How your information is used
What we do
Our CCG is a membership organisation comprising of 16 GP practices within the CCG’s geographical boundaries and is responsible for planning, buying and monitoring (also known as commissioning) health services from healthcare providers such as hospitals and GP practices for our local population to ensure the highest quality of healthcare. We also have a performance monitoring role of these services, which includes responding to any concerns from our patients on services offered.
The CCG holds some information about you and this document (which is also known as a privacy notice or fair processing notice) outlines how that information is used, who we may share that information with, how we keep it secure (confidential) and what your rights are in relation to this.
What kind of information do we use?
We use four types of information/data:
- Anonymised data is data about you but from which you cannot be personally identified. It is any personal data which has been processed so that all identifiers (such as name or NHS number) are removed minimising the likelihood that the data will identify individuals
- Pseudonymised data is any personal data which has been processed so that all identifiers such as name, address, date of birth and NHS Number is removed and replaced with a code which makes it anonymous to the CCG, but would allow others such as those responsibile for providing care to idenitfy an individual
- Personal data is data from which you can be personally identified
- Sensitive data is data about you, such as data relating to your healthcare, from which you can be identified
What do we use anonymised data for?
We use anonymised data to plan health care services. Specifically we use it to:
- Check the quality and efficiency of the health services we commission
- Prepare performance reports on the services we commission
- Work out what illnesses people will have in the future, so we can plan and prioritise services and ensure these meet the needs of patients in the future
- Review the care being provided to make sure it is of the highest standard
- Look at care being provided to see where improvements could be made
What do we use pseudonymised information for?
We use pseudonymised information (sometimes described as de-identified) where, for example, a GP practice provides information to us to analyse the care of people living in our area. This ensures that:
- Only the GP practice (or organisation sending data in to us) are able to identify you as they securely maintain a record of which unique code represents each patient. This is useful, for example, where information about the same patient is being compared over two different time periods
- The information we receive is unidentifiable to us – we have no means to determine which individual the data relates to as names, address, dates of birth and NHS number have been removed before we see the data
- There is no transfer of personal or sensitive personal data to the CCG unless there is a legal basis/justification for the CCG to process that information
- There is little or no risk to those individuals of their pseudonymised information revealing their identity to people who do not need to know it. For example the unique code ensures the associated data is attributable to that code, however the code itself is meaningless to anybody other than the GP practice (using the above example)
- This information improves the CCG’s ability to determine the care needs of people within its area, for example to:
- Assess where delays in care occur to help ensure patients are treated in a timely manner
- Identify gaps in the provision of services to inform the development of new services that better meet the needs of the local population
- Monitor outcomes for patients (such as what proportion of patients attended Accident and Emergency in the 3 months after completing a package of care) to drive improvements in how services are delivered
Pseudonymised data is used across a variety of areas, such as Inpatient, Outpatient, Accident and Emergency, Out of Hours, Urgent Care, Community Nursing, Community Mental Health, General Practice and Social Care from a variety of health and care providers. Data is pseudonymised by the Data Services for Commissioning Regional Office (DSCRO) based at North of England Commissioning Support (NECS) in accordance with the requirements of the Health and Social Care Act 2012 or by the healthcare provider themselves.
The pseudonymised code is used across these services so that the data can be linked together without revealing the identity of the patient. The pseudonymised code is not used outside of this data. The CCG handles pseudonymised data as if it were sensitive personal data. No further data linkages are undertaken outside of the above process.
What do we use your sensitive and personal information for?
There are some limited exceptions where we may hold and use sensitive personal information about you. For example the CCG has been required by law to perform certain services that involve the processing of sensitive personal information.
The areas where we regularly use sensitive personal information include:
- The process where you or your GP can request special treatments that is not routinely funded by the NHS, which are known as Individual Funding Requests
- Assessments for continuing healthcare (for those with complex medical needs) and appeals
- Responding to your queries, compliments or concerns
- Assessment and evaluation of safeguarding concerns
- The information is necessary for your direct care
- Responding to patients, carers or Member of Parliament communication
- Investigating incidents
- Investigating the causes of an infection, sometimes contagious, which may be a risk to the public (a Post Infection Review). We do not need to always ask your permission to access your information if there is a risk to the public
- You have freely given your informed agreement (consent) for us to use your information for a specific reason (purpose)
- There is an overriding public interest in using the information, for example, in order to safeguard an individual, or to prevent a serious crime
- There is a legal requirement that will allow us to use or provide information (for example, a formal court order)
- Where there is a Section 251 exemption permitting the use of sensitive personal information under specific conditions, for example
- Understand the local population needs and plan for future requirements, which is known as “Risk Stratification for commissioning”. Information from health and social care records is looked at anonymously by the CCG, alongside that of others, to identify groups of patients who would benefit from some additional help from their GP or care team. The aim is to prevent ill health and possible future hospital stays, rather than wait for you to become sick. Only the GP/care team is able to see who actually requires additional help and all processing of information is carried out under strict rules to make sure this is the case. Typically, we only use the NHS number to identify patients in this work. Risk stratification is undertaken by eMBED Health Consortium using the King’s Fund Combined Predictive Model. Further information is available here
- Ensure that the CCG is billed accurately for the treatment of its patients, which is known as “invoice validation”. Information such as your NHS Number, name, address and date of treatment may be passed on to enable the billing process. These details are held in a secure environment and kept confidential. This information will only be used to validate invoices, and will not be shared for any further commissioning purposes. Invoice validation is undertaken on behalf of the CCG by North of England Commissioning Support Unit (NECS). Further information is available here
- Monitor access to services, waiting times and particular aspects of care, for which the CCG is considered to be an “Accredited Safe Haven”
Do you share my information with other organisations?
We commission a number of organisations (both within and outside the NHS) to provide healthcare services to you. We may also share anonymised statistical information with them for the purpose of improving local services, for example understanding how health conditions spread across our local area compared against other areas.
The law provides some NHS bodies, particularly NHS Digital, ways of collecting and using patient data that cannot identify a person to help Commissioners to design and procure the combination of services that best suit the population they serve.
Data may be linked and de-identified by these special bodies so that it can be used to improve health care and develop and monitor NHS performance. Where data is used for these statistical purposes, stringent measures are taken to ensure individual patients cannot be identified.
When analysing current health services and proposals for developing future services it is sometimes necessary to link separate individual datasets to be able to produce a comprehensive evaluation. This may involve linking primary care GP data with secondary care SUS (secondary uses service) data (inpatient, outpatient and A&E). In some cases there may also be a need to link local datasets which could include a range of acute-based services such as radiology, physiotherapy, audiology etc., as well as mental health and community-based services such as Improving Access to Psychological Therapies, district nursing, podiatry etc. When carrying out this analysis, the linkage of these datasets is always done using a pseudonym in the form of a unique code as the CCG does not have any access to patient identifiable data.
We may also contract with other organisations to process data. We ensure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.
Currently, the external data processors we work with include (amongst others):
What are your rights?
You have the right to have information about you processed fairly and lawfully, and to be able to access any personal information about you held by the NHS. You also have the right to privacy, and can expect the NHS to keep information confidential and secure. You have the right to request that your confidential information is not used for purposes other than your own care and treatment, and to have your objections considered. These rights are set out in the NHS Constitution.
Opt-out of (stop) information about you being processed
If you do not want the NHS to use information about you, collected by your GP then you can opt out by completing an opt-out form and returning it to your GP practice. There are different types or levels of opt-out available, further information about these types are explained below:
Type 1 opt-outs
- If you do not want information that identifies you to be shared outside your GP practice, for purposes beyond your direct care you can register a type 1 opt-out with your GP practice. This prevents your personal confidential information from being used other than in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease.
Type 2 opt-outs
- NHS Digital collects information from a range of places where people receive care, such as hospitals and community services. If you do not want your personal confidential information to be shared outside of NHS Digital for purposes other than for your direct care you can register a type 2 opt-out with your GP practice.
Depending on the type of opt out you may choose, this will prevent your information being shared outside of your GP practice or NHS Digital for purposes beyond your direct care (except in special circumstances allowed by law, such as when there is a public health emergency or safeguarding issue).
Please be aware that if you opt-out the CCG does not hold or commission the retention of identifiable historical data (such as a data warehouse) and therefore any opt-out will be applied to the data provided by NHS Digital and the Data Services for Commissioner’s Regional Office (DSCRO).
It is entirely up to you whether the NHS can use your information or not – and if you choose to opt out this will not in any way affect the care or treatment you receive as a patient.
Please note that you may opt-out of your information being used for Risk Stratification. However, where this could affect your direct care (through case management, where this data assists GPs to identify the care needs of their patients), you will need to discuss this with your GP to be clear of the possible consequences.
Please contact your GP practice, the hospital or healthcare provider if you wish for them to stop processing information about you that is not for your direct care.
If you wish for the CCG to stop processing information about you or require any information as to how information is used then please contact us, marking your message for the attention of the Caldicott Guardian, who is responsible for protecting the confidentiality of a patient and service-user information and enabling appropriate information-sharing.
What safeguards are in place to ensure data that identifies me is secure?
We only use information that may identify you in accordance with the Data Protection Act 1998. The Data Protection Act requires us to have an appropriate justification (lawful basis) if we wish to use/process any personal information. This means that we cannot collect information without the purpose of this being clearly identified and we can only do this where a law that gives us permission to do this.
Within the health sector, we also have to follow the common law duty of confidence, which means that identifiable information about you provided or collected during your care should be treated as confidential and only shared for the purpose of providing direct care. We handle information in accordance with the Confidentiality NHS Code of Practice, HSCIC Guide to Confidentiality, Caldicott Principles and professional standards in addition to the above legal requirements.
We also ensure the information we hold is kept in secure locations, restrict access to information to authorised personnel only, protect personal and confidential information held on equipment such as laptops with encryption (which masks data so that unauthorised users cannot see or make sense of it). All CCG staff are required to make sure information is kept confidential and receive annual training on how to do this. This is monitored by the CCG and any breaches are managed through disciplinary procedures.
The CCG has an executive nurse responsible for protecting the confidentiality of patient information. This person is called the Caldicott Guardian, they can be contacted using the details below.
The CCG is registered with the Information Commissioner’s Office (ICO) as a data controller and collects data for a variety of purposes. A copy of the registration is available through the ICO website – by searching for “NHS Airedale Wharfedale & Craven Clinical Commissioning Group”.
How long do we hold confidential information for?
All records held by the CCG will be kept for the duration specified by national guidance from the Information Governance Alliance (see Records Management Code of Practice for Health and Social Care 2016 Retention Schedule for further information). Upon the end of the retention period, data will be reviewed as to whether it can then be securely destroyed.
If you would like to know more about how we use your data please contact:
NHS Airedale, Wharfedale and Craven Clinical Commissioning Group
Millennium Business Park
Office: 01274 237324
For further information click one of the links above.
If you would like a large print version or a translation of this page, please contact us.