Practice Policies 

GP Practice Transparency Notice for GPES Data for Pandemic Planning and Research (COVID-19)

This practice is supporting vital coronavirus (COVID-19) planning and research by sharing your data with NHS Digital.

Coronavirus (COVID-19) pandemic and your information

The ICO recognises the unprecedented challenges the NHS and other health professionals are facing during the COVID-19 pandemic.

The ICO also recognises that 'Public bodies may require additional collection and sharing of personal data to protect against serious threats to public health'.  The Government have also taken action in respect of this and on 20 March 2020 the Secretary of State for Health and Social Care issued a notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 requiring organisations such as GP Practices to use your information to help GP Practices and other healthcare organisations to respond to and deal with the COVID-19 pandemic.  Please note that this notice has now been revised and extended by a further notice from 29 July 2020 until 31 March 2021.

In order to look after your healthcare needs during this difficult time we may urgently need to share your personal information, including medical records, with clinical and non clinical staff who belong to organisations that are permitted to use your information and need to use it to help deal with the COVID-19 pandemic.  This could (amongst other measures) consist of either treating you or a member of your family and enable us and other healthcare organisations to monitor the disease, assess risk and manage the spread of the disease.  Additionally, the use of your information is now required to support NHS Test and Trace.

Please be assured that we will only share information and health data necessary to meet yours and public healthcare needs.  The Secretary of State for Health and Social Care has also stated that these measures are temporary and will expire on 31 March 2021 unless a further extension is required.  Any further extension will be provided in writing and we will communicate the same to you.

Please note that the data protection and electronic communication laws do not stop us from sending public health messages to you, either by phone, text or email as these messages are not direct marketing.

It may also be necessary, where the latest technology allows us to do so, to use your information and health data to facilitate digital consultations and diagnoses and we will always to this with your security in mind.  If you are concerned about how your information is being used, please contact our Data Protection Officer using the contact details provided in our Privacy Notice.

The type of personal data we are sharing with NHS Digital

The data being shared with NHS Digital will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. The data contains NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death for those patients. It will also include coded health data which is held in your GP record such as details of:

  • diagnoses and findings
  • medications and other prescribed items
  • investigations, tests and results
  • treatments and outcomes
  • vaccinations and immunisations

How NHS Digital will use and share your data

NHS Digital will analyse the data they collect and securely and lawfully share data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only. These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials. The British Medical Association, the Royal College of General Practitioners and the National Data Guardian are all supportive of this initiative.

NHS Digital has various legal powers to share data for purposes relating to the coronavirus response. It is also required to share data in certain circumstances set out in the COVID-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).

Legal notices under the COPI Regulations have also been issued to other health and social care organisations requiring those organisations to process and share confidential patient information to respond to the coronavirus outbreak. Any information used or shared during the outbreak under these legal notices or the COPI Regulations will be limited to the period of the outbreak unless there is another legal basis for organisations to continue to use the information. 

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared. Organisations using your data will also need to have a clear legal basis to do so and will enter into a data sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital Transparency Notice for GP Data for Pandemic Planning and Research (COVID-19).

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your rights over your personal data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see:

Confidentiality/General Data Protection Regulation

General Data Protection Regulation (GDPR) is the new law that determines how your personal data is processed and kept safe, and legal rights that you have in relation to your own data.

The regulation applies from 25 May 2018, and will apply even after the UK leaves the EU.

What GDPR means for our patients...

The GPPR sets out the key principle about processing personal data, for staff or patients:

    • Data must be processed lawfully, fairly and transparently
    • It must be collected for specific, explicit and legitimate purposes
    • It must be limited to what is necessary for the purposes for which it is processed
    • Information must be accurate and must be kept up to date
    • Data must be held securely 
    • It can only be retained for as long as necessary for the reason it was collected

There are also stronger rights for patients regarding the information that practices hold about them.  These include:

    • Being informed about how their data is used
    • Patients to have access to their own data
    • Patients can ask to have incorrect information changed
    • Restrict how their data is used
    • Move their patient data from one health organisation to another
    • The right to object to the patient information being processed (in certain circumstances)

For further information please feel free to read our Fair Processing Notice which can be viewed and downloaded here.

Reception and administration staff require access to your medical records in order to do their jobs.  These members of staff are bound by the same confidential rules as clinical staff.

Freedom of Information

The Freedom of Information Act 2000 aims to ensure that general practice contractors providing general or personal medical services are open to the public concerning the way that we operate.

In compliance with the act, the surgery has developed a Publication Scheme which details all of the information that we routinely publish.  If you would like a copy of the scheme please contact 01362 852800 or download it by clicking here.

Further information can be obtained at

Who can request information? 

Under the act, any individual is able to make a request to the surgery for information.  An applicant is entitled to be informed in writing by the surgery, whether the surgery holds information required and if this is the case, to have the information communicated to him/her.

How can a request be made?

Requests must be made in writing, state the name of the applicant and an address for correspondence and describe the information requested.

Please send requests by letter to: Trudy Dye, Operations Manager, Theatre Royal Surgery, 27 Theatre Street, Dereham, NR19 2EN.

What will the surgery do?

Following a request the surgery will reply within 20 working days of the request being made to say if the information is available or not.  The surgery will then try to provide the information in the preferred format of the applicant.  Information may be shared on a website or on hard copy.

Do I have to pay for information?

As a general rule anything listed in the Publication Scheme is available free of charge if providing one copy in paper format or if it is downloaded from our website or sent electronically.

Is there any information that the surgery will not give me?

The surgery will make every effort to provide your with a copy of the information requested and may have to ask you a few questions to make sure that we provide you with what you want.  There may be some documentation or certain parts of that documentation which we are not allowed to release.  Some examples of information we would not be allowed to release under this act are:

    • Someone else's medical records (protected by the Data Protection Act 1998) 
    • Personal information (protected by the Data Protection Act 1998)
    • A companies trade secrets 
    • Any information held in court records


Complaints, Comments or Suggestions

If you have any complaints, observations or suggestions about the way in which our practice works, please address them in the first instance to our Operations Manager.  We do not accept official complaints via this website or email.

Please rest assured that we do try our best to make your dealings with the surgery a pleasant, effective and efficient process but we recognise that we may not always get things right.  If you tell us what has happened we will investigate it thoroughly, send you a response and hope to learn from the event.

You can, of course, tell us if we do something particularly well or if you have been especially helped by an individual member of our team - we learn from the good things as well as the occasions when something may not have been done quite so well.

Positive comments, complaints and significant incidents are shared by the whole team and we treat them as a learning experience so that we can strive to improve our service.

Complaints Policy

If you have any complaint or concern about the service that you have received from the doctors or staff working in this practice, you are entitled to ask for an explanation.

Our procedure does not deal with matters of legal liability or compensation and does not affect your right to seek compensation in law.

We operate an informal, in-house, complaints procedure to deal with this.  In some cases the in-house procedure is not an appropriate form of investigation, in which case you will be referred to the appropriate authority.

Our complaints procedure does not affect your right to make a formal complaint to another body (download our Complaints Guide by clicking here).  Our management team will ensure that your complaint is investigated as thoroughly and speedily as possible by the most appropriate person(s) in the practice.  Complaints about your clinical treatment will be investigated by a clinician and not by a manager.  If you are complaining about a practice policy or procedure, one of our managers will investigate the matter and reply to you.  We aim to respond to you within ten working days.

If your complaint is complex or if it concerns a member of staff who is absent, we may require longer than ten working days in order to complete our investigations.

At all times we will do our utmost to keep you informed about the progress of your complaint.

Making a complaint will not prejudice your treatment at the practice or in the wider NHS.  Details of any complaints are not filed with your medical records but are kept completely separately.

How do I make a complaint?

Please ask for a copy of the Practice Complaint Leaflet and Form.  You can collect this from reception or download by clicking the links (these are also available under the downloads section of this website).

You do not have to use the form if you prefer to set out your complaint in your own way.

The Health Service Ombudsman

The Health Service Ombudsman has published a booklet that describes the 'six principles for remedy' in relation to complaints handling and it involves: 

    • Getting it right
    • Being customer focused
    • Being open and accountable
    • Acting fairly and proportionately
    • Putting things right
    • Seeking continuous improvements

If you remain unhappy after everything has been done to try and resolve your concern or complaint you have the right to approach the Ombudsman.  You can contact them via their helpline on 0345 015 4033.

What do I do if I am not satisfied with the way in which the surgery has handled my complaint?

You can contact various bodies who will help you which are detailed in our complaints guide (above).  It is recommended that you always try to address any complaint directly with us in the first instance - we will do our best to help you.  However, there is nothing stopping you going to one of the following if you prefer:

    • South Norfolk Clinical Commissioning Group Patient Advice and Liaison Service 
    • NHS England
    • NHS Complaints Advocacy for Norfolk
    • The Parliamentary and Health Service Ombudsman
    • Citizens Advice Bureau 
    • The Samaritans 

Zero Tolerance

Theatre Royal Surgery operate a zero tolerance policy with regards to violence and abuse and these behaviours will not be tolerated under any circumstance.  The surgery has the right to remove patients who are abusive from the practice list in order to safeguard practice staff, patients and other persons.

The practice staff are here to help you.  Help us in order to help you.

Infection Control

Theatre Royal Surgery is committed to reducing acquired infections and has policies and procedures in place to achieve this.  We aim to keep the surgery clean and tidy and to offer a safe environment for all our staff and patients.

Our GPs and nursing team follow procedures to ensure that treatment and the clinical equipment used meets infection control guidance.  A review of infection control policies is undertaken annually to ensure that they are adequate and meet national guidance and all clinical staff undertake annual training on infection control.

We carry out an annual infection control audit to make sure that our infection control procedures are working and an audit of minor surgery was recently undertaking in which no infections were reported.

Our infection control lead at Theatre Royal Surgery is Catherine Crosland, Lead Practice Nurse.

Access to Records

In accordance with the Data Protection Act (1998) and Access to Health Records Act, patients may request to see their medical records.  Such requests should be made through the Operations Manager (Trudy Dye).

As of 01 April 2016, you have the option to view additional information in your medical record online.  This includes a summary of information relating to medication, allergies and adverse reactions, coded data is now also included.  Access to this type of information requires additional security considerations.

Any patient wishing to use this facility will need to apply, in person, to our reception team.  Your identify will need to be verified by means of photographic documentation and it will be necessary to read and understand an explanatory leaflet before consenting and applying to online access.

Other online services:

    • Online appointment booking
    • Online prescription ordering
    • For those patients who have decided not to opt out, the surgery provides an automated daily upload of any changes to a patient's summary information to the Summary Care Record (SCR).  Summary information (i.e. core SCR) includes medications, allergies and adverse reactions.  Patient implied consent is required.
    • GP2GP record transfer (this means that if patients move between practices, their computerised clinical record can be transferred as well as their paper notes)

GP Training

We are an accredited GP training practice and regularly have medical students from the UEA Medical School being taught within the surgery.

Read more about our current training programme by clicking on 'teaching & research' in the further information menu located at the bottom of the website.

From time to time we sometimes have medical students from other areas, practice and community nurses, students, and administrative staff training (under supervision) in our surgery.

In recent years Theatre Royal Surgery has been pleased to welcome GPs and other clinicians from around the world to either visit or spend a week or two with us to observe how an English general practice works.

Call 111 when you need medical help fast but it’s not a 999 emergencyNHS ChoicesThis site is brought to you by My Surgery Website