ATTENTION - THIS UPDATE INCLUDES IMPORTANT INFORMATION ABOUT THE CORONAVIRUS (COVID-19) AND YOUR INFORMATION - PLEASE READ CAREFULLY
Coronavirus (COVID-19) pandemic and your information
The ICO recognises the unprecedented challenges the NHS and other health professionals are facing during the Coronavirus (COVID-19) pandemic.
The ICO also recognise that 'Public bodies may require additional collection and sharing of personal data to protect against serious threats to public health.'
The Government have also taken action in respect of this and on 20th March 2020, the Secretary of State for Health and Social Care issued a Notice under Regulation 3(4) of The Health Service (Control of Patient Information) Regulations 2002 requiring organisations such as GP Practices to use your information to help GP Practices and other healthcare organisations to respond to and deal with the COVID-19 pandemic.
In order to look after your healthcare needs during this difficult time, we may urgently need to share your personal information, including medical records, with clinical and non-clinical staff who belong to organisations that are permitted to use your information and need to use it to help deal with the COVID-19 pandemic. This could (amongst other measures) consist of either treating you or a member of your family and enable us and other healthcare organisations to monitor the disease, assess risk and manage the spread of the disease.
Please be assured that we will only share information and health data that is necessary to meet yours and the public’s healthcare needs.
The Secretary of State for Health and Social Care has also stated that these measures are temporary and will expire on 30th September 2021 unless a further extension is required. Any further extension will be communicated via an update to this Privacy Notice.
Please also note that the data protection and electronic communication laws do not stop us from sending public health messages to you, either by phone, text or email as these messages are not direct marketing.
It may also be necessary, where the latest technology allows us to do so, to use your information and health data to facilitate digital consultations and diagnoses and we will always do this with your security in mind.
The Privacy Notice tells you about information we collect and hold about you, what we do with it, how we will look after it and who we might share it with. It covers information we collect directly from you or receive from other individuals or organisations.
We revise our Privacy Notice on an annual basis to ensure that it continually provides transparent information about the use of your data. This notice was reviewed in September 2021.
We are committed to protecting your privacy and will only process personal information in accordance with the General Data Protection Regulations (GDPR), the Data Protection Act 2018, the common law duty of confidentiality and the Human Rights Act 1998.
Why we collect information about you
If you are receiving services from the NHS, we will need to use your information (paper or electronic) to provide treatment, to check the quality of your care, to help you make good decisions about your health and to investigate complaints and claims. We also use your information to:
- Check the quality of care we provide to everyone (a clinical audit)
- Protect the health of the general public
- Monitor how we spend public money
- Train healthcare workers
- Carry out research
- Help the NHS plan for the future
From time to time the CCG uses patient data to analyse the health of a population. This is required for the commissioning of health services, or to help target preventive care at certain groups of patients.
Security of your information
If we use your information for the above reasons, we will remove your name and other details which could identify you. However, if we need to use the information in a way that identifies you, we will ensure that we have a fair and lawful basis for doing so.
The CCG works with our data processor, Arden GEM Commissioning Services Unit (AGEM CSU), to ensure that information is held in secure locations with restricted access for authorised personnel. We protect any personal information that is held on our systems with encryption so that it cannot be accessed by those who do not have access rights.
- Your information will not be sent by the CCG outside of the United Kingdom to a country that does not have appropriate legislation to protect your privacy.
- We will never sell any information about you.
- We will never share your information with a third-party organisation for marketing purposes without your prior written consent.
- We will always observe your right to opt-out of the use of your data for commissioning purposes.
Access to your information
You have the general right to see or be given a copy of the personal data an organisation holds about you. This is known as a Subject Access Request. Full details of how to raise a request can be found in NHS Norfolk & Waveney CCG’s Subject Access and Access to Health Records Policy by clicking here.
To read the Norfolk & Waveney CCGs Privacy Notice in full, please click here.
Merger of the Norfolk and Waveney CCGs – Transfer of Data
Information previously held by NHS North Norfolk, South Norfolk, West Norfolk, Norwich and Great Yarmouth and Waveney CCGs will be transferred to NHS Norfolk and Waveney CCG on 1st April 2020. The new CCG is the new data controller for any data previously held by the former CCGs. Any questions about the use of this data should be directed to the Data Protection Officer. Contact details can be found within the NW Public Privacy Notice.
COVID19 – Management of Subject Access Request (Updated on 22/02/2021)
Please note that some staff from the CCG have been redeployed to various front line roles in order to manage the current COVID19 health crisis, and our offices are shut whilst social distancing measures are in place. As such we do not have access to any of our offices, and therefore are limited in the information we can provide in relation to your data at this time. Our ability to respond to subject access requests within a calendar month will be affected by the current situation, however we will, of course, make every effort to maintain business as usual where we can. We appreciate your understanding at this time.