GDPR - Students Doctors details

[markberry]

On our student data collection sheets we ask for students Doctors name and address. It's then recorded in SIMS.

 

I've asked why we hold this information and get the usual response of, not sure but we've always asked for it. Pretty much every school I know collect this information too. In the last 15 years we've never called a students doctor (they couldn't give us any information anyway), we've never sent anything to a students doctor or had any other need for that information.

 

So, is anyone able to tell me why schools ask for and hold this information?

[MatthewL]

I cannot see any reason why, there never going to tell you anything and any communication would likely be done via the school nursing team (surely) who would have that information on the system.

 

Unless the school were to write to a GP but then school nursing team/social would be involved more than likely plus parents.

 

Lots of employers used to ask for it but noticed it has been removed now from many places and I think those who do ask its from old because that is the way its always done.

 

If a child were to go to hospital you only need name, DoB and they will find you and maybe address to verify. Probably more benefit collecting NHS numbers.

[markberry]

I cannot see any reason why, there never going to tell you anything and any communication would likely be done via the school nursing team (surely) who would have that information on the system.

 

Unless the school were to write to a GP but then school nursing team/social would be involved more than likely plus parents.

 

Lots of employers used to ask for it but noticed it has been removed now from many places and I think those who do ask its from old because that is the way its always done.

 

If a child were to go to hospital you only need name, DoB and they will find you and maybe address to verify. Probably more benefit collecting NHS numbers.

 

We have stopped collecting it now as I've said it wasn't needed but was worried that there might be a reason I'm missing!

[Ditto]

Like you, we collected this and I was unconvinced it was necessary. Some said it might be to contact the GP in the case where a child carries an epipen or suffers from epilepsy. But with 111 and 999, I really don't think that stance has sway in today's world. Besides, if ringing my local GP surgery is anything to go by, the speed of response is such that it's no use for urgent situations. From my time as a Data Manager, I don't think we ever used the details and it certainly wasn't needed for any of the census submissions. Good job on getting it removed. The data you don't have is the easiest manage from a GDPR perspective!

[thebatman]

This is a historical thing, before the days of the NHS having a interconted network, paremdeics / hospitals used to ask if you new GPs detail so they could ask them for information (ie do they allergies). But now they just look on the system.

[psydii]

Child Protection Team liaising with external agencies.

Admissions Team following up students with large medical files.

Hand-over to ambulance crews.

 

(Hospitals round here always ask for GP Details on admission)

[MatthewL]

Handing over files to ambulance crews I would be questioning that, a summary should be enough. Summary for condition and medication which will put straight onto the EPR or paper if still paper shouldn't need more than that.

 

The biggest thing you can do to help is NHS number (find my NHS number), that is put into system and transferred on arrival at hospital which will help speed up verifying patient and record on hospital PAS system,

[enjay]

Child Protection Team liaising with external agencies.

 

Perhaps, although those agencies possibly have access anyway. Or don't need the information.

 

Admissions Team following up students with large medical files.

 

In which case, ask for it when needed. The parents would probably be volunteering the information anyway, and may well be able to provide better information than the GP anyway.

 

Hand-over to ambulance crews.

 

I've had to call an ambulance a few times for myself, friends or family members. Never once have the ambulance crew asked for the GP's details, and A&E can access it anyway.

[enjay]

This question hadn't actually occurred to me before now. We're redesigning our admissions form just now (finally going paperless!) so this is a good opportunity to review it. There is so much duplication of records in the medical section of SIMS anyway (on a recent review of something, I found the same doctor listed 5 times, and that was the individual GP not the practice) so losing it would be good.

[psydii]

Ok how about safeguarding? In cases of unexplained extended absence, when other avenues of contact have failed it would be appropriate to contact the GP to see if there were any potentially relevant concerns there given the circumstances.

 

It may be that the school isn't the one to make contact (the an officer of LA might be more appropriate at this stage) but having multiple methods for reconnecting with absent students is essential.

[enjay]

Ok how about safeguarding? In cases of unexplained extended absence, when other avenues of contact have failed it would be appropriate to contact the GP to see if there were any potentially relevant concerns there given the circumstances.

 

It may be that the school isn't the one to make contact (the an officer of LA might be more appropriate at this stage) but having multiple methods for reconnecting with absent students is essential.

 

Sounds like a job for education welfare, not the school.

[psydii]

Sounds like a job for education welfare, not the school.

...quite possibly, but who holds the contact details?

[Ditto]

Fundamentally, this all links back to the GDPR Principle of Data Minimisation. If you can show a genuine need for holding the data, then you should be fine. What you shouldn't be doing is holding data 'just in case' it's needed. ICO cover this at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/

 

I'd suggest include your DPO in the discussion to advise on the decision.

[markberry]

Fundamentally, this all links back to the GDPR Principle of Data Minimisation. If you can show a genuine need for holding the data, then you should be fine. What you shouldn't be doing is holding data 'just in case' it's needed. ICO cover this at https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/principles/storage-limitation/

 

I'd suggest include your DPO in the discussion to advise on the decision.

 

Exactly this! I am the DPO too!

[markberry]

Ok how about safeguarding? In cases of unexplained extended absence, when other avenues of contact have failed it would be appropriate to contact the GP to see if there were any potentially relevant concerns there given the circumstances.

 

It may be that the school isn't the one to make contact (the an officer of LA might be more appropriate at this stage) but having multiple methods for reconnecting with absent students is essential.

 

But what is a doctors going to tell you? Patient doctor privilidge means they can't speak to you about one of their patients. In 15 years in this organisation we've never done that so surely holding that information for that reason isn't a valid reason 'just in case' under data protection.

[MatthewL]

Doctors will never tell you anything, even the Police cannot go in and just ask there is a process.

 

If a student is absent this its for the EWO, they will have procedures in place and steps to follow if they need to go down that route in a recognised way and point of contact.

 

I cannot see any valid reason for this to be kept. If its a medical emergency then its parents or A&E/Ambulance and they will have that information if needed. The only time that I can the information been needed if a student has complex needs but generally it would be a consultant at the hospital rather than GP from the experience I've had.

[enjay]

The only time that I can the information been needed if a student has complex needs but generally it would be a consultant at the hospital rather than GP from the experience I've had.

 

Agreed, on both counts. The consultants would know much more than the GP, and often the parent knows more than the GP because they've had it explained in detail by a specialist. Also, in the instances where information is needed by the school, the GP/consultant wouldn't give the information to the school anyway, flow of information would be via the parent. That said, I can think of an instance where the school spoke directly to the consultant, but that only happened after the parent had written to the consultant authorising the communication.

[Davit2005]

Does this have a conflict of interest.

 

The DPO must be free of a conflict of interest. The tasks and duties of the DPO must not result in a conflict of interest, meaning that the DPO cannot hold a position or perform tasks within the organisation that leads her or him to influence the use of personal data.

[psydii]

But what is a doctors going to tell you? Patient doctor privilidge means they can't speak to you about one of their patients. In 15 years in this organisation we've never done that so surely holding that information for that reason isn't a valid reason 'just in case' under data protection.

 

While it may not be for the school to contact the GP, the GP is a Professional point of contact for the family, and in exceptional circumstances (such as the child has disappeared and the family is not responding to contact) should be contacted. While the LA may hold legal responsibility for making this contact, who has the most accurate contact information?

 

 

Consider a scenario where a parent is medically vulnerable and this has not been disclosed to the school or LA. The GP likely knows. In the event a child has an unexplained absence and the primary and secondary (not that all students even have contactable secondary's) are not responding, is it not reasonable for the appropriate authority to contact the GP in case they have a) had recent contact, and b) are aware of medical issues with the primary carer that may warrant an immediate intervention (disclosable under Public Interest)?

Edited January 19, 2022 by psydii

[nicholab]

Doctors will never tell you anything, even the Police cannot go in and just ask there is a process.

 

If a student is absent this its for the EWO, they will have procedures in place and steps to follow if they need to go down that route in a recognised way and point of contact.

 

I cannot see any valid reason for this to be kept. If its a medical emergency then its parents or A&E/Ambulance and they will have that information if needed. The only time that I can the information been needed if a student has complex needs but generally it would be a consultant at the hospital rather than GP from the experience I've had.

 

I do find it strange that doctors can be snotty to the Police.

[GrumbleDook]

Exactly this! I am the DPO too!

 

What??!!!!

 

You have a conflict of interest here. Do you have anyone providing external advice/support?

 

If there is no one else in-house to do it then get an external DPO and just be the internal DP lead. Protect yourself.

 

Back to the question in hand.

 

Yes, it is historic and does need reconsidering. If nothing else, the needs may have changes.

 

The information is generally held from a safeguarding well-being perspective, allowing the school to send information to the nominative primary health care provider should they need to be informed (the is controller to controller data sharing). Most of the time this is not needed due to inter-agency cooperation under such circumstances. If there is inter-agency work going on (or possibly going on) then you might consider moving to only collecting at this point.

 

The child’s NHS number is a significantly important piece of personal data, and not really something for a school to use. It may be that collecting the GP details is less invasive when you consider what it is needed for.

 

Also consider what the method of getting the information might be once you actually need to use it.

 

I would speak with your DSL and SENDCO about it, and even give the local MASH a call for advice. Also read any guidance you may have had from your LADO.

[elsiegee40]

Exactly this! I am the DPO too!

 

You should not be DPO too.

 

There is a clear conflict of interest between your two roles. Basically, you cannot be responsible for monitoring yourself as a person responsible for data.

[paulkerton]

Exactly this! I am the DPO too!

No, no, no, no, no. There is absolutely no way you should be the DPO

You're part of the system, you can't examine the system too. You're Mark Berry not Sue Grey.

[nicholab]

No, no, no, no, no. There is absolutely no way you should be the DPO

You're part of the system, you can't examine the system too. You're Mark Berry not Sue Grey.

 

I think some Headteacher have not be genuine and they have force this position on staff.

[enjay]

Going back to the original topic, I asked our data manager about GP details. Apparently, we collect it in case there is a medical emergency and we can't contact parents, so any additional information we can provide might help. The GP wouldn't talk to us, but they would talk to A&E staff.