Privacy and cookies

Sharing Information with Health and Care organisations

Information Sharing Agreements and contracts will be in place ensuring that where we share information, this meets both the requirements of the Health and Care Act 2022 and the current Data Protection legislation ensuring that your confidentiality and rights are not breached.

The ICB is actively working with health and social care partners to ensure that where you receive a referral, for example for community services, all the relevant information that organisation requires in order to offer you the right service is available. We are also working with the hospitals that provide services to our population to ensure that if you find yourself in an emergency situation, relevant and potentially lifesaving information from your GP record will be available, showing any latest tests and any allergies you may suffer from, which the hospital clinicians will need to know.

Whenever a new arrangement is made to share information externally, both with health and social care organisations and with third party suppliers, we will ensure that a legal basis has been identified, using a tool called a Data Protection Impact Assessment, which will highlight any risks to your information and ensure they are resolved before any sharing takes place.

Our Commitment to Data Privacy and Confidentiality

We are committed to protecting your privacy and will only process personal confidential data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, the Common Law Duty of Confidentiality, Professional Codes of Practice and the Human Rights Act 1998.

In the circumstances where we are required to use personal identifiable information, we will only do this if:

• The information is necessary for your direct healthcare, or
• We have received explicit consent from you to use your information for a specific purpose, or
• There is an overriding public interest in using the information:
  • In order to safeguard an individual,
  • To prevent a serious crime or in the case of Public Health or other emergencies, to protect the health and safety of others, or
• There is a legal requirement that allows or compels us to use or provide information (e.g. a formal court order or legislation), or
• We have permission from the Secretary of State for Health and Social Care to use certain confidential patient identifiable information when it is necessary for our work

Everyone working for the NHS has a legal and contractual duty to keep information about you confidential.

All identifiable information that we hold about you will be held securely and confidentially. We use administrative and technical controls to do this. All health and social care organisations are required to provide annual evidence of compliance with applicable laws, regulations and standards through the Data Security and Protection toolkit.

 Our staff, contractors and committee members receive appropriate and ongoing training to ensure that they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures. Staff are trained to ensure how to recognise and report and incident and the organisation has procedures for investigating, managing and learning lessons from any incidents that occur.

Your information will not be sent outside of the United Kingdom where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.

The ICB maintains a set of regularly updated policies and procedures covering all aspects of information governance.

Your Rights

Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the ICB holds about them. Not all rights apply equally to all our processing activity as certain rights are not available depending on the lawful basis for the processing.

When you view a link in our ‘Use of Personal and Sensitive Information’ section, we have highlighted which rights apply and which may not. To help understand why some may not apply the following should help.

Examples of where rights may not apply - where our lawful basis is:

• Processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller - then rights of erasure, portability do not apply.
• Legal Obligation - then rights of erasure, portability, objection, automated decision making and profiling do not apply.

If you require further detail each link below will take you to the Information Commissioner’s Office’s website where further detail is provided in section ‘When does the right apply.’

These rights are:

• The right to be informed about the processing of your data
• The right of access to the data held about you
• The right to have that information amended in the event that it is not accurate
• The right to have the information deleted
• The right to restrict processing
• The right to have your data transferred to another organisation (data portability)
• The right to object to processing
• Rights in relation to automated decision making and profiling

Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure.

You have the right to be informed about how your information is used.

Supporting these rights patients in England also have the right under the NHS Constitution to request that their personal confidential data is not used for reasons other than their individual care and treatment. The process for applying this right is called the ‘National Patient Data Opt-out’ this gives patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used just for their individual care and treatment or also used for research and planning purposes.

However there are exemptions to this, the national patient data opt-out applies unless:

• There is a mandatory legal requirement or an overriding public interest for the data to be shared e.g. Adults and Children safeguarding;
• The opt-out does not apply when the individual has consented to the sharing of their data; or
• Where the data is anonymised in line with the Information Commissioner’s Office (ICO) Code of Practice on Anonymisation.

To be compliant with the national data opt-out policy the ICB has put procedures in place to review uses or disclosures of confidential patient information against the national data opt-out operational policy guidance.

If you believe the ICB is using your personal information in a way you would object to or contrary to your National Patient Data Opt-Out request, you have the right to object and have your objections considered and where your wishes cannot be followed, to be told the reasons including the legal basis.

For further details of the national patient data opt out can be found here: https://www.nhs.uk/your-nhs-data-matters/

Queries and Complaints

If you would like to exercise any of your rights under the UK General Data Protection Regulation or Data Protection Act 2018, including access to the information we hold about you, or you have any questions or complaints regarding the information we hold about you, please contact us at the address below.

Address:          NHS South Yorkshire Integrated Care Board, 197 Eyre Street, Sheffield, S1 3FG

Email:              syicb-sheffield.icbsubjectaccessrequests@nhs.net                   

For independent advice about data protection, privacy and data-sharing issues, or to make a complaint about our handling of your information you can contact:

The Information Commissioner

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Phone: 0303 1231113 or 01625 54 57 45

Website: https://ico.org.uk/