NHS East Berkshire Clinical Commissioning Group (CCG) is responsible for securing, planning, designing and paying for your NHS services, including planned and emergency hospital care, mental health, rehabilitation, community and primary medical care (GP) services. This is known as commissioning. We need to use information about you to enable us to do this effectively, efficiently and safely.
For further information please refer to the ‘About Us’ page on our internet: http://www.eastberkshireccg.nhs.uk/about-us
This Fair Processing Notice (also known as a Privacy Notice) is part of our programme to make the data processing activities we are carrying out in order to meet our commissioning obligations transparent.
This notice tells you about information we collect and hold about you, what we do with it, how we will look after it and who we might share it with.
It covers information we collect directly from you or receive from other individuals or organisations.
If you require any additional information or explanation requests for this should be sent to this email address: Eastberksccgs.enquiries@nhs.net , or by post to:
NHS East Berkshire Clinical Commissioning Group (CCG)
King Edward VII Hospital
St Leonard’s Road
Windsor
SL4 3DP
We will keep our Fair Processing Notice under regular review. This notice was last reviewed on 24 May 2018.
We are committed to protecting your privacy and will only process data in accordance with the Data Protection Legislation. This includes the General Data Protection Regulation (EU) 2016/679 (GDPR), the Data Protection Act (DPA) 2018, the Law Enforcement Directive (Directive (EU) 2016/680) (LED) and any applicable national Laws implementing them as amended from time to time.
In addition, consideration will also be given to all applicable Law concerning privacy, confidentiality, the processing and sharing of personal data including the Human Rights Act 1998, the Health and Social Care Act 2012 as amended by the Health and Social Care (Safety and Quality) Act 2015, the common law duty of confidentiality and the Privacy and Electronic Communications (EC Directive) Regulations.
NHS East Berkshire CCG is a Data Controller as defined under the GDPR. We are legally responsible for ensuring that all personal information that we process i.e. hold, obtain, record, use or share about you, is done in compliance with the Data Protection Principles as set out in Article 5 under GDPR.
All data controllers must notify the Information Commissioner’s Office (ICO) of all personal information processing activities. Our ICO Data Protection Registration number is ZA334333 and our entry can be found in the Data Protection Register on the Information Commissioner’s Office website
Everyone working for the NHS has a legal duty to keep information about you confidential. The NHS Care Record Guarantee and NHS Constitution provide a commitment that all NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and promote your health and wellbeing.
If you are receiving services from the NHS, we share information that does not identify you (anonymised) with other NHS and social care partner agencies for the purpose of improving local services, research, audit and public health.
We would not share information that identifies you unless we have a fair and lawful basis such as:
and/or
The CCG is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.
All information that we hold about you will be held securely and confidentially. We use administrative and technical controls to do this. We use strict controls to ensure that only a limited amount of authorised staff are able to see information that identifies you where it is appropriate to their role and is strictly on a need-to-know basis.
All of our staff, contractors and committee members receive role appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.
We will only use the minimum amount of information necessary about you.
We will only retain information in accordance with the schedules set out in the Records Management Code of Practice for Health and Social Care 2016.
Your information will not be sent outside of the United Kingdom where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.
GDPR provides the following rights for individuals:
If you do not agree to certain information being processed or shared with us, or by us, or have any concern, then please let us know.
You have the right to refuse/withdraw consent to information sharing at any time. The possible consequences can be fully explained to you and could include delays in receiving care. If you wish to discuss withdrawing consent please contact the CCGs Patient Advice and Liaison Service, CSCSU.PALSCOMPLAINTS@nhs.net. Telephone: 0300 123 6258
The NHS Constitution states "You have the right to request that your confidential information is not used beyond your own direct care and treatment and to have your objections considered".
Direct care is defined as a clinical, social or public health activity concerned with the prevention, investigation and treatment of illness and the alleviation or suffering of an individual.
Indirect care is defined as work within the health and social care environment which does not involve the direct treatment or support of individuals e.g. research, commissioning and much of the work done in public health.
There are several forms of opt-outs available at different levels. These include for example:
A. Information directly collected by the CCG:
Your choices can be exercised by withdrawing your consent for the sharing of information that identifies you, unless there is no overriding legal obligation.
B. Information not directly collected by the CCG, but collected by organisations that provide NHS services:
Your right to opt out of data sharing and processing
The NHS Constitution states ‘You have a right to request that your personal confidential information is not used beyond your own care and treatment and to have your objections considered’. For further information please visit: https://www.gov.uk/government/publications/the-nhs-constitution-for-england
There are several forms of opt- outs available at different levels:
If you do not want personal confidential information that identifies you to be shared outside your GP practice you can register a ‘Type 1 opt-out’ with your GP practice. This prevents your personal confidential information from being used except for your direct health care needs and in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease. Patients are only able to register the opt-out at their GP practice and your records will be identified using a particular code that will stop your records from being shared outside of your GP Practice.
National data opt-out
The national data opt-out was introduced on 25 May 2018 and replaces the previous ‘type 2’ opt-out. NHS Digital collects information from a range of places where people receive care, such as hospitals and community services. The new programme provides a facility for individuals to opt-out from the use of their data for research or planning purposes. For anyone who had an existing type 2 opt-out, it will have been automatically converted to a national data opt-out from 25 May 2018 and will receive a letter giving them more information and a leaflet explaining the new national data opt-out. The national data opt-out choice can be viewed or changed at any time by using the online service at www.nhs.uk/your-nhs-data-matters “
It is also important to note that by exercising your right to “Opt Out”, there could be consequences. These situations will be discussed with you by your GP or by NHS Digital depending on whether you choose Type 1 Opt-Out or Type 2 Opt-Out.
We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
Individuals can find out if we hold any personal information by making a request under the Right of Access under GDPR, more commonly called a ‘Subject Access Request’.
If we do hold information about you we will:
We will hold Subject Access Requests for 3 years after closure at which time the retention period will be reviewed on an individual basis. If a Subject Access Request has been subject to an appeal we will be required to hold your information for 6 years after closure at which time your information will be destroyed.
For further information on how to make a request go to: http://www.eastberkshireccg.nhs.uk/about-us/how-we-spend-the-money/freedom-of-information/
If you require further advice, you can contact us on: 01753 636840 or via email: Eastberksccgs.enquiries@nhs.net or put your request in writing to:
The FOI Coordinator,
NHS East Berkshire Clinical Commissioning Group,
King Edward VII Hospital,
St. Leonards Road,
Windsor,
Berkshire,
SL4 3DP
The CCG has an Executive Director responsible for protecting the confidentiality of patient information. This person is called the Caldicott Guardian who oversees the arrangements for the use and sharing of patient information. The Caldicott Guardian plays a key role in ensuring that the NHS, Councils with Social Services and Public Health responsibilities and Partner Organisations satisfy the highest practical standards for handling patient information. Acting as the ‘conscience’ of the organisation, the Caldicott Guardian actively supports work to enable information sharing where it is appropriate to share and advises on options for lawful and ethical processing of information.
The Caldicott Guardian for this organisation is:
The CCG has a Data Protection Officer (DPO) responsible for monitoring compliance with the GDPR and other data protection legislation, the organisations data protection policies, awareness-raising, training and audits. The DPO acts as a contact point for the ICO, our employees and the public. They co-operate with the ICO and will consult on any other matter relevant to Data Protection.
The DPO for this organisation is:
Assistant Director for Strategic Programmes and Planning & Data Protection Officer - Frimley Collaborative
Mobile: 07899 048510
Email: eastberksccg.dpo@nhs.net
As a commissioner, we do not routinely hold or have access to your medical records. However, we may need to hold some personal information about you, for example:
Our records may include relevant information that you have told us, or information provided on your behalf by relatives or those who care for you and know you well, or from health professionals and other staff directly involved in your care and treatment.
Our records may be held on paper or in a computer system. The types of information that we may collect and use include the following:
Although this is not an exhaustive detailed listing, the following table lists key examples of the purposes and rationale for why we collect and process information:
ACTIVITY PURPOSE |
RATIONALE |
Complaints |
RationaleWe will process your personal information where it relates to a complaint where you have asked for our help or involvement. The information we will require when you make a complaint will be:
Legal BasisThe CCG has a duty as to the improvement in quality of services under Section 14R NHS Act 2006 and will rely on your explicit consent as the basis to undertake such activities. Complaint ProcessWhen we receive a complaint from an individual we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint. We will only use the personal information we collect to process the complaint and to check on the level of service being provided. We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis. We will keep personal information contained in complaint files in line with NHS retention policy. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle. We may use service user stories, following upheld complaints, but the individual will remain anonymous. The service user stories will provide a summary of the concern, service improvements identified and how well the complaints procedure has been applied. Explicit consent will always be sought from the service user and carer or both before we use the service user story. To make a complaint, please use the details on our http://www.eastberkshireccg.nhs.uk/contact-us page. BenefitsManaging complaints enables the CCG to continuously improve the quality of the services they commission. Retention PeriodInformation relating to complaints will be retained for 10 years after which time the information will be reviewed and if no longer necessary will be destroyed. |
Individual Funding Request (IFR) |
RationaleWe will collect and process your personal information where we are requested to fund a specific treatment or service for a condition that is not routinely offered by the NHS. This is called an “Individual Funding Request” (IFR). Legal BasisThe CCG has a duty to have regard to the need to reduce health inequalities in access to health services and health outcomes achieved as outlined in the National Health Service Commissioning Board and Clinical Commissioning Groups (Responsibilities and Standing Rules) Regulations 2012 (SI 2012 No 2996) (Part 7-34 (1) and (2). The clinical professional who first identifies that you may need the treatment will explain to you the information that we need to collect and process in order for us to assess your needs and commission your care and will ask for your informed consent for personal clinical information to be shared with the CCG. BenefitsThe Individual Funding Request process allows East Berkshire CCG to look at evidence for the safety and effectiveness of any treatment and ensures that the services we pay for will give patients the greatest health gains from the finite resources we have available. Retention PeriodInformation relating to Individual Funding Requests will be retained for 2 years if funding is rejected and 8 years if funding is accepted after which time the information will be reviewed and if no longer necessary will be destroyed. |
Continuing Healthcare |
RationaleWe will collect and process your identifiable information where you have asked us to undertake assessments for your continuing healthcare which is a package of care that is arranged and funded solely by the NHS for individuals who are not in hospital but have been assessed as having a “primary health need”. This is called “Continuing Health Care” (CHC) Legal BasisThe CCG has a duty to have regard to the need to reduce health inequalities in access to health services and health outcomes achieved as outlined in the National Health Service Commissioning Board and Clinical Commissioning Groups (Responsibilities and Standing Rules) Regulations 2012 (SI 2012 No 2996) (Part 6-20-22. The clinical professional who first sees you to discuss your needs will explain to you the information that they need to collect and process in order for us to assess your needs and commission your care and will ask for your informed consent for personal clinical information to be shared with the CCG. BenefitsEast Berkshire CCG can arrange a care and support package that meets your assessed needs. The CCG can determine how your needs and care will be managed, where your care will be given e.g. in your own home or in a care home and identify which organization will be responsible for meeting your needs. Retention PeriodInformation relating to Continuing Healthcare will be retained for 8 years after which time the information will be reviewed and if no longer necessary will be destroyed. |
Medicines Optimisation |
RationaleMedicines Optimisation is about ensuring that the right patients get the right choice of medicine at the right time. By focusing on patients and their experiences, the goal is to help patients to improve their outcomes, take their medicines correctly, avoid taking unnecessary medicines, reduce wastage of medicine and improve medicines safety. Ultimately medicines optimisation can help encourage patient to take ownership of their treatment. To achieve the above we will process your personal data for the following purposes:
Legal BasisThe CCG will rely on the below legal basis to process personal data for the purposes of medicines optimisation:
Retention PeriodThe CCG will hold your information for a period of 5 years. Before records are destroyed we will review information held and take into account any further retention periods which may oblige us to hold the information for a further period of time. BenefitsEast Berkshire CCG can carry out Medicines Optimisation activities to ensure that patients receive prescribed items which are clinically effective and cost effective based on individual, local and national health population needs. We can also benchmark and share best practice at a practice level, locally and nationally to further improve our patients’ experience of prescribed items and to the benefit of our local population. |
Clinical Concerns |
RationaleClinical Concerns was developed in response to the Francis Report 2013 and is a process through which the CCG works in collaboration with General Practices and other local healthcare Providers to gather intelligence about the quality and safety of local services and to facilitate learning and improvement. Your General Practice has appointed the CCG as the Data Processor to process Clinical Concerns on their behalf and have a Data Processing Agreement in place which identifies General Practice as the Data Controller and the CCG as the Data Processor. The Data Processing Agreement details the boundaries of sharing information and is reviewed on an annual basis. In order to facilitate the investigation of Clinical Concerns, your General Practice will provide the CCG with your NHS Number. The CCG will share this with the relevant healthcare providers involved in your care and treatment in order for them to investigate. The aim of this investigation is to resolve any outstanding issues in relation to the individual’s care and treatment and to provide an opportunity to improve the quality of the service. The CCG will not use your NHS number for any other purpose. Legal BasisThe General Practice will rely on GDPR Articles 6(1)(e) and 9(2)(h) and the Health & Social Care Act (duty to share) as a legal basis to raise a Clinical Concern. The General Practice will provide you with comprehensive information by way of a Fair Processing Notice which clearly details the data sharing relationship with the CCG. The CCG will rely on the NHS Act 2006 Section 13R and 14Q as a legal basis to support their enactment of the following commissioning duties:
BenefitsTo assist with the gathering of intelligence about the quality and safety of local services and to facilitate learning and improvement. Retention PeriodThe CCG will hold your information for a period of 10 years following the closure of a clinical concern. Before records are destroyed we will review information held and take into account any serious incident retentions which may require us to hold the information for a further period of time. Each case will be reviewed on an individual basis. |
Learning Disabilities Mortality Review (LeDeR) Programme |
RationaleThe Learning Disabilities Mortality Review (LeDeR) Programme aims to review the death of any person who lived with learning disabilities, identifying any health and social care factors relating to the death where things could have been done differently, and seeking to ensure that where care and treatment have not been at the expected standard this is not repeated elsewhere. The programme is co-ordinated by the University of Bristol in partnership with NHS England. East Berkshire CCG participates in the programme by co-ordinating reviews at a local level. The LeDeR programme office (University of Bristol) can be told about the death of a person with learning disabilities by anyone holding that information. This could be, for example, a health or care professional, a relative, a service manager or another person with learning disabilities. When the death is notified to the programme, via a secure web portal, personal information about the person who has died is collected. This information is then shared with the CCG in the locality where the patient had been registered with their GP. The CCG co-ordinates the mortality reviews for its geographical area at the local level, and is therefore privy to all of the information about the case communicated from the LeDeR programme office. The information is communicated via a secure web platform. The CCG appoints a trained reviewer who then seeks further information about the person who has died from health or care professionals who have been involved in supporting that person. The reviewer may ask them questions about the health and care of the person, their diagnosis and treatments, and the circumstances leading up to their death. The reviewer may also need to look in the person’s health or care records to check how their care was delivered. The reviewer will also make contact, when possible, with those closest to the person, including their families and/or carer, so that they can contribute to the review, should they wish. This will be done with the family and/or carer consent. The personal identifiable information collected for LeDeR reviews is uploaded, stored and communicated via a secure web platform hosted by the University of Bristol and covered by rigorous processes that meet NHS information governance requirements. The information that the LeDeR programme gathers about people with learning disabilities who have died includes:
Reports shared with local steering groups and other forums for the promotion of improvement and learning are shared in anonymised form with personal identifiers redacted. Legal BasisThe LeDeR Programme has obtained Section 251 approval from the Health Research Authority’s Confidentiality Advisory Group (CAG 251), on behalf of the Secretary of State, allowing it to handle identifiable data without consent in order to conduct a review of a death, and to link it to NHS Digital cause of death data. The reference number for this is: 16/CAG/0056. CAG 251 allows data to be stored for the purpose of the programme for 10 years. BenefitsTo make improvements to the lives of people with learning disabilities by identifying any potentially modifiable factors associated with a person's death, and working to ensure that these are not repeated elsewhere. Retention PeriodInformation relating to LeDeR reviews is retained by the University of Bristol for a period of 10 years from the completion of a review. The CCG will not retain personal identifiable information relating to reviews locally, but will keep on file for 10 years anonymised review reports. |
Assuring Transformation |
RationaleAssuring Transformation data is information we collect about people with a learning disability, autism or both who are getting care in hospitals for their mental health or because they have had behavior that can be challenging. The CCG collects this data each month from healthcare Providers which is collected by NHS Digital. NHS Digital will publish a monthly progress report and provide this information to NHS England. These reports do not include any personal information. There is a calendar that tells you exactly when it will be published. This information informs NHS England of:
NHS England will check this information to make sure people are not in hospital if they would be better looked after in the community. NHS England has produced an Assuring Transformation Easy Read Leaflet which can be obtained from your healthcare Provider. Legal BasisAssuring Transformation is a mandatory data collection of which has been approved by the Secretary of State under Regulations enabled by Section 251 of the NHS Act 2006 reference CAG 8-02(a-c)/2014. If you do not want your information to be included in these collections please contact us. BenefitsThe published report allows the public to check if the NHS is doing a good job of looking after people with a learning disability, autism or both who are in hospital and assists NHS England in determining whether patients are getting the right care in the right place. |
Safeguarding |
RationaleSafeguarding means protecting peoples' health, wellbeing and human rights, and enabling them to live free from harm, abuse and neglect. It is a key part of providing high-quality health and social care. The CCG will participate in Serious Case Reviews undertaken by either the local Children’s Safeguarding Boards or the Adult Safeguarding Boards for continued learning, to minimize risk and to improve services. As part of delegated commissioning arrangements the Designated Adults Safeguarding Manager (DASM) will act on behalf of Primary Care and will be provided with personal confidential information specific to an individual case. The DASM will review this information and produce an anonymized report which is signed by the organisations Caldicott Guardian and submitted to the relevant Children or Adult Safeguarding Boards at which point personal confidential information provided to the CCG is destroyed. Legal BasisThe CCG has a statutory responsibility under the Children Act 2004, Care Act 2014 and safeguarding provision within the Data Protection Act 2018 (Schedule 1, Part 2, Subsections 18 and 19) to ensure the safety of all children, and the safety of adults at risk of abuse and neglect. BenefitsSafeguarding is a fundamental element of the CCGs commissioning plans and forms a core part of the commissioning assurance process. Retention PeriodThe CCG will hold your information for a period of 8 years following the closure of a case. Before records are destroyed we will review information held and take into account any serious incident retentions which may require us to hold the information for a further period of time. Each case will be reviewed on an individual basis. |
Infection Prevention and Control |
Rationale
CCGs collaborate with Public Health service (both Public Health England and the Local Authority) and NHS England and work closely with provider organisations involved in patient care to jointly identify and agree the possible causes of, factors that contributed to, and learning related to the prevention and reduction of infections. We will process personal information (e.g. name, address, date of birth) and special category (e.g. healthcare). Information may be shared with Primary and Secondary healthcare providers and with the Local Authority who are responsible for Public Health within the CCG boundary. Legal Basis Under the Health & Social Care Act 2008: Code of Practice for the NHS for the Prevention and Control of Healthcare Associated Infections (revised January 2015) and Regulation 3 of The Health Service (Control of Patient Information) Regulations 2002 the CCG has a statutory legal basis for collecting and processing information for the purposes of Infection Control and will rely on GDPR Articles 6(1)(e) and 9(2)(i) where processing is necessary for reasons of public interest. Benefits CCGs participate/lead on Post Infection Review in the circumstances set out in the Post Infection Review Guidance issued by NHS England. The CCG gathers this information from Healthcare Providers and uses the results to inform the mandatory healthcare associated infections reporting systems and identify learning in order to reduce and prevent further infections. Retention Period Post infection reviews may be kept up to eight years. |
Risk stratification |
RationaleRisk stratification is a process that uses de-identified personal data from health care services to determine which people are at risk of experiencing certain outcomes, such as unplanned hospital admissions. Data Processing activities for Risk StratificationRisk stratification tools are used by CCGs to analyse the overall health of a population using data which is anonymised in line with the Information Commissioner's Office (ICO) Anonymisation Code of Practice. The combined CCGs Secondary Use Service (SUS) data and GP data which contains an identifier (usually NHS number) is made available to clinicians with a legitimate relationship with their patients to enable them to identify which patients should be offered targeted preventative support to reduce those risks. The CCG has commissioned NHS South, Central and West Commissioning Support Unit (SCWCSU) to provide the risk stratification software solution on behalf of itself and its GP practices. This processing takes place under contract following the below steps:
The risk scores are only made available to authorized users within the GP Practice where you are registered via a secure portal managed by SCWCSU. If you do not wish information about you to be included in the risk stratification programme please contact your GP Practice. They can add a code to your records that will stop your information from being used for this purpose. Further information about risk stratification is available from: https//www.england.nhs.uk/ourwork/tsd/ig/risk-stratification/ Legal BasisThe use of identifiable data by CCGs and GPs for risk stratification has been approved by the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority and this approval has been extended to October 2018 which gives us a statutory legal basis under Section 251 of the NHS Act 2006 to process data for risk stratification purposes which sets aside the duty of confidentiality. We are committed to conducting risk stratification effectively, in ways that are consistent with the laws that protect your confidentiality. BenefitsCCGs and GPs use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable admissions. Typically this is because patients have a long term condition such as Chronic Obstructive Pulmonary Disease. NHS England encourages CCGs and GPs to use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable admissions. Knowledge of the risk profile of our population will help the CCG to commission appropriate preventative services and to promote quality improvement in collaboration with our GP practices. |
Invoice Validation |
RationaleThe Invoice Validation process ensures that care providers who provide you with care and treatment can be paid for the services they provide. Care providers submit their invoices to NHS Shared Business Services (NHS SBS) who process invoices on behalf of NHS East Berkshire CCG. NHS SBS do not require and should not receive any patient confidential data to provide their services. There are situations where identifiable patient personal data is required to ensure that the correct service provider is paid. In such cases service providers are required to send identifiable patient personal data such as NHS Number to a Controlled Environment for Finance (CEfF) which is a secure restricted area within SCWCSU who process this data on our behalf and indicate which invoices we can validate (authorize) for payment. NHS England has published guidance on how invoices must be processed and Commissioners have a duty to detect report and investigate any incidents of where a breach of confidentiality has been made. For more information see: https://www.england.nhs.uk/ourwork/tsd/ig/in-val/invoice- validation-faqs/ Legal BasisThe legal basis for SCWCSU to receive personal identifiable data for the purposes of invoice validation is provided by Section 251 of the NHS Act 2006 and will rely on GDPR Articles 6(1)(e) and 9(2)(h). BenefitsThe invoice validation process supports the delivery of patient care by ensuring that:
Retention Period Information relating to Invoice Validation will be retained for 3 years. |
Patient and Public Involvement |
RationaleIf you have asked us to keep you regularly informed and up to date about the work of the CCG or if you are actively involved in our engagement and consultation activities or patient participation groups, we will collect and process personal confidential data which you share with us. This is called ‘Patient and Public Involvement’ Where you submit your details to us for involvement purposes, we will only use your information for this purpose. You can opt out at any time by contacting us using our contact details at the end of this document. Individuals can also complete online surveys via our Citizen Space website in which you will be asked to agree to the Terms and Conditions of using the site and will be asked for your explicit consent for us to use your information in which we will publish survey results. We will only use your information for this purpose of which you can opt out at any time. Legal BasisUnder the NHS Act 2006 Section 14Z2, the CCG has a duty, in relation to health services provided (or which are to be provided) under arrangements made by the CCG exercising its functions, to make arrangements so as to secure that individuals to whom the services are being (or may be) provided are involved at various specified stages. We will rely on your explicit consent for this purpose. Where you have agreed to participate in online surveys on our Citizen Space site, your information will be held for 6 months following the publication of survey results after which you’re your information will be deleted. If we need to keep your information for longer the retention period will be provided on the Citizen Space Privacy Notice. BenefitsIf you would like to find out more information on how to get involved and how this benefits East Berkshire CCG, please see our Getting Involved pages: https://www.eastberkshireccg.nhs.uk/getting-involved/ Records RetentionWhere you have provided us with your contact details for us to keep in touch, we will contact you periodically to ensure you are still happy for us to hold these details. If we do not hear back from you we will delete your information from our database. |
Commissioning |
RationaleTo collect NHS data about service users that we are responsible for. Legal BasisUnder the Health & Social Care Act 2012 the CCG has a statutory legal basis for collecting and processing information for the purposes of commissioning and will rely on GDPR Articles 6(1)(e) and 9(2)(h). Processing ActivitiesHospitals and community organisations that provide NHS-funded care are legally and contractually obliged to submit certain information to NHS Digital about services provided to our service users. This information is generally known as commissioning datasets. The CCG obtains these datasets from NHS Digital and they relate to service users registered with GP Practices that are members of the CCG. These datasets are then used in a format that does not directly identify you, for wider NHS purposes such as managing and funding the NHS, monitoring activity to understand and plan the health needs of the population, and to gain evidence that will improve health and care through research. The datasets include information about the service users who have received care and treatment from those services that we are responsible for funding. The CCG is unable to identify you from these datasets. They do not include your name, home address, NHS number, post code or date of birth. Information such as your age, ethnicity and gender, as well as coded information about any clinic or accident and emergency attendances, hospital admissions and treatment will be included. The specific terms and conditions and security controls that we are obliged to follow when using these commissioning datasets can also be found on the NHS Digital website. We also receive similar information from GP Practices within our CCG membership that does not identify you. BenefitsWe use these datasets for a number of purposes such as:
If you do not wish your information to be included in these datasets, even though it does not directly identify you to us, please contact your GP Practice and they can apply a code to your records that will stop your information from being included. |
Primary and Secondary Care |
RationaleWe commission a number of organisations to provide primary and secondary healthcare services to you. These organisations may be within the NHS or outside the NHS. Primary Care services cover GP Practices, Dental Practices, Community Pharmacies and high street Optometrists. Secondary Care services are usually (but not always) delivered in a hospital or clinic with the initial referral being received from Primary Care. These organisations may share identifiable, pseudonymised, anonymized, aggregated and personal confidential data information with us for the following purposes:
Legal BasisThe Health & Social Care Act 2012 allows us to collect your information and is only accessed a limited number of authorised staff and not disclosed to other organisations. We will never share your personal information unless a legal basis has been identified for the different purposes of sharing or we have obtained your explicit consent. BenefitsThrough sharing information ethically and lawfully the NHS is able to improve its understanding of the most important health needs and the quality of the treatment and care provided.
|
Cabinet Office |
RationaleThe Cabinet Office is responsible for carrying out data matching exercises. Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out. We participate in the Cabinet Office’s National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise, as detailed here. Legal BasisThe use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under GDPR. Data matching by the Cabinet Office is subject to a Code of Practice. View further information on the Cabinet Office’s legal powers and the reasons why it matches particular information: |
National Registries |
National Registries (such as the Learning Disabilities Register) have statutory permission under Section 251 (16/CAG/0056) of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user.
|
Research |
Data may be collected for the purpose of research.Research can be undertaken using information that does not identify you (anonymised). The law does not require your consent to be obtained in this case but information should be made available to you where your anonymised data is used for the purposes of research. Information can be made available either in waiting rooms, using information leaflets, published on notice boards, waiting room screens and/or an organisations website. Where identifiable data is needed for research, you may be approached by an organisation who has provided you with care and asked if you wish to participate in a research study. Where identifiable data is required, an organisation must obtain explicit consent. A member of the research team will discuss the research study with you and will provide you with information on what the study is about, what information they wish to collect, how to opt out and who to contact for more information. If you do not wish your information to be used for research, whether identifiable or non-identifiable, please let your GP Practice know. They will add a code to your records that will stop your information from being used for research. Legal BasisYour explicit consent will be obtained as the legal basis to process identifiable information for research purposes. BenefitsResults from research studies can provide a direct benefit to individuals who take part in medical trials and indirect benefit to the population as a whole. Retention PeriodRetention periods will be included in the research study Information Leaflet related to each study. |
The CCG will use other organisations to provide us with support services. These organisations will process information on our behalf. These organisations are known as “data processors” and will provide additional expertise to support the work of East Berkshire CCG:
Legal Basis
East Berkshire CCG are committed to ensure that a legal basis is identified for all flows of personal identifiable to external organisations.
The CCG ensures that this is supported by use of an NHS Standard Contract which is mandated by NHS England for use by commissioners for all contracts for healthcare services other than primary care. The NHS Standard Contract covers:
In addition a Data Sharing Framework Contract (DSFC) and Data Sharing Agreement (DSA) are in place with NHS Digital for the release of patient level data and Service Level Agreements are in place with NHS South Central and West Commissioning Support Unit (SCWCSU) for the services they provide.
The below tables outline the organisations we use, services they provide and CCGs legal basis for processing your information:
NHS SOUTH, CENTRAL & WEST COMMISSIONING SUPPORT UNIT (SCWCSU)
|
||
Purpose |
Type of Data |
Legal Basis |
| PALs and Complaints |
|
NHS Act – Section 14R / Consent |
| Subject Access Requests |
|
GDPR & Data Protection Act / Consent |
| Individual Funding Requests
|
|
Health and Social Care Act 2012 / Consent |
| Invoice Validation
|
|
S251 NHS Act 2006/ GDPR Articles 6(1)(e) and 9(2)(h) |
| Risk Stratification
|
|
S251 NHS Act 2006/ GDPR Articles 6(1)(e) and 9(2)(h) |
Assurance:
|
||
|
NHS SOUTH, CENTRAL & WEST COMMISSIONING SUPPORT UNIT (SCWCSU)
|
||
| Purpose | Type of Data | Legal Basis |
| Human Resources - Staff Recruitment & Employment Data
SCW HR Privacy Statement
|
· personal
· special category |
NHS Act 2006 & Health & Social Care Act (Ability for CCG to act as an employer).
& GDPR (EU) 2016/679 Articles 6, 1 (b) & 9, 2 (b)(g)(h) |
| Assurance:
Legal Basis identified for each data flow Service Level Agreement in place between EBCCG and SCWCSU. |
||
NHS SOUTH, CENTRAL & WEST COMMISSIONING SUPPORT UNIT (SCWCSU)DSCRO |
||
Purpose |
Type of Data |
Legal Basis |
| Invoice Validation |
|
S251 S251 NHS Act 2006/
GDPR Articles 6(1)(e) and 9(2)(h)
|
| Risk Stratification |
|
S251 NHS Act 2006 / GDPR Articles 6(1)(e) and 9(2)(h) |
| Secondary Use Service (SUS) |
pseudonymised |
S251 NHS Act 2006
Health and Social Care Act 2012 / GDPR Articles 6(1)(e) and 9(2)(h) |
| Local Flows from Acute, Ambulance, Demand for Service, Diagnostic Services, Emergency Care, Experience, Quality & Outcomes, Mental Health, Population, Primary Care, Public Health Screening |
pseudonymised |
Health and Social Care Act 2012/ GDPR Articles 6(1)(e) and 9(2)(h) |
| Mental Health Services |
|
Health and Social Care Act 2012/GDPR Articles 6(1)(e) and 9(2)(h) |
| Improving Access to Psychological Therapy |
|
Health and Social Care Act 2012 /GDPR Articles 6(1)(e) and 9(2)(h) |
| Maternity |
|
Health and Social Care Act 2012 /GDPR Articles 6(1)(e) and 9(2)(h) |
| Mental Health Learning Disability |
|
Health and Social Care Act 2012 /GDPR Articles 6(1)(e) and 9(2)(h) |
| Diagnostic Imaging |
|
Health and Social Care Act 2012 /GDPR Articles 6(1)(e) and 9(2)(h) |
| Child and Young People Health Service |
|
Health and Social Care Act 2012 /GDPR Articles 6(1)(e) and 9(2)(h) |
Additional Assurance:
|
||
OPTUM HEALTH SOLUTIONS (UK) LTD |
||
Purpose |
Type of Data |
Legal Basis |
| Processing of pseudonymised SUS data and local data flows to provide contract management for London Providers commissioned by the group of CCGs known as The London Focus Group. |
|
S251 NHS Act 2006
& Health and Social Care Act 2012 |
Additional Assurance:
|
||
Data may be de-identified and linked by organisations so that it can be used to improve health care and development and monitor NHS performance. Where data is used for these statistical purposes, stringent measures are taken to ensure individual patients cannot be identified. When analysing current health services and proposals for developing future services it is sometimes necessary to link separate individual datasets to be able to produce a comprehensive evaluation. This may involve linking primary care GP data with other data such as secondary uses service (SUS) data (inpatient, outpatient and A&E). In some cases there may also be a need to link local datasets which could include a range of acute-based services such as radiology, physiotherapy, audiology etc, as well as mental health and community-based services such as Improving Access to Psychological Therapies, district nursing, podiatry etc. When carrying out this analysis, the linkage of these datasets is always done using a unique identifier that does not reveal a person’s identity as the CCG does not have any access to patient identifiable data.
East Berkshire CCG will approach the management of its business records in line with their Records Management Policy which sets out roles and responsibilities for records management and the key operating principles for record keeping across the business and manages records in line with the Records Management NHS Code or Practice for Health and Social Care which sets the required standards of practice in the management of records for those who work within or under contract to NHS organisations in England, based on current legal requirements and professional best practice.
The CCGs records shall not be retained indefinitely. At the end of the retention, records shall be disposed of. In most cases this will mean controlled destruction; a small percentage of records may become archived meaning that they will be retained indefinitely under the Public Records Act.
Information Governance is to do with the way organisations ‘process’ or handle information. It covers personal information relating to patients, service users, employees, and corporate information (financial and accounting records.)
The Organisations that we do business with are subject to the same legal rules and conditions for keeping personal confidential data and secure and are underpinned by a contract with us.
Before awarding any contract, we ensure that organisations will look after your information to the same high standards that we do. Those organisations can only use your information for the service we have contracted them for and cannot use it for any other purpose. All organisations are required to complete a Department of Health Information Governance Toolkit which draws together the legal rules and central guidance and presents them in a single standard set of information governance requirements which covers management structures and responsibilities, confidentiality, data protection and information security. All organisations are required to achieve a Level 2 score which demonstrates that organisations can be trusted to maintain the confidentiality and security of personal information and in-turn increases public confidence that the NHS and its partners can be trusted with personal data.
If you have any questions or concerns regarding how we use your information, please contact us at:
Post:
East Berkshire Clinical Commissioning Group (CCG)
King Edward VII Hospital
St Leonard’s Road
Windsor
SL4 3DP
Tel: 01753 636840
For independent advice about data protection, privacy and data-sharing issues, you can contact the:
Information Commissioner
Wycliffe House, Water Lane,
Wilmslow,
Cheshire,
SK9 5AF.
Phone: 08456 306060 or 01625 545745
Website: https://ico.org.uk/
Further information about the way in which the NHS uses personal confidential data and your rights in that respect can be found in:
The NHS Care Record Guarantee:
This guarantee is a commitment that NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and promote your health and wellbeing.
The Constitution establishes the principles and values of the NHS in England. It sets out rights to which patients, public and staff are entitled, and pledges which the NHS is committed to achieve, together with responsibilities, which the public, patients and staff owe to one another to ensure that the NHS operates fairly and effectively
To share or not to share? Information Governance Review:
This was an independent review of information about service users shared across the health and care system led by Dame Fiona Caldicott and was conducted in 2012.
Provides further information about the data flowing within the NHS to support commissioning.
NHS Digital – Guide to Confidentiality:
NHS Digital are the trusted national provider of high-quality information, data and IT systems for health and social care and are responsible for collecting data from across the health and social care system.
Information Commissioner’s Office (ICO):
The ICO is the Regulator for GDPR and offer independent advice and guidance on the law and personal data, including your rights and how to access your personal information.
The HRA protects and promotes the interests of patients and the public in health and social care research.
