• The practice uses manual and computer systems for administration and patient clinical care.
• We are in the process of becoming 'paper light' which means all clinical records will eventually be computerised.
• We have disease registers which are used to help maximise patients health and in reviewing and monitoring chronic illness such as heart disease, diabetes and women having cervical smears.
• We may use the information for other reasons such as research, audit, training and planning purposes.
• We take great care to ensure that we maintain high standards of confidentiality at all times.
• We are registered with the Data Protection Agency and comply with their regulations. This gives you rights of access to the information held in both electronic and paper records.
• You may ask your doctor to see your medical record.
• Information is shared when appropriate, between health professionals and on occasions with other agencies such as social work. If any information is shared with non NHS professionals, you will be made aware of this and it will be discussed with you.
• Anti fraud measures demand that our systems are scrutinised from time to time by non clinical personnel. They have to respect confidentiality and have special rules covering their access and work practice that have been agreed by professional and governmental bodies.

We will record details of your medical history, personal life and treatment as part of your routine care. Our staff need this information to care for you properly and, like all staff working in the NHS, they are bound by a strict code of confidentiality. We will keep this information in your medical case record folder or on computer.

Members of the NHS team looking after you will share your personal health information; you will normally meet all of the staff and be introduced to them by name. This may also include students and trainees in medicine, nursing or other health care professions who are looking after you. Students and trainees are also bound by the same high standards of confidentiality. Your information will not be available or shared with NHS staff, trainees or students who are not looking after you directly and do not need to know it. This is called the "need to know" principle.

We may share some of your personal information with those staff outside the NHS that work closely with us to provide for your care and other needs, for example in social work and education services. The information is restricted to those items that they "need to know" in order to help you. We will always ask you for permission to share this information. If you agree, your relatives, friends and carers can also be kept up to date with the progress of your treatment.

We, like all other NHS bodies, have appointed a "Caldicott Guardian". The Guardian's job is to oversee how we use information and enforce patients' rights to confidentiality.

The NHS uses information from patients for a wide range of other purposes. Using information in this way is extremely valuable and can improve healthcare for everybody. We may use it to

• protect the health of the general public
• check that we run our services efficiently
• plan health services for the future
• train our staff
• carry out medical research

When we use information in this way it is usually made anonymous, however we do sometimes use information that identifies individuals and these uses are explained below. This information is always kept confidential and is only used if authorised by our Caldicott Guardian.

We may record some of your personal health information in databases used by doctors and others for clinical audit. This is one way in which we maintain high-quality care; we will check a group of similar cases to your own against agreed standards to see where improvements can be made. Some of these audits are done over groups of hospitals, over Scotland or even the whole UK. In these cases we make every effort to use anonymous information. We are obliged to act on refusal to participate if possible.

We may use some of your personal health information in research. This is when health care staff use information from their patients to help them find the causes of disease and the effects of treatment and for planning new treatments. If the research involves you personally you will be contacted and asked for your consent.

Sometimes we are required by law to pass on information, for example to notify a birth or report certain infectious diseases for public health reasons. The Scottish Executive Health Department also requires information from us to help monitor health services and plan for the future. We send basic personal details of all the patients we care for, along with information about their hospital or clinic attendance, to the NHS Information and Statistics Division.

The new act gives you the right to know how we will use your personal health information. This information can only give a short description of how we use information but NHS Lothian's Data Protection Officer will be happy to answer any questions you may have. You also have the right to object to us making use of your information. You can ask us to change or restrict the way we use your information and we are obliged to agree if it is possible to do so. Again our Data Protection Officer will be happy to provide you with guidance. Where we have a legal duty to notify information about health, e.g. notifiable diseases regulations, this information must be disclosed. The new Act also gives you the right of access to any personal information that we hold about you, either in written medical records or on computer. If you wish to see or get a copy of your information, You should contact the Practice Manager in the practice you attended. They will explain how to access Your record and can arrange for any abbreviations or jargon in the record to be explained to you. If you think any of the information in your record is inaccurate, incomplete or out of date you can ask to have the record amended.