Data Controller(s)

NHS Sheffield CCG

Purpose

Hospitals and community setting organisations that provide NHS-funded care must by law submit certain information to NHS Digital about services provided to you and the population we serve. This information is known as commissioning datasets. The CCG obtains these datasets from NHS Digital which relate to patient registered with our GP Practices. This enables us to plan, design, purchase and pay for the best possible care available for you.

Type of Information Used

Different types of commissioning data are legally allowed to be used by different organisations within, or contracted to, the NHS.

Identifiable – when disclosed from Primary and Secondary care services to NHS Digital

Pseudonymised – the CCG may only receive this information in a pseudonymised format which does not identify individuals.

Legal Basis

Statutory requirement for NHS Digital to collect identifiable information.

For use by the CCG:

GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller

GDPR Article 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

A section 251 approval from the Secretary of State, through the Confidentiality Advisory Group, enables the pseudonymised information to be sent to the CCG via NHS Digital for our Commissioning purposes.

How we collect (the source) and use the information

The datasets we receive from NHS Digital have been linked and are in a format that does not directly identify you. Information such as your age, ethnicity and gender, as well as coded information about any clinic or Accident and Emergency attendances, hospital admissions and treatment will be included.

We also receive information from the GP Practices within our CCG that does not identify you.

We use these datasets for a number of purposes such as:

Performance managing contracts

Reviewing the care delivered by providers to ensure service users are receiving quality and cost effective care

To prepare statistics on NHS performance to understand health needs and support service redesign, modernisation and improvement

To help us plan future services to ensure they continue to meet our local population needs

Data Processors

Yorkshire Data Services for Commissioning Regional Office (DSCRO)  hosted by North of England Commissioning Support (NECS) obtains the identifiable information from the Secondary Uses Service (SUS) at NHS Digital. The DSCRO also receives identifiable information directly from providers They pseudonymise the information and pass it to the CCG.

Your Rights

If you do not want the NHS to use information about you, collected by your GP, then you can opt out by completing an opt-out form and returning it to your GP practice. There are different types or levels of opt-out available; Type 1 opt out is where you do not wish for your information to be shared outside of your GP Practice for any purpose other than your direct care and Type 2 opt out   is where you do not wish for your information to be shared by NHS Digital.

From 25 May 2018 the type 2 opt-out has been replaced by the National Data Opt-Out with a transition period running until October 2018. Type 2 opt-outs that have been recorded previously have been automatically converted to national data opt-outs. Further information about the Type 2 opt-out and the conversion to the national data opt-out is available from NHS Digital.

Details of the national patient opt out can be found here: https://www.nhs.uk/your-nhs-data-matters/

With regards to Commissioning under GDPR you have the right:

• To be informed about the processing of your information (this notice)
• Of access to the information held about you
• To have the information corrected in the event that it is inaccurate
• To restrict or stop processing
• To object to it being processed or used
• Not to be subject automated decision-taking or profiling
• To be notified of data breaches

How long we will keep the information

Information is retained in accordance with the Records Management Code of Practice for Health and Social Care 2016. Datasets received via NHS Digital are retained for as long as the Data Sharing Agreement is in place.

Who we will share the information with (recipients)

This information is not shared outside of the CCG