Fair Processing Notice (Privacy Notice)

Who we are and what we do

NHS Portsmouth Clinical Commissioning Group (CCG) is responsible for securing, planning, designing and paying for your NHS services, including planned and emergency hospital care, as well as community and primary medical care (GP) services. We also have a performance monitoring role for these services, which includes ensuring that the highest quality of healthcare is provided and responding to any concerns from our patients on services offered. This is known as commissioning. For further information please refer to the About Us page on our website.

Using your information

We need to use information about you to enable us to commission services effectively, efficiently and safely.

Our CCG holds some information about you and this document outlines how that information is used, who we may share that information with and why, how we keep it secure (confidential) and what your rights are in relation to this.

What kind of information do we use?

As a Commissioner we do not routinely hold or have access to your medical records. However, we may need to hold some personal information about you, for example:

Your name, address, your date of birth, contact details and your NHS number which in some circumstances we may use as your single identifying number with no other information about you attached. Your NHS number is present in all of your health records and therefore we are able to use that number to link information to you or about you without revealing any personal or confidential data, where we are lawfully allowed to do this.

We use the following types of information/data:

• Personal Data – means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Special Categories of Personal Data – this term describes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
• Confidential Patient Information – this term describes information or data relating to their health and other matters disclosed to another (e.g. patient to clinician) in circumstances where it is reasonable to expect that the information will be held in confidence. Including both information ‘given in confidence’ and ‘that which is owed a duty of confidence’. As described in the Confidentiality: NHS code of Practice: Department of Health guidance on confidentiality 2003.
• Pseudonymised – The process of distinguishing individuals in a dataset by using a unique identifier which does not reveal their ‘real world’ identity.
• Anonymised – Data in a form that does not identify individuals and where identification through its combination with other data is not likely to take place
• Aggregated – Statistical data about several individuals that has been combined to show general trends or values without identifying individuals within the data.

What do we use your Personal Confidential Data for?

There are some limited exceptions where we may hold and use personal confidential information about you. For example the CCG is required by law to perform certain services that involve the processing of personal confidential information.

The areas where we regularly use personal confidential information include:

• responding to your queries, compliments or concerns
• assessment and evaluation of safeguarding concerns
• where there is a provision permitting the use of confidential personal information under specific conditions, for example to:
  – understand the local population needs and plan for future requirements, which is known as “Risk Stratification for commissioning.”

Personal confidential information may also be used in the following cases:

• the information is necessary for your direct healthcare needs
• we need to respond to patients, carers or Member of Parliament communications
• you have freely given your informed agreement (consent) for us to use your information for a specific purpose
• there is an overriding public interest in using the information e.g. in order to safeguard an individual, or to prevent a serious crime
• there is a legal requirement that will allow us to use or provide information (e.g. a formal court order)

What do we use non-identifiable data for?

We use pseudonymised, anonymised and aggregated data to plan health care services. Specifically we use it to:

• check the quality and efficiency of the health services we commission
• prepare performance reports on the services we commission
• work out what illnesses people may have in the future, so we can plan and prioritise services and ensure these meet the needs of patients in the future
• review the care being provided to make sure it is of the highest standard

Do we share your information with other organisations?

We commission a number of organisations, both within and outside the NHS (see Appendix A for details) to provide healthcare services to you. We may share anonymised statistical information with them for the purpose of improving local services, research, audit and public health; for example understanding how health conditions spread across our local area compared against other areas. We do not share information outside of the European Economic Area (EEA).

We would not share information that identifies you unless we have a fair and lawful basis such as:

• You have given us permission;
• We need to act to protect children and vulnerable adults;
• When a formal court order has been served upon us;
• When we are lawfully required to report certain information to the appropriate authorities e.g. to prevent fraud or a serious crime;
• Emergency Planning reasons such as for protecting the health and safety of others;
• When permission is given by the Secretary of State or the Health Research Authority on the advice of the Confidentiality Advisory Group to process confidential information without the explicit consent of individuals

The law provides some NHS bodies, particularly NHS Digital, (formally the Health and Social Care Information Centre) ways of collecting and using patient data that cannot identify a person to help Commissioners to design and procure the combination of services that best suit the population they serve.

How we process information within the CCG

Data may be anonymised and linked with other data so that it can be used to improve health care and development and monitor NHS performance. Where data is used for these statistical purposes, stringent measures are taken to ensure individual patients cannot be identified.

When analysing current health services and proposals for developing future services it is sometimes necessary to link separate individual datasets to be able to produce a comprehensive evaluation. This may involve linking primary care data from your Doctor (GP) with other data such as hospital inpatient stays, outpatient appointments and A&E attendances; this type of data is called secondary uses service (SUS) data. In some cases there may also be a need to link local datasets which could include a range of other hospital based services such as radiology, physiotherapy, audiology etc., as well as mental health and community-based clinics and services such as district nursing, podiatry etc. When carrying out this analysis, the linkage of these datasets is always done using a unique identifier that does not reveal a person’s identity as the CCG does not have any access to identifiable data for these purposes.

We also contract with other organisations to process data on our behalf. These organisations are known as Data Processors and we ensure they are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.

A full list of details including the legal basis, any Data Processor involvement and the purposes for processing information can be found in Appendix A.

What safeguards are in place to ensure data that identifies you is secure?

We only use information that may identify you in accordance with Data Protection legislation. The legislation requires us to process personal data only if there is a legitimate basis for doing so and that any processing must be fair and lawful.

Within the health sector, we also have to follow the common law duty of confidence, which means that where identifiable information about you has been given in confidence, it should be treated as confidential and only shared for the purpose of providing direct healthcare.

Everyone working for the NHS has a legal duty to keep information about you confidential. The NHS Care Record Guarantee and NHS Constitution provide a commitment that all NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and promote your health and wellbeing.

The NHS Digital Code of Practice on Confidential Information applies to all of our staff, and they are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. All CCG staff are expected to make sure information is kept confidential and receive annual training on how to do this. This is monitored by the CCG and can be enforced through disciplinary procedures.

We also ensure the information we hold is kept in secure locations, restrict access to information to authorised personnel only, protect personal and confidential information held on equipment such as laptops with encryption (which masks data so that unauthorised users cannot see or make sense of it).

We ensure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.

The CCG has a senior member of staff responsible for protecting the confidentiality of patient information. This person is called the Caldicott Guardian. The contact details of our Caldicott Guardian are as follows:

Dr Elizabeth Fellows, please e-mail pccg.enquiries@nhs.net

They are supported by another senior member of staff who is responsible for information risk and information security, this person is called the Senior Information Risk Owner (SIRO). The contact details of our SIRO are as follows:

Michelle Spandley – Chief Finance Officer, please e-mail: pccg.enquiries@nhs.net

The above two roles are also supported by our Data Protection Officer who assists the CCG to monitor internal compliance, inform and advise on our data protection obligations, provide advice regarding Data Protection Impact Assessments (DPIAs) and act as a contact point for data subjects and the supervisory authority.

The contact details of our DPO are as follows:
Email: pccg.DPO@nhs.net
Tel: 023 928 9500

Portsmouth CCG is registered with the Information Commissioner’s Office (ICO) as a data controller and collects data for a variety of purposes. Our registration number is Z3610968 and a copy of the registration is available through the ICO website.

How long do we hold information for?

All records held by the CCG will be kept for the duration specified by national guidance from NHS Digital. Once information that we hold has been identified for destruction it will be disposed of in the most appropriate way for the type of information it is. Personal confidential and commercially sensitive information will be disposed of by approved and secure confidential waste procedures. We keep a record of retention schedules within our information asset registers, in line with the Records Management Code of Practice for Health and Social Care 2016.

Your right to opt out of data sharing and processing

The NHS Constitution states ‘You have a right to request that your personal confidential information is not used beyond your own care and treatment and to have your objections considered’. For further information please click here.

You have the right to withdraw consent to us sharing your confidential and personal information if you do not wish us to process or share it.

There are several forms of opt- outs available at different levels. These include for example:

Information directly collected by the CCG. Your choices can be exercised by withdrawing your consent for the sharing of information that identifies you, unless there is an overriding legal obligation. We will first need to explain how this may affect the care you receive but you can do this by writing to us.

Information not directly collected by the CCG but collected by organisations that provide NHS services. These are known as Type 1 and national data opt-outs and are described below:

National data opt-out. The national data opt-out was introduced on 25 May 2018, enabling patients to opt-out from the use of their data for research or planning purposes, in line with the recommendations of the National Data Guardian in her Review of Data Security, Consent and OptOuts.

By 2020 all health and care organisations are required to apply national data opt-outs where confidential patient information is used for research and planning purposes. NHS Digital has been applying national data opt-outs since 25 May 2018. Public Health England has been applying national data opt-outs since September 2018.

The national data opt-out replaces the previous ‘type 2’ opt-out, which required NHS Digital not to share a patient’s confidential patient information for purposes beyond their individual care. Any patient that had a type 2 opt-out recorded on or before 11 October 2018 has had it automatically converted to a national data opt-out. Those aged 13 or over were sent a letter giving them more information and a leaflet explaining the national data opt-out. For more information go to National data opt out programme.

The use of personal confidential data by CCGs for invoice validation under approval reference (CAG 7-07)(a-c)/2013) has been recently extended to the end of September 2020 – NHS England Invoice Validation and as part of that review, it has been agreed that NO opt out will be applied to invoice validation due to the importance of accurately allocating NHS resources and the lack of evidence of public concern in relation to the use of data for this specific purpose. This effectively means that data which includes an identifier (usually NHS number) which is flowing from NHS Digital to commissioners for invoice validation/challenge purposes will be provided for all patients to ensure that providers receive the correct funding for the health and care services they provide.

Gaining access to the data we hold about you

The CCG does not directly provide health care services and therefore does not hold personal healthcare records. If you wish to have sight of, or obtain copies of your own personal health care records you will need to apply to your GP Practice, the hospital or NHS Organisation which provided your health care.

Where information from which you can be identified is held by the CCG, you have the right to ask to:

• View this or request copies of the records by making a Right of Access request under the General Data Protection Regulation.
• request information is corrected/rectified
• have the information updated where it is no longer accurate
• where applicable, request information is erased
• where applicable, request for your data to be portable
• where applicable, ask us to stop processing information about you where we are not required to do so by law

Everybody has the right to see, or have a copy, of data we hold that can identify you, with some exceptions. You do not need to give a reason to see your data.

If you want to access your data you must make the request in writing. Under special circumstances, some information may be withheld.

You can do this by writing to us at:

NHS Portsmouth CCG
CCG headquarters
4th Floor
1 Guildhall Square
Portsmouth
PO1 2GJ

What is the right to know?

The Freedom of Information Act 2000 (FOIA) gives people a general right of access to information held by or on behalf of public authorities, promoting a culture of openness and accountability across the public sector. You can request any information that the CCG holds, that does not fall under an exemption. You may not ask for information that is covered by the Data Protection legislation under FOIA. However you can request this under a right of access request – see section above ‘Gaining access to the data we hold about you’.

Your request must be in writing and can be either posted or emailed to:
ccgfoi@portsmouthcc.gov.uk

Tel: 023 9268 8482

Postal requests should be directed to:

Corporate Information Governance Officer
Customer, community & democratic service
Portsmouth City Council
Civic Offices
Portsmouth
PO1 2AL

Freedom of Information

Information Commissioners Office

For independent advice about data protection, privacy, data sharing issues and your rights you can contact:

Information Commissioner’s Office
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF

Telephone: 0303 123 1113 (local rate) or 01625 545 745
Email: casework@ico.org.uk or visit the ICO website.

Complaints or questions

We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. Portsmouth City Council handle complaints on behalf of the CCG and you can contact them as follows:

Email: portsmouthccgcomplaints@portsmouthcc.gov.uk
Phone: 023 9283 4456

Portsmouth City Council
Corporate Complaints Team
Civic Offices
Guildhall Square
Portsmouth
PO1 2BG

For further information, visits the complaints section of our website.

Links to other websites

This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit.

Changes to this privacy notice

We keep our privacy notice under regular review. This Fair Processing notice was last updated in October 2020.