Use of Artificial Intelligence Privacy Notice

Introduction

At Hildenborough and Tonbridge Medical Group, we have a legal duty to explain how we use any personal information we collect about you at the organisation.

Why do we have to provide this privacy notice?

We are required to provide you with this privacy notice by law. It provides information about how we use the personal and healthcare information we collect, store and hold about you and is aligned to the Practice Privacy Notice. If you have any questions about this privacy notice or are unclear about how we process or use your personal information or have any other issue regarding your personal and healthcare information, then please contact our Data Protection Officer who is the Practice Manager.

The main things the law says we must tell you about what we do with your personal data are:

• We must let you know why we collect personal and healthcare information about you
• We must let you know how we use any personal and/or healthcare information we hold about you
• We need to inform you in respect of what we do with it
• We need to tell you about who we share it with or pass it on to and why
• We need to let you know how long we can keep it for

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the common law duty of confidentiality and NHS information governance requirements.

Lawful basis

The use of AI does not change the lawful basis for processing your personal data. We rely on:

• Article 6(1)(e) UK GDPR – Public task.
• Article 9(2)(h) UK GDPR – Health or social care purposes.

Where AI is used to support individual care, we rely on implied consent, as you would reasonably expect your data to be used in this way.

Automated decision making

We do not use AI to make solely automated decisions about your care that produce legal or similarly significant effects. Clinical decisions remain under the control of qualified healthcare professionals.

Which AI tools will we use?

This organisation uses AI tools to give us the ability to create human-like text and context and answer questions in a conversational manner. These AI tools are used to simplify processes to improve the efficiency, quality and speed of our business processes so valuable clinical staff time can be better used in delivering patient care.

At Hildenborough and Tonbridge Medical Group the following AI tools are used:

• Anima - NHS-approved online consultation platform designed for patients to submit medical or administrative queries.
• Anima Documents - an NHS-approved digital tool used by GP practices to automate the handling of incoming paperwork like hospital letters and test results. It uses AI to read documents, match them to the correct patient, write short summaries, and suggest clinical codes and follow-up tasks, saving staff time and reducing backlogs
• Abtrace - London-based health-tech company that provides an AI-driven,clinically validated software platform for GP practices to automate patient monitoring and safety checks.

All suppliers are subject to contractual controls and data protection requirements.

How do we use AI?

The use of AI is the biggest and fastest moving change to computing in recent years. It is a new technology that requires careful governance to ensure its use is safe and does not expose personal data about our service users and staff to unnecessary risk.

Examples of its use include:

• Internal business meeting notes and any action points
• Summaries of multi-disciplinary team meetings where our service users and patients cases are discussed
• To support both the compiling and documenting of a patient’s clinical record

If you have concerns about the use of AI tools during your care, please discuss these with your clinician. Where appropriate, we will consider whether alternative arrangements can be made.

• The clinician will always review and, if necessary, correct the recordings before it is used as part of your healthcare record. No decisions about your care will be made by AI algorithms.

Governance of AI

We are aware of the risks when using AI. It is totally dependent upon development and training so we must be mindful of some key risks when it can:

• Get things wrong and present incorrect statements as facts (a flaw known as 'AI hallucination')
• Be biased and often gullible when responding to leading questions
• Be coaxed into creating toxic content as it is prone to 'prompt injection attacks'
• Be corrupted by manipulating the data used to train the model (a technique known as 'data poisoning')

Before their use is approved, AI tools are subject to enhanced Data Protection Impact Assessments for the specific use case requested. These are considered by the Information Governance Lead and Data Protection Officer to decide if they are fit for use.

AI tools are used to support staff decision-making and record keeping. Clinical decisions are always made by appropriately qualified healthcare professionals. AI outputs are reviewed by staff and are not relied upon without human oversight.

How we handle your information

We are required by law to provide you with the following information about how we handle your information:

Data Controller

The Hildenborough and Tonbridge Medical Group

Information Governance

Dr Tara Sheehan, IG lead

Purpose of the processing

In support of direct health or social care to individual patients. 

The main types of personal data that will be processed during a consultation or multi-disciplinary meeting would be the patient’s name, contact details, medical history, diagnosis, treatment information, and any other information shared during consultations or the meeting. 

This may also include an audio recording of the clinician(s), although this is to detail their professional identifiers such as name and title. 

To check and review the quality of the AI use which is called audit and clinical governance.

Lawful basis for processing

These purposes are supported under the following sections of the GDPR:

• Article 6(1)(c) 'processing is necessary for compliance with a legal obligation'
• Article 6(1)(e) 'processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller'

Healthcare staff will also respect and comply with their obligations under the common law duty of confidence.

Recipient or categories of recipients of the processed data

Some examples of where AI technology is used within the practice:

• Clinical Decision Support System (CDSS) is a software tool used by the practice to support direct patient care. It securely analyses information already held within the practice clinical system to help identify patients who may require reviews, monitoring, screening, vaccinations or other clinical interventions. The system provides prompts and recall functions to support clinicians and practice staff in delivering safe, proactive and effective care.
• Online Consultation System is a digital platform used by the practice to receive and manage patient requests online. Patients can submit medical or administrative queries, and the system securely routes requests to the appropriate practice team. Anima includes a feature that creates a summary of information provided by patients to assist practice staff with triage. All decisions about patient care are made by healthcare professionals and not by AI.

Right to access and correct

You have the right to access your medical record and have any errors or mistakes corrected. Please speak to a member of staff or look at our Access to Medical Records and Online Services Policy.

We are not aware of any circumstances in which you will have the right to delete correct information from your medical record; although you are free to obtain your own legal advice if you believe there is no lawful purpose for which we hold the information and contact us if you hold a different view.

Retention period

Information generated during clinical care becomes part of the patient's health record and is retained in accordance with the NHS Records Management Code of Practice.

Right to complain

In the unlikely event that you are unhappy with any element of our data-processing methods, do please contact the Practice Manager in the first instance. If you feel that we have not addressed your concern appropriately, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).