Privacy notices

The Data Protection Officer assists with monitoring internal compliance, informing and advising on data protection obligations, providing advice regarding Data Protection Impact Assessments (DPIAs) and acting as a contact point for data subjects and the supervisory authority.

The Trust is the Data Controller for the information which we hold and use. Our Trust is registered with the Information Commissioners Office (ICO).

Details of our registration can be found on https://ico.org.uk/esdwebpages/search

Head Office address:

Cambridgeshire Community Services NHS Trust
Units 7-8, Meadow Lane
St Ives, Cambs
PE27 4LG

Our Data Protection Officer (DPO) is Matthew Poole. You can contact him by post, email or telephone.

Norwich Community Hospital
Bowthorpe Road
Norwich
NR2 3TU

Telephone: 01603 272619

Email IG@nchc.nhs.uk

We collect personal confidential information about you which will be used to support the delivery of appropriate, high quality care and treatment. Your information is known as your personal data. We process your data to help us deliver our services in fulfilment of our public task of delivering health care. Where we are doing so to fulfil a statutory function, we do so on the basis of fulfilling a legal obligation.

These records for both patient and staff may include:

• name, address, email address, telephone/mobile number, date of birth, next of kin
• contact we have had, such as appointments and home visits
• details and records of treatment and care, including notes and reports about your health
• medical results like x-rays, blood tests, etc.
• photos or videos used as part of your care
• information from people who care for you and know you well, such as health professionals and relatives who are linked to the patient’s care. This includes information on expectant mothers so we can plan visits to new born children and where we need to access records for safeguarding purposes

Your medical information is known as special category data. Your records may also include other special category data, such as your sexuality, race or religious beliefs.

When we process your special category data, we do so to provide a medical diagnosis; for the purpose of health or social care or treatment or the management of health or social care systems and services. We may check patient information against the national NHS Spine to ensure the details are correct, for example when the Trust commissions other providers to provide direct care. We may also use your data for research purposes (read about how we use information).

It is important for us to have a complete picture as this information assists staff involved in your care to develop care plans, deliver appropriate treatment and deliver and provide improved care.

Your data will be collected by software providers who act as data processors, providing technology which helps us provide you with a quality service such as internet providers. They cannot use your data, the data is passed to us and we ensure they have adequate security in place to protect your confidentiality.  

We use your information to:

• help inform decisions that we make about your care
• ensure that your treatment is safe and effective
• work effectively with other organisations who may be involved in your care
• support the health of the general public
• safeguard children and vulnerable adults
• plan our services to ensure we can meet future needs
• review care provided to ensure it is of the highest standard possible
• train healthcare professionals
• research and audit including audits on quality of records
• prepare statistics on NHS performance
• monitor how we spend public money

It helps you because:

• accurate and up-to-date information assists us in providing you with the best possible care
• if you see another healthcare professional, specialist or another part of the NHS, they can readily access the information they need to provide you with the best possible care

Where possible, when using information to develop future services and provision, or carry out research, anonymised information will be used.

We retain and destroy your data in accordance with our Retention Schedule.

Read the patient data and research leaflet for more information about how your information may be used in research and your rights.

Whenever you use a health or care service, such as attending A&E or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• improving the quality and standards of care provided
• research into the development of new treatments 
• preventing illness and diseases
• monitoring safety
• planning services
• secondary uses of data, for example, population health management/risk stratification

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified, in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out, your confidential patient information will still be used to support your individual care.

Visit www.nhs.uk/your-nhs-data-matters to find out more about your NHS data or register your choice to opt out. The NHS webpage will explain:

• what is meant by confidential patient information
• examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• the benefits of sharing data
• who uses the data
• how your data is protected
• how to access the system to view, set or change your opt-out setting
• contact telephone number if you want to know any more or to set/change your opt-out by phone
• situations where the opt-out will not apply

You can also find out more about how patient information is used by reading the patient data and research leaflet and visiting the understanding patient data website. 

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Health and care organisations have until 2020 to put systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care. East of England Community Health and Care NHS Trust is compliant with the national data opt-out policy. 

All NHS organisations are expected to participate and support health and care research. Conducting high-quality clinical research helps us keep improving NHS care by finding out which treatments work best. To be effective, we may need to contact you to ask you to take part in our research. If we think your information may be of use in a research project, usually someone in the care team looking after you will contact you. People in your care team may look at your health records to check whether you are suitable to take part in a research study, before asking you whether you are interested or sending you a letter on behalf of the researcher.

Where we are processing your special category data for research purposes we are doing so in the pursuit of scientific or historical research purposes or statistical purposes.

Information is retained in secure electronic and paper records and access is restricted to those who need to know. It is important that your information is kept safe and secure to protect your confidentiality.

There are a number of ways in which your privacy is shielded, including:

• by removing your identifying information,
• using an independent review process,
• adhering to strict contractual conditions and
• ensuring strict sharing or processing agreements are in place.
• Managing who has access to what information (user access controls)

Read more about Records Management Code of Practice.

Everyone working for the Trust is subject to the common law duty of confidentiality and the Data Protection Act 2018. Information provided in confidence will only be used for the purposes for which it has been gathered, or for purposes closely associated with it, unless there are other circumstances covered by the law which mean we have to disclose the data.

Information may be disclosed lawfully to third parties in accordance with the Freedom of Information Act 2000.

Under the NHS Confidentiality Code of Conduct, all staff are required to protect information, inform you of how your information will be used and allow you to decide if and how some of your information can be shared. This will be noted in your records.

All Trust staff are required to undertake annual training in data protection, confidentiality and IT/cyber security, with additional training for specialists, such as healthcare workers, data protection officers and IT staff.

Teaching clinicians - Some medical files are needed to teach student clinicians about rare cases. Without such materials, new doctors and nurses would not be properly prepared to treat you.

Clinical placements - Clinical placements for students commonly take place within the NHS.

Students, such as student nurses, medical students, social work students, could be receiving training in the service that is caring for you. This may be when you are in a community setting such as a day hospital, or when you are being visited by health or staff at home.

If staff would like a student to be present they will always ask for your permission before that meeting or episode of care. The treatment or care you receive will not be affected if you refuse to have a student present during your episode of care.

Occasionally, for assessment purposes, students may request that their supervisor be present. You may refuse this if it makes you feel uncomfortable.

To provide the best care possible, sometimes we will need to share your data with others. We only do this where it will be in your best interests, or we are under a legal obligation to do so.

We may share your information with a range of health and social care organisations and regulatory bodies, for example your GP, the hospital which treats you, a consultant, NHS England, the local Council or a school. With consent we will share your information with third sector charities such as Barnardo’s. You may be contacted by any one of these organisations for a specific reason; they will have a duty to tell you why they have contacted you.

Where we share your information, we will have appropriate security measures in place. There will be either a contract or an information sharing agreement in place. We will only share your information where we are satisfied that there are sufficiently secure arrangements in place with the other organisation.

For your benefit, we may also need to share information from your records with non-NHS organisations who are providing you with care or other services, such as social services or private healthcare organisations.

We may also be asked to share basic information about you, such as your name and parts of your address, which does not include special category information from your health records. Generally, we would only do this to assist another organisation to carry out their statutory duties (such as usages of healthcare services, public health or national audits).

Non-NHS organisations may include, but are not restricted to:

• social services
• education services
• local authorities
• the police
• voluntary sector providers
• private sector providers

• Electronic Patient Record Systems (ERPs)
  • TPP SystmOne
  • Idox Lilie
  • Dentally
• e-RS – Electronic Referral Systems (National product)
• Dental Referrals via National Dental Referrals platform
• Anna Freud POD - Online mental health outcomes and feedback system
• Accurx Scribe Ambient Voice Technology (AVT) - Pilot programme ongoing
• Accurx for Video Consultations
• Attend Anywhere for Video Consultations
• Federated Data Platform (FDP)
• Mental Health Services Data Set (MHSDS)
• Community Services Data Set (CSDS)
• SharePoint via the NHS National Tenant
• SharePoint via the CCS Local Tenant
• National weekly, monthly and quarterly returns
• Microsoft Synapse for the Modern Data Platform – Datawarehouse
• Microsoft Power BI for reporting via the in-house dashboard system iHub
• Bespoke built Referral Systems for Professionals to make referrals to
• N&W Advice, Support and Access CYP Mental Health Services – Request for Support and Triage process (Bespoke)
• Shared Care Record

You have certain rights in relation to your information. These rights depend on the reason we process your data. It may not be possible to agree to your request, if the need to keep the record is of significant importance. If it is not, we will explain the reason for this to you.

Your have the right:

• to request a copy of your personal data
• to request that the Trust corrects any personal data if it is found to be inaccurate or out of date
• to request your personal data is erased where it is no longer necessary for the Trust to retain such data
• to withdraw your consent to the processing at any time, where we have sought your consent for this processing
• to data portability, ie to transfer your data to another controller, where certain conditions are met
• where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing
• to object to the processing of personal data
• to lodge a complaint with the Information Commissioners Office (ICO)

If you would like further information about any of these rights, please contact the Trust’s Data Protection Officer using the details below or visit our website.

If we wish to use your personal data for a new purpose, not covered by this Notice or reasonably foreseeable from the original reason(s) we processed your data, then we will provide you with a new notice explaining the new use(s) prior to commencing the processing, setting out the relevant purposes and processing conditions.

Information about you can also be used and provided to other organisations for purposes beyond your individual care, for research and planning to help provide better health and care for you, your family and future generations. This may only take place when there is a clear legal basis to use this information.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out, your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this web page you will:

• see what is meant by confidential patient information
• find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• find out more about the benefits of sharing data
• understand more about who uses the data
• find out how your data is protected
• be able to access the system to view, set or change your opt-out setting
• find the contact telephone number if you want to know any more or to set/change your opt-out by phone
• see the situations where the opt-out will not apply

You can change your mind about your choice at any time.

Helpful websites:

• Patient data and research leaflet - Health Research Authority (which covers health and care research)
• Introducing patient data - Understanding patient data (which covers how and why patient information is used, the safeguards and how decisions are made)

Each organisation has a senior person responsible for protecting the confidentiality of your information and enabling appropriate sharing. This person is known as the Caldicott Guardian.

You can contact the Trust’s Caldicott Guardian or Data Protection Officer by using the contact us section of this website.

If you have any questions or concerns regarding the information we hold on you, the use of your information or would like to discuss further, please contact the Information Governance team on email: ccs.accesstoinfo@nhs.net or call 01480 822063

We aim to meet the highest standards when collecting and using personal information. We encourage people to bring concerns to our attention and we take any complaints we receive very seriously.

You can submit a complaint through the Trust’s Complaints Procedure, available on our website or you can write to:

The Complaints Department 
Freepost: RTGA-CTLG-SCKH
PALS & Patient Experience Team
3 Meadow Park
St Ives
Cambs, PE27 4LG
Tel: 0800 013 2511 
Email ccs-tr.pals@nhs.net

If you remain dissatisfied with the Trust’s decision following your complaint, you may wish to contact:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF 

www.ico.org.uk