Data Controller(s)

Purpose

Assuring Transformation (AT) data collects information about individuals with learning disabilities and/or autism, who may have a mental health condition or behaviour that challenges, in in-patient settings, and provides it to the CCG. It gives the CCG broad oversight of their care.

Type of information Used

Identifiable: Personal (such as name, address, date of birth) and Special Category (health information)

Legal basis

GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller.

It is a statutory duty for the CCG to participate in this data collection. There are formal directions from the Secretary of State mandating the collection: (Health & Social Care Act 2012) – in the General Guidance. The Information Standard Notice for this data collection was published on 6th January 2015 (SCCI2007 Amd 7/2014).

GDPR Article 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

A section 251 approval (CAG 8-02(a-c)/2014) from the Secretary of State, through the Confidentiality Advisory Group, enables the flow of personal confidential data from organisations to commissioners, about the services that they provide for:

• people in in-patient beds with learning disabilities and/or autism of,
• any age
• any level of security (general / low / medium / high)
• any status under the Mental Health Act (informal or detained)

However, the information cannot be shared if:

• the individual has objected to the use of their information as part of the AT data
• the individual lacks capacity to make their own decision

How we collect (the source) and use the information

The AT data is sent to the CCG from healthcare providers and collected by NHS Digital on NHS England’s behalf. It covers all people with learning disabilities and/or autism that are being cared for in in-patient settings and includes: the number of people in in-patient settings; discharges and admissions; whether individuals have a care plan, a care co-ordinator, regular care reviews and access to independent advocacy; the age and gender of individuals; and the type of in-patient setting that is providing their care. The information collected is published in reports by NHS Digital. The reports don’t include any personal information, like names, birthdays or NHS numbers in them.

Data Processors

Your Rights

Under the NHS constitution you have the right to be informed about how your information is used. You also have the right to request that your confidential information is not used beyond your own care and treatment, and to have your objections considered, and where your wishes cannot be followed, to be told the reasons including the legal basis. If you do not wish for your information to be included in the information sent to NHS Digital then please let us know via Owen Jones (owen.jones2@nhs.net)

With regards to Assuring Transformation under GDPR you have the right:

• To be informed about the processing of your information (this notice)
• Of access to the information held about you
• To have the information corrected in the event that it is inaccurate
• To restrict or stop processing
• To object to it being processed or used
• Not to be subject automated decision-taking or profiling
• To be notified of data breaches

How long we will keep the information

Who we will share the information with (recipients)

Information will be received from healthcare providers and shared with NHS Digital and NHS England.