Confidential and personal information

We recognise the importance of protecting personal and confidential information in all that we do, and take care to meet our legal and other duties. By issuing this privacy information, we demonstrate our commitment to openness and accountability.

Why have we issued this privacy notice for our patients, staff and service users?

We recognise the importance of protecting personal and confidential information in all that we do, and take care to meet our legal and other duties, including compliance with the following:

  • Data Protection Act 1998
  • Human Rights Act 1998
  • Access to Health Records Act 1990
  • Freedom of Information Act 2000
  • Health and Social Care Act 2012, 2015
  • Public Records Act 1958
  • Copyright Design and Patents Act 1988
  • Re-Use of Public Sector Information Regs 2004
  • Computer Misuse Act 1990
  • Common Law Duty of Confidentiality
  • NHS Care Records Guarantee for England
  • Social Care Records Guarantee for England
  • International information Security Standards
  • Information Security Code of Practice
  • Records Management Code of Practice for Health & Social Care 2016
  • Accessible Information Standards
  • General Data Protection Regulations 2018

How do we collect your information?

Your information could be collected in a number of different ways. This might be from a referral made by your GP or another healthcare professional you have seen, or perhaps directly from you – in person, over the telephone or on a form you have completed.

There may also be times when information is collected from your relatives or next of kin – for example, if you are taken to one of our departments but you are unconscious or unable communicate.

What information do we collect?

The information that we collect about you may include details such as:

  • Name, address, telephone, email, date of birth and next of kin
  • Any contact we have had with you through appointments, attendances and home visits
  • Details and records of treatment and care, notes and reports about your health, including any allergies or health conditions
  • Results of diagnostic testing e.g. x-rays, scans, blood tests, etc
  • Other relevant information from people who care for you and know you well, such as health professionals, relatives and carers.

We may also collect other information about you, such as your sexuality, race or ethnic origin, religious or other beliefs, and whether you have a disability or require any additional support with appointments (like an interpreter or advocate in line with your rights under the Accessible Information Standard).

Why do we collect your information?

We collect personal and confidential information about you to support with the delivery of appropriate healthcare and treatment. In order to provide you with high quality care, we must keep records about you, your health and the care that we provide, or plan to provide to you. It is important for us to have a complete picture as this information enables us to provide the right care to meet your individual needs.

How do we keep your information safe and maintain confidentiality?

Under the Data Protection Act 1998, strict principles govern our use of information and our duty to ensure it is kept safe and secure. Your information may be stored within electronic or paper records, or a combination of both. All our records are restricted so that only those individuals who have a legitimate right to access the information can get access. This might be through the use of technology or other environmental safeguards.

Everyone working for the NHS is subject to the Common Law Duty of Confidentiality. This means that any information that you provide to us in confidence will only be used in connection with the purpose for which it was provided, unless we have specific consent from you or there are other special circumstances covered by law.

Under the NHS Confidentiality Code of Conduct, all of our staff are required to protect information, inform you of how your information will be used, and allow you to decide if and how your information can be shared.

Every NHS organisation has a senior person that is responsible for protecting the confidentiality of your information and enabling appropriate sharing. This person is known as the Caldicott Guardian, and within our trust this role sits with our Medical Director.

How do we use your information and why is this important?

We use your information to ensure that:

  • The right decisions are made about your care
  • Your treatment is safe and effective; and
  • We can work well with other organisations that may be involved in your care

This is important because having accurate and up-to-date information will assist us in providing you with the best possible care. It also ensures that all information is readily available if you see another health professional or specialist within our trust or another part of the NHS.

There is also the potential for your information to help improve health care and other services across our trust and the wider NHS. Therefore, your information may also be used to help with:

  • Ensuring that our services can be planned to meet the future needs of patients
  • Reviewing the care provided to ensure it is of the highest standard possible, improving individual diagnosis and care
  • Evaluating and improving patient safety
  • Training other healthcare professionals
  • Conducting clinical research and audits, and understanding more about health risks and causes to develop new treatments
  • Preparing statistics on NHS performance and monitoring how we spend public money
  • Supporting the health of the general public
  • Evaluating Government and NHS policies

Do we share your information with anyone else?

To help provide you with the best possible care, sometimes we will need to share your information with others. However, any sharing of information will always be governed by specific rules and laws. We may share your information with a range of health and social care organisations and regulatory bodies. You may be contacted by any one of these organisations for a specific reason, and they will have a duty of telling you why they have contacted you.

Sharing with other organisations

We work with a number of other NHS organisations and independent treatment centres and clinics to provide you with the best possible care. To support this, your information may be securely shared.

Where the sharing involves a non-NHS organisation, a specific information sharing agreement is put in place to ensure that only relevant information is shared and this is done securely in a way which complies with the law.

Unless there are exceptional circumstances (such as a likely risk to the health and safety of others) or a valid reason permitted by law, we will not disclose any information to third parties which can be used to identify you without your consent.

Mandatory information sharing

Sometimes we are required by law to disclose or report certain information which may include details which identify you. However, this is only done after formal authority by the Courts or by a qualified health professional. This may include reporting a serious crime or identification of an infectious disease that may endanger the safety of others. Where this disclosure is necessary, only the minimum amount of information is released.

We are also required to send statutory information to the Department of Health, which is then held centrally and strictly controlled by the NHS Information Authority. This organisation takes advice from an independent board called the Security and Confidentiality Advisory Group, which reports to the government Chief Medical Officer.

There may also be occasions when the trust is reviewed by an independent auditor, which could involve reviewing randomly selected patient information to ensure we are legally compliant.

There are other statutory bodies where we are required to provide your information, these include:

  • Parliamentary Health Service Ombudsman
  • Care Quality Commission
  • General Medical Council
  • Police (in certain situations only such as Terrorism or serious crime)

Clinical training, research and audit

Some health records are needed to teach student clinicians about rare cases and diseases. Without such materials, new doctors and nurses would not be properly prepared to treat you and others. It is also possible that individuals, such as student nurses, medical students and healthcare cadets, are receiving training in the service that is caring for you. If staff would like a student to be present, they will always ask for your permission and you have the right to refuse without this effecting the care or treatment that you are receiving.

We also undertake clinical research and audits within the trust, and your permission may be required for some of this work. If you agree to be involved, a full explanation will be given and your consent will be obtained before proceeding. Your consent may not be required if the information being used has been anonymised. This means that it cannot be used to identify an individual person.

Do you have the right to withhold or withdraw your consent for information sharing?

You have the right to refuse (or withdraw) consent to information sharing at any time. This is also referred to as ‘opting out’. If you choose to prevent your information from being disclosed to other authorised professionals involved in your care, it might mean the care that can be provided is limited and, in certain circumstances, it may not be possible to offer certain treatment options. The possible consequences of withholding your consent will be fully explained to you at the time should this situation occur.

You also have the right to ‘opt out’ of having your information used in any mandatory audits which the trust is subjected to. If this is the case, you should write to our Information Governance team with your name, address, date of birth and hospital number or NHS number.

How can you get access to the information that we hold about you?

Under the terms of the Data Protection Act 1998 and the General Data Protection Regulations 2018, you have the right to request access to the information that we hold about you.

You can request information or an application form, by one of the following means:

Post: The Disclosure Team, Kedhlow Building, Royal Cornwall Hospital, Truro, Cornwall, TR1 3LJ

Tel: 01872 254505

Email: rch-tr.Disclosure@nhs.net

How can you contact us with queries or concerns about this privacy notice?

If you have any queries or concerns regarding the information that we hold about you or you have a question regarding this privacy notice, please contact our Information Governance team:

Post: Information Governance Department, Kedhlow Building, Royal Cornwall Hospital, Truro, Cornwall, TR1 3LJ

Tel: 01872 258580

Email: rch-tr.Infogov@nhs.net

How long do we retain your records?

Health and Social Care 2016, which sets out the appropriate length of time each type of NHS record is retained. We do not keep your records for longer than necessary.
All records are appropriately reviewed once their retention period has been met, and the Trust will decide whether the record still requires retention or should be confidentially destroyed. All decisions and destructions will be documented.

Please refer to our Policy to Manage Information and records for further information:

How can you make a complaint?

You have the right to make a complaint if you feel unhappy about how we hold, use or share your information. We would recommend contacting our Information Governance team initially to talk through any concerns that you have.

It may also be possible to resolve your concerns through a discussion with our Patient Advice and Liaison Service (PALS) before (or without the need to start) a more formal process:

Address: Patient Experience Team, Knowledge Spa, Royal Cornwall Hospital, Truro, TR1 3LJ.

Tel: 01872 252793

Email: rcht.patientexperience@nhs.net

If you remain dissatisfied following the outcome of your complaint, you may then wish to contact the Information Commissioner’s Office:
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Web: https://ico.org.uk/concerns/

Phone: 0303 123 1113

Please note that the Information Commissioner will not normally consider an appeal until you have exhausted your rights of complaint to us directly. Please see the website above for further advice.

Changes to this Privacy Notice?

We will occasionally update this Privacy and Fair Collection webpage to reflect company and customer feedback. We therefore encourage you to periodically review this webpage in case of any changes.
With thanks to Cornwall Partnership Trust who gave permission for us to share their Privacy Notice. It has been amended to reflect Royal Cornwall Hospitals Trusts elements.