Data Protection

To achieve this, each organisation will be sharing more information about our patients than ever before to ensure we can identify the most vulnerable to provide joined up healthcare and to support each other to ensure there is no disruption of service if staff become unwell.

Our legal basis to do so is as follows:

General Data Protection Regulation (GDPR)

The GDPR allows information to be shared for individual care, planning and research. Where health and care information (which would be classed as special category data) is shared for either individual care or to help tackle the disease through research and planning then the relevant Article 6 conditions (official authority, compliance with a legal obligation, public interest and on occasions vital interests) and Article 9 conditions (substantial public interest, the delivery of health and care, vital interests or for public health purposes and scientific research) should be relied on as applicable to the situation.

Control of Patient Information Regulation 2002

Individual healthcare organisations, arm’s length Bodies (except NHS Digital and NHS England and NHS Improvement which have been separately notified) and local authorities have been given legal notice under this regulation to support the processing and sharing of information to help the COVID-19 response.

Health and Social Care (Safety and Quality Act 2015)

Duty to share information
In Part 9 of the Health and Social Care Act 2012 (health and adult social care services: information).

Vaccination status

The Department of Health and Social Care (DHSC) has formally announced that individuals undertaking CQC regulated activities in England must be fully vaccinated against Covid 19 no later than 1st April 2022 to protect patients, regardless of their employer, including secondary and primary care.

The Trust must therefore ensure we have a record of staff vaccinations which is obtained from the National Immunisation and Vaccination System which is then loaded in to ESR.

NHSE will then extract the numbers from ESR to gain an understanding of how the Trust is managing this new requirement.

Your vaccination record will be treated in confidence in the same way as we would any other special category data (health) as required under UK Data Protection Law.

General Data Protection Regulation

The new Regulations is designed to harmonise data privacy laws across Europe, to protect and empower data subjects providing more choice about what is done with your data, and to make Organisations more accountable.
Under this new Regulation you have the following rights.

1. right of access to their data free of charge within 30 days, unless request is considered complex or excessive. An extension of an additional 60 days could be applied but we will inform you of this.
2. right to rectification. When personal data are inaccurate, the right to request the data is rectified. Although this may not always be possible. We can however note your concerns or objections.
3. right to erasure or right to be forgotten, although we would not delete Health or Personnel records as there is a legal reason to keep them.
4. right to restriction of processing. Simply said, the right of the data subject to limit the processing of his/her personal data.
5. right to be informed. The right to be told what we do with their data, the legal basis for processing it and what future uses we may wish to use it for.

If you need more information about this refer to the Information Commissioners website or contact us and we will be glad to help. rch-tr.infogov@nhs.net

• General Data Protection Regulation 2018
• Human Rights Act 1998
• Access to Health Records Act 1990
• Freedom of Information Act 2000
• Health and Social Care Act 2012, 2015
• Public Records Act 1958
• Copyright Design and Patents Act 1988
• Re-Use of Public Sector Information Regs 2004
• Computer Misuse Act 1990
• Common Law Duty of Confidentiality
• NHS Care Records Guarantee for England
• Social Care Records Guarantee for England
• International information Security Standards
• Information Security Code of Practice
• Records Management Code of Practice for Health & Social Care 2016
• Accessible Information Standards

Our legal reasons for processing your heath information are set out within the Articles of the General Data Protection Regulation and are listed below.

6 (1)(a) ‘…the data subject has given consent to the processing of his or her personal data for one or more specific purposes

• Consent from Patients to use their data
• Consent from Staff to use their data
• Consent from Volunteers to use their data
• Consent from those donating to charities to use their data
• Consent from Trust members to be contacted regarding Trust activities.

6(1)(b) ‘…processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;

• Used to provide services to staff members with information about their employment.
• Used to manage contracts of employment.

6(1)(.c) processing is necessary for compliance with a legal obligation to which the controller is subject;

• Commissioning
• Planning
• Confidential information provided to NHS Digital with legal mandate under directions and disseminated to commissioners as pseudonym-ised personal data

6(1)(d) ‘…necessary in order to protect the vital interests of the data subject or of another natural person’
6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.

• To treat patients.
• To conduct research (does not rely on consent, although consent maybe sought)
• To conduct business of the Trust other than that of its core function (treatment of patients)

6(1)(f) ‘…processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

• Can be used for the transfer and sharing of staff data.

9(2)(a) ‘…the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject;
9(2)(b) ‘…is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of employment and social protection law (Safeguarding)

• Used for purposes of processing staff data.
• Safeguarding children and adults

9(2)( c) ‘…processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent This condition is met if—

• the processing is necessary to protect the vital interests of an individual, and
• the data subject is physically or legally incapable of giving consent.

9(2)(d) ‘…processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects;
9(2)(e) ‘…processing relates to personal data which are manifestly made public by the data subject;
9 (2)(f) ‘…processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity;

• Provided to Trust’s solicitors in defence of the Trust and those that are employed by it.
• Provided to patient solicitors on request (although 9(2)(a) would have been applied)

9(2)(g )‘…processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject;
9(2)(h) ‘…medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems…’

• Provision of direct care to patients within the Trust
• Sharing of healthcare data with other organisations for direct care purposes
• To support activities relating to the management of healthcare services

9(2)(i) ‘…processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;
9(2)(j) ‘…scientific or historical research purposes or statistical purposes …’ This covers the provision of direct healthcare and administrative purposes such as:

• waiting list management
• performance against national targets
• activity monitoring
• production of datasets to submit for commissioning purposes
• Used for Research
• Used to add data to national registers
• Used for Clinical Audit

There may also be times when information is collected from your relatives or next of kin – for example, if you are taken to one of our departments but you are unconscious or unable communicate.

• Name, address, telephone, email, date of birth and next of kin
• Any contact we have had with you through appointments, attendances and home visits
• Details and records of treatment and care, notes and reports about your health, including any allergies or health conditions
• Results of diagnostic testing e.g. x-rays, scans, blood tests, etc
• Other relevant information from people who care for you and know you well, such as health professionals, relatives and carers.
• The Trust uses alerts which are specific to you that help clinicians when treating you.

We may also collect other information about you, such as your sexuality, race or ethnic origin, religious or other beliefs, and whether you have a disability or require any additional support with appointments (like an interpreter or advocate in line with your rights under the Accessible Information Standard).

We collect personal and confidential information about you to support with the delivery of appropriate healthcare and treatment. In order to provide you with high quality care, we must keep records about you, your health and the care that we provide, or plan to provide to you. It is important for us to have a complete picture as this information enables us to provide the right care to meet your individual needs.

We collect relevant information about staff members in order to fulfil our obligations as an employer and to assist in the administration of your employment. This will include a Personnel file containing such things as sickness records, performance reviews and contracts of employment. We will also collect information to ensure we are able to pay you, manage your pension contributions and other necessary tasks.

Under the Data Protection Act 2018, strict principles govern our use of information and our duty to ensure it is kept safe and secure. Your information may be stored within electronic or paper records, or a combination of both. All our records are restricted so that only those individuals who have a legitimate right to access the information can get access. This might be through the use of technology or other environmental safeguards.

Everyone working for the NHS is subject to the Common Law Duty of Confidentiality. This means that any information that you provide to us in confidence will only be used in connection with the purpose for which it was provided, unless we have specific consent from you or there are other special circumstances covered by law.
Under the NHS Confidentiality Code of Conduct, all of our staff are required to protect information, inform you of how your information will be used, and allow you to decide if and how your information can be shared.

Every NHS organisation has a senior person that is responsible for protecting the confidentiality of your health information and enabling appropriate sharing. This person is known as the Caldicott Guardian, and within our Trust this role sits with an appropriately trained senior Consultant.

The Trust has a Senior Information Risk Officer (Director of Integrated Governance). They are the most senior person in the Trust with responsibility for managing risks to the information we process.

• The right decisions are made about your care
• Your treatment is safe and effective; and
• We can work well with other organisations that may be involved in your care

This is important because having accurate and up-to-date information will assist us in providing you with the best possible care. It also ensures that all information is readily available if you see another health professional or specialist within our trust or another part of the NHS.

There is also the potential for your information to help improve health care and other services across our trust and the wider NHS. Therefore, your information may also be used to help with:

• Ensuring that our services can be planned to meet the future needs of patients
• Reviewing the care provided to ensure it is of the highest standard possible, improving individual diagnosis and care
• Evaluating and improving patient safety
• Training other healthcare professionals
• Conducting clinical research and audits, and understanding more about health risks and causes in order to develop new treatments
• Preparing statistics on NHS performance and monitoring how we spend public money
• Supporting the health of the public
• Evaluating Government and NHS policies

To help provide you with the best possible care, sometimes we will need to share your information with others. However, any sharing of information will always be governed by specific rules and laws. We may share your information with a range of health and social care organisations (which include private healthcare providers) and regulatory bodies. You may be contacted by any one of these organisations for a specific reason, and they will have a duty of telling you why they have contacted you.

Where the sharing involves a non-NHS organisation, a specific information sharing agreement is put in place to ensure that only relevant information is shared and this is done securely in a way which complies with the law.

The Cornwall and the Isles of Scilly Health and Social Care Partners are working to maximise the benefits patients receive from the health and social care providers in Cornwall, to achieve this we may at time engage external private organisations to help us meet this challenge.

E.g. we have engaged Newton Europe to help us deliver the Embrace Care programme

The Embrace Care programme is focussed on delivering better health and care outcomes for over 65s at risk of hospital admission, or who have been admitted to hospital. It allows the system to deliver an integrated and local-focussed community offer while supporting better outcomes for the older people of Cornwall and the Isles of Scilly.
Unless there are exceptional circumstances (such as a likely risk to the health and safety of others) or a valid reason permitted by law, we will not disclose any information to third parties which can be used to identify you without your consent.

The appointed Data Protection Officer for the Royal Cornwall Hospitals Trust is:
Mr Mark Scallan. PC.dp. PC.foi
There may also be occasions when the trust is reviewed by an independent auditor, which could involve reviewing randomly selected patient information to ensure we are legally compliant.

There are other statutory bodies where we are required to provide your information, these include:

• Parliamentary Health Service Ombudsman
• Care Quality Commission
• General Medical Council
• Police (in certain situations only such as Terrorism or serious crime)

We also undertake clinical research and audits within the trust, and your permission may be required for some of this work. If you agree to be involved, a full explanation will be given and your consent will be obtained before proceeding. Your consent may not be required if the information being used has been anonymised. This means that it cannot be used to identify an individual person.

You also have the right to ‘opt out’ of having your information used in any mandatory audits which the Trust is subjected to. If this is the case, you should write to our Information Governance team with your name, address, date of birth and hospital number or NHS number.

You can choose to opt out of sharing your confidential patient information for research and planning. There may still be times when your confidential patient information is used: for example, during an epidemic where there might be a risk to you or to other people’s health. You can also still consent to take part in a specific research project.

You can choose to opt out of sharing your confidential patient information for research and planning. There may still be times when your confidential patient information is used: for example, during an epidemic where there might be a risk to you or to other people’s health. You can also still consent to take part in a specific research project.

To find out more or to make your choice visit www.nhs.uk/your-nhs-data-matters or call 0300 303 5678.

Under the terms of the Data Protection Act 2018 and the General Data Protection Regulations 2018, you have the right to request access to the information that we hold about you.

Request for access to medical records forms

Can we charge a fee?

In most cases we will not charge a fee to comply with a subject access request.

However, where the request is manifestly unfounded or excessive we may charge a “reasonable fee” for the administrative costs of complying with the request.

We may also charge a reasonable fee if an individual requests further copies of their data following a request. The fee will be based on the administrative costs of providing further copies.

How long do we have to comply?

We must act on the subject access request without undue delay which will usually be within one month of receipt. Where the request is considered complex or excessive we can apply an extension of a further 60 days, if this is the case we will inform you of this.

The time will be calculated from the day after we receive the request (whether the day after is a working day or not) until the corresponding calendar date in the next month.

If this is not possible because the following month is shorter (and there is no corresponding calendar date), the date for response is the last day of the following month.

If the corresponding date falls on a weekend or a public holiday, we have until the next working day to respond.

For practical purposes the Trust will aim to provide the information within 28-day days to ensure compliance is always within a calendar month.

Please be advised that the request will not be processed until the Royal Cornwall Hospitals NHS Trust (RCHT) is satisfied of the identity of the person making the request, and received the following:

The Trust Policy is that we must have at least two types of identity validation prior to providing access to, or disclosing of personal identifiable information.

If you are making a request on behalf of another person: we would require ID from both parties.

Therefore, could you please provide two of the following (one of which must be photographic identification)

• Copy of valid passport
• Copy of current driving licence
• Copy of paid utility bill

Any documentation will be considered on an individual basis but may not be accepted.
Unfortunately we will not be able to process your request until we are in possession of this information.

• How long do we retain your records?
• NHS Digital retention schedule
• How can you contact us with queries or concerns about this privacy notice?

If you want to see the health records of someone who has died, this is facilitated under the Access to Health Records Act (1990). The Access to Health Records Act 1990 and the Common Law protects the confidentiality of patients even after they have died. For this reason deceased patient’s records can only be disclosed in limited circumstances.

Request for Access to Health Records AHRA

You can request information or an application form, by one of the following means:
Post: The Disclosure Team, Kedhlow Building, Royal Cornwall Hospital, Truro, Cornwall, TR1 3LJ
Tel: 01872 254505
Email: rch-tr.Disclosure@nhs.net

Please refer to our Policy to Manage Information and records for further information:

It may also be possible to resolve your concerns through a discussion with our Patient and Family Experience Team before (or without the need to start) a more formal process:
Address: Patient Experience Team, Knowledge Spa, Royal Cornwall Hospital, Truro, TR1 3LJ.

Tel: 01872 252793
Email: rcht.patientexperience@nhs.net
If you remain dissatisfied following the outcome of your complaint, you may then wish to contact the Information Commissioner’s Office:
Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Web: https://ico.org.uk/concerns/
Phone: 0303 123 1113

Please note that the Information Commissioner will not normally consider an appeal until you have exhausted your rights of complaint to us directly. Please see the website above for further advice.