How Your Information is Used - Fair Processing Notice

ACTIVITY PURPOSE

RATIONALE

Complaints

Rationale

We will process your personal information where it relates to a complaint where you have asked for our help or involvement.

The information we will require when you make a complaint will be:

• Your name, address and contact telephone number and those of the person that you may be complaining for; including their date of birth and NHS Number
• A summary of what has happened, giving dates where possible
• Which organisation provided the care or service
• A list of things that you are complaining about
• What you would like to happen as a result of your complaint

Legal Basis

The CCG has a duty as to the improvement in quality of services under Section 14R NHS Act 2006 and will rely on your explicit consent as the basis to undertake such activities.

Complaint Process

When we receive a complaint from an individual we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service being provided.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute.

If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with NHS retention policy. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

We may use service user stories, following upheld complaints, but the individual will remain anonymous. The service user stories will provide a summary of the concern, service improvements identified and how well the complaints procedure has been applied. Explicit consent will always be sought from the service user and carer or both before we use the service user story.

To make a complaint, please use the details on our http://www.eastberkshireccg.nhs.uk/contact-us page.

Benefits

Managing complaints enables the CCG to continuously improve the quality of the services they commission.

Retention Period

Information relating to complaints will be retained for 10 years after which time the information will be reviewed and if no longer necessary will be destroyed.

Individual Funding Request (IFR)

Rationale

We will collect and process your personal information where we are requested to fund a specific treatment or service for a condition that is not routinely offered by the NHS.

This is called an “Individual Funding Request” (IFR).

Legal Basis

The CCG has a duty to have regard to the need to reduce health inequalities in access to health services and health outcomes achieved as outlined in the  National Health Service Commissioning Board and Clinical Commissioning Groups (Responsibilities and Standing Rules) Regulations 2012 (SI 2012 No 2996) (Part 7-34 (1) and (2).

The clinical professional who first identifies that you may need the treatment will explain to you the information that we need to collect and process in order for us to assess your needs and commission your care and will ask for your informed consent for personal clinical information to be shared with the CCG.

Benefits

The Individual Funding Request process allows East Berkshire CCG to look at evidence for the safety and effectiveness of any treatment and ensures that the services we pay for will give patients the greatest health gains from the finite resources we have available.

Retention Period

Information relating to Individual Funding Requests will be retained for 2 years if funding is rejected and 8 years if funding is accepted after which time the information will be reviewed and if no longer necessary will be destroyed.

Continuing Healthcare

Rationale

We will collect and process your identifiable information where you have asked us to undertake assessments for your continuing healthcare which is a package of care that is arranged and funded solely by the NHS for individuals who are not in hospital but have been assessed as having a “primary health need”.

This is called “Continuing Health Care” (CHC)

Legal Basis

The CCG has a duty to have regard to the need to reduce health inequalities in access to health services and health outcomes achieved as outlined in the National Health Service Commissioning Board and Clinical Commissioning Groups (Responsibilities and Standing Rules) Regulations 2012 (SI 2012 No 2996) (Part 6-20-22.

The clinical professional who first sees you to discuss your needs will explain to you the information that they need to collect and process in order for us to assess your needs and commission your care and will ask for your informed consent for personal clinical information to be shared with the CCG.

Benefits

East Berkshire CCG can arrange a care and support package that meets your assessed needs.  The CCG can determine how your needs and care will be managed, where your care will be given e.g. in your own home or in a care home and identify which organization will be responsible for meeting your needs.

Retention Period

Information relating to Continuing Healthcare will be retained for 8 years after which time the information will be reviewed and if no longer necessary will be destroyed.

Medicines Optimisation

Rationale

Medicines Optimisation is about ensuring that the right patients get the right choice of medicine at the right time.   By focusing on patients and their experiences, the goal is to help patients to improve their outcomes, take their medicines correctly, avoid taking unnecessary medicines, reduce wastage of medicine and improve medicines safety.  Ultimately medicines optimisation can help encourage patient to take ownership of their treatment.

To achieve the above we will process your personal data for the following purposes:

1. To carry out direct patient-facing activities on behalf of or at the request of a GP or General Practice.
2. To undertake analysis using specific criteria to identify individual patients that may benefit from a safer, more effective and / or more efficient medicinal regimes and approaches.  This analysis may be carried out proactively or at the direct request of a General Practices and all lead to recommendations to the responsible clinician
3.  To carry out administrative purposes which are necessary to ensure that the right payments are made and staff are suitably trained to undertake the work safely and effectively

Legal Basis

The CCG will rely on the below legal basis to process personal data for the purposes of medicines optimisation:

• Health & Social Care Act 2012 (Section 251b) (duty to share)
• NHS Act 2006 (Section 3a) (duty as to provision of certain services)
• GDPR Articles 6(1)(e) and 9(2)(h)

Retention Period

The CCG will hold your information for a period of 5 years.  Before records are destroyed we will review information held and take into account any further retention periods which may oblige us to hold the information for a further period of time.

Benefits

East Berkshire CCG can carry out Medicines Optimisation activities to ensure that patients receive prescribed items which are clinically effective and cost effective based on individual, local and national health population needs.  We can also benchmark and share best practice at a practice level, locally and nationally to further improve our patients’ experience of prescribed items and to the benefit of our local population.

Clinical Concerns

Rationale

Clinical Concerns was developed in response to the Francis Report 2013 and is a process through which the CCG works in collaboration with General Practices and other local healthcare Providers to gather intelligence about the quality and safety of local services and to facilitate learning and improvement.

Your General Practice has appointed the CCG as the Data Processor to process Clinical Concerns on their behalf and have a Data Processing Agreement in place which identifies General Practice as the Data Controller and the CCG as the Data Processor. The Data Processing Agreement details the boundaries of sharing information and is reviewed on an annual basis.

In order to facilitate the investigation of Clinical Concerns, your General Practice will provide the CCG with your NHS Number. The CCG will share this with the relevant healthcare providers involved in your care and treatment in order for them to investigate. The aim of this investigation is to resolve any outstanding issues in relation to the individual’s care and treatment and to provide an opportunity to improve the quality of the service. The CCG will not use your NHS number for any other purpose.

Legal Basis

The General Practice will rely on GDPR Articles 6(1)(e) and 9(2)(h) and the Health & Social Care Act (duty to share) as a legal basis to raise a Clinical Concern. The General Practice will provide you with comprehensive information by way of a Fair Processing Notice which clearly details the data sharing relationship with the CCG.

The CCG will rely on the NHS Act 2006 Section 13R and 14Q as a legal basis to support their enactment of the following commissioning duties:

• Information on safety of services provided by the health service
• Duty as to effectiveness and efficiency
• Duty as to the improvement in the quality of services

Benefits

To assist with the gathering of intelligence about the quality and safety of local services and to facilitate learning and improvement.

Retention Period

The CCG will hold your information for a period of 10 years following the closure of a clinical concern. Before records are destroyed we will review information held and take into account any serious incident retentions which may require us to hold the information for a further period of time. Each case will be reviewed on an individual basis.

Learning Disabilities Mortality Review (LeDeR) Programme

Rationale

The Learning Disabilities Mortality Review (LeDeR) Programme aims to review the death of any person who lived with learning disabilities, identifying any health and social care factors relating to the death where things could have been done differently, and seeking to ensure that where care and treatment have not been at the expected standard this is not repeated elsewhere. The programme is co-ordinated by the University of Bristol in partnership with NHS England. East Berkshire CCG participates in the programme by co-ordinating reviews at a local level.

The LeDeR programme office (University of Bristol) can be told about the death of a person with learning disabilities by anyone holding that information. This could be, for example, a health or care professional, a relative, a service manager or another person with learning disabilities. When the death is notified to the programme, via a secure web portal, personal information about the person who has died is collected. This information is then shared with the CCG in the locality where the patient had been registered with their GP. The CCG co-ordinates the mortality reviews for its geographical area at the local level, and is therefore privy to all of the information about the case communicated from the LeDeR programme office. The information is communicated via a secure web platform.

The CCG appoints a trained reviewer who then seeks further information about the person who has died from health or care professionals who have been involved in supporting that person. The reviewer may ask them questions about the health and care of the person, their diagnosis and treatments, and the circumstances leading up to their death. The reviewer may also need to look in the person’s health or care records to check how their care was delivered. The reviewer will also make contact, when possible, with those closest to the person, including their families and/or carer, so that they can contribute to the review, should they wish. This will be done with the family and/or carer consent. The personal identifiable information collected for LeDeR reviews is uploaded, stored and communicated via a secure web platform hosted by the University of Bristol and covered by rigorous processes that meet NHS information governance requirements.

The information that the LeDeR programme gathers about people with learning disabilities who have died includes:

• Personal details: (name, date of birth, date of death, gender, ethnicity, postcode, NHS number). These details help to identify the person who has died so that a local reviewer can trace their service contacts and conduct a review into their death.
• Information about the circumstances leading to the person’s death, that is held in health or social care records, in order to review the person’s care, assess best practice and identify where service improvements may be required.
• Information about the person’s relative or next of kin (name, contact details, relationship), in order to invite them to contribute their views to the review.
• Information about the person’s cause of death. The central LeDeR programme office will share the NHS number (or any other information that could identify the person, e.g. date of birth and date of death) with NHS Digital. NHS Digital link this to information about cause of death held by the Office for National Statistics and send back to the LeDeR programme office the coding for the causes of death for people with learning disabilities whose deaths have been reviewed.

Reports shared with local steering groups and other forums for the promotion of improvement and learning are shared in anonymised form with personal identifiers redacted.

Legal Basis

The LeDeR Programme has obtained Section 251 approval from the Health Research Authority’s Confidentiality Advisory Group (CAG 251), on behalf of the Secretary of State, allowing it to handle identifiable data without consent in order to conduct a review of a death, and to link it to NHS Digital cause of death data. The reference number for this is: 16/CAG/0056. CAG 251 allows data to be stored for the purpose of the programme for 10 years.

Benefits

To make improvements to the lives of people with learning disabilities by identifying any potentially modifiable factors associated with a person's death, and working to ensure that these are not repeated elsewhere.

Retention Period

Information relating to LeDeR reviews is retained by the University of Bristol for a period of 10 years from the completion of a review. The CCG will not retain personal identifiable information relating to reviews locally, but will keep on file for 10 years anonymised review reports. 

Assuring Transformation

Rationale

Assuring Transformation data is information we collect about people with a learning disability, autism or both who are getting care in hospitals for their mental health or because they have had behavior that can be challenging.

The CCG collects this data each month from healthcare Providers which is collected by NHS Digital. NHS Digital will publish a monthly progress report and provide this information to NHS England.  These reports do not include any personal information.  There is a calendar that tells you exactly when it will be published.

This information informs NHS England of:

• how many people are in hospital
• how long they have been in hospital for
• when their care and treatment is checked
• what kind of hospital they are in

NHS England will check this information to make sure people are not in hospital if they would be better looked after in the community.

NHS England has produced an Assuring Transformation Easy Read Leaflet which can be obtained from your healthcare Provider.

Legal Basis

Assuring Transformation is a mandatory data collection of which has been approved by the Secretary of State under Regulations enabled by Section 251 of the NHS Act 2006 reference CAG 8-02(a-c)/2014.

If you do not want your information to be included in these collections please contact us.

Benefits

The published report allows the public to check if the NHS is doing a good job of looking after people with a learning disability, autism or both who are in hospital and assists NHS England in determining whether patients are getting the right care in the right place. 

Safeguarding

Rationale

Safeguarding means protecting peoples' health, wellbeing and human rights, and enabling them to live free from harm, abuse and neglect. It is a key part of providing high-quality health and social care.  The CCG will participate in Serious Case Reviews undertaken by either the local Children’s Safeguarding Boards or the Adult Safeguarding Boards for continued learning, to minimize risk and to improve services.  As part of delegated commissioning arrangements the Designated Adults Safeguarding Manager (DASM) will act on behalf of Primary Care and will be provided with personal confidential information specific to an individual case. The DASM will review this information and produce an anonymized report which is signed by the organisations Caldicott Guardian and submitted to the relevant Children or Adult Safeguarding Boards at which point personal confidential information provided to the CCG is destroyed.

Legal Basis

The CCG has a statutory responsibility under the Children Act 2004, Care Act 2014 and safeguarding provision within the Data Protection Act 2018 (Schedule 1, Part 2, Subsections 18 and 19) to ensure the safety of all children, and the safety of adults at risk of abuse and neglect.

Benefits

Safeguarding is a fundamental element of the CCGs commissioning plans and forms a core part of the commissioning assurance process.

Retention Period

The CCG will hold your information for a period of 8 years following the closure of a case. Before records are destroyed we will review information held and take into account any serious incident retentions which may require us to hold the information for a further period of time. Each case will be reviewed on an individual basis.

Risk stratification

Rationale

Risk stratification is a process that uses de-identified personal data from health care services to determine which people are at risk of experiencing certain outcomes, such as unplanned hospital admissions.

Data Processing activities for Risk Stratification

Risk stratification tools are used by CCGs to analyse the overall health of a population using data which is anonymised in line with the Information Commissioner's Office (ICO) Anonymisation Code of Practice.  The combined CCGs Secondary Use Service (SUS) data and GP data which contains an identifier (usually NHS number) is made available to clinicians with a legitimate relationship with their patients to enable them to identify which patients should be offered targeted preventative support to reduce those risks.

The CCG has commissioned NHS South, Central and West Commissioning Support Unit (SCWCSU) to provide the risk stratification software solution on behalf of itself and its GP practices.

This processing takes place under contract following the below steps:

• NHS Digital has a legal obligation to obtain data from providers of NHS care such as the local hospital or community hospital.  This data is then sent to the SCWCSU DSCRO and amended so that only your NHS number could identify you. The data is then provided to SCWCSU for processing in the risk stratification software. The CCG has signed a Data Sharing Contract with NHS Digital for the use of this data, called Secondary Use Services (SUS) data.
• Your GP practice enables an organisation called Graphnet Healthcare, to extract data from your records which again, is only identifiable by your NHS Number.  This data will only be extracted and provided to SCWCSU for those patients that have not objected to Risk Stratification or where no other type of objection to information sharing has been recorded on your record. The data, containing the same verified NHS numbers, are sent via secure transfer, directly to SCWCSU by Graphnet.
• SCWCSU then link both sets of data using their risk stratification software.  An algorithm is run on the data to generate a risk score for each Patient. The CCG is able to see data only after your NHS number has been removed and replaced by a pseudonymised reference.  Your GP will be able to see the data with your NHS number in it so that it can identify if you require further support from them to manage your healthcare needs.

The risk scores are only made available to authorized users within the GP Practice where you are registered via a secure portal managed by SCWCSU.

If you do not wish information about you to be included in the risk stratification programme please contact your GP Practice. They can add a code to your records that will stop your information from being used for this purpose.

Further information about risk stratification is available from: https//www.england.nhs.uk/ourwork/tsd/ig/risk-stratification/

Legal Basis

The use of identifiable data by CCGs and GPs for risk stratification has been approved by the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority and this approval has been extended to October 2018 which gives us a statutory legal basis under Section 251 of the NHS Act 2006 to process data for risk stratification purposes which sets aside the duty of confidentiality. We are committed to conducting risk stratification effectively, in ways that are consistent with the laws that protect your confidentiality.

Benefits

CCGs and GPs use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable admissions.  Typically this is because patients have a long term condition such as    Chronic    Obstructive    Pulmonary    Disease.    NHS    England encourages CCGs and GPs to use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable admissions.

Knowledge of the risk profile of our population will help the CCG to commission appropriate preventative services and to promote quality improvement in collaboration with our GP practices.

Invoice Validation

Rationale

The Invoice Validation process ensures that care providers who provide you with care and treatment can be paid for the services they provide.

Care providers submit their invoices to NHS Shared Business Services (NHS SBS) who process invoices on behalf of NHS East Berkshire CCG. NHS SBS do not require and should not receive any patient confidential data to provide their services.

There are situations where identifiable patient personal data is required to ensure that the correct service provider is paid.

In such cases service providers are required to send identifiable patient personal data such as NHS Number to a Controlled Environment for Finance (CEfF) which is a secure restricted area within SCWCSU who process this data on our behalf and indicate which invoices we can validate (authorize) for payment. NHS England has published guidance on how invoices must be processed and Commissioners have a duty to detect report and investigate any incidents of where a breach of confidentiality has been made.

For more information see: https://www.england.nhs.uk/ourwork/tsd/ig/in-val/invoice- validation-faqs/

Legal Basis

The legal basis for SCWCSU to receive personal identifiable data for the purposes of invoice validation is provided by Section 251 of the NHS Act 2006 and will rely on GDPR Articles 6(1)(e) and 9(2)(h).

Benefits

The invoice validation process supports the delivery of patient care by ensuring that:

• service providers are paid for patients treatment,
• enables services to be planned, commissioned, managed and subjected to financial control,
• enables commissioners to confirm that they are paying appropriately for the treatment of patients for whom they are responsible
• fulfilling commissioners duties of fiscal probity and scrutiny
• enables invoices to be challenged and disputed or discrepancies resolved 

Retention Period

Information relating to Invoice Validation will be retained for 3 years.

Patient and Public Involvement

Rationale

If you have asked us to keep you regularly informed and up to date about the work of the CCG or if you are actively involved in our engagement and consultation activities or patient participation groups, we will collect and process personal confidential data which you share with us.

This is called ‘Patient and Public Involvement’

Where you submit your details to us for involvement purposes, we will only use your information for this purpose. You can opt out at any time by contacting us using our contact details at the end of this document.

Individuals can also complete online surveys via our Citizen Space website in which you will be asked to agree to the Terms and Conditions of using the site and will be asked for your explicit consent for us to use your information in which we will publish survey results.  We will only use your information for this purpose of which you can opt out at any time.

Legal Basis

Under the NHS Act 2006 Section 14Z2, the CCG has a duty, in relation to health services provided (or which are to be provided) under arrangements made by the CCG exercising its functions, to make arrangements so as to secure that individuals to whom the services are being (or may be) provided are involved at various specified stages.

We will rely on your explicit consent for this purpose.

Where you have agreed to participate in online surveys on our Citizen Space site, your information will be held for 6 months following the publication of survey results after which you’re your information will be deleted.  If we need to keep your information for longer the retention period will be provided on the Citizen Space Privacy Notice.

Benefits

If you would like to find out more information on how to get involved and how this benefits East Berkshire CCG, please see our Getting Involved pages: https://www.eastberkshireccg.nhs.uk/getting-involved/

Records Retention

Where you have provided us with your contact details for us to keep in touch, we will contact you periodically to ensure you are still happy for us to hold these details. If we do not hear back from you we will delete your information from our database.

Commissioning

Rationale

To collect NHS data about service users that we are responsible for.

Legal Basis

Under the Health & Social Care Act 2012 the CCG has a statutory legal basis for collecting and processing information for the purposes of commissioning and will rely on GDPR Articles 6(1)(e) and 9(2)(h).

Processing Activities

Hospitals and community organisations that provide NHS-funded care are legally and contractually obliged to submit certain information to NHS Digital about services provided to our service users.

This information is generally known as commissioning datasets. The CCG obtains these datasets from NHS Digital and they relate to service users registered with GP Practices that are members of the CCG.

These datasets are then used in a format that does not directly identify you, for wider NHS purposes such as managing and funding the NHS, monitoring activity to understand and plan the health needs of the population, and to gain evidence that will improve health and care through research.

The datasets include information about the service users who have received care and treatment from those services that we are responsible for funding. The CCG is unable to identify you from these datasets. They do not include your name, home address, NHS number, post code or date of birth.  Information such as your age, ethnicity and gender, as well as coded information about any clinic or accident and emergency attendances, hospital admissions and treatment will be included.

The specific terms and conditions and security controls that we are obliged to follow when using these commissioning datasets can also be found on the NHS Digital website.

We also receive similar information from GP Practices within our CCG membership that does not identify you.

Benefits

We use these datasets for a number of purposes such as:

• Performance managing contracts;
• Reviewing the care delivered by providers to ensure service users are receiving quality and cost effective care;
• To prepare statistics on NHS performance to understand health needs and support service re-design, modernisation and improvement;
• To help us plan future services to ensure they continue to meet our local population needs;
• To reconcile claims for payments for services received in your GP Practice;
• To audit NHS accounts and services.

If you do not wish your information to be included in these datasets, even though it does not directly identify you to us, please contact your GP Practice and they can apply a code to your records that will stop your information from being included.

Primary and Secondary Care

Rationale

We commission a number of organisations to provide primary and secondary healthcare services to you. These organisations may be within the NHS or outside the NHS.

Primary Care services cover GP Practices, Dental Practices, Community Pharmacies and high street Optometrists.

Secondary Care services are usually (but not always) delivered in a hospital or clinic with the initial referral being received from Primary Care.

These organisations may share identifiable, pseudonymised, anonymized, aggregated and personal confidential data information with us for the following purposes:

• To look after the health of the general public such as notifying central NHS groups of outbreaks of infectious diseases
• To undertake clinical audit of the quality of services provided
• To carry out risk profiling to identify patients who would benefit from proactive intervention
• To perform case management where the NHS offers intervention and integrated care programmes involving multiple health and social care providers
• To report and investigate, complaints, claims and untoward incidents
• To prepare statistics on our performance for the Department of Health
• To review out care to make sure that it is of the highest standard

Legal Basis

The Health & Social Care Act 2012 allows us to collect your information and is only accessed a limited number of authorised staff and not disclosed to other organisations. We will never share your personal information unless a legal basis has been identified for the different purposes of sharing or we have obtained your explicit consent.

Benefits

Through sharing information ethically and lawfully the NHS is able to improve its understanding of the most important health needs and the quality of the treatment and care provided.

Cabinet Office

Rationale

The Cabinet Office is responsible for carrying out data matching exercises. Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information.  Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

We participate in the Cabinet Office’s National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise, as detailed here.

Legal Basis

The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under GDPR.

Data matching by the Cabinet Office is subject to a Code of Practice.

View further information on the Cabinet Office’s legal powers and the reasons why it matches particular information:

https://www.gov.uk/government/publications/code-of-data-matching-practice-for-national-fraud-initiative

National Registries

National Registries (such as the Learning Disabilities Register) have statutory permission under Section 251 (16/CAG/0056) of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user.

Research

Data may be collected for the purpose of research.

Research can be undertaken using information that does not identify you (anonymised). The law does not require your consent to be obtained in this case but information should be made available to you where your anonymised data is used for the purposes of research. Information can be made available either in waiting rooms, using information leaflets, published on notice boards, waiting room screens and/or an organisations website.

Where identifiable data is needed for research, you may be approached by an organisation who has provided you with care and asked if you wish to participate in a research study.  Where identifiable data is required, an organisation must obtain explicit consent.  A member of the research team will discuss the research study with you and will provide you with information on what the study is about, what information they wish to collect, how to opt out and who to contact for more information.

If you do not wish your information to be used for research, whether identifiable or non-identifiable, please let your GP Practice know. They will add a code to your records that will stop your information from being used for research.

Legal Basis

Your explicit consent will be obtained as the legal basis to process identifiable information for research purposes.

Benefits

Results from research studies can provide a direct benefit to individuals who take part in medical trials and indirect benefit to the population as a whole.

Retention Period

Retention periods will be included in the research study Information Leaflet related to each study.

NHS SOUTH, CENTRAL & WEST COMMISSIONING SUPPORT UNIT (SCWCSU)

Purpose

Type of Data

Legal Basis

• personal
• special category

• personal
• special category

• personal
• special category

• personal
• special category

• personal
• special category

Assurance:

• Legal Basis identified for each data flow
• Service Level Agreement in place between EBCCG and SCWCSU.

NHS SOUTH, CENTRAL & WEST COMMISSIONING SUPPORT UNIT (SCWCSU)

SCW HR Privacy Statement

Privacy Statement

·       special category

&

GDPR (EU) 2016/679

Articles 6, 1 (b) & 9, 2 (b)(g)(h)

Legal Basis identified for each data flow

Service Level Agreement in place between EBCCG and SCWCSU.

NHS SOUTH, CENTRAL & WEST COMMISSIONING SUPPORT UNIT (SCWCSU)

DSCRO

Purpose

Type of Data

Legal Basis

• personal

GDPR Articles 6(1)(e) and 9(2)(h)

• personal
• special category

• personal
• special category

pseudonymised

Health and Social Care Act 2012 / GDPR Articles 6(1)(e) and 9(2)(h)

• personal
• special category

pseudonymised

• special category pseudonymised

• special category pseudonymised

• special category pseudonymised

• special category pseudonymised

• special category pseudonymised

• special category pseudonymised

Additional Assurance:

• Legal Basis identified or each data flow
• Data Sharing Framework Contract
• Data Sharing Agreement

OPTUM HEALTH SOLUTIONS (UK) LTD

Purpose

Type of Data

Legal Basis

• Pseudonymised SUS data and local flows from London Providers (Admitted patient Care, A&E, Outpatients and Critical Care data extracts).

&

Health and Social Care Act 2012

Additional Assurance:

• Legal Basis is identified for data flows
• NHS National Standard Contract
• Achieved full ISO 27001 Accreditation
• Information Governance Toolkit Level 2 Compliance (ODS Code: 8GW39)
• Service Contract and Data Processing Agreement between CCGs and Optum