Our Clinical Commissioning Group (CCG) holds some information about you. This notice is to inform you of the type of information (including personal information) that the CCG holds, how that information is used, with whom we may share that information and how we keep it secure and confidential.
What we do
Our CCG is responsible for planning, buying and monitoring (also known as commissioning) Primary Care and Secondary Care services. Secondary Care services are usually (but not always) delivered in a hospital or clinic with the initial referral being received from Primary Care.
We commission these health services from hospitals and GP practices for our local population to ensure the highest quality of healthcare. We also have a performance monitoring role of these services, which includes responding to any concerns from our patients on services offered. Further details about what we do are on our web site here
To help us to model and plan services to best meet your future healthcare needs, the CCG needs to understand the health, social and general wellbeing issues that people are facing today. The only way we can achieve this is by using the information that your GP, your clinician or your social worker enter into your care record.
How we use your information
Our CCG holds some information about you and this document outlines how that information is used, with whom we may share that information, how we keep it secure (confidential) and what your rights are in relation to this. The NHS Care Record Guarantee for England sets out the rules that govern how patient information is used in the NHS and what control patients can have over this.
The NHS Constitution establishes the principles and values of the NHS in England. It sets out rights to which patients, public and staff are entitled, and pledges which the NHS is committed to achieve, together with responsibilities, which the public, patients and staff owe to one another to ensure that the NHS operates fairly and effectively.
What kind of information do we use?
We use the following types of information/data:
- Identifiable – containing details that identify individuals
- Pseudonymised – about individuals but with identifying details (such as name or NHS number) replaced with a unique code
- Anonymised – about individuals but with identifying details removed
- Aggregated – anonymised information grouped together so that it doesn’t identify individuals
What do we use anonymised information for?
We use anonymised information to plan healthcare services. Specifically we use it to:
- check the quality and efficiency of the health services we commission
- prepare performance reports on the services we commission.
- work out what illnesses people will have in the future, so we can plan and prioritise services and ensure these meet the needs of patients in the future
- review the care being provided to make sure it is of the highest standard
What do we use your personal and confidential/sensitive information for?
For the purposes listed above, we will only use anonymised data which means that individuals can not be identified. We can only use any information that may identify you (known as personal information) in accordance with the Data Protection Act 1998 and other laws such as the Health and Social Care Act 2012.
We also have a Common Law Duty of Confidentiality to protect your information. This means that where a legal basis for using your personal or confidential information does not exist, we will not do so.
Therefore, as a commissioning organisation we do not routinely hold medical records or confidential patient data. There are some limited exceptions where we may hold and use personal information about you; for example the CCG is required by law to perform certain services that involve the processing of sensitive personal information. The areas where we regularly use sensitive personal information include:
- a process where you or your GP can request special treatments that is not routinely funded by the NHS, which are known as Individual Funding Requests
- assessments for continuing healthcare (a package of care for those with complex medical needs) and appeals
- responding to your queries, compliments or concerns
- assessment and evaluation of safeguarding concerns
- where there is a provision permitting the use of sensitive personal information under specific conditions, for example to:
- understand the local population needs and plan for future requirements, which is known as “Risk Stratification for commissioning” – this is explained further later in this document
- ensure that the CCG is billed accurately for the treatment of its patients, which is known as “invoice validation” – this is explained further later in this document
- monitor access to services, waiting times and particular aspects of care, for which the CCG is considered to be an “accredited safe haven”.
Sensitive personal information may also be used in the following cases:
- The information is necessary for your direct healthcare
- To respond to patients, carers or Member of Parliament communication
- We have received consent from individuals to be able to use their information for a specific purpose.
- There is an over-riding public interest in using the information e.g. in order to safeguard an individual, or to prevent a serious crime.
- There is a legal requirement that will allow us to use or provide information (e.g. a formal court order).
- For the health and safety of others, for example to report an infectious disease such as meningitis or measles.
- We have special permission for health and research purposes (granted by the Health Research Authority).
- We have special permission called a ‘Section 251 agreement’ (Section 60 of the Health and Social Care Act 2001 as re-enacted by Section 251 of the NHS Act 2006) which allows the Secretary of State for Health to make regulations to set aside the common law duty of confidentiality for defined medical purposes. An example of where this is used is in risk stratification. Further information can be found on the Health Research Authority’s web site
Risk stratification is targeted healthcare intervention which applies computer-based algorithms or calculations to identify those patients registered with the GP practice who are most at risk from certain medical conditions and who will benefit from clinical care to help prevent or better treat their condition. Currently this is carried out via a Section 251 agreement. We use the services of a health partner, North of England Commissioning Support Unit (NECS) to do this. Minimal identifiers are used for this purpose, such as NHS number, post code, date of birth. Further information can be found on NHS England’s web site here
Do you share my information with other organisations?
We commission a number of organisations (both within and outside the NHS) to provide healthcare services to you. We may also share anonymised statistical information with them for the purpose of improving local services, for example we may share with local authorities in helping to understand how health conditions spread across our local area compared against other areas or with social care organisations to help better co-ordination of health and social care services.
We do not routinely share identifiable personal data with organisations not listed within this notice but we may need to share with other organisations for specific purposes on a case by case basis, for example Individual Funding Requests but this is done with patient consent.
The law provides some NHS bodies, particularly the Health and Social Care Information Centre (NHS Digital), ways of collecting and using patient data that cannot identify a person to help Commissioners to design and procure the combination of services that best suit the population they serve.
We may also share information with NHS England and NHS Digital. If you do not want your information to be used for purposes beyond providing your care you can choose to opt-out. If you wish to do so, please inform your GP practice and they will mark your choice in your medical record. You can opt out of your data being used for some purposes. You can withdraw your opt-out choice at any time by informing your GP practice. More information is available on NHS Digital Your personal information choices
NHS Digital takes the responsibility for looking after care information very seriously. Please follow links on how we look after information for more detailed documentation.
NHS England recognises the importance of protecting personal and confidential information in all that it does, directs or commissions, and takes care to meet its legal duties. Follow the links on the How we use your information page for more details.
Data may be de-identified and linked by these special bodies so that it can be used to improve healthcare and development and monitor NHS performance. Where data is used for these statistical purposes, stringent measures are taken to ensure individual patients cannot be identified.
When analysing current health services and proposals for developing future services it is sometimes necessary to link separate individual datasets to be able to produce a comprehensive evaluation. This may involve linking primary care GP data with other data such as secondary uses service (SUS) data (inpatient, outpatient and A&E). In some cases there may also be a need to link local datasets which could include a range of acute-based services such as radiology, physiotherapy, audiology etc, as well as mental health and community-based services such as Improving Access to Psychological Therapies (IAPT), district nursing, podiatry etc. When carrying out this analysis, the linkage of these datasets is always done using a unique identifier that does not reveal a person’s identity.
We may also contract with other organisations to process data. These organisations are known as Data Processors. We ensure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.
Currently, the external data processors we work with include NHS North of England Commissioning Support Unit, which is based at John Snow House, Durham, DH1 3YG, and which has been granted a legal basis for processing data for us and which operates under strict controls to ensure your information is handled lawfully.
The validation of invoices is undertaken within a controlled environment for finance within the North of England CSU (NECS) which is based at John Snow House, Durham, DH1 3YG. This is carried out via a Section 251 agreement and is undertaken to ensure that the CCG is paying for treatments relating to its patients only. The dedicated NECS team receives patient level information (minimal identifiers are used for this purpose, such as NHS number, post code, date of birth) direct from the hospital providers and undertakes a number of checks to ensure that the invoice is valid and that it should be paid for by the CCG. The CCG does not receive or see any patient level information relating to these invoices. Further information about invoice validation can be found on NHS England’s web site here
What are your rights?
Where information from which you can be identified is held, you have the right to ask to:
- View this or request copies of the records by making a subject access request.
- request information is corrected
- have the information updated where it is no longer accurate
- ask us to stop processing information about you where we are not required to do so by law – although we will first need to explain how this may affect the care you receive.
How do we keep your information secure and confidential?
We only use information that may identify you in accordance with the Data Protection Act 1998. The Data Protection Act requires us to process personal data only if there is a legitimate basis for doing so and that any processing must be fair and lawful.
Within the health sector, we also have to follow the common law duty of confidence, which means that where identifiable information about you has been given in confidence, it should be treated as confidential and only shared for the purpose of providing direct healthcare.
The NHS Digital Code of Practice on Confidential Information applies to all of our staff, and they are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. All CCG staff are expected to make sure information is kept confidential and receive annual training on how to do this. This is monitored by the CCG and can be enforced through disciplinary procedures.
We also ensure the information we hold is kept in secure locations, restrict access to information to authorised personnel only and protect personal and confidential information held on equipment such as laptops with encryption (which masks data so that unauthorised users cannot see or make sense of it).
We ensure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where information that could or does identify a person is processed.
We have a senior person responsible for protecting the confidentiality of patient information and enabling appropriate information sharing. This person is called the Caldicott Guardian. The Caldicott Guardian for the CCG is Dr Matthew Walmsley, Chair / GP, who can be contacted using the contact details at the top of this document. We also have a Senior Information Risk Owner (SIRO) who is responsible for owning the CCG’s information risk. The SIRO is Mr Matt Brown, Director of Operations. They are supported by the Executive Committee and Audit & Risk Committee which meets regularly to discuss information governance issues.
We are registered with the Information Commissioner’s Office (ICO) as a data controller which describes the purposes for which we process personal data. A copy of the registration is available from the ICO’s web site by searching on our CCG name.
How long do you hold information for?
All records held by the CCG will be kept for the duration specified by national guidance from the Department of Health, The Records Management Code of Practice for Health and Social Care 2016. Confidential information is securely destroyed in accordance with this code of practice.
How do I gain access to the information you hold about me?
The CCG does not directly provide health care services and therefore does not hold personal healthcare records. If you wish to have sight of, or obtain copies of your of your own personal health care records you will need to apply to your GP Practice, the hospital or organisation which provided your health care.
Under the Data Protection Act 1998 every living individual has the right to see, or have a copy of data which organisations hold about them, with some exceptions. You do not need to give a reason to see your data, but you may be charged a fee.
If you want to access your data you must make the request in writing. Under special circumstances, some information may be withheld.
Your right to opt out
In some instances, you are allowed to request that your confidential information is not used beyond your own care and treatment and to have your objections considered. To support this patients are able to register objections with their general practice to either prevent their identifiable data being released outside of the GP Practice (known as a Type 1 objection) or to prevent their identifiable data from any health and social care setting being released by NHS Digital (known as a Type 2 objection) where in either case it is for purposes other than direct patient care. If your wishes cannot be followed, you will be told the reasons (including the legal basis) for that decision. There are certain circumstances where a person is unable to opt out but these are only where the law permits this such as in adult or children’s safeguarding situations.
You have a right in law to refuse or withdraw previously granted consent to the use of your personal information. There are possible consequences of not sharing such as the effect this may have on your care and treatment but these will be explained to you to help with making your decision.
If you wish to exercise your right to opt-out, or to speak to somebody to understand what impact this may have, if any, please contact us using the contact details at the top of this document.
What is the right to know?
The Freedom of Information Act 2000 (FOIA) gives people a general right of access to information held by or on behalf of public authorities, promoting a culture of openness and accountability across the public sector.
What sort of information can I request?
In theory, you can request any information that the CCG holds, that does not fall under an exemption. You may not ask for information that is covered by the Data Protection Act.
How do I make a request for information?
Your request must be in writing and can be either posted or emailed to the CCG. The service is managed by the Information Governance Team at NECS. Details of how to apply can be found on our web site here
Where can I obtain further advice?
For independent advice about data protection, privacy, data sharing issues and your rights you can contact:
Information Commissioner’s Office
Telephone: 0303 123 1113 (local rate) or 01625 545 745
Visit the ICO website here
Complaints or questions?
We try to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. Please contact us using the contact details at the top of this document should you have any such concerns.