Data Controller(s)

NHS Sheffield CCG

Purpose

To fund specific treatment for you for a particular condition that is not covered in our contracts with providers. Individual Funding Requests provide payments required to receive specialist treatment, not routinely provided on the NHS, on a case by case basis.

Type of information Used

Identifiable: Personal (such as name, address, date of birth, NHS number) and Special Category (health information) – to make payments

Anonymous – to provide reports for analysis of payments made

Legal basis

GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller

GDPR Article 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

How we collect (the source) and use the information

Information required to make payments in relation to funding treatments is provided by you, along with relevant information from primary and secondary care regarding the referral for specialist treatment. The CCG will only use the identifiable information we collect to process the request for funding.

This process is carried out with the consent of the patient to satisfy the Common Law Duty of Confidentiality.

Data Processors

Blueteq Ltd

Your Rights

With regards to Individual Funding Requests under GDPR you have the right:

• To be informed about the processing of your information (this notice)
• Of access to the information held about you
• To have the information corrected in the event that it is inaccurate
• To restrict or stop processing
• To object to it being processed or used
• Not to be subject automated decision-taking or profiling
• To be notified of data breaches

How long we will keep the information

Information relating to Individual Funding requests where the funding has been granted will be retained as per the standard care records retention set out in the Records Management Code of Practice for Health and Social Care 2016.

Where requests have been rejected information will be retained for 2 years.

Who we will share the information with (recipients)

This information is not shared outside of the CCG.