Frequently Asked Questions

A Local Health and Care Record (LHCR) partnership is a group of NHS and local authority organisations working together using digital technology to share information to help continually improve health and care services. The Thames Valley and Surrey (TVS) Care Records Partnership is one of the national LHCR programmes.

For further information see NHS England's summary of the Local Health and Care Record Exemplar programme and the NHS England announcement regarding Thames Valley and Surrey.

• Share Your Care programme in Berkshire and Frimley
• The Health Information Exchange in Oxfordshire
• My Care Record in Buckinghamshire
• The Surrey Care Record

• Surrey Heartlands Integrated Care System (ICS) also known as Surrey Heartlands Health and Care Partnership
• Frimley Health and Care ICS
• Buckinghamshire, Oxfordshire and Berkshire West ICS
• Milton Keynes University Hospital Trust

• Multiple Integrated Care Systems (ICS) across health and care are working together
• Better, safer care by connecting and providing access to an individual's care record across the Thames Valley and Surrey region. 
• Use of data for improving physical and mental health outcomes through planning, research and innovation, with strong links to academic centres, Academic Health Science Networks and Commissioning Support Units.

The current status of the TVS Care Records in in each of the local areas across TVS will be updated regularly on our current status page.

Your health and care information is held by organisations that provide your care, like your GP, hospital or care home. This information is often stored electronically (not on paper). Data about you can be used to:

• provide your personal care
• plan health and care services
• carry out research to find new treatments or services.

Good quality data is essential to help make sure that you get the best possible care. All staff who help look after you need to have up-to-date information about you. Staff in your GP practice, hospital or care home need this information to guide your care.

Everyone should be able to access information about their own health and care. This can help them manage their own health. It can help to keep information accurate and up to date. It can also help to reduce the times you have to repeat the same information to lots of different people.

There are several systems for sharing health and care information. Information is shared between health and care staff and the organisations they work for. The sort of information that is shared includes:

• illnesses you have
• your treatment and care
• test results
• medicines you are taking
• allergies
• information about hospital appointments and admissions.

Each organisation that holds data about you decides who can see it. Which staff can see information depends on their job. A doctor will be able to see more information than a receptionist.  Health and care staff should only access your health and care record if they:

• need to provide care for you or
• need information to manage care, like making outpatient appointments.

Download the NHS App

You can download the NHS App. This shows some data held by your GP, like allergies and medicines. It also allows you to do things like book GP appointments.

Make a Subject Access Request to your Care Provider

Contact the Data Protection Officer at the organisation providing your care. This could be your local hospital or GP practice. Details of how to do this can be found on the organisation’s website. If you ask to see your data, you should get a reply within one month. If it is complicated to reply, you should be told how long it will take. They should reply finally within three months of your request.

Please find more detailed information under the question 'What is a Subject Access Request and how do I make one?'

At the moment your records are kept by individual organisations involved in your care. For example your GP will have a record  and if you attend hospital, they will create a separate record. If you use adult and children’s services in local authorities, they will also create a record. At the moment these are unlikely to be shared meaning they can be inaccurate or incomplete. Bringing these electronic records together in one place will provide a fuller picture about your health.

In some areas there are local records sharing programmes covering a part of the Thames Valley and Surrey region. For example, My Care Record in Buckinghamshire. We know however that a lot of healthcare happens further afield, for example about one in five episodes of hospital care is provided outside of a patient's home county. The work of the partnership will connect local care records across the TVS region.

1. To provide your care
2. Using data to ensure effective design and operation of health and care services

The Thames Valley & Surrey Care Record holds a set of information about you from the health and care organisations that provide care for you locally. 

The records of those health and care organisations are subject to retention periods set out in documents such as the NHS Records Management Codes of Practice.

As the information about you on the Thames Valley & Surrey Care Record comes from local organisational systems, the data will be kept for the same amount of time that it is kept on those local systems.

Care professionals need access to all relevant data about you to ensure your care is safe and effective. 

However if you have concerns about the sharing of your data and wish to raise an objection then you can do so under the GDPR legal right to object. 

You will need to contact the health and care organisation(s) that hold the information on you and discuss your concerns with them. They will help clarify who can see your data and why. Should you still have concerns they will discuss what possibilities there are to address these. 

Sharing data for your individual care

Information about you is shared between people and organisations that provide your care. If you do not want information about you shared, even for your own care, you should contact the Data Protection Officer at the organisation providing most of your care, or your most recent care. This could be your GP practice or local hospital.

Your request will be discussed with relevant staff, like your doctor. They will decide if there might be a serious risk to you if your information is not shared. They may also discuss your request with other organisations that provide care for you.

It is unlikely that it will be possible to share just some of your data. For example, only sharing information about your physical health, but not your mental health.

If you choose to object to sharing information for your own care, it is likely that none of your data will be shared across organisations. If you object, you can change your mind at any time. However, if you do this there may be some gaps in the data available to be shared through the TVS Care Records. It might not include all the information for the period that you objected to sharing.

You can request to opt-out of information being processed for planning (e.g. health and care services) or research (e.g. to develop new treatments or services). This is called the National Data Opt-Out scheme. It means that you can opt-out of people being able to use your personally identifiable data for planning or research.

If your data is anonymised, so that it is not identifiable, it can still be shared. This will happen even if you use the National Data Opt-out.

You can learn more about your options under the National Data Opt-Out or make your opt-out decision here: nhs.uk/your-nhs-data-matters or by calling 0300 3035678.

The Thames Valley & Surrey Care Records Partnership is not a data controller. The organisations providing your care locally are the controllers of the data they hold about you and are working in partnership to ensure it is available for sharing within the TVS Care Records when needed to benefit your care. 

 If you have any concerns about data sharing, please speak to the local care organisations who hold your records. As there will be more than one organisation involved in the provision and processing of information about your care across the Partnership, the various system leads will act as Joint Data Controllers in accordance with the General Data Protection Regulation (GDPR 2018).

To find out more about these arrangements, please read more on the Data Controller Narrative.

It is really important that we keep your data safe. There are a number of ways we do this:

• Using technology to restrict who can access your data. This can be done with passwords, swipe cards or encryption, so the data can only be read using a code.
• Making sure that anyone who can access your data has the right training.
• Making sure that anyone who can access your data is approved by their organisation.
• Keeping computer systems up to date to protect against viruses and hacking.
• Having an audit trail every time personally identifiable data is looked at or used.

If someone misuses patient data, they could lose their job or prosecuted.

The legal basis for processing data within the TVS Care Records is ‘the provision of health or social care services’ GDPR Article 9(2)(h) and GDPR Article 6(1)(e) for a ‘task carried out in the public interest’. 

• The right to be informed
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability

No, not at the moment. If you are registered at a GP practice outside of the Thames Valley and Surrey region, please check with them directly as your record may be shared as part of another Local Health and Care Record (LHCR) programme. We are working to provide connections with other regions so that information is available for authorised health and care professionals wherever they are providing treatment - for example when you are on holiday or commuting to and from work.

The TVS Care Records programme will use anonymised information for health and care planning and research. This is called ‘secondary use’ of data. Identifiable patient information will only be used for your individual care. Your anonymous information helps us to plan which services to run, and help with diagnosis and treatments.

Anonymised information is data where details that can identify a person, like name, address and date of birth, are removed.

When fully anonymised information from lots of people is put together, it is impossible to identify individuals. This data can then be used to plan and improve health and care services. 

There are different levels of identifiability.

When all the information about a person is present, the person is fully identifiable. As information is removed or hidden, the image is more and more blurred. It becomes more difficult to identify who that person is. When most personal information has been removed, it is not possible to identify someone. This means they are anonymous.

The Information Commissioner’s Office gives guidance about what data must be removed or hidden. It also makes rules that must be followed to anonymise data properly.

Data that has had information removed (or hidden) that identifies who you are, like name, address and date of birth, is used as much as possible for things that are not your personal care. Often, it is only a row of numbers and codes that can be seen. This is de-personalised or anonymised data.

Statistics are published regularly by the NHS, like A&E waiting times or vaccination coverage. This type of information can only be published if the data is anonymous. This means it is not possible to identify any individual.

Personally identifiable data can only be used if you give your permission or if it is required by law. {link to detail}. It can then be used only if the proper safeguards are in place. It cannot be used for insurance, marketing or released to an employer without your consent.

Information about all people using health services can help plan future services. This might be by looking at data about:

• who is using services. For example, looking at how many children are born to plan services for young people, or
• by doing research to understand new treatments.

By linking together small amounts of data from lots of patients, planners and researchers can look for patterns. This helps them identify ways to improve health and care services. The information is really valuable to help to:

• understand more about disease
• develop new treatments
• monitor safety
• plan services and
• see if NHS policy is working.

Planners and researchers use patient data to help them to:

• understand more about disease
• develop new treatments
• monitor safety
• plan services and
• see if NHS policy is working.

This kind of research is vital to improve health and care for everyone. Researchers and planners can ask to use data from several sources, such as:

• Audits like the National Diabetes Audit
• Disease registers like the National Cancer Registry
• Service data like Hospital Episode Statistics
• Prescribing databases
• Patient surveys like the National Inpatient Survey
• GP records

Before research starts, the plan is usually looked at by an independent committee. The committee checks that using the data is appropriate and in the best interests of patients. Wherever possible data used is anonymised. Researchers should be given the smallest amount of data needed to answer their questions. Data must be stored securely. A legal contract must be signed before data can be shared or used.

Often a study will need to use data about an individual that is held in more than one place. A trusted third party, usually NHS Digital, links the data using a unique code which is then removed. This means the researcher cannot re-identify individuals.

It is really important that we keep your data safe. There are a number of ways we do this:

• Using technology to restrict who can access your data. This can be done with passwords, swipe cards or encryption, so the data can only be read using a code.
• Making sure that anyone who can access your data has the right training.
• Making sure that anyone who can access your data is approved by their organisation.
• Keeping computer systems up to date to protect against viruses and hacking.
• Having an audit trail every time personally identifiable data is looked at or used.

If someone misuses patient data, they could lose their job or prosecuted.