Home

Privacy

General Data Protection Regulations (GDPR) and Data Protection Act 2018

The GDPR and Data Protection Act 2018 form part of the data protection framework within the UK, with both coming into force on 25 May 2018.

The Information Commissioner’s Office provides useful information about the new legislative framework which can be accessed by clicking on the following web links:

General Data Protection (GDPR) Regulations

Data Protection Act 2018

The CCG is currently reviewing its policies and processes to ensure it is compliant with the new legislative requirements. This includes reviewing our current Privacy Notice, which is the document published on our website which outlines what information we collect about you, what types of personal data we hold and what we do with that information, including your rights under GDRP in relation to the information we hold.

One of the requirements of the new legislation is for each organisation to have a nominated Data Protection Officer. The Data Protection Officer for NHS West Leicestershire CCG is Hayley Gidman, Head of Information Governance, who can be contacted using the following email address: This email address is being protected from spambots. You need JavaScript enabled to view it. or via the CCG’s Contact Us page.

 

 To pdf download (170 KB) the NHS West Leicestershire CCG Privacy Notice 

 

At NHS West Leicestershire Clinical Commissioning Group we’re committed to protecting and respecting your privacy.

NHS West Leicestershire Clinical Commissioning Group (WLCCG) has various roles and responsibilities, but a major part of our work involves making sure that:

  • contracts are in place with local health service providers;
  • routine and emergency NHS services are available to patients; 
  • those services provide high quality care and value for money; and 
  • paying those services for the care and treatment they have provided. 

This is called “commissioning” and is explained in more detail on our website at www.westleicestershireccg.nhs.uk 

Accurate, timely and relevant information is essential for our work to help us to design and plan current and future health and care services, evidence and review our decisions and manage budgets.

As a commissioning organisation, our purpose is not to provide direct care and so we do not routinely hold or receive information about patients and service users in relation to care. We do however sometimes hold information from which people can be identified to enable us to fulfil our responsibilities as outlined above and this is explained in this notice.

What is a Privacy Notice?

What information do we collect?

Your Rights

We respect your right with regards to data privacy and data protection when you communicate (online or offline) with us through our various websites, offline programs and events.

Find out what information we collect about you, what types of personal data we handle and what we do with that information.

UK data protection laws give you several rights in relation to the information that NHS West Leicestershire CCG holds about you.

 

 

What is a Privacy Notice?

A Privacy Notice is a statement that describes how NHS West Leicestershire CCG collects, uses, retains and discloses personal information. Different organisations sometimes use different terms and it can be referred to as a privacy statement, a fair processing notice or a privacy policy.

To ensure that we process your personal data fairly and lawfully we are required to inform you:

  • Why we need your data
  • How it will be used
  • Who it will be shared with

This information also explains what rights you have to control how we use your information.

The law determines how organisations can use personal information. The key laws are: The Data Protection Act 2018 (DPA), the Human Rights Act 1998 (HRA), and the common law duty of confidentiality, along with health specific legislation such as the Health and Social Care Act 2012.  

Within these pages we describe instances where NHS West Leicestershire CCG is the ‘data controller’ for the purposes of the Data Protection Act 2018, and where we direct or commission the processing of patient data to help deliver better healthcare, or to assist the management of healthcare services.

NHS West Leicestershire CCG recognises the importance of protecting personal and confidential information in all that we do, all we direct or commission, and takes care to meet its legal duties.

This part of the Privacy Notice outlines the management of the notice, contact details for the CCG and access to the relevant  legislation.

Complaints about how we process your personal information

In the first instance, you should contact the CCG Complaints Team at:

West Leicestershire Clinical Commissioning Group,

Corporate Affairs Team

55 Woodgate

Loughborough

Leicestershire

LE11 2TZ

Telephone: 01509 567702

Email:  eThis email address is being protected from spambots. You need JavaScript enabled to view it.

If, however, you are not satisfied that your complaint has been resolved, you have the right to contact the Information Commissioner to request an independent investigation of your complaint:

Information Commissioner’s Office
Wycliffe House
Water Lane,
Wilmslow SK9 5AF
ico.org.uk

Telephone: 0303 123 1113

 

Changes to our Privacy Notice

We keep our privacy notice under regular review and we will place any updates on this web page. This notice was last updated in July 2018.  

Data Protection Notification

NHS West Leicestershire CCG is a ‘data controller’ under the DPA 2018. We have notified the Information Commissioner that we process personal data and the details are publicly available from the:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow SK9 5AF
ico.org.uk

Registration number:  ZA004909

How to contact us

Please contact us via our Data Protection Officer if you have any questions about our privacy notice or information we hold about you:

Hayley Gidman

Head of Information Governance

Midlands and Lancashire CSU,

Heron House, 120 Grove Road,

Fenton, ST4 4LX

Email: This email address is being protected from spambots. You need JavaScript enabled to view it.

What information do we collect?

 What information do we collect about you?

We only collect and use your information for the lawful purposes of administering the business of NHS West Leicestershire CCG.

We process personal information to enable us to support the provision of healthcare services to patients, maintain our own accounts and records, promote our services, and to support and manage our employees. In order to do so effectively we are often required to process personal data i.e. that which identifies a living individual.

We also process special category data. This is personal data which the Data Protection Act 2018 (DPA 2018) says is more sensitive, and so needs more protection:

  • racial and ethnic origin
  • offences (including alleged offences), criminal proceedings, outcomes and sentences
  • trade union membership
  • religious or similar beliefs
  • employment tribunal applications, complaints, accidents, and incident details

This information will generally relate to our staff, covered by the Privacy Notice for Staff.

In terms of patient information, the special category data we process includes:

  • physical or mental health details
  • racial and ethnic origin
  • sexual orientation

Your Rights

 

The right to be informed

You have the right to be informed about the collection and use of your personal data. This privacy notice is one of NHS West Leicestershire CCG’s key methods for providing you with this information. In addition to this notice, we will provide you with more specific information at the time we collect personal data from you, such as when you apply for Continuing Healthcare or make a complaint to us.

The right of access

You have the right to ask us for confirmation of whether we process data about you and if we do, to have access to that data so you are aware and can verify the lawfulness of the processing.

You can make your own application to see the information we hold about you, or you can authorise someone else to make an application on your behalf.  A child’s parent or guardian, a patient representative, or a person appointed by the Court may also apply. If you wish to ask us for confirmation of whether we process data about you or access your personal data, then please contact:

West Leicestershire Clinical Commissioning Group,

Corporate Affairs Team

55 Woodgate,

Loughborough,

Leicestershire

LE11 2TZ

Telephone: 01509 567702

Email:  This email address is being protected from spambots. You need JavaScript enabled to view it.

The right to rectification

You are entitled to have personal data that we hold about you rectified if it is inaccurate or incomplete. If we have passed the data concerned on to others, we will contact each recipient and inform them of the rectification - unless this proves impossible or involves disproportionate effort. If this is the case, we will explain to you why.

The right to erasure

You have the right to have personal data we hold about you erased and to prevent processing in specific circumstances:

  • Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
  • If you withdraw your consent for us to process your data (if this was the basis on which it was collected)
  • The personal data was unlawfully processed (i.e. a breach of UK data protection laws)
  • The personal data has to be erased in order to comply with a legal obligation

However, if we have collected and are processing data about you to comply with a legal obligation for the performance of a public interest task or exercise of official authority, i.e. because we have a legal duty to do so in our functioning as a CCG, then the right to erasure does not apply.

The right to restrict processing

You have the right to ‘block’ or suppress processing of your personal data which means that if you exercise this right, we can still store your data but not to further process it and will retain just enough information about you to ensure that the restriction is respected in future.

You can ask us to restrict the processing of your personal data in the following circumstances:

  • If you contest the accuracy of the data, we hold about you we will restrict the processing until the accuracy of the data has been verified
  • If we are processing your data as it is necessary for the performance of a public interest task and you have objected to the processing, we will restrict processing while we consider whether our legitimate grounds for processing are overriding
  • If the processing of your personal data is found to be unlawful but you oppose erasure and request restriction instead; or
  • If we no longer need the data we hold about you, but you require the data to establish, exercise or defend a legal claim.

If we have disclosed the personal data in question to others, we will contact each recipient and inform them of the restriction on the processing of the personal data - unless this proves impossible or involves disproportionate effort. If asked to, we  must also inform you about these recipients.

We will inform you if we decide to lift a restriction on processing.

The right to data portability

The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability although it only applies where we are processing your personal data based on your consent for us to do so or for the performance of a contract and where the processing is carried out by automated means. This means that currently, the CCG does not hold any data which would be subject to the right to data portability.

The right to object

Where the CCG processes personal data about you on the basis of being required to do so for the performance of a task in the public interest/exercise of official authority, you have a right to object to the processing.

You must have an objection on grounds relating to your particular situation.

If you raise an objection, we will no longer process the personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.

Rights in relation to automated decision making and profiling

As the CCG does not make any decisions based solely on automated processing, individuals’ rights in relation to personal data processed in this way are not applicable.

The right to withdraw consent

If the CCG processes data about you on the basis that you have given your consent for us to do so, you have the right to withdraw that consent at any time. Where possible, we will make sure that you are able to withdraw your consent using the same method as when you gave it.

If you withdraw your consent, we will stop the processing as soon as possible.

Consent can be withdrawn by contacting:

West Leicestershire Clinical Commissioning Group,

Corporate Affairs Team

55 Woodgate,

Loughborough,

Leicestershire

LE11 2TZ

Telephone: 01509 567702

Email:  eThis email address is being protected from spambots. You need JavaScript enabled to view it.

How the NHS and care services use your information and your choices

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected to help ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be provided to other approved organisations, where there is a legal basis, to help with planning services, improving the care provided, research into developing new treatments and preventing illness.  All of these help to provide better health and care for you, your family and future generations. Confidential personal information about your health and care is only used in this way where allowed by law and would never be used for insurance or marketing purposes without your explicit consent.

You have a choice about whether you want your confidential patient information to be used in this way.

To find out more about the wider use of confidential personal information and to register your choice to opt out if you do not want your data to be used in this way, visit www.nhs.uk/my-data-choice.. If you do choose to opt out you can still consent to your data being used for specific purposes.

If you are happy with this use of information you do not need to do anything. You can change your choice at any time.

How will NHS West Leicestershire CCG use information about you? NHS Continuing Healthcare - Purposes for processing

Purposes for processing

NHS Continuing Healthcare (CHC) is explained by NHS Choices here.

The National Health Service Commissioning Board and Clinical Commissioning Groups (Responsibilities and Standing Rules) Regulations 2012, Part 6 places a duty on CCGs to make provision for, i.e. provide CHC services. 

Our CHC services are provided through NHS Midlands and Lancashire Commissioning Support Unit whom we have commissioned to act as data processors in relation to our CHC services.

To determine if someone is eligible for CHC and to then arrange a care and support package that meets their assessed needs, information about the individual will need to be collected, reviewed and shared with care providers such as care homes.  As the CCG has a duty to provide CHC services, this requires the collection of information about individuals for this purpose and the use of that information and the sharing of it with third parties who need to be involved in the process; we will make sure that we keep the individual concerned informed at all times of who will be providing or receiving data about them and why.

An individual receiving care or their representative may apply for a review of a CCG’s decision to decline funding by an Independent Review Panel.  The independent review process is coordinated by the NHS Continuing Healthcare team in NHS England.

Sources of personal data

The sources of personal data include:

  • Persons who will receive CHC services
  • Representatives of persons who will receive CHC services e.g. family members, lawyers
  • Care Homes, GP’s, Hospitals and other Providers we commission

Categories of personal data

The information CCGs use to assess eligibility, and which may be submitted to an Independent Review Panel, fall under the following headings:

  • behaviour
  • cognition (understanding)
  • communication
  • psychological/emotional needs
  • mobility
  • nutrition (food and drink)
  • continence
  • skin (including wounds and ulcers)
  • breathing
  • symptom control through drug therapies and medication
  • altered states of consciousness
  • other significant needs

The obtained records that relate to these areas may include Care Home records, Health Records (for example GP, Hospital, Mental Health, District Nursing) and Social Care Records.

Recipients of personal data

Personal data relating to a CHC application is received by:

  • Midlands and Lancashire Commissioning Support Unit Continuing Healthcare Teams
  • Internally in the CCG by the Nursing and Quality Team and Corporate Affairs Team
  • The members of an independent review panel. An independent review panel is made up of:
  • an independent lay member chair
  • a representative nominated by a Clinical Commissioning Group (not involved in the case);
  • a representative nominated by a Local Authority (not involved in the case); and
  • at times there is also a clinical advisor in attendance

Legal basis for processing

For GDPR purposes NHS West Leicestershire CCG’s lawful basis for processing is Article 6(1) (e) – ‘…exercise of official authority…’ And for the processing of special categories (health) data, the CCG’s lawful basis is Article 9(2) (h) – ‘…health or social care…’

Individual Funding Requests

Purposes for processing

The NHS has a duty to spend the money it receives from the government in a fair way, taking into account the health needs of the whole community.  The CCG’s role is to ensure it gets best value for this money by spending it wisely on behalf of the public.

CCGs pay for local NHS health services and NHS England pays for highly specialised health services. The CCGs have a legal duty to provide health services for patients with the fixed amount of money they have received from the government. They have a legal duty not to spend more than this. This means that some hard choices have to be made. Not all treatments can be provided by the NHS. Treatments that are limited by CCGs are shown in their Clinical Commissioning Policies: https://www.westleicestershireccg.nhs.uk/your-ccg/publications/corporate-documents/policies

However, CCGs know that there will always be times when a patient would benefit from a particular treatment not usually provided  by the NHS. To apply for this treatment, an Individual Funding Request (IFR) is made. To allow the CCG to consider these requests, access to both personal and health information regarding the individual to whom the request relates is required.  As the National Health Service Commissioning Board and Clinical Commissioning Groups (Responsibilities and Standing Rules) Regulations 2012, Part 7, Regulation 34 places a duty on CCGs in respect of the funding and commissioning of drugs and other treatments, this provides the CCG with a legal basis to use personal data as part of this process.

Individual Funding Requests are managed on behalf of the CCG by NHS East Leicestershire and Rutland Clinical Commissioning Group.

Sources of personal data

The information is provided by a clinician who submits an IFR application form on behalf of a patient.

Categories of personal data

The IFR application form includes:

  • NHS number
  • name and address
  • date of birth
  • GP details
  • diagnosis
  • requested intervention and other information relevant to the request
  • Gender and ethnicity are also collected and held in anonymous form for equality monitoring.

Categories of recipients

Applications are considered by an independent panel who have not been involved in your treatment. The panel is made up of doctors, nurses, public health experts, pharmacists, CCG representatives and lay members and is led by an independent lay member chair.

Legal basis for processing

For GDPR purposes NHS West Leicestershire CCG’s lawful basis for processing is Article 6(1) (e) – ‘…exercise of official authority…’ For the processing of special categories (health) data the lawful basis is Article 9(2)(h) – ‘…health or social care…’.

Complaints and Enquiries

Purposes for processing

Most NHS care and treatment goes well but sometimes things can go wrong. If you are unhappy with your care or the service you have received, it is important to let us know so we can improve.  When NHS West Leicestershire CCG receives a complaint, to allow it to be fairly and thoroughly managed, in most cases personal information will be required. CCGs have statutory duties (Section 6 of the Local Authority Social Services and National Health Service Complaints [England] Regulations (2009) (under section 113 “Complaints about Healthcare” of the Health and Social Care (Community Health and Standards) Act 2003)) which allow the processing of personal data in relation to complaints.

In order to process a complaint or concern, NHS West Leicestershire CCG will collect the relevant information at the point of contact to enable the team to provide a sufficient response to the request.

NHS West Leicestershire CCG’s complaints process is managed by the CCG itself and it is overseen by the Corporate Affairs Department.

Sources of the data

The sources of personal data include:

  • Patients
  • Members of the public
  • Patient representatives
  • Members of Parliament
  • Parliamentary and Health Service Ombudsman
  • Other CCG’s (with the consent of the individual)
  • Provider organisations we commission (with the consent of the individual)
  • NHS England (with the consent of the individual)

Categories of Personal data

Information relating to complaints would generally include the following categories of personal data:

  • Patient’s name
  • Patient’s address
  • Patient’s contact number
  • GP Surgery
  • Patient’s NHS number
  • Patient’s date of birth
  • Representative details (if applicable)
  • Representative address (if applicable)
  • The nature of the complaint

Recipients of personal data

The recipients of personal data relating to complaints include:

  • Any team within the CCG that may receive an enquiry or complaint
  • Midlands and Lancashire Commissioning Support Unit who manage other services on behalf of the CCG under contract
  • Relevant providers (with the consent of the data subject) in order to fully investigate the complaint being made
  • Members of Parliament
  • Parliamentary and Health Service Ombudsman
  • Other CCG’s (with the consent of the individual)
  • NHS England (with the consent of the individual)

Legal basis for processing

For the General Data Protection Regulation (GDPR) purposes NHS West Leicestershire’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’.  For the processing of special categories data, the basis is Article 9(2)(h) ‘…health or social care…’.

MP Enquiries

Purposes for processing

NHS West Leicestershire CCG shares responsibility for accounting to the public and to Parliament for policies, decisions and activities across the health and care sector. Accountability to Parliament will often be required through responses to parliamentary questions, enquiries from MPs on behalf of their constituents , and appearances before parliamentary committees. In doing so, NHS West Leicestershire CCG collects relevant information at the point of contact to enable the CCG to provide a response to the request.

Sources of personal data

The sources of personal data include:

  • MP
  • Constituent of the MP
  • Parliament or DHSC 
  • Parliamentary and Health Service Ombudsman

Categories of personal data

The data collected by NHS West Leicestershire CCG is stored in the Corporate Affairs Team’s central files. These will include:

  • An individual’s name, contact information and any other information relating to the query
  • MP’s information

Categories of recipients

The information, including information about the member of the public and MP is used by:

  • NHS West Leicestershire CCG’s Accountable Officer
  • NHS West Leicestershire CCG’s Corporate Affairs Team
  • Any other team within NHS West Leicestershire CCG that may directly receive such requests
  • NHS West Leicestershire CCG teams that hold any information relevant to the request.
  • The Commissioning Support Units (CSUs) under contract with NHS West Leicestershire CCG in the handling of any relevant information that they hold on behalf of NHS West Leicestershire CCG.

 

Legal basis for processing

For the General Data Protection Regulation (GDPR) purposes NHS West Leicestershire CCG’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’.  For the processing of special categories data, the basis is Article 9(2)(h) ‘…health or social care…’.

Whistleblowing

Purposes for processing

Whistleblowing is the term used when a worker contacts us with a concern about an organisation and its services. The concern will typically (although not necessarily) be regarding something they have witnessed at work.

NHS West Leicestershire CCG can investigate cases against healthcare providers it has a contract with.

Sources of personal data

Information will be provided by:

  • the whistleblower regarding themselves and those involved in the issues leading to the concerns raised
  • those considered at risk
  • Providers we commission services from

Categories of personal data

Data collected can be anonymous from the whistleblower depending on the nature in which the information is provided. Other times:

  • name
  • contact details
  • specific elements relating to the concerns may be collected, i.e. personal information regarding another employee, or those concerned to be at risk (name, contact information etc.).

Categories of recipients

The information is used by:

  • NHS West Leicestershire CCG and relevant teams for the purposes of investigation
  • An alternative external body such as the following:
    • Fraud and corruption – NHS Counter Fraud Authority
    • Serious patient safety issues or issues relating to condition of registration – Care Quality Commission (CQC)
    • Allegations regarding a clinician’s fitness to practice – relevant professional regulator or healthcare body (CQC)
    • Safeguarding issues will be dealt with in accordance with NHS West Leicestershire CCG safeguarding policies.

 

Legal basis for processing

For the GDPR purposes NHS West Leicestershire CCG’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For the processing of special categories data the basis is Article 9(2)(h) ‘…health or social care…’.

Legal Claims

Purposes for processing

In certain situations, because of its commissioning responsibilities NHS West Leicestershire CCG is required to become involved in legal proceedings such as claims for compensation, court of probation orders , court of protection orders and court orders.

It is therefore necessary for it to process personal and special categories of data for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings), for the purpose of obtaining legal advice, or for the purpose of establishing, exercising or defending legal rights. These legal proceedings include claims.

Categories of personal data

These will include:

  • An individual’s name, contact information and any other information relating to the situation
  • Information about the representative of an individual
  • Information about the family and carers of an individual 
  • Information about the health and social care professionals involved in an individual’s care 
  • Information about court officials

Sources of the data

The sources of data include:

  • The Courts
  • Representatives of an individual
  • Lawyers
  • GPs and other Providers we commission
  • Health and social care professionals involved in an individual’s care

Categories of recipients

These include:

  • The Courts
  • Representatives of an individual
  • Lawyers
  • GPs and other Providers we commission
  • Health and social care professionals involved in an individual’s care

Legal basis for processing

Where we process personal data for Court of Protection purposes, the legal basis for doing so is:

  • Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject
  • Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
  • Article 6(1)(f) – processing is necessary for the purposes of legitimate interests pursued by the controller.

Where we process special categories of personal data for these purposes, the legal basis for doing so is:

  • Article 9(2)(f) – processing is necessary for the establishment, exercise or defence of legal claims; or
  • Article 9(2)(g) – processing is necessary for reasons of substantial public interest.

Communications, Stakeholder Engagement and Patient Experience

Purposes for processing

Patient and public participation is an essential part of NHS West Leicestershire CCG’s way of working. It is one of the legal duties of the CCG. We want to build strong and supportive communications and patient experience and stakeholder engagement relationships, so that we can work in partnership and use people’s experiences and views to inform our work.

NHS West Leicestershire CCG offers various services to the public giving them the opportunity to communicate engage and share their experiences with us. These could be engaging with members of the public and professional colleagues regarding:

  • contacting the CCG’s Governing Body through the CCG contact forms online
  • the latest news and information from the CCG
  • providing consultation feedback opportunities on initiatives
  • CCG membership services
  • invitations to events and details on how to get involved
  • Mystery Shopper activities
  • survey activities
  • social media channels and opportunities such as Facebook ,Twitter and Hootsuite
  • media enquiries

However, we only use these details to provide the service the person has requested and for other closely related purposes. For example, we might use information about people who have requested a publication to carry out a survey to find out if they are happy with the level of service they received or if the information is useful to them.

Any personal data received in response to communication, stakeholder and patient experience activities is removed before responses are collated, analysed or disseminated.

The CCG uses the following external providers as data processors to support our communication, stakeholder engagement and patient experience activities:

  • NHS Midlands and Lancashire CSU

Categories of personal data

These include

  • name
  • age address and postcode
  • e-mail address
  • whether the applicant can access e-mail
  • whether the applicant is a:
    • patient or health service user (current or previously)
    • carer of a patient currently / previously using health services
    • representative of a patient organisation
  • Ability to use telephone, e-mail, and internet to communicate and take part in meetings
  • Ability to commit time
  • Skills and experience
  • Any access or support needs to enable participation
  • References

Sources of personal data

  • By CCG teams in the routine course of their work with relevant stakeholders, e.g. at events, during consultations
  • When members of the public voluntarily contact NHS West Leicestershire CCG and ask to be placed on a relevant mailing list for updates or to become members of the CCG etc.
  • Our Strategic Transformation Partner organisations e.g. other CCG’s in Leicestershire, Local Authorities, Voluntary organisations, GP’s, Provider organisations we commission, NHS England

 

Categories of recipients

  • Members of the public
  • Our website data processor provider
  • Our mailing services data processor provider
  • Our surveys processing provider
  • Internal CCG staff
  • Our Strategic Transformation Partner organisations e.g. other CCGs in Leicestershire, Voluntary organisations, GP’s, Provider organisations we commission and NHS England

 

Legal Basis for processing

For the General Data Protection Regulation (GDPR) purposes NHS West Leicestershire CCG’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’.

 

Improving Quality and Patient Safety

Purposes for processing

NHS West Leicestershire CCG is committed to the improvement of quality and delivery of services. It has therefore set up and uses various processes to ensure the quality of care it commissions is excellent.  To improve quality and for patient safety purposes, the CCG uses personal data and special category data which includes:

  • incident reporting
  • serious incidents requiring investigation (SIRI), evidence and reports relating to incidents under various policy and procedural structures
  • quality visits to our commissioned providers
  • safety alerts

An incident requiring investigation is defined as an incident that occurred in relation to NHS-funded services and care resulting in unexpected or avoidable death, harm or injury to patient, carer, staff or visitor.

Improving quality and patient safety is managed internally within the CCG and it is also supported by the Patient Safety Team in NHS West Leicestershire CCG.

Sources of the data

Incident events are recorded across the CCG, and from within all systems and services commissioned by NHS West Leicestershire CCG.  These include:

  • Staff
  • GPs
  • Patients
  • Commissioned acute provider organisations e.g. UHL, LPT

Categories of personal data

The data received by NHS West Leicestershire CCG includes a record for each incident including (if relevant):

  • patient or staff name
  • NHS Number
  • other personal details, including relevant healthcare records
  • information about the incident, including others involved or impacted by the event.

Categories of recipients

The information is used by the relevant team or department together with Nursing and Quality, and Corporate Affairs Team in NHS West Leicestershire CCG.

Legal basis for processing

For the GDPR purposes NHS West Leicestershire CCG’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For the processing of special categories data the basis is Article 9(2)(h) ‘…health or social care…’.

Care and treatment reviews

Purposes for processing

Care and Treatment Reviews (CTRs), Transforming Care Programme (TCP),  Individual Case Review and Best Interest Decision Reviews are part of NHS West Leicestershire CCG’s commitment to transforming services for people with learning disabilities, autism or both. They are used by commissioners for people living in the community, in learning disability and mental health hospitals and care homes.

These activities also help to improve the quality of care people receive by asking key questions and making recommendations that lead to improvements in safety, care and treatment. They reduce the amount of time people spend in hospital and bring people together to help to sort out any problems which can keep people in hospital longer than necessary. They do this by helping to improve current and future care planning, including plans for leaving hospital.

Our Care and Treatment review process is managed internally within the CCG and it is also supported by West Leicestershire CCG

Categories of Data

NHS West Leicestershire CCG processes personal data to organise CTRs. The personal data NHS West Leicestershire CCG processes include:

  • name and home address
  • NHS number
  • date of current admission and estimated date of discharge
  • consent to the Care and Treatment Review
  • date(s) and venue(s) of panel meeting(s)

Sources of the data

  • Patients
  • Representatives of patients
  • NHS Providers of health care e.g. hospitals
  • Care homes
  • Private providers

Categories of recipients

  • Patients
  • Representatives of patients
  • Providers of health care (including the CTR panel members consisting of experts by experience)

Legal basis for processing

For the GDPR purposes NHS West Leicestershire CCG’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For the processing of special categories data the basis is Article 9(2)(h) ‘…health or social care…’.

Safeguarding

Purposes for processing

NHS West Leicestershire CCG is dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently and conscientiously applied with the wellbeing of all, at the heart of what it does. 

NHS Leicester City CCG provides safeguarding services for itself , NHS West Leicestershire CCG and NHS West Leicestershire CCG.

Categories of personal data

The data collected by NHS West Leicestershire CCG staff on behalf of itself and the other CCGs across Leicester, Leicestershire and Rutland   in the event of a safeguarding situation will be as much personal information as is necessary, or possible to obtain, in order to handle the situation. These include:

  • Basic demographics and contact details
  • Special category information (such as health information).

 

This information is documented from various sources in various forms such as:

  • GP Records- Consultation Information sheets
  • Serious Case Review reports
  • Domestic Homicide Review Reports
  • Individual Agency Summary Reports
  • Child Protection Plans
  • 72 Hour incident forms / Serious Incident forms
  • Individual Safeguarding reports
  • Overview reports
  • CHC Packages of Care
  • GP Practitioner Performance report - GP Names and Professional Registration number

 

Sources of the data

NHS West Leicestershire CCG will either receive or collect information when any person contacts the CCG with safeguarding concerns or we believe there may be safeguarding concerns.  These include:

  • Members of Public
  • Representative of people at risk
  • The relevant Safeguarding Boards
  • Local Authorities
  • Police
  • Healthcare professionals (i.e. their GP or mental health team)
  • Providers we commission where relevant.

 

Recipients of personal data

We share information accordingly to ensure duty of care and investigation as required with other partners that include:

  • The relevant Safeguarding Boards
  • Local Authorities
  • Police
  • Healthcare professionals (i.e. their GP or mental health team)
  • Providers we commission where relevant.

 

Legal basis for processing

For the General Data Protection Regulation (GDPR) purposes is Article 6(1)(e) ‘…exercise of official authority…’. For the processing of special categories data, the basis is Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’

 

Reimbursements to patients

Purpose of processing

As part of NHS policy, the CCG is required to process and support financial payments  to patients and their families when they have incurred financial expenses, such as through the Healthcare Travel Costs Scheme. 

NHS Midlands and Lancashire Commissioning Support Unit is our data processor for reimbursement purposes. 

Sources of personal data

  • Patients
  • Representatives of patients

 

Categories of personal data

  • Name
  • Contact details
  • NHS number

 

Recipients of personal data

  • Patients
  • Representatives of patients
  • NHS Midlands and Lancashire Commissioning Support unit
  • NHS Business Services Authority

Legal basis for processing

As a data controller NHS West Leicestershire CCG relies upon

  • Article 6(1)(e) ‘…a task carried out in the public interest or in the exercise of official authority vested in the controller’
 
 

Invoice validation

 
Purpose of processing

Invoice validation is an important process. It involves using your NHS number to check that we are the CCG that is responsible for paying for your treatment.

Midlands and Lancashire Commissioning Support Unit is an accredited Controlled Environment for Finance (CEfF) under a Section 251 exemption which enables them to process patient identifiable information on behalf of NHS West Leicestershire CCG without consent for the purposes of invoice validation – CAG 7-07(a)(b)(c)/2013.

We will also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.

Sources of personal data

Categories of Personal data

Recipients of personal data

  • NHS Midlands and Lancashire Commissioning Support Unit is the only organisation that will  receive personal data relating to invoice validation as an accredited Controlled Environment for Finance.

Legal basis for processing

For the General Data Protection Regulation (GDPR) purposes is Article 6(1)(e) ‘…exercise of official authority…

For special categories (health) data the basis is 9(2)(h) ‘…health or social care…’.

 

Risk Stratification

Purpose of processing

Risk stratification is a process GPs use to help them to identify and support patients with long-term conditions and to help prevent unplanned hospital admissions or reduce the risk of certain diseases developing such as type 2 diabetes.  This is called risk stratification for case-finding and is a type of profiling as it is the automated processing of personal data to analyse or predict health needs.  However, this is not a solely automated process as whilst cases are identified through an automated process, no decisions are made automatically; they are made by the GP.

The CCG also uses risk stratified data to understand the health needs of the local population in order to plan and commission the right services. This is called risk stratification for commissioning.

Risk stratification tools use historic information about patients, such as age, gender, diagnoses and patterns of hospital attendance and admission collected by NHS Digital from NHS hospitals and community care services.   This is linked to data collected in GP practices and analysed to produce a risk score. 

GPs are able to identify individual patients from the risk stratified data when it is necessary to discuss the outcome and consider preventative care. However the CCG can never identify an individual from the risk stratified data that we see. Where the risk stratification process has linked GP data to health data obtained from other sources i.e. NHS Digital or other health care provider, the GP will ask for your permission to access the details of that information.   

NHS Midlands and Lancashire Commissioning Support Unit is our data processor for risk stratification purposes.

Sources of the data

  • Personal data is supplied by GPs and NHS Digital (Secondary Use Services Data)

Categories of Personal data

  • Data from the GP Practice system will be obtained by using a “bulk data extract”, uploaded directly by the risk stratification tool supplier from the practice system. Prior to the upload, the supplier will obtain permission from the practice to request the data from the practice system provider and the practice will notify their system providers that this permission has been granted.
  • The data extract will EXCLUDE patients who have expressed a wish not to share information. Reports produced from the system including identifiable data is only provided back to your GP or member of your care team as data controller in an identifiable form. Your GP can provide more information about any risk stratification programme they are using. Should you have any concerns about how your information is managed at the surgery please contact the Practice Manager to discuss how the disclosure of your personal information can be limited.
  • The Secondary Uses Service (SUS) is the single, comprehensive repository for healthcare data in England which enables a range of reporting and analyses to support the NHS in the delivery of healthcare services. Information on care provided for all patients by health care providers (both NHS and independent sector healthcare providers for NHS patients only) must be submitted to the Secondary Uses Service according to the Commissioning Data Set Mandated Data Flows guidelines.

Recipients of personal data

  • The combined CCG’s Secondary Use Service (SUS) data and GP data which contains an identifier (usually NHS number) is made available to clinicians with a legitimate relationship with their patients to enable them to identify which patients should be offered targeted preventative support to reduce those risks. NHS West Leicestershire CCG does not have access to identifiable information.

Legal basis for processing

For the General Data Protection Regulation (GDPR) purposes is Article 6(1)(e) ‘…exercise of official authority…

For special categories (health) data the basis is 9(2)(h) ‘…health or social care…’.

 

How we use information provided by NHS Digital

We use information collected by NHS Digital from healthcare providers such as hospitals, community services and GPs, which includes information about the patients who have received care and treatment from the services that we fund. 

Categories of Data

The data we receive does not include patients’ names or home addresses, but it will usually include information such as:

  • NHS number
  • Postcode
  • Date of birth
  • Ethnicity
  • Gender
  • Coded information about visits to clinics, Emergency Departments, hospital admissions and other NHS services. 

 

Legal basis for processing

For GDPR purposes NHS West Leicestershire CCG’s lawful basis for processing is 6(1)(e) ‘…exercise of official authority…’.

For special categories (health) data the basis is 9(2)(h) ‘…health or social care…’.

The Secretary of State for Health has given limited permission for us (and other NHS commissioners) to use certain confidential patient information when it is necessary for our work and unless we have a legal basis to use identifiable data; de-identified information is used for all purposes other than direct care. This approval is given under Regulations made under Section 251 of the NHS Act 2006 and is based on the advice of the Health Research Authority’s Confidentiality and Advisory Group.

In order to use this data, we have to meet strict conditions that we are legally required to follow, which includes making a written commitment to NHS Digital that we will not use information in any way that would reveal your identity.

The National Fraud Initiative

NHS West Leicestershire CCG is required to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing, or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.

The Cabinet Office is responsible for carrying out data matching exercises.

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

We participate in the Cabinet Office’s National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise.

The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014.

Data matching by the Cabinet Office is subject to a Code of Practice. Should you wish to know more information on this Fair Processing Notice please see the full text.  View further information on the Cabinet Office’s legal powers and the reasons why it matches particular information. For further information on data matching at this authority contact Stuart Francis at This email address is being protected from spambots. You need JavaScript enabled to view it..

Legal basis for processing

For the GDPR purposes NHS West Leicestershire CCG’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’, or where there is a legal obligation to share information Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.

Automated Decision Making

NHS West Leicestershire CCG does not use automated individual decision-making (making a decision solely by automated means without any human involvement).

Retaining information

Information in the CCG is held for a specific length of time depending on the type of information it is.  The length of time we retain your information for is defined by the NHS retention schedule which can be viewed online here: NHS Digital Records Management Code of Practice for Health and Social Care 2016

Once information has been reviewed and is no longer required to be kept by a retention period the information will be securely destroyed. 

Paper records are destroyed via a contract with C&V Data Management Services  and electronic records deleted.

Security of your information

NHS West Leicestershire CCG takes our duty to protect your personal information and confidentiality seriously. We are committed to taking all reasonable measures to ensure the confidentiality and security of personal data for which we are responsible, whether computerised or on paper.

Alongside the Data Protection Officer (DPO), we have appointed a Senior Information Risk Owner (SIRO) who is accountable for the management of all information assets and any associated risks and incidents, and a ‘Caldicott Guardian’ who is responsible for the management of patient information and patient confidentiality.

All staff are required to undertake annual information governance training and are provided with an information governance handbook that they are required to read and agree to adhere to. The handbook ensures that staff are aware of their information governance responsibilities and follow best practice guidelines ensuring the necessary safeguards and appropriate use of person-identifiable and confidential information.

Under the NHS Confidentiality Code of Conduct, all our staff are also required to protect your information and inform you of how your information will be used. This includes, in most circumstances, allowing you to decide if and how your information can be shared.

Everyone working for the NHS is subject to the common law duty of confidentiality.  Information provided in confidence will only be used for the purposes advised and consented to by the service user, unless it is required or permitted by the law.

Your Rights - The right to be informed

 

You have the right to be informed about the collection and use of your personal data. This privacy notice is one of NHS West Leicestershire CCG’s key methods for providing you with this information. In addition to this notice, we will provide you with more specific information at the time we collect personal data from you, such as when you apply for Continuing Healthcare or make a complaint to us.

The right of access

You have the right to ask us for confirmation of whether we process data about you and if we do, to have access to that data so you are aware and can verify the lawfulness of the processing.

You can make your own application to see the information we hold about you, or you can authorise someone else to make an application on your behalf.  A child’s parent or guardian, a patient representative, or a person appointed by the Court may also apply. If you wish to ask us for confirmation of whether we process data about you or access your personal data, then please contact:

West Leicestershire Clinical Commissioning Group,

Corporate Affairs Team

55 Woodgate,

Loughborough,

Leicestershire

LE11 2TZ

Telephone: 01509 567702

Email:  This email address is being protected from spambots. You need JavaScript enabled to view it.

The right to rectification

You are entitled to have personal data that we hold about you rectified if it is inaccurate or incomplete. If we have passed the data concerned on to others, we will contact each recipient and inform them of the rectification - unless this proves impossible or involves disproportionate effort. If this is the case, we will explain to you why.

The right to erasure

You have the right to have personal data we hold about you erased and to prevent processing in specific circumstances:

  • Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed
  • If you withdraw your consent for us to process your data (if this was the basis on which it was collected)
  • The personal data was unlawfully processed (i.e. a breach of UK data protection laws)
  • The personal data has to be erased in order to comply with a legal obligation

However, if we have collected and are processing data about you to comply with a legal obligation for the performance of a public interest task or exercise of official authority, i.e. because we have a legal duty to do so in our functioning as a CCG, then the right to erasure does not apply.

The right to restrict processing

You have the right to ‘block’ or suppress processing of your personal data which means that if you exercise this right, we can still store your data but not to further process it and will retain just enough information about you to ensure that the restriction is respected in future.

You can ask us to restrict the processing of your personal data in the following circumstances:

  • If you contest the accuracy of the data, we hold about you we will restrict the processing until the accuracy of the data has been verified
  • If we are processing your data as it is necessary for the performance of a public interest task and you have objected to the processing, we will restrict processing while we consider whether our legitimate grounds for processing are overriding
  • If the processing of your personal data is found to be unlawful but you oppose erasure and request restriction instead; or
  • If we no longer need the data we hold about you, but you require the data to establish, exercise or defend a legal claim.

If we have disclosed the personal data in question to others, we will contact each recipient and inform them of the restriction on the processing of the personal data - unless this proves impossible or involves disproportionate effort. If asked to, we  must also inform you about these recipients.

We will inform you if we decide to lift a restriction on processing.

The right to data portability

The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability although it only applies where we are processing your personal data based on your consent for us to do so or for the performance of a contract and where the processing is carried out by automated means. This means that currently, the CCG does not hold any data which would be subject to the right to data portability.

The right to object

Where the CCG processes personal data about you on the basis of being required to do so for the performance of a task in the public interest/exercise of official authority, you have a right to object to the processing.

You must have an objection on grounds relating to your particular situation.

If you raise an objection, we will no longer process the personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.

Rights in relation to automated decision making and profiling

As the CCG does not make any decisions based solely on automated processing, individuals’ rights in relation to personal data processed in this way are not applicable.

 

Latest news and events

CCG news

Staff at NHS West Leicestershire ...
Staff at NHS West Leicestershire CCG are wearing their jeans on Jeans for Genes Day 2018 which takes pla...
Read more
Start a Conversation
You don't have to struggle alone. Talk to someone. Get some help. Leicestershire County Council has launched a suicide prevention cam...
Read more
Check before you tick
    Many of us assume that we are entitled to free prescriptions, but getting it wrong cou...
Read more
Is Your Heart Older Than ...
Do you know your heart age? Adults across the country are being encouraged to take a few minutes ou...
Read more
NHS Self-Care Event
The NHS is going through many changes and no more so than in the Hinckley and Bosworth area.  One...
Read more
Back to school blues or ...
The school summer holidays are drawing to a close and many parents are getting their children ready to go back to school. Unders...
Read more

New to this site

Documents

seperator

Get Involved

The Better Care Together Plan - our STP

The Better Care Together Plan - Our Sustainability and Transformation Partnership The NHS commission and provide health and care services for over...

The Better Care Together Plan - Our Sustainability and Transformation Partnership

The NHS commission and provide health and care services for over a million people in Leicester, Leicestershire and Rutland. Every day our services support people to stay healthy and lead independent lives. And when people are ill, our services are there for them, their carers and families.
 
Over the next few years, the services we deliver, and where and how we offer them, will need to change, so that they can continue to be delivered in a way that is safe for patients as well as in a way the NHS can afford. The demand for services is growing more quickly than the resources which we have can cope with, as people are living longer and our population is continuing to grow. The Better Care Together Plan explains how these services can be changed for the better to improve care and the patient experience while meeting these demands.
 
In 2017 we held events across West Leicestershire to share the draft version of the plan with patients, family carers and staff to discuss the draft Better Care Together Plan. You can find out more about the events on this page, and download the findings from the STP events on this page.
 
In the 70th year of the NHS the partnership has published ‘Next steps to better care in Leicester, Leicestershire and Rutland’, a document describing the progress of partners from health and local authorities to improve the health and wellbeing of local people. Download the BCT Brochure.
 
 
 
 
To find out more, and see how you can be involved, visit the Better Care Together website

Influence the shape of local health services

From time to time NHS West Leicestershire CCG reviews the services it commissions. A key part of any review is ...

From time to time NHS West Leicestershire CCG reviews the services it commissions. A key part of any review is to ensure we take account of the views of local people to help shape local health services. As a patient or service user, for example you can help us improve services by providing feedback on your experience.

NHS West Leicestershire is committed to involving local people in discussions and decisions about changes to local health services through a variety of ways. This could be taking part in a survey or attending a face to face meeting.  

In this section we provide details of the latest opportunities to be involved in our engagements and consultations. We also include details of consultations and engagements being carried out by our partners, in the NHS and local authorities.

Details of all our engagements and consultations will be made available here but to make sure you don’t miss out on opportunities to get involved register for In Touch to receive regular updates. You can also follow us on Twitter and Facebook.

Make a difference with your local PPG

Would you like to get involved with our campaigns and make a difference in the care patients receive? Your GP surg...

Would you like to get involved with our campaigns and make a difference in the care patients receive?

Your GP surgery has its own small team of people who provide a voice for all the patients on the practice’s list. Known as a Patient Participation Group or a PPG, these groups meet regularly to work with the GPs and staff at the practice to improve the way things are run.

The work of PPGs is invaluable to our work  as a CCG too. The feedback we get from our PPGs help shape the decisions that we make and directly influence the services we commission for all our patients and carers.

Read more

Stay in touch with the NHS

Do you want to be the first to know about what is happening with your local NHS services in West Leice...

Do you want to be the first to know about what is happening with your local NHS services in West Leicestershire?

By signing up to our In Touch mailing list, you will receive monthly messages to keep you up to date including information on local health events, new services, opportunities to get involved in the planning and design of new services, or information about health conditions and support which you are particularly interested in. 

We’ll never pass your details on to anyone else, and we’ll never try to sell you anything – this is about keeping you in touch with what is happening in your local NHS.

Sound interesting? Read more

 

NHS Self-Care Event

The NHS is going through many changes and no more so than in the Hinckley and Bosworth area.  One...

The NHS is going through many changes and no more so than in the Hinckley and Bosworth area.  One of the main aims of the Hinckley & Bosworth Medical Alliance is to make people more aware of the things patients can do to keep healthy.  Trips to the GP surgery can sometimes be avoided if people know what help there is available to keep healthy and how to treat minor ailments themselves.

Many new health services have been introduced and to help the public understand more of these an event is planned by your GP surgery, The LPT (Leicestershire Partnership Trust) who supply the District Nurses, the ILT (Integrated Locality Team), and the Hinckley & Bosworth Medical Alliance at the Mary Forrayn Centre Leicester Rd, Hinckley LE10 1LW on Sept 17th (3pm until 6pm).  Lots of services will have displays and experts in each area there to answer questions about what is on offer in the Hinckley & Bosworth area. 

One of the stalls at the event will be for representing FLiC (Family Lifestyle Club) - This is an 8 week course for families keen to learn more about becoming fit, healthy and managing their weight.

Some of the other services in attendance are

  • Loros – The Leicestershire Hospice Charity
  • Carers support - local support for all Carers of any age.
  • Pharmacist Support – Self Care Drugs
  • Patient Participation Groups – find out how you can have a voice at your GP surgery as well as learn something about extra services on offer.
  • …and many more

Everyone is welcome and light refreshments will be available.

For more information contact Belinda-Lee Botting by email at the Federation office Belinda. Lee-Botting@gp-c82121.nhs.uk

seperator