A Fair Processing Notice (FPN), also known as a Privacy Notice, is a statement by an organization that informs individuals about how their personal data is collected, used, retained, and disclosed.
Security of information
Confidentiality affects everyone. We as a Trust have a legal basis to gather, store and process large amounts of information on a daily basis. This includes medical records, personal records and computerised information for the purposes of preventive or occupational medicine; medical diagnosis; or if the process is necessary for the performance of a task carried out in the public interest. This information is used by many people throughout the course of their daily work.
Our duty to protect information and confidentiality is taken very seriously. We are committed to taking all reasonable measures to ensure the confidentiality and the security of all information for which we are responsible, whether computerised or on paper. This includes regular staff training on the legal obligations they have to maintain confidentiality and security of information at all times.
Ä¢¹½tvÊÓƵ takes staff training extremely seriously. This is to ensure that nobody will access or use your information without a relevant reason, and to stop accidental loss, damage and destruction of any of your medical, personal and electronic records.
Why do we collect information about you?
To make sure you get the best care doctors, nurses and the team of healthcare staff looking after you keep records about your health and any care or treatment you may receive from the NHS. These records help to make sure that you receive the best possible care. These may be written down in your paper records or held on one of the Trust’s electronic systems. They may include:
- Basic details about you such as name, address, date of birth, next of kin, GP, etc.,
- Contact we have had with you such as appointments or clinic visits,
- Notes, x-rays, test results and reports about your health, treatment and care,
- Results of x-rays, scans and laboratory tests,
- Relevant information from people who care for you and know you well such as health professionals and relatives.
Always check that your details are correct when you visit us and please tell us of any changes as soon as possible.
How your personal information is used
Your records are used to manage and deliver the care you receive to make sure that:
- The doctors, nurses and other healthcare members of staff involved in your care have correct and up to date information, to look at your health and decide on the right care for you,
- Healthcare staff have the information they need to be able to look at and improve the quality and type of care you receive,
- Your concerns and worries can be properly investigated if a complaint is raised,
- The right information is available if you see another doctor, or are referred to a specialist or another part of the NHS.
Who do we share personal information with?
Everyone working within the NHS has a legal duty to keep information confidential. Similarly, anyone who receives information from us has a legal duty concerning your confidentiality. The partner organisations with which we share information are:
- Other NHS Trusts and hospitals that are involved in your care,
- CCGs. (Clinical Commissioning Groups),
- General Practitioners (GPs),
- Ambulance Services,
- Adults’ and children’s social care services.
You may be receiving care from other agencies as well as the NHS. Therefore, we may need to share information with other agencies about you, so we can all work together for your benefit. We will only do this if they have a legitimate need, or we have your permission. These agencies include
- Social Care Services,
- Education Services,
- Local Authorities,
- Voluntary and private sector providers working with the NHS,
- General Medical Council.
We will not provide your information to any other third parties without your permission unless there are exceptional circumstances, such as, if the health and safety of you and others is at risk or if the law requires us to pass on information.
The Ä¢¹½tvÊÓƵ & Yorkshire and Humber Care Record
The Ä¢¹½tvÊÓƵ Care Record & The Yorkshire and Humber Care Record (YHCR) are two secure, read only computer systems that brings together information about patients who have used services provided by their GP, local hospitals, community healthcare, social services and mental health teams.
The Ä¢¹½tvÊÓƵ Care Records covers Ä¢¹½tvÊÓƵ whereas the Yorkshire and Humber Care Record cover the Yorkshire and Humber region.
They enable clinical and care staff to review real time health and care information across the care providers and between different systems.
You have the right to opt out of your medical records being shared by the Ä¢¹½tvÊÓƵ and the Yorkshire and Humber Care Record and if you would like any further information on the opt out process for each system, or would like to discuss this further, please contact us using the details provided below.
If you would like any further information, or you wish to opt of this service, please contact Information Governance below via:
Information Governance
Disclosure of information
You have the right to object to how and with whom we share the information that is within your records that could identify you. This will be noted within your records so that all staff involved with your care and treatment are aware of your decision. By choosing this option, it may mean that the delivery of your care or treatment is more difficult. You can also change your mind at any time about your decision.
If your consent is relevant, you are required to provide this in writing. This is essential as you may change your preference regarding consent further down the line. You as an individual also have the right to withdraw your consent at any time.
How your personal information is used to improve the NHS
Your information will also be used to help us manage the NHS and protect the health of the public by being used to:
Your information will be used to:
- Review the care we provide to make sure it is of the highest standard and quality
- Make sure our services can meet your needs in the future
- Investigate your queries, complaints and legal claims
- Make sure the hospital receives payment for the care you receive
- Prepare statistics on NHS performance
- Audit NHS accounts and services
- Undertaking heath research and development
- Helping to train and educate healthcare staff.
The National Data Guardian opt-out programme is a service that allows people to opt out of their confidential patient information being used for research and planning. Please see
to make your choice.
Call recording and CCTV
Telephone calls to the Ä¢¹½tvÊÓƵ may be recorded and we also operate CCTV cameras on all our hospital sites. Data is captured for the following purposes:
- To prevent crime or misuse
- To make sure that staff act in compliance with Trust procedures
- To ensure quality control
- Training, monitoring and service improvement.
SMS text messaging
When attending the Trust for an appointment or a procedure you may be asked to confirm that the Trust has the correct contact number for you. This can be used to provide appointment details via SMS text messages and automated calls to advise you of future appointment times. You may also receive your appointment letters via an SMS text message, you will be provided with a unique link and pin code to access your appointment letter. If you do not access your appointment letter within 24-48 hours, you will also receive a paper copy of the letter via post. .
Virtual appointments
With your consent, your treating clinician may invite you for an appointment virtually via the Trust’s electronic meeting platform. This will enable healthcare professionals to continue treating you without you physically attending the hospital, preventing any undue delays to your care.
Back to topHow you can access your records
The Data Protection legislation gives you a right to access the information we hold about you in our records. Requests can be made verbally or in writing to the Access to Health Records Department.
The Trust will provide your information to you one month from receipt of:
- A verbal request or completed application form, containing adequate supporting information to enable us to verify your identity and locate your records,
- An indication of what information you are requesting, to enable the Trust to locate it in an efficient manner.
You as an individual have the right to request an erasure of any information that has been inaccurately added to your medical records, personal records or other computerised system. If you think any information is inaccurate or incorrect, please contact us using the details below.
Ultimately, if you are unhappy with the way we have handled your information you have the right to make a complaint to the Trust or to the Information Commissioner’s Office (the ICO).
Retention
The retention period for medical records at the Ä¢¹½tvÊÓƵ, once you have been discharged from our care is eight years. Once this period is up your records may then be destroyed within the guidelines set out by the Data Protection legislation. There are some exemptions to this, such as maternity and child records; these will be kept for at least 25 years in line with the NHS Code of Practice.
Data controller
The Data controller responsible for keeping your information confidential is:
The Trust’s Data Protection Officer is:
Johnny Chagger
Freedom of Information
The Freedom of information Act 2000 provides any person with the right to obtain information held by the Ä¢¹½tvÊÓƵ, subject to exemptions.
Notification
The Data Protection Legislation requires organisations to lodge a notification with the Information Commissioner to describe the purposes for which they process personal information. These details are publicly available from:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Legal basis for processing your data
As part of our requirements under the law, the Trust must demonstrate a clear legal reason for collecting, using, sharing and retaining personal data about you. For personal data used in the provision of health and social care our basis is outlined as ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’ under 6(1)(e) of UK GDPR. This is because Trust is a public organisation providing a healthcare service and is required to use names, addresses or other personal data to deliver this service.
Our legal basis for using sensitive personal data (called ‘special categories of personal data’ under UK GDPR) is that this is necessary for the ‘provision of health or social care or treatment or the management of health of social care systems and services’ under 9(2)(h) of UK GDPR. This is because the Trust must use health and social care information about you or your child in the delivery of their care.
Furthermore, these points cover the use of data for clinical audits, service improvement and sharing with other health or social care providers when necessary as part of our service delivery.
There may be times when the Trust uses other different legal bases for other services it provides (for example, research).
Back to top