How your information is used (Fair Processing Notice)

Who we are

NHS Buckinghamshire Clinical Commissioning Group (CCG) is responsible for securing, planning, designing and paying for your NHS services, including planned and emergency hospital care, mental health, rehabilitation, community and primary medical care (GP) services. This is known as commissioning. We need to use information about you to enable us to do this effectively, efficiently and safely.

For further information please refer to our ‘About Us’ page.

What is this Fair Processing about?

This Fair Processing Notice (also known as a Privacy Notice) is part of our programme to make the data processing activities we are carrying out in order to meet our commissioning obligations transparent.

This notice tells you about information we collect and hold about you, what we do with it, how we will look after it and who we might share it with.

It covers information we collect directly from you or receive from other individuals or organisations.

This notice is not exhaustive. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to this email address: mailto:bucksccg@nhs.net or by post to:

NHS Buckinghamshire Clinical Commissioning Group
Second Floor
Aylesbury Vale District Council Offices
The Gateway
Gatehouse Road
Aylesbury
Buckinghamshire HP19 8FF

Telephone: 01296 587220 (Opening hours: Monday to Friday, 9.00am – 5.00 pm (excluding Bank Holidays)

Reviews of and changes to our Fair Processing Notice

We will keep our privacy notice under regular review. This privacy notice was last reviewed on 24 May 2018 prior to introduction of the General Data Protection Regulations (GDPR)

Our Commitment to Data Privacy and Confidentiality Issues

We are committed to protecting your privacy and will only process personal confidential data in accordance with Data Protection Legislation.

This includes the General Data Protection Regulation (EU) 2016/679 (GDPR), the Data Protection Act (DPA) 2018, the Law Enforcement Directive (Directive (EU) 2016/680) (LED) and any applicable national Laws implementing them as amended from time to time.

In addition, consideration will also be given to all applicable Law concerning privacy, confidentiality, the processing and sharing of personal data including the Human Rights Act 1998, the Health and Social Care Act 2012 as amended by the Health and Social Care (Safety and Quality) Act 2015, the common law duty of confidentiality and the Privacy and Electronic Communications (EC Directive) Regulations.

NHS Buckinghamshire CCG is a Data Controller as defined under GDPR. . We are legally responsible for ensuring that all personal information that we process i.e. hold, obtain, record, use or share about you, is done in compliance with the Data Protection Principles as set out in Article 5 under GDPR.

All data controllers must notify the Information Commissioner’s Office (ICO) of all personal information processing activities. Our ICO Data Protection Register number is  ZA336065 and our entry can be found in the Data Protection Register on the Information Commissioner’s Office website.

Everyone working for the NHS has a legal duty to keep information about you confidential. The NHS Care Record Guarantee and NHS Constitution provide a commitment that all NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and promote your health and wellbeing.

If you are receiving services from the NHS, we share information that does not identify you (anonymised) with other NHS and social care partner agencies for the purpose of improving local services, research, audit and public health.

We would not share information that identifies you unless we have a fair and lawful basis such as:

  • You have given us permission;
  • To protect children and vulnerable adults;
  • When a formal court order has been served upon us;
  • and/or
  • When we are lawfully required to report certain information to the appropriate authorities e.g. to prevent fraud or a serious crime;
  • Emergency Planning reasons such as for protecting the health and safety of others;
  • When permission is given by the Secretary of State or the Health Research Authority on the advice of the Confidentiality Advisory Group to process confidential information without the explicit consent of individuals

The CCG is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.

All information that we hold about you will be held securely and confidentially. We use administrative and technical controls to do this. We use strict controls to ensure that only authorised staff are able to see information that identifies you. Only a limited number of authorised staff have access to information that identifies you where it is appropriate to their role and is strictly on a need-to-know basis.

All of our staff, contractors and committee members receive appropriate and on- going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.

We will only use the minimum amount of information necessary about you.

Retention of Records

We will only retain information in accordance with the schedules set out in the Records Management Code of Practice for Health and Social Care 2016.

Destruction of Paper Records

The normal destruction method used within the CCG for confidential / sensitive information is by shredding. All confidential waste will be placed in the allocated “PHS Data Shred” consoles or confidential waste bins / sacks.  Shredding of confidential information is carried out on site using an accredited mobile shredding company, a certificate is issued once completed.

Overseas Transfers

Your information will not be sent outside of the United Kingdom where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.

Your Rights

GDPR provides the following rights for individuals:

  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making and profiling.

You have certain legal rights, including a right to have your information processed fairly and lawfully and a right to access any personal confidential data we hold about you.

You have the right to privacy and to expect the NHS to keep your information confidential and secure.

If you do not agree to certain information being processed or shared with us, or by us, or have any concern, then please let us know.

We may need to explain the possible impact this could have on our ability to help you and discuss the alternative arrangements that are available to you.

Requests for using your information beyond your own care will be considered and where your wishes cannot be followed, you will be told the reasons including the legal basis.

You have the right to refuse/withdraw consent to information sharing at any time. The possible consequences can be fully explained to you and could include delays in receiving care. If you wish to discuss withdrawing consent please contact the CCGs Patient Advice and Liaison Service, scwcsu.palscomplaints@nhs.net

Tel: 0800 328 5640

What is the patient opt-out?

You also have a right to request that your confidential information is not used beyond your own care and treatment and to have your objections considered. Where your wishes cannot be followed, you are to be told the reasons including the legal basis. This is regarded as an opt-out so as not to confuse with ‘consent’.

These are commitments set out in the NHS Constitution, for further information please visit www.gov.uk/government/publications/the-nhs-constitution-for-england.

The NHS Constitution states “You have the right to request that your confidential information is not used beyond your own direct care and treatment and to have your objections considered”.

Direct care is defined as a clinical, social or public health activity concerned with the prevention, investigation and treatment of illness and the alleviation or suffering of an individual.

Indirect care is defined as work within the health and social care environment which does not involve the direct treatment or support of individuals e.g. research, commissioning and much of the work done in public health.

There are several forms of opt-outs available at different levels. These include for example:

  1. Information directly collected by the CCG: Your choices can be exercised by withdrawing your consent for the sharing of information that identifies you, unless there is no overriding legal obligation.
  2. Information not directly collected by the CCG, but collected by organisations that provide NHS services (as described in the next section).

Type 1 opt-out 

If you do not want personal confidential data information that identifies you to be shared outside your GP practice, for purposes beyond your direct care, you can register a ‘Type 1 opt-out’ with your GP practice. This prevents your personal confidential information from being used other than in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease.

Patients are only able to register the opt-out at their GP practice.

Records for patients who have registered a ‘Type 1 opt-out’ will be identified using a particular code that will be applied to your medical records that will stop your records from being shared outside of your GP Practice.

Type 2 opt-out 

NHS Digital (formerly known as The Health and Social Care Information Centre – HSCIC) collects information from a range of places where people receive care, such as hospitals and community services.

They have a legal duty to do this but also have an obligation to ensure the information is used and shared appropriately and safely, more information about this is available here NHS Digital.

To support those NHS constitutional rights, patients within England are able to opt out of their personal confidential data being shared by NHS Digital for purposes other than their own direct care, this is known as a ‘Type 2 opt-out’

If you do not want your personal confidential information to be shared outside of NHS Digital, for purposes other than for your direct care, you can register a ‘Type 2 opt-out’ with your GP practice.

There may be occasions when it is not possible to exercise your right to “opt-out”, this will be in situations such as when we have an obligation by law or for the purposes of safeguarding.

It is also important to note that by exercising your right to “opt-out”, there could be consequences.  These situations will be discussed with you by your GP or by NHS Digital depending on whether you choose Type 1 or Type 2 opt-out.

Patients are only able to register the opt-out at their GP practice.

Further Information and Support about Type 2 opt-outs:

 For further information and support relating to Type 2 opt-outs please contact  NHS Digital contact centre at enquiries@nhsdigital.nhs.uk referencing ‘Type 2 opt-outs – Data requests’ in the subject line; or

Alternatively, call NHS Digital on (0300) 303 5678; or

Alternatively visit the website.

Complaints or questions

We try to meet the highest standards when collecting and using  personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

To make a complaint or bring concerns to our attention, please contact us in writing:

Patient Advice and Liaison Service (PALS) or The Complaints Service
NHS South Central & West Commissioning Support Unit
Albert House
Queen Victoria Road
High Wycombe
HP11 1AG

Email: scwcsu.palscomplaints@nhs.net

By Telephone: 0800 328 5640

The information we will require when you make a complaint will be:

  • Your name, address and contact telephone number and those of the person that you may be complaining for; including their date of birth and NHS Number.
  • A summary of what has happened, giving dates where possible.
  • Which organisation provided the care or service.
  • A list of things that you are complaining about.
  • What you would like to happen as a result of your complaint

 

Subject Access Requests

Individuals can find out if we hold any personal information by making a ‘subject access request’ under the Data Protection Act 1998. If we do hold information about you we will:

  • Give you a description of it;
  • Tell you why we are holding it;
  • Tell you who it could be disclosed to; and
  • Let you have a copy of the information in an intelligible form

We will hold Subject Access Requests for 3 years after closure at which time the retention period will be reviewed on an individual basis. If a Subject Access Request has been subject to an appeal we will be required to hold your information for 6 years after closure at which time your information will be destroyed.

To make a request for any personal information we may hold you need to put the request in writing to our contact address provided .

If we do hold information about you, you can ask us to correct any mistakes by, once again, contacting us at the contact address:

Email: SCWCSU.SAR@nhs.net

Post: Omega House, 112 Southampton Road, Eastleigh, SO50 5PB

If you require further advice, you can contact us on: 01296 587220 or via email Bucksccg@nhs.net or put your request in writing to:

Post: The FOI Lead, Headquarters, Second Floor, The Gateway, Gatehouse Rd, Aylesbury, HP19 8FF

Caldicott Guardian

The CCG has an named individual  responsible for protecting the confidentiality of patient information. This person is called the Caldicott Guardian who oversees the arrangements for the use and sharing of patient information.

The Caldicott Guardian plays a key role in ensuring that the NHS, Councils with Social Services and Public Health responsibilities and Partner Organisations satisfy the highest practical standards for handling patient information.

Acting as the ‘conscience’ of the organisation, the Caldicott Guardian actively supports work to enable information sharing where it is appropriate to share and advises on options for lawful and ethical processing of information.

The contact details of our Caldicott Guardian are as follows:

Karen West, GP Clinical Director
Karen.west3@nhs.net
, Tel: 01296 587220

Data Protection Officer

The CCG has a Data Protection Officer (DPO) who is a designated person with responsibility for protection of personal data. The officer makes sure that the organisation follows the law and appropriate regulations.

The Data Protection Officer (DPO) is responsible for monitoring compliance with the GDPR and other data protection legislation, the organisations data protection policies, awareness-raising, training and audits.  The DPO acts as a contact point for the ICO, our employees and the public. They co-operate with the ICO and will consult on any other matter relevant to Data Protection.

Ideally this appointment is separate to the Caldicott Guardian, especially where the Caldicott Guardian role leads to the determination of purposes and means of processing. Information Governance Alliance guidance indicates is a conflict of interest, reflecting related EU Guidelines. This is true for the CCG, where the Caldicott Guardian role holder is also a GP Clinical Director for Integrated Care.

The CCG Data Protection Officer is not the Data Protection Officer for primary care practices. As with the role of Caldicott Guardian (above), practices are expected to have their own appointment. A CCG appointment could not cover primary care given practices independent contractor status, and the substantial limitations placed on CCGs by Caldicott 2 in terms of patient confidential information it is authorised to receive which do not apply to member practices.

The contact details of our Data Protection Officer are as follows:

Russell Carpenter, Head of Governance/Board Secretary
Russell.carpenter@nhs.net
, Tel: 01296 587220

Personal Information we collect and hold about you

As a commissioner, we do not routinely hold or have access to your medical records. However, we may need to hold some personal information about you, for example:

  • If you have made a complaint to us about healthcare that you have received and we need to investigate
  • If you ask us to provide funding for Continuing Healthcare services
  • If you ask us for our help or involvement with your healthcare, or where we are required to fund specific specialised treatment for a particular condition that is not already covered in our contracts with organisations that provide NHS care.
  • If you ask us to keep you regularly informed and up-to-date about the work of the CCG, or if you are actively involved in our engagement and consultation activities or service user/Patient Participation

Our records may include relevant information that you have told us, or information provided on your behalf by relatives or those who care for you and know you well, or from health professionals and other staff directly involved in your care and treatment.

Our records may be held on paper or in a computer system. The types of information that we may collect and use include the following:

Identifiable: This is data which contains details which can identify individuals such as name, address, date of birth, postcode

Pseudonymised Information: This is data that has undergone a technical process that replaces your identifiable information such as NHS number, postcode, date of birth with a unique identifier, which obscures the ‘real world’ identity of the individual patient to those working with the data.

Anonymised Information: This is data rendered into a form which does not identify individuals and where there is little or no risk of identification (identification is not likely to take place).

Aggregated: This is anonymized data which is grouped together so that it does not identify an individual

Personal Confidential Data: This term describes personal information about identified or identifiable individuals, which should be kept private or secret. For the purposes of this notice ‘personal’ includes the Data Protection Act definition of personal data, but it is adapted to include dead as well as living people. ‘Confidential’ includes both information ‘given in confidence’ and ‘that which is owed a duty of confidence’ and is adapted to include ‘sensitive’ as defined in the Data Protection Act and is used interchangeably with ‘confidential’ in this document.

Sensitive Personal Data: The Data Protection Act defines “sensitive personal data” as information about an individual’s: racial or ethnic origin; political opinions; religious beliefs; trade union membership; health; sexual life; alleged criminal activity; or court proceedings.

 

Our uses of information

Although this is not an exhaustive detailed listing, the following table lists key examples of the purposes and rationale for why we collect and process information:

Complaints

We will process your personal information where it relates to a complaint where you have asked for our help or involvement.

The information we will require when you make a complaint will be:

  • Your name, address and contact telephone number and those of the person that you may be complaining for; including their date of birth and NHS Number
  • A summary of what has happened, giving dates where possible
  • Which organisation provided the care or service
  • A list of things that you are complaining about

What you would like to happen as a result of your complaint

Legal Basis

The CCG has a duty as to the improvement in quality of services under Section 14R NHS Act 2006 and will rely on your explicit consent as the basis to undertake such activities.

Complaint Processing Activities

When we receive a complaint from an individual we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service being provided.

We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute.

If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with NHS retention policy. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

We may use service user stories, following upheld complaints, but the individual will remain anonymous. The service user stories will provide a summary of the concern, service improvements identified and how well the complaints procedure has been applied. Explicit consent will always be sought from the service user and carer or both before we us

Benefits

Managing complaints enables the CCG to continuously improve the quality of the services they commission.

Retention Period

Information relating to complaints will be retained for 10 years after which time the information will be reviewed and if no longer necessary will be destroyed.e the service user story.

Individual Funding Treatments

We will collect and process your personal information where we are required to fund specific treatment for you for a particular condition that is not already covered in our contracts. This may be called an “Individual Funding Request” (IFR).

The Individual Case Review Panel (ICRP) considers IFRs and the panel is administered by the NHS South and West Commissioning Support Unit on behalf of the Clinical Commissioning Groups across Thames Valley.

Legal Basis

The CCG has a duty to have regard to the need to reduce health inequalities in access to health services and health outcomes achieved as outlined in the National Health Service Commissioning Board and Clinical Commissioning Groups (Responsibilities and Standing Rules) Regulations 2012 (SI 2012 No 2996) (Part 7-34 (1) and (2).

View further information on Individual Funding Requests.

The clinical professional who first identifies that you may need the treatment will explain to you the information that we need to collect and process in order for us to assess your needs and commission your care and will ask for your informed consent for personal clinical information to be shared with the CCG.

 Benefits

The Individual Funding Request process allows Buckinghamshire CCG to look at evidence for the safety and effectiveness of any treatment and ensures that the services we pay for will give patients the greatest health gains from the finite resources we have available.

Continuing Healthcare

We have commissioned NHS Oxford Health NHS Foundation Trust to collect and process your identifiable information where you have asked us to undertake assessments for Continuing Healthcare (a package of care for those with complex medical needs) and commission resulting care packages.

Legal Basis

The CCG has a duty to have regard to the need to reduce health inequalities in access to health services and health outcomes achieved as outlined in the National Health Service Commissioning Board and Clinical Commissioning Groups (Responsibilities and Standing Rules) Regulations 2012 (SI 2012 No 2996) (Part 6-20-22.

The clinical professional who first sees you to discuss your needs will explain to you the information that they need to collect and process in order for us to assess your needs and commission your care and will ask for your informed consent for personal clinical information to be shared with the CCG.

View further information on Continuing Health Care.

Benefits

Buckinghamshire CCG can arrange a care and support package that meets your assessed needs. The CCG can determine how your needs and care will be managed, where your care will be given e.g. in your own home or in a care home and identify which organization will be responsible for meeting your needs.

Retention Period

Information relating to Continuing Healthcare will be retained for 8 years after which time the information will be reviewed and if no longer necessary will be destroyed.

 

Safeguarding

Safeguarding means protecting peoples’ health, wellbeing and human rights, and enabling them to live free from harm, abuse and neglect. It is a key part of providing high-quality health and social care. The CCG will participate in Serious Case Reviews undertaken by either the local Children’s Safeguarding Boards or the Adult Safeguarding Boards for continued learning, to minimize risk and to improve services. As part of delegated commissioning arrangements the Designated Adults Safeguarding Manager (DASM) will act on behalf of Primary Care and will be provided with personal confidential information specific to an individual case. The DASM will review this information and produce an anonymized report which is signed by the organisations Caldicott Guardian and submitted to the relevant Children or Adult Safeguarding Boards at which point personal confidential information provided to the CCG is destroyed.

Legal Basis

The CCG has a statutory responsibility under the Children Act 2004, Care Act 2014 and safeguarding provision within the Data Protection Act 2018 (Schedule 1, Part 2, Subsections 18 and 19) to ensure the safety of all children, and the safety of adults at risk of abuse and neglect.

Benefits

Safeguarding is a fundamental element of the CCGs commissioning plans and forms a core part of the commissioning assurance process.

Retention Period

The CCG will hold your information for a period of 8 years following the closure of a case. Before records are destroyed we will review information held and take into account any serious incident retentions which may require us to hold the information for a further period of time. Each case will be reviewed on an individual basis.

Risk Stratification

Rationale

Risk stratification is a process that uses de-identified personal data from health care services to determine which people are at risk of experiencing certain outcomes, such as unplanned hospital admissions.

Data Processing activities for Risk Stratification

Risk stratification tools are used by CCGs to analyse the overall health of a population using data which is anonymised in line with the Information Commissioner’s Office (ICO) Anonymisation Code of Practice.

The combined CCGs Secondary Use Service (SUS) data and GP data which contains an identifier (usually NHS number) is made available to clinicians with a legitimate relationship with their patients to enable them to identify which patients should be offered targeted preventative support to reduce those risks.

The CCG has commissioned NHS South, Central and West Commissioning Support Unit (SCWCSU) to provide the risk stratification software solution on behalf of itself and its GP practices. This is known as Integrated Population Analytics, or IPA.

The CCG will use pseudonymised versions of this information to understand the local population needs, whereas GPs will be able to identify (by NHS number) which of their patients are at risk in order to offer a preventative service to them.

NHS South, Central and West Commissioning Support Unit (SCW) – DSCRO work with Graphnet Health Limited to extract Primary Care data and the SCWCSU process this data on behalf of the CCG for Risk Stratification purposes.

This processing takes place under contract following the below steps:

  • NHS Digital has a legal obligation to obtain data from providers of NHS care such as the local hospital or community hospital.  This data is then sent to the SCWCSU DSCRO and amended so that only your NHS number could identify you. The data is then provided to SCWCSU for processing in the risk stratification software. The CCG has signed a Data Sharing Contract with NHS Digital for the use of this data, called Secondary Use Services (SUS) data.
  • The SCWCSU contract Graphnet Health Limited to extract primary care data identifiable by your NHS Number for those patients that have not objected to Risk Stratification or where no Type 1 objection has been made by an individual. The data containing the same verified NHS numbers are then stored within a secure sever owned and managed by SCWCSU which is then processed through the risk stratification algorithms and the output made available in the IPA user interface.
  • Within the landing stage, the risk stratification system automatically links and pseudonymises the identifiable data from GP’s and NHS Digital. No identifiable data of any patient is seen by the CCG.

SCWCSU has set up a formula to analyse the data in pseudonymised form to produce a risk score for each patient. This information is available to SCWSCU DSCRO.

The risk scores are only made available to authorized users within the GP Practice where you are registered via a secure portal managed by SCWCSU.

This portal allows only the GPs to view the risk scores for the individual patients registered in their practice in identifiable form. The outputs can be made available if Practices are working as a locality, federation or super practice and this access is agreed by the Caldicott Guardian for each Practice.

If you do not wish information about you to be included in our risk stratification programme, please contact your GP Practice. They can add a code to your records that will stop your information from being used for this purpose.

Further information about risk stratification is available from: https//www.england.nhs.uk/ourwork/tsd/ig/risk-stratification/

Further information about Integrated Population Analytics is available from: https://www.scwcsu.nhs.uk/ipa

Legal Basis

NHS England has gained approval from the Secretary of State, through the Confidentiality Advisory Group, for its application for the disclosure of commissioning data sets and GP data for risk stratification purposes to data processors working on behalf of GPs which provides a statutory legal basis under Section 251 of the NHS Act 2006 to process data for risk stratification purposes. We are committed to conducting risk stratification effectively, in ways that are consistent with the laws that protect your confidentiality.

Benefits

CCGs and GPs use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable admissions. Typically this is because patients have a long term condition such as Chronic Obstructive Pulmonary Disease.  NHS England encourages CCGs and GPs to use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable admissions.

Knowledge of the risk profile of our population will help the CCG to commission appropriate preventative services and to promote quality improvement in collaboration with our GP practices.

 

Invoice Processing

The Invoice Validation process ensures that care providers who provide you with care and treatment can be paid for the services they provide.

Care providers submit their invoices to NHS Shared Business Services (NHS SBS) who process invoices on behalf of NHS Buckinghamshire CCG NHS SBS do not require and should not receive any patient confidential data to provide their services.

There are situations where identifiable patient personal data is required to ensure that the correct service provider is paid.

In such cases service providers are required to send identifiable patient personal data such as NHS Number to a Controlled Environment for Finance (CEfF) which is a secure restricted area within SCWCSU who process this data on our behalf and indicate which invoices we can validate (authorize) for payment. NHS England has published guidance on how invoices must be processed and Commissioners have a duty to detect report and investigate any incidents of where a breach of confidentiality has been made.

For more information see: https://www.england.nhs.uk/ourwork/tsd/ig/in-val/invoice- validation-faqs/

Commissioners have a duty to detect report and investigate any incidents of where a breach of confidentiality has been made.

View further information on Invoice Validation – FAQs.

Legal Basis

The legal basis for SCWCSU to receive personal identifiable data for the purposes of invoice validation is provided by Section 251 of the NHS Act 2006.

Benefits

 The invoice validation process supports the delivery of patient care by ensuring that:

  • service providers are paid for patients treatment,
  • enables services to be planned, commissioned,
  • managed and subjected to financial control,
  • enables commissioners to confirm that they are paying appropriately for the treatment of patients for whom they are responsible
  • fulfilling commissioners duties of fiscal probity and scrutiny

enables invoices to be challenged and disputed or discrepancies resolved.

Primary and Secondary Care

We commission a number of organisations to provide primary and secondary healthcare services to you. These organisations may be within the NHS or outside the NHS.

Primary Care services cover GP Practices, Dental Practices, Community Pharmacies and high street Optometrists.

Secondary Care services are usually (but not always) delivered in a hospital or clinic with the initial referral being received from Primary Care.

These organisations may share identifiable, pseudonymised, anonymized, aggregated, personal confidential and sensitive personal data information with us for the following purposes:

  • To look after the health of the general public such as notifying central NHS groups of outbreaks of infectious diseases
  • To undertake clinical audit of the quality of services provided
  • To carry out risk profiling to identify patients who would benefit from proactive intervention
  • To perform case management where the NHS offers intervention and integrated care programmes involving multiple health and social care providers
  • To report and investigate, complaints, claims and untoward incidents
  • To prepare statistics on our performance for the Department of Health
  • To review our care to make sure that it is of the highest standard

Legal Basis

Your information is only accessed by authorized persons and not disclosed unless necessary.  We will never share your personal information unless a legal basis has been identified for the different purposes of sharing or we have obtained your explicit consent.

The Health & Social Care Act 2012 allows us to collect your information and is only accessed a limited number of authorised staff and not disclosed to other organisations. We will never share your personal information unless a legal basis has been identified for the different purposes of sharing or we have obtained your explicit consent.

Benefits

Through sharing information ethically and lawfully the NHS is able to improve its understanding of the most important health needs and the quality of the treatment and care provided.

Patient and Public Involvement

If you have asked us to keep you regularly informed and up to date about the work of the CCG or if you are actively involved in our engagement and consultation activities or patient participation groups, we will collect and process personal confidential data which you share with us.

This is called ‘Patient and Public Involvement’

Where you submit your details to us for involvement purposes, we will only use your information for this purpose. You can opt out at any time by contacting us using our contact details at the end of this document.

Individuals can also complete online surveys via our Citizen Space website in which you will be asked to agree to the Terms and Conditions of using the site and will be asked for your explicit consent for us to use your information in which we will publish survey results. We will only use your information for this purpose of which you can opt out at any time.

Legal Basis

Under the NHS Act 2006 Section 14Z2, the CCG has a duty, in relation to health services provided (or which are to be provided) under arrangements made by the CCG exercising its functions, to make arrangements so as to secure that individuals to whom the services are being (or may be) provided are involved at various specified stages.

We will rely on your consent for this purpose.

Where you have agreed to participate in online surveys on our Citizen Space site, your information will be held for 6 months following the publication of survey results after which you’re your information will be deleted. If we need to keep your information for longer the retention period will be provided on the Citizen Space Privacy Notice.

Benefits

Where you submit your details to us for involvement purposes, we will only use your information for this purpose. You can opt out at any time by contacting us using our contact details provided.

If you would like to find out more information on how to get involved and how this benefits Buckinghamshire CCG, please see our Getting Involved pages.

Records Retention

Where you have provided us with your contact details for us to keep in touch, we will contact you periodically to ensure you are still happy for us to hold these details. If we do not hear back from you we will delete your information from our database.

Commissioning

To collect NHS data about service users that we are responsible for.

Legal Basis

Our legal basis for collecting and processing information for this purpose is statutory.

Under the Health & Social Care Act 2012 the CCG has a statutory legal basis for collecting and processing information for the purposes of commissioning.

Processing Activities

Hospitals and community organisations that provide NHS-funded care must submit certain information to NHS Digital about services provided to our service users.

This information is generally known as commissioning datasets. The CCG obtains these datasets from NHS Digital and they relate to service users registered with GP Practices that are members of the CCG.

These datasets are then used in a format that does not directly identify you, for wider NHS purposes such as managing and funding the NHS, monitoring activity to understand and plan the health needs of the population, and to gain evidence that will improve health and care through research.

The datasets include information about the service users who have received care and treatment from those services that we are responsible for funding. The CCG is unable to identify you from these datasets. They do not include your name, home address, NHS number, post code or date of birth.  Information such as your age, ethnicity and gender, as well as coded information about any clinic or accident and emergency attendances, hospital admissions and treatment will be included.

The specific terms and conditions and security controls that we are obliged to follow when using these commissioning datasets can also be found on the NHS Digital website.

More information about how this data is collected and used by NHS Digital is available on their website.

We also receive similar information from GP Practices within our CCG membership that does not identify you.

Benefits

We use this datasets for a number of purposes such as:

  • Performance managing contracts;
  • Reviewing the care delivered by providers to ensure service users are receiving quality and cost effective care;
  • To prepare statistics on NHS performance to understand health needs and support service re-design, modernisation and improvement;
  • To help us plan future services to ensure they continue to meet our local population needs;
  • To reconcile claims for payments for services received in your GP Practice;
  • To audit NHS accounts and services.

If you do not wish your information to be included in these datasets, even though it does not directly identify you to us, please contact your GP Practice and they can apply a code to your records that will stop your information from being included.

Sharing information provided to us with other bodies

The CCG is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for; auditing, or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.

The Cabinet Office is responsible for carrying out data matching exercises.

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

We participate in the Cabinet Office’s National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise, as detailed here.

The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under the Data Protection Act 1998.

Data matching by the Cabinet Office is subject to a Code of Practice.

View further information on the Cabinet Office’s legal powers and the reasons why it matches particular information.

For further information on data matching at this authority contact

email address:  mailto:bucksccgs@nhs.netor by post to:

NHS Buckinghamshire Clinical Commissioning Group
Second Floor
Aylesbury Vale District Council Offices
The Gateway
Gatehouse Road
Aylesbury
Buckinghamshire HP19 8FF

Telephone: 01296 587220

Cabinet Office

The Cabinet Office is responsible for carrying out data matching exercises. Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

We participate in the Cabinet Office’s National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise, as detailed here.

Legal Basis

The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under GDPR.

Data matching by the Cabinet Office is subject to a Code of Practice.

View further information on the Cabinet Office’s legal powers and the reasons why it matches particular information:

https://www.gov.uk/government/publications/code-of-data-matching-practice-for-national-fraud-initiative

For other organisation to provide services to us

The CCG will use other organisations to provide us with support services. These organisations will process information on our behalf. These organisations are known as “data processors” and will provide additional expertise to support the work of Buckinghamshire CCG:

Legal Basis

Buckinghamshire CCG are committed to ensure that a legal basis is identified for all flows of personal identifiable to external organisations.

The CCG ensures that this is supported by use of an NHS Standard Contract which is mandated by NHS England for use by commissioners for all contracts for healthcare services other than primary care. The NHS Standard Contract covers:

  • confidential information of all parties (Section: GC20),
  • patient confidentiality, data protection, freedom of information and transparency (Section: GC21)     In addition a Data Sharing Framework Contract (DSFC) and Data Sharing Agreement (DSA) are in place with NHS Digital for the release of patient level data and Service Level Agreements are in place with NHS South Central and West Commissioning Support Unit (SCWCSU) for the services they provide.

The attached document here describes the organisations we use, the services they provide and legal basis for processing your information.

Benefits

These organisations are subject to the same legal rules and conditions for keeping personal confidential data and secure and are underpinned by a contract with us.

Before awarding any contract, we ensure that organisations will look after your information to the same high standards that we do. Those organisations can only use your information for the service we have contracted them for and cannot use it for any other purpose. 

Data Flows

The CCG maps each individual data flow in and out of the organisation in order to understand what data it holds and processes. These data flow maps are reviewed and updated annually as part of the requirement to complete an Information Governance Toolkit. Data Flow Maps are available on request from the CCG.

Email: bucksccg@nhs.net

Tel: 01296 587220

National Registries

National Registries (such as the Learning Disabilities Register) have statutory permission under Section 251 (16/CAG/0056) of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user.

Research

Data may be collected for the purpose of research.

Research can be undertaken using information that does not identify you (anonymised). The law does not require your consent to be obtained in this case but information should be made available to you where your anonymised data is used for the purposes of research. Information can be made available either in waiting rooms, using information leaflets, published on notice boards, waiting room screens and/or an organisations website.

Where identifiable data is needed for research, you may be approached by an organisation who has provided you with care and asked if you wish to participate in a research study. Where identifiable data is required, an organisation must obtain explicit consent. A member of the research team will discuss the research study with you and will provide you with information on what the study is about, what information they wish to collect, how to opt out and who to contact for more information.

If you do not wish your information to be used for research, whether identifiable or non-identifiable, please let your GP Practice know. They will add a code to your records that will stop your information from being used for research.

Legal Basis

Your explicit consent will be obtained as the legal basis to process identifiable information for research purposes.

Sometimes research can be undertaken using information that does not identify you. The law does not require us to seek your consent in this case, but the organisation holding your information will make notices available on the premises and on the website about any research projects that are undertaken.

Benefits

Results from research studies can provide a direct benefit to individuals who take part in medical trials and indirect benefit to the population as a whole.

Service user records can also be used to identify people to invite them to take part in clinical trials, other interventional studies or studies purely using information from medical records.

Retention Period

Retention periods will be included in the research study Information Leaflet related to each study.

Processing Activities

Where identifiable data is needed for research, service users will be approached by the organisation where treatment was received, to see if they wish to participate in research studies.

If you do not wish your information to be used for research, whether identifiable or non-identifiable, please let your GP Practice know. They will add a code to your records that will stop your information from being used for research.

Further Information

Further information about the way in which the NHS uses personal confidential data and your rights in that respect can be found in:

Data Linkage

Data may be de-identified and linked by organisations so that it can be used to improve healthcare and development and monitor NHS performance. Where data is used for these statistical purposes, stringent measures are taken to ensure individual patients cannot be identified. When analysing current health services and proposals for developing future services it is sometime necessary to link separate individual data sets to be able to produce a comprehensive evaluation. This may involve linking primary care GP data with other data such as secondary uses service (SUS) data (inpatient, outpatient and A&E) In some cases there may also be a need to link local datasets which could include a range of acute-based services such as radiology, physiotherapy, audiology etc, as well as mental health and community-based services such as Improving Access to Psychology Therapies, district nursing, podiatry etc. When carrying out this analysis, the linkage of these datasets is always done using a unique identifier that does not reveal a person’s identity as the CCG does not have any access to patient identifiable data.

Data Retention

Buckinghamshire CCG will approach the management of its business records in line with their Records Management Policy which sets out roles and responsibilities for records management and the key operating principles for record keeping across the business and manages records in line with the Records Management NHS Code or Practice for Health and Social Care which sets the required standards of practice in the management of records for those who work within or under contract to NHS organisations in England, based on current legal requirements and professional best practice.

 The CCGs records shall not be retained indefinitely. At the end of the retention, records shall be disposed of. In most cases this will mean controlled destruction; a small percentage of records may become archived meaning that they will be retained indefinitely under the Public Records Act.

Information Governance

Information Governance is to do with the way organisations ‘process’ or handle information. It covers personal information relating to patients, service users, employees, and corporate information (financial and accounting records.)

The Organisations that we do business with are subject to the same legal rules and conditions for keeping personal confidential data and secure and are underpinned by a contract with us.

Before awarding any contract, we ensure that organisations will look after your information to the same high standards that we do. Those organisations can only use your information for the service we have contracted them for and cannot use it for any other purpose. All organisations are required to complete a Department of Health Information Governance Toolkit which draws together the legal rules and central guidance and presents them in a single standard set of information governance requirements which covers management structures and responsibilities, confidentiality, data protection and information security. All organisations are required to achieve a Level 2 score which demonstrates that organisations can be trusted to maintain the confidentiality and security of personal information and in-turn increases public confidence that the NHS and its partners can be trusted with personal data.

Contact us

If you have any questions or concerns regarding how we use your information, please contact us at:

NHS Buckinghamshire Clinical Commissioning Group
Second Floor
Aylesbury Vale District Council Offices
The Gateway
Gatehouse Road
Aylesbury
Buckinghamshire HP19 8FF

Telephone: 01296 587220

Email: bucksccg@nhs.net

Further advice and guidance

For independent advice about data protection, privacy and data-sharing issues, you can contact:

Information Commissioner
Wycliffe House,
Water Lane,
Wilmslow,
Cheshire,
SK9 5AF.

Tel: 0303 123 1113

Website: www.ico.gov.uk

Further information about the way in which the NHS uses personal confidential data and your rights in that respect can be found in:

The NHS Care Record Guarantee:

This guarantee is a commitment that NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and promote your health and wellbeing.

The NHS Constitution:

The Constitution establishes the principles and values of the NHS in England. It sets out rights to which patients, public and staff are entitled, and pledges which the NHS is committed to achieve, together with responsibilities, which the public, patients and staff owe to one another to ensure that the NHS operates fairly and effectively

To share or not to share? Information Governance Review:

This was an independent review of information about service users shared across the health and care system led by Dame Fiona Caldicott and was conducted in 2012.

NHS Commissioning Board – Better Data, Informed Commissioning, Driving Improved Outcomes: Clinical Data Sets:  

Provides further information about the data flowing within the NHS to support commissioning.

NHS Digital – Guide to Confidentiality:  

NHS Digital are the trusted national provider of high-quality information, data and IT systems for health and social care and are responsible for collecting data from across the health and social care system.

 

Health Research Authority:

The HRA protects and promotes the interests of patients and the public in health and social care research.