Protecting your personal data

We have a duty to support and care for those most in need.  To do this, we must hold records about you, your personal circumstance and the services/care you are receiving or may need to receive in the future.

This information will be held securely either on paper or on an electronic record.

The record may include:

• basic details about you, such as address, date of birth, postcode, sex, first language, next of kin, NHS number, ethnic group; in some cases, this might also include genetic information; biometrics (where used for ID purposes); health;
• sex life; or sexual orientation
• current and past contacts we have had with you 
• notes and reports about your health and social care and any treatment, care or support you need
• details and records about the services or care you receive and who is providing them
• results of your tests and diagnosis
• relevant information from other professionals, relatives or those who care for you or know you well
• any contacts you have with us such as home visits or outpatient appointments
• information on medicines, side effects and allergies
• patient experience feedback and treatment outcome information, you have provided
• photos or videos you have consented to be taken
• Please note that this is not a full list of the types of information we hold or handle.

Most of your records are electronic and are held on a computer system or a secure IT network. New ways of providing joined up services are being implemented, with closer working with GPs and other healthcare and social care providers. 

To assist this, the use of other electronic patient record systems to share your information will be implemented.  You will be given the opportunity to say no and to opt-out of this sharing.  To do this, please speak to your GP or the team providing your treatment.    

The information that we keep is used to ensure that we can:

• contact you
• make informed decisions about your treatment and care
• plan your service and support
• refer on to another service if required
• investigate any concerns or complaints about your service
• review the care we provide to ensure it is effective
• work effectively with others who also provide you with care – i.e. your GP, other health providers, social care, or other providers of care
• monitor people receiving a service and the funding for that service
• carry out research in order to improve services and ensure they meet people’s needs
• produce statistics for central government and local planning (This information is used anonymously).

We will process your personal information fairly and lawfully by only using it if we have a lawful reason and when we do, we make sure you know how we intend to use it and tell you about your rights;

We do not rely on consent to use your information for a health care purpose as a ‘legal basis for processing’.  We rely on specific provisions under Article 6 and 9 of the General Data Protection Regulation, such as ‘…a task carried out in the public interest or in the exercise of official authority vested in the controller or the provision of health treatment.’ 

This means we can use your personal information to provide you with your health care without seeking your consent.  However, you do have the right to say ‘NO’ to our use of your information but this could have an impact on our ability to provide you with care.

We will not share your data for a purpose outside of your healthcare without your consent. 

Although we will not rely on your consent to share information for your healthcare purpose, we will follow good practice laid down by common law duty of confidence with regards to informing you of what we do with your information, this is called implied consent.

Any use of personal information for non-direct care purposes without a lawful basis  or consent will be considered as a breach of GDPR and subsequent data protection legislation and/or common law duty of confidence.

Your information will be safe and treated with the utmost respect.  If we ask you for personal information we promise to:

• make sure you know why we need it
• ask only for what we need and not collect too much or irrelevant information in order for us to carry out the various tasks within the delivery of your care
• have secure processes in place to keep your personal information safe when it is being used, shared, and when it is being stored to protect it and make sure it is only available to authorised members of staff
• only collecting and using your information to provide you with your care and treatment and will not use it for anything else
• if the data is to be used for another purpose (not health care) we will get your consent to share it with other organisations and give you the chance to refuse permission
• not make your personal information available for commercial use
• consider your request if you ask us to stop holding and processing data about you
• notify you if your data is disclosed inappropriately
• only hold your information for as long as is necessary for your care. This time period is set out and agreed following national guidance. Please ask us for more information

In return we ask you to:

• give us accurate information
• tell us as soon as possible if there are any changes to your personal circumstances such as your address
• This helps us to keep your information reliable and up to date
• It is good practice for those providing your care to:
• discuss and agree with you what they intend to record about you
• give you a copy of letters and other documents they write about you
• show you what they have recorded about you
• ask for your permission to share information with others and
• let you know what they have told others about you and who those others are

We would like to make you aware that if you email us your personal sensitive information about yourself or your loved ones, the email route is unsecure. 

If you wish to send your information securely, please follow the step below; however, if you do not wish to take this route, we will still accept your email and continue the correspondence. 

1. Make sure you have the correct email address.
2. Please send an email to the staff informing them that you wish to send them personal sensitive information.
3. The staff member will then send you an NHS Mail encrypted link.
4. Once you receive the encrypted email, click on the link.
5. The link will take you to a page to register to the encryption site.
6. You will then be able to send the personal sensitive information and even attach documents to the message.
7. Our staff will receive your information securely and continue any further correspondence through this encryption site.

For more information, please access the below document:

• Accessing Encrypted Emails Guide for Non-NHSmail users

The only individuals who have access to your records regularly, are those involved in providing your service. The NHS and other agencies, including social services and private healthcare organisations work together so we may need to share information about you, with other professionals and services involved in your care. Everyone involved in your service has a legal duty to keep information about you confidential and secure.

When other agencies are involved in providing a service, they will have access to your records. However, in these circumstances only the relevant amount of information is shared.

We share your data with other professionals in order to provide the most appropriate treatment and support for you, and your carers, or when the welfare of other people is involved. 

Examples of who we share personal information with:

• ambulance services
• external care providers
• social care
• GPs
• hospitals and other health partners
• housing organisations
• police
• voluntary organisations
• The information from your patient record will only be used for purposes that benefit your care - we would never share it for marketing or insurance purposes.
• Under the common law duty of confidence, you have the right to refuse/withdraw your consent to information sharing at any time. Please discuss this with your relevant care professional as this could have implications in how you receive further care, including delays in you receiving care.
• However, a person’s right to confidentiality is not absolute and there may be other circumstances when we must share information from your patient record with other agencies.  In these rare circumstances we are not required to have your consent.
• Examples of this are:
• If there is a concern that you are putting yourself at risk of serious harm
• If there is concern that you are putting another person at risk of serious harm
• If there is concern that you are putting a child at risk of harm
• If we have been instructed to do so by a Court
• If the information is essential for the investigation of a serious crime
• If you are subject to the Mental Health Act (1983), there are circumstances in which your ‘nearest relative’ must receive information even if you object
• If your information falls within a category that needs to be notified for public health or other legal reasons, such as certain infectious diseases
• Your information will not be disclosed to third parties such as partners, relatives, friends or carers without your consent unless the:
• disclosure is required by law
• health or safety of others is at risk

NHS Digital, on behalf of NHS England assess the effectiveness of the care provided by publicly-funded services - we have to share information from your patient record such as referrals, assessments, diagnoses, activities (e.g. taking a blood pressure test) and in some cases, your answers to questionnaires on a regular basis to meet our NHS contract obligations.

You have the right to object to us sharing your information to NHS Digital – this will not affect your care in any way.

More about opting out of sharing your data with NHS Digital

We manage, maintain and protect all information according to legislation, our policies and best practices. We have security measures in place to maintain and safeguard the confidentiality, reliability and availability of our systems and data.

All information is stored, processed and communicated in a secure manner and made available only to authorised members of staff on a need to know basis. Only the minimum amount of information required will be shared.

The trust is registered with the information commissioner’s office, registration number: Z2416880

All the IT systems used by the trust are implemented with robust information security safeguards to protect your personal information.

We make every effort to handle all information in a way that respects your rights and meet the requirements of the General Data Protection Regulations and subsequent UK legislation.

• The right to be informed: You have the right to know why and how your personal data is being processed. All the information you need to know can be found on this page and throughout this website
• The right of access: Under current data protection law, you have the right to ask us for a copy of all the information we hold about you. This is called a subject access request. Please see below for more information. Once we have all the relevant information we will provide your records within one month. A copy of the requested information will be provided individual free of charge unless the request is what the law calls ‘manifestly unfounded or excessive’, in particular if it is repetitive. In some cases, information may be withheld but we will discuss this with you.
• The right to rectification: You have the right to have your information corrected if you believe it is factually inaccurate – this is known as the right to rectification.
• The right to erasure: The right to erasure is also known as ‘the right to be forgotten’. In certain circumstances, it allows you to instruct organisations to delete or remove personal data. When we receive a request for the deletion or removal of personal data, we will consider the grounds for the request and decide whether to comply or whether we can legally refuse in order for us to provide our healthcare service
• The right to restriction of processing:  In certain circumstances, you have a right to stop us processing your personal data. Where this right applies (e.g. if the individual contests the accuracy of the data or the processing is unlawful), we are still allowed to store the personal data but must not use it for any other purposes unless certain conditions apply. In most cases the restriction will not be in place forever, but for a limited time; for example while you consider the accuracy of the data or review whether you have legitimate grounds to override the objection.
• The right to data portability:  This is a new right that lets you get hold of and re-use their personal data for your own benefit across different services. It applies:  to personal data you have given us, and when we are processing that data on the basis of consent or for the performance of a contract and when the data is being processed by automated means.
• The right to object: you have the right to object to the processing of your personal data for several reasons.

Please contact the Information governance team at clchig@nhs.net for more details or to make a request.

To help us monitor our performance, evaluate and develop the services we provide, it is necessary to review and share minimal information, for example with the NHS Clinical Commissioning Groups. The information we share would be anonymous so you cannot be identified and all access to and use of this information is strictly controlled.   

In order to ensure that we have accurate and up-to-date patient records, we carry out a programme of clinical audits. Access to your patient records for this purpose is monitored and only anonymous information is used in any reports that are shared internally with in our Trust.

The trust actively promotes research with a view to improving future care. Researchers can improve how physical and mental health can be treated and prevented. If we use your patient information for research, we remove your name and all other personal data which would identify you. If we need the information in a form that would personally identify you, we would ask for your permission first.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt-out your confidential patient information will still be used to support your individual care.

The national data opt-out allows you to choose if you do not want your confidential patient information to be used for purposes beyond individual care and treatment.

To find out more or to register your choice to opt out, please visit NHS - Your Data Matters

On this web page you will:

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to access the system to view, set or change your opt-out setting
• See the situations where the opt-out will not apply
• Why patient information is used, the safeguards and how decisions are made
• You can change your mind about your choice at any time.

You should let us know if you disagree with something written on your file. You may not always be able to change or remove the information. However, we will correct factual inaccuracies and may include your comments in the records.