Rise Park Surgery uses a mailing company called Docmail to handle some mailings to patients. Typically this is for bulk mailings such as the invitations to attend health follow ups where it is difficult to accommodate the administrative work involved without affecting our ability to serve patients.
This is permissible under guidance from both the Information Commissioner’s Office (ICO) and the Department of Health (DoH) subject to the provisions of the Data Protection Act
Please find below some more information about Docmail and how we work with them to ensure that we protect our patients’ personal data at all times.
What is Docmail
Docmail is provided by CFH Docmail Ltd a secure print and mailing company which provides print and mailing services for Local Government, GPs, Dentists, Medical Practices, Schools, Exam Boards and Banks etc. throughout the UK.
The system can be found online at www.docmail.co.uk and requires a secure user name and password for us to log on and upload our letters and address lists to create the printed output for despatch to Royal Mail. The system allows us to upload a letter template and mailing data for the patients we want to write to via a secure web portal.
2 The Data Protection Act (1998) (DPA)
Rise Park Surgery and Docmail are both fully compliant with the Data Protection Act.
The Information Commissioners Office issued guidance in February 2012 for organisations that outsource some of its data processing to a third party. The Data Protection Act allows outsourcing to take place but stipulates certain conditions that must be met for it to be compliant.
An organisation that processes personal data is required to handle personal data in accordance with the data protection principles. A data controller may choose to use another organisation to process personal data on its behalf – a data processor.
The data controller remains responsible for ensuring its processing complies with the DPA, whether it processes in-house or engages a data processor.
Where a data processor is used the data controller must ensure that suitable security arrangements are in place in order to comply with the seventh data protection principle.
Further extracts from the guidance are reproduced here and the entire document is available on the ICO website.
Rise Park Surgery has strictly adhered to this guidance in setting up the partnership with Docmail.
Rise Park Surgery remains the data controller and as such has the responsibility for ensuring compliance with the provisions of the Act. We are not able to pass on those responsibilities to Docmail whose role is that of a data processor.
There is a written contract between Wareham Surgery and CFH – Total Document Management Ltd in addition to the standard terms of business that are published on the Docmail website. That contract stipulates that Docmail can only act in accordance with instructions from Wareham Surgery i.e. they can only print and mail letters in accordance with data provided by us. They are not able to do anything else with that data. The contract also creates a legal requirement for Docmail to act in accordance with the seventh principle of the Data Protection Act.
3 Connecting For Health
Docmail has achieved a 100% rating in the Department of Health’s Information Governance Toolkit Assessment for 2014-2015 and we meet with the terms and conditions of the DH Information Governance Assurance Statement. This assessment is publicly available and can be viewed here
The letters will be delivered to your address by Royal Mail in the normal way. The letters will carry the Docmail logo and the return address on the reverse side. This address does not identify the letter as having come from a doctor’s surgery.
Docmail delete the personal data 28 days after the mailing.
If you have any questions or require further information about this please ask to speak to the Practice Manager.