Purpose of the processing

The GP Connect service allows GP practices and clinical staff to share GP practice clinical information and data between IT systems quickly and efficiently for the purpose of direct care.

This makes data from clinical systems available in real time, in a standardised format that can be used across different systems and be made available to health and social care professionals (or those who work under their authority) who need access to the data for direct patient care.

From a privacy and data protection perspective, the service provides a method of secure information transfer and reduces the need to use less secure or less efficient methods of information transfer, such as email or telephone. 

NHS England is also responsible for ensuring that the messages traverse NHS England’s Infrastructure securely, accurately and safely to and from provider and consumer systems for the purposes of direct patient care.

NHS England is the data controller of the message audit data.

The patient information contained within the messages is not collected or stored by NHS England. NHS England processes the messages on behalf of the GP practices, which are controllers of the GP patient record.

This DPIA assesses the risks associated with NHS England’s role as controller as part of GP Connect Service. This means that it covers how the messages are transferred securely over NHS England infrastructure, including

• the safe and accurate transfer of messages over NHS England Infrastructure to provider and consumer systems
• the collection and storage of audit data which is collected as part of the message transaction
• the assurance of the components that directly interact with the NHS England infrastructure to deliver the GP Connect Service

Details of NHS England’s responsibilities are set out within this DPIA. 

This DPIA also consider the risks to end users of GP Connect from the perspective of those who are both providers and consumers.

It is the legal responsibility of each data controller who is a user of the GP Connect Service, to assess and manage their own data protection risks.