necessary to fulfil the purposes the Practice collected it for, as required to satisfy any legal, accounting, or reporting obligations, or as necessary to resolve disputes. To determine the appropriate retention period for personal data, the Practice considers the amount, nature, and sensitivity of personal data, the potential risk of harm from unauthorised use or disclosure of personal data, the purposes for processing the personal data, whether the Practice can fulfil the purposes of processing by other means, and any applicable legal requirements.

The Practice typically retains personal data for the periods set out below, subject to any exceptional circumstances or to comply with laws or regulations that require a specific retention period: -

•	GP records - 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the European Union.
•	Electronic patient records – indefinitely as they must not be destroyed or deleted for the foreseeable future.
•	Children and young people - all types of records for children and young people should be retained until the patient is 25 (or 26 if they are 17 when treatment ends) or eight years after their death, if sooner. (Note that if a child's illness or death could be relevant to an adult condition or have genetic implications for their family, records may be kept for longer).
•	Maternity records (including obstetric and midwifery records) must be retained for 25 years after the birth of the last child.
•	Mental health records. Records of people who have been treated for a mental disorder will be retained for 20 years after the date of last contact between the patient and any healthcare professional employed by the mental health provider, or eight years after the death of the patient if sooner. 

Technical and Organisational Security Measures  

King’s College London NHS Health Centre has implemented the following technical and organisational security measures to protect personal data:
•	Encryption of personal data – via smartcard access on clinical system.
•	Segregation of personal data from other networks – N3 secure connections on emails and server.
•	Access control and user authentication – Employee individual computer access log on
•	Employee training on information security – Annual Information Governance Training
•	Written information security policies and procedures – Annual updates on policies, process, audits

King’s College London NHS Health Centre has a Senior Administrator, who works alongside the data protection officer, and manages the security and legitimacy of patients records, ensuring they are stored electronically, and coded according to their medical complaints, interventions, procedures.  Ensuring the patient records are accurate and up to date.

Changes to this Record of Processing Activities  

King’s College London NHS Health Centre reserves the right to amend this Record of Processing Activities from time to time consistent with the GDPR and other applicable data protection requirements.