NHS Bedfordshire, Luton and Milton Keynes HCP Privacy Notice
Who we are and what we do
NHS Bedfordshire, Luton and Milton Keynes HCP is responsible for securing, planning, designing and paying for your NHS services, including planned and emergency hospital care, mental health services, rehabilitation and community services. This is known as commissioning.
This Privacy Notice is part of our programme to make transparent the data processing activities we are carrying out in order to deliver on our commissioning activities.
We also have a responsibility for arranging unplanned care services, commissioning specialist services for individual patients and supporting the system to manage a national emergency. We also monitor the performance of services to ensure they are safe, provide high quality care, meeting the needs of the local population. Part of this performance management responsibility includes responding to any concerns from patients about services.
What is a Privacy Notice
This Privacy Notice tells you about information we collect and hold about you, what we do with it, how we will look after it and who we might share it with.
It covers information we collect directly from you or receive from other individuals or organisations.
This notice is not exhaustive. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to:-
NHS Bedfordshire, Luton and Milton Keynes ICB
Arndale House
The Mall
LUTON
LU1 2LJ
Email:
blmkicb.contactus@nhs.net
Reviews of and Changes to our Privacy Notice
We will keep our privacy notice under regular review. This privacy notice was last reviewed in October 2022.
Our Commitment to Data Protection and Confidentiality
We are committed to protecting your privacy and will only process personal confidential data in accordance with the UKGDPR and the Data Protection Act, the common law duty of confidentiality and the Human Rights Act 1998.
NHS Bedfordshire, Luton and Milton Keynes HCP is a data controller and therefore legally responsible for ensuring that all personal information is only processed in accordance data protection legislation, and that you have the ability to exercise your rights in respect of your information.
All data controllers must register their processing activities with the Information Commissioner’s Office (ICO). Our ICO Data Protection Register number is
ZB038274 and our entry can be found in the Data Protection Register on the
Information Commissioner’s Office website
Everyone working for the NHS has a legal duty to keep information about you confidential. The NHS Care Record Guarantee and NHS Constitution provide a commitment that all NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and promote your health and wellbeing.
If you are receiving services from the NHS, we share information that does not identify you (anonymised) with other NHS and social care partner agencies for the purpose of improving local services, research, audit and public health.
We would not share information that identifies you unless we have a fair and lawful basis such as:
- You have given us permission;
- To protect children and vulnerable adults;
- When a formal court order has been served upon us;
and/or
- When we are lawfully required to report certain information to the appropriate authorities e.g. to prevent fraud or a serious crime;
- Emergency Planning reasons such as for protecting the health and safety of others;
- When permission is given by the Secretary of State or the Health Research Authority on the advice of the Confidentiality Advisory Group to process confidential information without the explicit consent of individuals.
All information that we hold about you will be held securely and confidentially. We use administrative and technical controls to do this. We use strict controls to ensure that only authorised staff are able to see information that identifies you. Only a limited number of authorised staff have access to information that identifies you where it is appropriate to their role and is strictly on a need-to-know basis.
All of our staff, contractors and committee members receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.
We will only use the minimum amount of information necessary about you.
Information in the HCP is held for a specific length of time depending on the type of information it is. The length of time we retain your information for is defined by the NHS retention schedule which can be viewed online here:
Records Management Code of Practice for Health and Social Care 2021
Once information has been reviewed and is no longer required to be kept by a retention period the information will be securely destroyed. Information is securely destroyed via an approved confidential paper and shredding recycling contractor.
Personal Information we collect and hold about you
As a commissioner, we do not routinely hold or have access to your medical records. However, we may need to hold some personal information about you, for example:
- if you have made a complaint to us about healthcare that you have received and we need to investigate
- if you ask us to provide funding for Continuing Healthcare services
- if you ask us for our help or involvement with your healthcare, or where we are required to fund specific specialised treatment for a particular condition that is not already covered in our contracts with organisations that provide NHS care.
- if you ask us to keep you regularly informed and up-to-date about the work of the HCP, or if you are actively involved in our engagement and consultation activities or service user participation groups.
Our records may include relevant information that you have told us, or information provided on your behalf by relatives or those who care for you and know you well, or from health professionals and other staff directly involved in your care and treatment.
Our records maybe held on paper or in a computer system.
The types of information that we may collect and use include the following:
Personal Confidential Data: This term describes personal information about identified or identifiable individuals, which should be kept private or secret. For the purposes of this guide ‘personal’ includes the DPA definition of personal data, but it is adapted to include dead as well as living people. ‘Confidential’ includes both information ‘given in confidence’ and ‘that which is owed a duty of confidence’ and is adapted to include ‘sensitive’ as defined in the Data Protection Act. Used interchangeably with ‘confidential’ in this document.
Pseudonymised Information: This is data that has undergone a technical process that replaces your identifiable information such as a NHS number, postcode, date of birth with a unique identifier, which obscures the ‘real world’ identity of the individual patient to those working with the data.
Anonymised Information: This is data rendered into a form which does not identify individuals and where there is little or no risk of identification (identification is not likely to take place).
Your Rights
UK GDPR provides the following rights for individuals:
Information directly collected by the HCP:
Your choices can be exercised by withdrawing your consent for the sharing of information that identifies you, unless there is no overriding legal obligation.
We only use your information for lawful purposes in order for us to administer the business of the HCP effectively, and the lawful basis for the HCP to process under the Data Protection Act 2018 is:
- Article 6 (1)(e) Public task: the processing is necessary for the ICB to perform a task in the public interest or for it’s official functions, and the task or function has a clear basis in law.
- Article 9 (2)(b) processing is necessary for the purpose of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union of member State law or a collective agreement pursuant to Member state law providing for appropriate safeguards for the fundamental rights and interests of the data subject.
- Article 9 (2)(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and by means of your consent where applicable.
No automated decision-making, including profiling takes place.
- Information not directly collected by the HCP but collected by organisations that provide NHS services.
Complaints or questions
We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.
Subject Access Requests
Individuals can find out if we hold any personal information by making a ‘subject access request’ under the Data Protection Act 2018. If we do hold information about you we will:
- Give you a description of it;
- Tell you why we are holding it;
- Tell you who it could be disclosed to; and
- Let you have a copy of the information in an intelligible form.
To make a request to any personal information we may hold you need to put the request in writing to our contact address provided further below.
If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting us at the contact address further below.
Key roles in the HCP
The HCP has a number of key roles which support the protection of your data:
- Caldicott Guardian – The HCP’s Caldicott Guardian is a senior person responsible for protecting the confidentiality of patient and service-user information and enabling appropriate information sharing. The Guardian actively supports work to enable information sharing where it is appropriate to share, and advises on options for lawful and ethical processing of information.
- Senior Information Risk Owner (SIRO) – The HCP’s SIRO is an Executive Director with overall responsibility for an organisation’s information risk policy. The SIRO is accountable and responsible for information risk across the organisation. The SIRO ensures that everyone is aware of their personal responsibility to exercise good judgement, and to safeguard and share information appropriately.
- Data Protection Officer (DPO) – The DPO is responsible for making sure that all information held by the ICBs is collected, stored and used in accordance with the Data Protection Act 2018 and UK GDPR. The DPO is also responsible for the management and investigation of information breaches and incidents and for ensuring that the rights of individuals
Our Uses of Information
Although this is not an exhaustive detailed listing, the following table lists key examples of the purposes and rationale for why we collect and process information:
| Purpose/Activity |
Rationale |
| Complaints |
To process your personal information if it relates to a complaint where you have asked for our help or involvement.
Legal Basis
We will need to rely on your explicit consent to undertake such activities.
Complaint Processing Activities
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide.
We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute.
If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with NHS retention policy. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
We will publish service user stories, following upheld complaints, anonymously via our governing body. The service user stories will provide a summary of the concern, service improvements identified and how well the complaints procedure has been applied. Consent will always be sought from the service user and carer or both before we publish the service user story. |
|
|
We will collect and process your personal information where we are required to fund specific treatment for you for a particular condition that is not already covered in our contracts.
This may be called an “Individual Funding Request” (IFR).
Legal Basis
The clinical professional who first identifies that you may need the treatment will explain to you the information that we need to collect and process in order for us to assess your needs and commission your care and gain your explicit consent. |
| Continuing Healthcare
|
We will collect and process your identifiable information where you have asked us to undertake assessments for Continuing Healthcare (a package of care for those with complex medical needs) and commission resulting care packages.
Legal Basis
The clinical professional who first sees you to discuss your needs will explain to you the information that they need to collect and process in order for us to assess your needs and commission your care and gain your explicit consent. |
| Safeguarding
|
We will collect and process identifiable information where we need to assess and evaluate any safeguarding concerns.
Legal Basis
Because of public Interest issues, e.g. to protect the safety and welfare of vulnerable children and adults, we will rely on a statutory basis rather than consent to process information for this use. |
| Risk stratification |
Risk stratification is a process for identifying and managing patients who are at high risk of emergency hospital admission.
Legal Basis
We are committed to conducting risk stratification effectively, in ways that are consistent with the laws that protect your confidentiality.
The use of identifiable data for risk stratification has been approved by the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority (known as Section 251 approval). Further information on Section 251 can be obtained by clicking here. The reference number for the risk stratification approval is CAG7-04(a)/2013. This approval allows your GP, or staff within your GP Practice who are responsible for providing your care, to see information that identifies you, but the ICB staff will only be able to see information in a format that does not reveal your identity.
Commissioning Benefits
Typically this is because patients have a long term condition such as Chronic Obstructive Pulmonary Disease. NHS England encourages HCPs and GPs to use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable admissions.
Knowledge of the risk profile of our population will help the HCP to commission appropriate preventative services and to promote quality improvement in collaboration with our GP practices.
Data Processing activities for Risk Stratification
Risk stratification tools use various combinations of historic information about patients, for example, age, gender, diagnoses and patterns of hospital attendance and admission and primary care data collected in GP practice systems.
The HCP will use pseudonymised information to understand the local population needs, whereas GPs will be able to identify which of their patients are at risk in order to offer a preventative service to them.
This processing for risk stratification is as follows:
- Identifiable SUS+ data is obtained from the SUS Repository to the Data Services for Commissioners Regional Office (DSCRO).
- Data quality management and standardisation of data is completed by the DSCRO and the data identifiable at the level of NHS number is transferred securely to Prescribing Services Ltd, who hold SUS+ data within a secure Data Centre .
- Identifiable GP Data is securely sent from the GP system to Prescribing Services Ltd.
- SUS+ data is linked to GP data in the risk stratification tool by the data processor.
- As part of the risk stratification processing activity, GPs have access to the risk stratification tool within the data processor, which highlights patients with whom the GP has a legitimate relationship and have been classed as at risk. The only identifier available to GPs is the NHS numbers of their own patients. Any further identification of the patients will be completed by the GP on their own systems.
- Once Prescribing Services Ltd has completed the processing, the ICB can access the online system via a secure connection to access the data Pseudonymised at patient level.
The risk scores are only made available to authorised users within the GP Practice where you are registered via a secure portal.
This portal allows only the GPs to view the risk scores for the individual patients registered in their practice in identifiable form.
If you do not wish information about you to be included in our risk stratification programme, please contact your GP Practice. They can add a code to your records that will stop your information from being used for this purpose.
Further information about risk stratification is available from: https://www.england.nhs.uk/ourwork/tsd/ig/risk-stratification/ |
| Invoice Validation
|
NHS Bedfordshire, Luton and Milton Keynes is responsible for paying for health services within Bedfordshire. We are required to check healthcare invoices to ensure that they are accurate and genuine.
To do this the HCP needs to be able to identify you so that the patient and the care provided match. Once your personal details have been used to check the validity of your care invoice, your personal details are deleted from our system before the invoice is processed for payment.
Processing Activities
The Invoice validation process involves using your NHS number and occasionally your postcode or date of birth to establish which NHS organisation is responsible for paying for your treatment. The information is only accessible by named staff in a controlled environment.
This activity is undertaken in house for Bedfordshire, Luton and Milton Keynes patients.
Legal Basis
The Secretary of State for Health has approved the NHS England application for support under Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002 (Section 251 Support). This allows Clinical Commissioning Groups (HCPs) and Commissioning Support Units (CSUs) to process Personal Confidential Data (PCD) which are required for invoice validation purposes. . |
| Patient and Public Involvement |
If you have asked us to keep you regularly informed and up to date about the work of the HCP or if you are actively involved in our engagement and consultation activities or patient participation groups, we will collect and process personal confidential data which you share with us.
Legal Basis
We will rely on your consent for this purpose
Benefits
Where you submit your details to us for involvement purposes, we will only use your information for this purpose. You can opt out at any time by contacting us using our contact details at the end of this document. |
| Commissioning
|
To collect NHS data about service users that we are responsible for.
Legal Basis
Our legal basis for collecting and processing information for this purpose is statutory.
Processing Activities
Hospitals and community organisations that provide NHS-funded care must submit certain information to NHS Digital about services provided to our service users.
This information is generally known as commissioning datasets. The HCP obtains these datasets from NHS Digital and they relate to service users registered with GP Practices that are members of the HCP.
These datasets are then used in a format that does not directly identify you, for wider NHS purposes such as managing and funding the NHS, monitoring activity to understand and plan the health needs of the population and to gain evidence that will improve health and care through research.
The datasets include information about the service users who have received care and treatment from those services that we are responsible for funding. The ICB is unable to identify you from these datasets. They do not include your name, home address, NHS number, post code or date of birth. Information such as your age, ethnicity and gender as well as coded information about any clinic or accident and emergency attendances, hospital admissions and treatment will be included.
The specific terms and conditions and security controls that we are obliged to follow when using those commissioning datasets can also be found on https://digital.nhs.uk/services/secondary-uses-service-sus.
We also receive similar information from GP Practices within our HCP membership that does not identify you. We use this datasets for a number of purposes such as:
- Performance managing contracts;
- Reviewing the care delivered by providers to ensure service users are receiving quality and cost effective care;
- To prepare statistics on NHS performance to understand health needs and support service re-design, modernisation and improvement;
- To help us plan future services to ensure they continue to meet our local population needs;
- To reconcile claims for payments for services received in your GP Practice;
- To audit NHS accounts and services;
If you do not wish your information to be included in these datasets, even though it does not directly identify you, Email:enquiries@nhsdigital.nhs.uk
(please include “national data opt-out policy”) within the subject line.
Telephone: (contact centre): 0300 303 5678. |
| For Other organisations to provide support services for us
|
This often involves those organisations processing data on our behalf.
Legal Basis
Statutory requirement for NHS Digital to collect identifiable information.
A Section 251 approval from the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority, enables the use of pseudonymised information about patients included in the datasets, by the organisations who submitted the information.
There is no requirement for a legal basis for use of the aggregated information which is available to the HCP as this does not identify individuals.
DATA PROCESSORS
Below are details of our data processors and the function that they carry out on our behalf:
· Circle MSK – Provide a musculo skeletal triaging service for the HCP
· Oasis – Archiving of records.
- RSR Consultants – Provide a service for detecting, counting and coding changes.
- Prescribing Services Ltd – Will be providing a Risk Stratification service for the HCP.
- ArdenGEM CSU – process secondary uses of data for Bedfordshire, Luton and Milton Keynes HCP
- HBLICT – provide an IT back up service
These organisations are subject to the same legal rules and conditions for keeping personal confidential data secure and are underpinned by a contract with us. Before awarding any contract, we ensure that organisations will look after your information to the same high standards that we do. Those organisations can only use your information for the service we have contracted them for and cannot use it for any other purpose. Other NHS organisations can act as Data Processors with the same legal rules and conditions applying and with contracts and agreements required to be in place.
Benefits
These organisations are subject to the same legal rules and conditions for keeping personal confidential data and secure and are underpinned by a contract with us.
Before awarding any contract, we ensure that organisations will look after your information to the same high standards that we do. Those organisations can only use your information for the service we have contracted them for and cannot use it for any other purposes. |
| National Registries
|
National Registries (such as the Learning Disabilities Register) have statutory permission under Section 251 of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user. |
| Research
|
To support research oriented proposals and activities in our commissioning system
Legal Basis
Your consent will be obtained by the organisation holding your records before identifiable information about you is disclosed for any research.
Sometimes research can be undertaken using information that does not identify you. The law does not require us to seek your consent in this case, but the organisation holding your information will make notices available on the premises and on the website about any research projects that are undertaken.
Benefits
Researchers can provide direct benefit to individuals who take part in medical trials and indirect benefit to the population as a whole.
Service user records can also be used to identify people to invite them to take part in clinical trials, other interventional studies or studies purely using information from medical records.
Processing Activities
Where identifiable data is needed for research, service users will be approached by the organisation where treatment was received, to see if they wish to participate in research studies. |
| Fraud Prevention
|
NHS Bedfordshire, Luton and Milton Keynes HCP is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.
The Cabinet Office conducts data matching exercises to assist in the prevention and detection of fraud. This is one of the ways in which the Minister for the Cabinet Office takes responsibility within government for public sector efficiency and reform. The Minister for the Cabinet Office is also the Chair of the Fraud, Error and Debt Taskforce, the strategic decision-making body for all fraud and error, debt and grant efficiency initiatives across government.
Data matching involves comparing sets of data, such as the payroll or benefits records of a body, against other records held by the same or another body to see how far they match. The data is usually personal information. The data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.
The processing of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under the Data Protection Act 2018.
All bodies participating in the Cabinet Office’s data matching exercises receive a report of matches that they should investigate, so as to detect instances of fraud, over- or under-payments and other errors, to take remedial action and update their records accordingly. |
| Sublicensing (onward sharing) with BLMK ICS Members |
In order to start operating as an Integrated Care System (ICS), the ICB needs to be able to share the commissioning and GP data with members of their Integrated Care System. The ICB has agreed with NHS Digital that it can share commissioning data under a sub license approach. The data will be shared under a Sub License with the following terms:
Data will only be shared with members of the ICS who sign up to the terms of the sublicensing agreement. The BLMK IG team blmkicb.ig@nhs.net hold the signed ICB sub licensee agreements.
The legal basis for sharing the data with ICS members is as follows:
Article 6 (1) (e) and Article 9 (2) (h)
Onward sharing of the data by ICS members (including with data processors) is not permitted. Data must be segregated from other datasets and additional linkage is not permitted.
|
Exercising an Opt-out
- Information directly collected by the HCP
Your right can be exercised by withdrawing your consent for the HCP to share information you have provided directly to us that identifies you, provided there is no overriding legal obligation for us to share your personal information. Where we cannot comply with your request, we will provide you with full details of the reason why. You can withdraw your consent in writing to the HCP, using the contact details within this Notice.
- Information collected by the ICB from organisations that provide NHS services
From May 2018 you are now able to opt out from the use of your data for research and planning purposes. This means that your information will be excluded from any statistical and/or performance data shared with the HCP, and your particular health needs will not inform how we shape services for our local population. Your choice to opt-out will have no negative impact on your individual care.
By setting your opt-out preferences at a national level, NHS Digital and Public Health England will excluded your confidential information (i.e. information that identifies you and your health data) from any anonymised information shared with commissioners and research bodies.
NHS Bedfordshire, Luton and Milton Keynes HCP meets the requirements of the National Data Opt Out.
You can check or update your opt-out preference via the following link: https://www.nhs.uk/your-nhs-data-matters/manage-your-choice/
Contact us
If you have any questions or concerns regarding how we use your information, please contact us at
:
NHS Bedfordshire, Luton and Milton Keynes HCP
Arndale House,
The Mall,
LUTON
LU1 2LJ
For independent advice about data protection, privacy and data-sharing issues, you can contact the:
Information Commissioner
Wycliffe House, Water Lane,
Wilmslow,
Cheshire, SK9 5AF.
Phone: 08456 30 60 60 or 01625 54 57 45
Website:
www.ico.gov.uk
The Data Protection Officer for the HCP is:
Lynda Harris
Head of Information Governance
Email:
lyndaharris2@nhs.net
