Privacy notice, conditions of use and accessibility statement

Terms of use (including cookie information)

Use of this site

NHS Northamptonshire Integrated Care Board provides this website for personal use. In using this website, the user agrees to use this site for lawful purposes only and in a manner that does not infringe the rights, or restrict or inhibit the use of this site by any third party.

Information collected through this website is for the sole use of NHS Northamptonshire Integrated Care Board.

NHS Northamptonshire Integrated Care Board cannot guarantee uninterrupted access to this website or the sites to which it links, and accepts no responsibility for any damages arising from the loss of use of this information.

Disclaimer

This website is intended simply to provide helpful advice and information about NHS Northamptonshire Integrated Care Board and the services we provide.

The organisation has taken every care in the preparation of the content of this website. NHS Northamptonshire Integrated Care Board is not liable for any loss or damage arising from the use of this site or the information contained in it.

NHS Northamptonshire Integrated Care Board is not responsible for the availability of access to and links from this site, or for the content on linked sites. The organisation is not responsible for any transmission received from any linked site. Links are provided solely to assist visitors to NHS Northamptonshire Integrated Care Board’s website and the inclusion of a link does not imply that the Organisation endorses or has approved the linked site. Equally, the lack of a link does not imply lack of endorsement.

Copyright

Unless otherwise indicated, NHS Northamptonshire Integrated Care Board retains the copyright to information featured on this website. Some images on this site have been provided by health and care organisations in Northamptonshire and copywrite remains theirs.

The names and logos identifying NHS Northamptonshire Integrated Care Board and Integrated Care Northamptonshire are proprietary marks of the NHS. Copying our logos and any other third party logo via this website is not permitted without approval of the relevant copyright owner.

Re-use of information

You may re-use the information on this website free of charge in any format. Re-use includes copying, issuing copies to the public, publishing, broadcasting and translating into other languages. It also covers non-commercial research and study. Re-use is subject to the following conditions:

Use of material should include an acknowledgement of the source
Reproduction of material should be accurate and should not mislead
Information should not be used for the principal purpose of advertising or promoting a particular product or service or for commercial gain.

If you have any questions about reusing information please email: northantsicb.communications@nhs.net

Revisions

NHS Northamptonshire Integrated Care Board may at any time amend and update this website.

Cookies

Cookies are small files placed on your computer by websites you visit. You can read all about common things cookies are used for on the Your Online Choices website and the About Cookies website.

You can view all key public information on our website without needing to use cookies, but some parts of it (usually third party software like YouTube or Twitter) may not display properly without them.

Your cookie choice

It is your choice whether or not you want websites to put cookies on your computer. You can manage your choices in your web browser on any device, and About Cookies offers a guide to managing your cookies on all modern browsers.

It’s important to remember that if you choose to disable all cookies all the time, some websites or website functions (particularly ones that require logins or passwords) may not work.

Withdrawing consent to use of cookies

If you decide at any time you don’t want cookies anymore, you can clear the cache in your web browser to delete any cookies that are there. You can then disable cookies and no more will be stored unless you decide to enable them again.

Our cookies do not provide us with any private or personally identifiable information about you. All data that is gathered is anonymous.

Our cookies

VerseOne CMS Cookies

This website is bulit on the VerseOne CMS By default, VerseOne CMS uses only one essential cookie, which is called JSESSIONID: this cookie is destroyed at the end of a user's session, i.e. when a user logs out and leaves the site, or after 20 minutes of inactivity on the site.

VerseOne CMS does not track users across sites, and JSESSIONID does not enable any functionality except the three items listed above.

JSESSIONID is an essential cookie — it is absolutely required for the operation of the solution and for the protection of users' data and security. For this reason, it cannot be switched off and users cannot opt out.

VerseOne CMS also uses VOPECRA, a long-term non-tracking cookie that is only placed on the user's browser if the user accepts cookies: VOPECRA is the cookie that remembers that the user has accepted cookies.

VerseOne CMS Cookies
NAME	DURATION	FUNCTION	SIZE
JSESSIONID	Session	Essential cookie for software functionality including session management for authentication, form submission validation, load-balancer configuration. Secured and does not track across websites (domain-specific).	44B
VOPECRA	'Permanent' (multi-year duration)	Remembers that a user has accepted cookies from a specific VerseOne CMS-powered website, enabling cookies from GA and Code Droplets (where configured). Secured and does not track across websites (domain-specific).	8B

Additional Cookies

In addition, icnorthamptonshire.org.uk also uses cookies to help us understand who is using our website as well as help us effectively promote our services through social media channels.

Additional cookies used by icnorthamptonshire.org.uk
Google analytics	Google Analytics cookies allows us to understand how people are using our site and make improvements to it - they do not record any personal identifiable information. Read more on how Google protects your privacy.

In addition, one other cookie appears on some pages where a video has been embeded from YouTube.

google.com (YouTube)

YouTube sets this cookie via embedded youtube-videos and registers anonymous statistical data

AboutCookies offers a guide to managing your cookies on all modern browsers.

Accessibility statement

Accessibility statement for ICNORTHAMPTONSHIRE.ORG.UK

This accessibility statement applies to the Northamptonshire Integrated Care and NHS Northamptonshire Integrated Care Board (ICB) website (www.icnorthamptonshire.org.uk).

This website is run by Northamptonshire ICB. We want as many people as possible to be able to use this website. For example, that means you should be able to:

change colours, contrast levels and fonts
zoom in up to 300% without the text spilling off the screen
navigate most of the website using just a keyboard
navigate most of the website using speech recognition software
listen to most of the website using a screen reader (including the most recent versions of JAWS, NVDA and VoiceOver)

We’ve also made the website text as simple as possible to understand.

AbilityNet has advice on making your device easier to use if you have a disability.

How accessible this website is

We know some parts of this website are not fully accessible:

PDF documents in the staff only section of the site will be accessibility checked on their next review date, by the end of the financial year 2022/23.

Feedback and contact information

If you need information on this website in a different format like accessible PDF, large print, easy read, audio recording or braille please contact us on:

email: comms.icnorthamptonshire@nhs.net

We’ll consider your request and get back to you in 7 days.

Reporting accessibility problems with this website

We’re always looking to improve the accessibility of this website. If you find any problems not listed on this page or think we’re not meeting accessibility requirements, contact our communications team:

email: comms.icnorthamptonshire@nhs.net
or use the page feedback form at the bottom of most pages.

Enforcement procedure

The Equality and Human Rights Commission (EHRC) is responsible for enforcing the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018 (the ‘accessibility regulations’). If you’re not happy with how we respond to your complaint, contact the Equality Advisory and Support Service (EASS).

Technical information about this website’s accessibility

Northamptonshire ICB is committed to making its website accessible, in accordance with the Public Sector Bodies (Websites and Mobile Applications) (No. 2) Accessibility Regulations 2018.

Compliance status

This website is partially compliant with the Web Content Accessibility Guidelines version 2.1 AA standard, due to the non-compliances listed below.

Non-accessible content

PDFs and other documents

Some of our PDFs and Word documents in the staff only section of the site have been moved from a previous website and have not been checked for accessibility. These will be checked at their next scheduled review date, by the end of the financial year 2022/23.

Any PDFs containing patient information are checked at a minimum every two years and are automatically unpublished if they are not reviewed. Any new PDF or Word documents we publish will by scanned for accessibility using the Microsoft Word accessibility checker or Adobe Acrobat’s Accessibility Checker.

What we’re doing to improve accessibility

This site was built with a focus on accessibility. We will be listening to feedback and making improvements where identified. We plan to run a yearly accessibility audit on the site, working with the website provider to implement and changes or improvements that the audit recommends.

Any new content we publish will meet accessibility standards. This will include:

ensuring text content meets a minimum reading age of below 12
there is no meaningless text links
acronyms and abbreviations are updated so they appear in full when they first appear on a page
ensuring documents are scanned for accessibility prior to upload.

Preparation of this accessibility statement

This statement was prepared on 29 June 2022. It was last reviewed 29 June 2022.

Privacy notice

Privacy notice and policy

The purpose of this notice is to inform you about the type of information (including personal information) that Northamptonshire Integrated Care Board (ICB) holds to perform its commissioning activities, how that information is used, who we share it with and how we keep it secure and confidential.

Integrated Care Northamptonshire is a group of organisations working in collaboration. Our partner organisations have their own privacy notices which you can find out more about on their website.

Kettering General privacy notice

Northampton General privacy notice

Northamptonshire Healthcare privacy notice

North Northamptonshire Council corporate privacy notice

West Northamptonshire Council corporate privacy notice

Your local health and social care organisations have a duty to keep complete, accurate and up-to-date information about your care so that you can receive the best possible support. When appropriate they also share information with other professionals that are supporting you, which could include GPs, hospital-based specialists, social workers, nurses, psychologists and health visitors. To support this a new process has been put in place in Northamptonshire, which electronically joins up your care records, at the point of care, from your local hospital, GP practices and community services. This is called the Northamptonshire Care Record (NCR). The Privacy notice and information page relating to this can be found on our Northamptonshire Care Record web page.

The UK Union Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA) have increased the rights that individuals have over their personal data. These data laws require organisations such as the ICB, hospitals and GPs to give their staff and customers the:

right to be informed on how their personal data is processed;
right to access what information is held;
right to rectification to correct inaccurate or complete information held.

You have the right to access any identifiable personal data that is being processed or shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a Court of Law

Right to delete inappropriately held information;
Right to restrict processing of some personal data;
Right to data portability whereby certain data can be transferred to another organisation;
Right to object to have their information used for marketing or research purposes.

You have the right to object to your personal information being processed. Please contact the ICB if you wish to object to the processing of your data.

You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance where the ICB has compelling legitimate grounds for the processing which override the interests, rights and freedoms in the right to object.

The Privacy Notices outlined clearly explain each of the commissioning activities in further detail and how each of the individual’s rights are supported by the controller.

Controller details

Northamptonshire Integrated Care Board (ICB)

Haylock House, Kettering Parkway, Venture Park, Kettering, NN15 6EY

Controller Data Protection Licence: ZB344361

Data Protection Officer (DPO)

Telephone: 0121 611 0730

Email: agem.dpo@nhs.net

Right to complain

You have the right to complain to the Information Commissioner’s Office by visiting their website or calling their helpline Tel: 0303 123 1113

Complaints, subject access requests and freedom of information

We use limited patient data for the purposes of Complaints, Subject Access Requests and Freedom of Information Requests.

We collect and store information that has been received directly from you or organisations such as Local Authority and GP Practices if you are a patient with the Continuing Healthcare, Children’s and Young People’s Continuing and Complex Healthcare, Individual Funding Requests or Medicines Management Team.

Under GDPR and the Data Protection Act 2018, you have the right to see or be given a copy of any personal data held about you by the ICB. To gain access to a copy of your information, you will need to make a Subject Access Request (SAR) to the ICB.

Under the Freedom of Information Act 2000 (FOI), you have the right to request copies of non-personal information held by the ICB. To gain access to this information, you will need to make a Freedom of Information (FOI) Request to the ICB.

Should you wish to make a complaint to the ICB, then there may be a need for us to view and access your patient data or request some from you directly. This will allow the ICB to look into your complaint.

Purpose of processing

Legal Obligations

Lawfulness conditions and special categories

Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject.”

Where your complaint or SAR involves processing of special category data the relevant condition for processing that data will be Article 9(2)(g) “substantial public interest” as defined by Data Protection Act 2018, Schedule 1, Part 2, Section 6(2)(a) “the exercise of a function conferred on a person by an enactment or rule of law”

Direct care

We keep identifiable and clinical data on you relating to the Continuing Health Care (CHC), Individual Funding Request (IFR) and Personal Health Budget (PHB) services where you have applied for these services.

This data is used to assess whether you meet the criteria for funding for these services and to enable provision of services thereafter.

People who have access to your information will only normally have access to that which they need to fulfil their roles.

Purpose of processing

Direct Care is care delivered to the individual alone. After a patient agrees to a referral for direct care elsewhere, such as a referral to a specialist in a hospital, necessary and relevant information about the patient, their circumstances and their problem will need to be shared with the other healthcare workers, such as specialist, therapists, technicians, social care etc.

The information that is shared is to enable the other health and social care workers to provide the most appropriate advice, investigations, treatments, therapies and or care.

In order to receive NHS CHC funding individuals have to be assessed by the ICB according to a legally prescribed decision making process to determine whether the individual has a ‘primary health need’.

Lawfulness conditions and special categories

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.

Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...”

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*

Where processing occurs for the National Fraud Initiative the conditions for processing are Article 6(1)e and Article 9(2)g ‘processing is necessary for reasons of substantial public interest, on the basis of Union or Member State Law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

HR staffing employment, recruitment and training

NHS Northamptonshire ICB welcomes everyone and supports an inclusive study and work environment. Declaring your equality monitoring information, aligned to the Equality Act 2010, helps us to identify current trends, future needs, and address areas of inequality. Enabling equity and fairness for all allows our apprentices to meet their full potential and succeed, regardless of background and personal identity.

The ICB collects and stores information relating to staff for the purposes of HR, Employment, Recruitment and Training. Information is collected and stored about prospective, current and past employees, including self employed and temporary staff.

Data is collected for purposes including recruitment, occupational health, vetting checks, staff training and payroll.

We commission AGEM Commissioning Support Unit to carry out and manage our HR processes.

We share information with the following organisations with your explicit consent or when the law allows: Sugarman Health, Disclosure and Barring Service, NHS Shared Business Services, HMRC and future employers where a reference is requested

Purpose of processing

Legal Obligation

Lawfulness conditions and special categories

Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”

And in addition an Article 9 Condition for processing should be adhered to;-

Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment”

Incident management

The ICB takes every measure to ensure that no identifiable personal data is accessed or shared

without complying with necessary regulations. On the rare occasion that the ICB or one of our

providers may breach these regulations it is our duty to investigate what may have caused such

an incident and the consequences of this.

In these circumstances the ICB may be required to obtain and process information relating to

the data subject in order to fully investigate and inform the individual of the outcome of their

enquiries. The ICB will always ensure the information obtained is not excessive, in line with the

Data Protection Principles of GDPR Article 5(1)(c) adequate, relevant and limited to what is

necessary in relation to the purposes for which they are processed ('data minimisation').

Purpose of processing

Incident investigation and learning

Lawfulness conditions and special categories

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.

And

Article 9(2)(g) ‘processing is necessary for reasons of substantial public interest..’

Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services’

The appropriate Article 9 condition will be dependent on the severity of the incident being investigated.

Litigation claims

The ICB is legally obliged to investigate any litigation or claims brought against them, and this will require us to access, process and hold some your personal identifiable data. This may include your name, address, date or birth and medical condition and other data we may hold. The data ICB will need to process will depend on the type of litigation or claim received.

This NHS Litigation Authority operates a scheme which this ICB pays an annual contribution for, and in return the NHS Litigation Authority supports the settlement of any clinical negligence claims the ICB receives.

Purpose of processing

Legal obligation

Lawfulness conditions and special categories

Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”

Article 9(f) “the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity

Medicines management

The ICB has a Medicines Management function to deliver prescribing support to improve the quality, safety and value for money in the use of medicines and offers advice to clinical and non-clinical staff, patients and the public.

The function provides support relating to many aspects of prescribing and the management of medicines, these include but are not limited to, medicines, appliances and nutritional products.

Personal data is used for both care outcomes and monitoring. We collect and store information that has been received directly from the patient or from GP practices, NHS trusts Providers, care homes, community pharmacies or other healthcare providers.

We may share information with the following organisations with your explicit consent or when the law allows: GP practices, NHS trusts, providers and care homes or other healthcare providers.

Purpose of processing

Legal Obligation

Lawfulness conditions and special categories

Article 6(1)(e) “the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”

In addition to the above, an Article 9 condition of processing must also be used; -

Article 9(2)(h) “the processing is necessary for the provision of medical or social care or treatment”

National Fraud Initiative

The ICB is required by law to protect the public funds it administers. It may share Information provided to it with other bodies responsible for auditing, or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.

The ICB participates in the Cabinet Office's National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud – see the guidance on the Government website. The Cabinet Office is responsible for carrying out data matching exercises subject to a Code of Practice.

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

The processing of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under data protection legislation or the General Data Protection Regulation (GDPR). For further information on the reasons why it matches particular information visit the government website.

Purpose of processing

Legal obligation

National screening and reporting programs

The NHS provides national screening and reporting programmes so that certain diseases can be detected at an early stage. These currently apply to bowel cancer, breast cancer, aortic aneurysms and diabetic retinal screening service as well as other exempt programmes. The law allows us to share your contact information with Public Health England and NHS England so that you can be invited to the relevant screening programme and so that nationally exempted programmes can operate effectively with regards to public and patient health.

More information can be found at:

Government website - population screening programme

NHS website - compliance with national data opt out (word document - data uses and releases compendium)

National Data Opt Out

Whenever you use a health or care service, such as attending Accident & Emergency or using community care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services.

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified, in which case your confidential patient information isn’t needed.

To find out more or to register your choice to opt out, please visit Opt out of sharing your health records - NHS (www.nhs.uk)

On this web page you will:

see what is meant by confidential patient information
find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
find out more about the benefits of sharing data
understand more about who uses the data
find out how your data is protected
be able to access the system to view, set or change your opt-out setting
find the contact telephone number if you want to know any more or to set/change your opt-out by phone
see the situations where the opt-out will not apply.

You can also find out more about how patient information is used at:

Health research authority - which covers health and research

Understanding patient data - which covers how and why patient information is used, the safeguards and how decisions are made

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes. Data would only be used in this way with your specific agreement.

Purpose of processing

The NHS provides several national health screening and reporting programs to detect diseases or conditions earlier such as; cervical and breast cancer, aortic aneurysm and diabetes. More information can be found at https://www.gov.uk/topic/population-screening-programmes The information is shared so as to ensure only those who should be called for screening are called and or those at highest risk are prioritised.

Lawfulness conditions and special categories

Article 6(1)(e); “necessary… in the exercise of official authority vested in the controller’ the processing is necessary to perform a task in the public interest

And

Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or

social care or treatment or the management of health or social care systems and services...”

Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices…’

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”

Patient communications

We will contact patients at times in relation to services, feedback and new initiatives in the area that they have registered an interest in.

We collect and store information that has been received directly from you when you have consented to this process.

We may share information with the following organisations with your explicit consent or when the law allows: GP Practices or service providers.

You do not have to agree to being contacted by the ICB. If you do give your consent, you can change your mind and withdraw it at any time by contacting the ICB

Purpose of processing

Public task

Lawfulness conditions and special categories

Article 6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”

Patient participation or engagement group

We host patient participation and engagement groups to improve the quality of services delivered by the ICB.

We collect and store information that has been received directly from you if you are actively involved in the patient participation or engagement group.

We may share information with the following organisations with your explicit consent or when the law allows: GP Practice or service provider.

You have the right to object to your identifiable information being used or shared for this purpose.

Please speak to the ICB if you no longer wish to have your data used or be a part of the Patient Participation or Engagement group.

Purpose of processing

Public Task

Lawfulness conditions and special categories

Article 6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”

Payments and invoice validation

Invoice validation is an important process in ensuring that your care is paid for correctly. It involves using your NHS number to check that we are the ICB that is responsible for paying for your treatment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for.

The process makes sure that the organisations providing your care are paid correctly. All information with NHS numbers collected to validate invoices is held within a secure, controlled environment for finance (CEfF) (within/on behalf of) the ICB.

Purpose of processing

Accurate payment of invoices to provide accountability and fulfill their legal obligations.

Lawfulness conditions and special categories

Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”

The ICB does not require access to special category data for the purposes of invoice validation and will not process data at this level

Population health management programme

Population Health Management (PHM) is aimed at improving the health of an entire population. It is being implemented across the NHS and this practice is taking part in a project extending across Northamptonshire.

PHM is about improving the physical and mental health outcomes and wellbeing of people and making sure that access to services is fair, timely and equal. It helps to reduce the occurrence of ill-health and looks at all the wider factors that affect health and care.

The PHM approach requires health care organisations to work together with communities and partner agencies, for example, GP Practices, community service providers, hospitals and other health and social care providers.

These organisations will share and combine information with each other in order to get a view of health and services for the population in a particular area. This information sharing is subject to robust security arrangements.

You have the right to object to our sharing your data in these circumstances, but we have an overriding responsibility to comply with our legal obligations.

Purpose of processing

To use linked data from primary, secondary and community care to understand population health more effectively.

This only uses pseudonymised data i.e. where information that identifies you has been removed and replaced with a pseudonym.

This will only ever be re-identified if we discover that you may benefit from a particular health intervention, in which case only the relevant staff within your practice will be able to see your personal information in order to offer this service to you.

In order to carry out this data linkage, your pseudonymised data will be passed to a Commissioning Support Unit, who are part of NHS England, who will link this to other local and national data sources to be able to carry out appropriate analyses. These linked datasets will also be securely shared with Northamptonshire ICB to carry out any further analysis needed to support improvements to the local populations health and to target health and social care resources effectively.

Only a small number of staff based within these UK based organisations will be able to access this data, and as this will be pseudonymised in accordance with the ICO Anonymisation Code of Practice, no one within these organisations will be able to identify you.

Lawfulness conditions and special categories

To support health and social care:

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. and
Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...”;

For supporting public health:

Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And
Article 9(2)(i) “processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices...”

We will also recognise your rights established under UK case law collectively known as the Common Law Duty of Confidentiality

Public health

Public health encompasses everything from national smoking and alcohol policies, the management of epidemics such as flu, the control of large scale infections such as TB and Hepatitis B to local outbreaks of food poisoning or Measles. Public Health England/UK Health Security Agency (UKHSA) monitors the numbers of certain infections that occur in healthcare settings through routine surveillance programmes, and advises on how to prevent and control infection in establishments such as hospitals, care homes and schools. In order to allow UKHSA to carry out accurate monitoring of infections, it may rely on information held by the ICB with regards to healthcare acquired infections (HCAIs).

This will necessarily mean the subjects personal and health information being shared with the Public Health organisations.

Some of the relevant legislation includes:

Health Protection (Notification) Regulations 2010 (SI 2010/659)
Health Protection (Local Authority Powers) Regulations 2010 (SI 2010/657)
Health Protection (Part 2A Orders) Regulations 2010 (SI 2010/658)
Public Health (Control of Disease) Act 1984
Public Health (Infectious Diseases) Regulations 1988 and
The Health Service (Control of Patient Information) Regulations 2002

Purpose of processing

Legal Obligation and Public Interest

Lawfulness conditions and special categories

Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.”

And

Article 9(2)(i) “processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices,..”

Quality alerts

A quality alert is a systemic issue, generally affecting a service, or the ability to deliver a high-quality service. The ICB quality team triage quality alerts and incidents reported by GPs/provider organisations. The ICB has a statutory duty to support NHS England with the continuous quality improvement of primary medical services as set out in the Health and Social Care Act 2012 and the Primary Medical Services assurance framework.

In order for the ICB to triage quality alerts and incidents reported by GPs and providers, the quality team at the ICB may require the relevant individual’s NHS number in order to investigate the quality alert or incident.

Purpose of processing

Legal Obligation

Lawfulness conditions and special categories

Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”

and

Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services”

Risk stratification

The ICB keeps identifiable and clinical data on you relating to risk stratification to support your GP in assessing the provision and use of services where you have applied for these services.

This data is used to assess whether you meet the criteria for funding for these services and to enable provision of services thereafter.

People who have access to your information will only normally have access to that which they need to fulfil their roles.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do not wish your data to be included in the risk stratification service, you can choose to opt out. You can contact your GP practice, which can apply a code to stop your identifiable information being used for risk stratification purposes, or you can contact the ICB, who will inform your GP practice and ask them to apply the opt-out code to ensure that your information is not used in the programme.

You can contact the ICB by email, phone or post:

Email: northantsicb.patientexperience@nhs.net

Phone: 01604 476777

Postal address:

NHS Northamptonshire ICB
Haylock House
Kettering Parkway
Venture Park
Kettering
NN15 6EY

Purpose of processing

Your GP uses your data to provide the best care they can for you. As part of this process, your GP will use your personal and health data to undertake risk stratification, also known as case finding.

Risk stratification involves applying computer based algorithms, or calculations, to identify those patients registered with the GP Surgery who are most at risk from certain medical conditions and who will benefit from clinical care to help prevent or better treat their condition.

To identify those patients individually from the patient community registered with your GP would be a lengthy and time-consuming process, which would by its nature potentially not identify individuals quickly and increase the time to improve care.

Your GP Surgery uses the services of a health partner, a Commissioning Support Unit (CSU) to identify those most in need of preventative or improved care. This contract is arranged by us.

Neither we nor the CSU will at any time have access to your personal or confidential data. They act on behalf of your GP to organise this service with appropriate contractual and security measures only.

The CSU will automatically process your personal and confidential data without any staff being able to view the data. Typically they will process your data using indicators such as your age, gender, NHS number and codes for your medical health to identify those who will benefit from clinical intervention.

Processing takes place automatically and without human or manual handling. Data is extracted from your GP computer system, automatically processed, and only your GP is able to view the outcome, matching results against patients on their system.

We have implemented strict security controls to protect your confidentiality and recommend this as a secure and beneficial service to you. At all times, your GP remains accountable for how your data is processed. However, if you wish, you can ask your GP for your data not to be processed for this purpose and your GP will mark your record as not to be extracted so it is not sent to the CSU for risk stratification purposes.

Lawfulness conditions and special categories

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*

Risk stratification projects

The ICB holds information about you but that does not directly identify you, pseudonymised datasets, obtained by NHS Digital for the purposes of managing and funding the NHS, monitoring activity, inform the way we plan and commission services, and to gain evidence on how we can improve health and care services. Processing in this manner is classed as Risk Stratification.

People who have access to your information will only normally have access to that which they need to fulfil their roles. You have the right to object to our sharing your data in these circumstances, but we have an overriding responsibility to comply with our legal obligations

Purpose of processing

Hospitals and community organisations that provide NHS-funded care must submit certain information to NHS Digital about services provided to our local population. This information is generally known as commissioning datasets.

The ICB obtains these datasets from NHS Digital. These datasets are used in a format that does not directly identify you for the purposes of managing and funding the NHS, monitoring activity, inform the way we plan and commission services, and to gain evidence on how we can improve health and care services.

The datasets do contain details of gender, numbers of patients in each age bracket, and clinical activity. But the level of information provide is not sufficient to re-identify you. ICBs are required to adopt strict security controls when using these commissioning datasets under a Data Processing Contract with NHS Digital that is reviewed and refreshed on an annual basis.

The data will be used to ensure patients are receiving quality and cost-effective care, and to support service redesign, modernisation, and improvement, and to plan future services.

In addition, the ICB engages with the services of Prescribing Services Limited (PSL) to analyse pseudonymised data extracted from your GP practice to support risk stratification. Your GP will use your data to provide the best care they can for you through case finding.

We also receive similar information in respect of our GP Practices; however, we cannot identify individual patients from this data.

Lawfulness conditions and special categories

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official

authority…’.

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”.

Safeguarding

Some members of society are recognised as needing protection, for example children and adults with care and support needs (adult hereafter). Safeguarding is the action that is taken to promote the welfare and protect children/ adult from harm. If a child/ adult is suffering or likely to suffer significant harm, professionals have a statutory responsibility to protect them. This statutory responsibility is enshrined within the Care Act 2014, Children Acts 1989 & 2004 & Social Care Act 2014.

Where there is a suspected or actual safeguarding issue professionals should aim to gain consent to share information, but should be mindful of situations where to do so would place a child/ adult at increased risk of harm. Information may be shared without consent if a professional has reason to believe that there is good reason to do so, and that the sharing of information will enhance safeguarding.

When decisions are made to share or withhold information, practitioners should record who has been given the information and why.

This is covered in the following legislation guidance:

The Mental Capacity Act 2005

Section 47 of The Children Act 1989

Section 18 Schedule 1 Part 2 of Data Protection Act 2018

Section 45 of the Care Act 2014

For children where who are identified as Child In Need professionals are required to seek consent in regards to sharing information. The relevant guidance is covered Section 17 Children Act 1989

Purpose of processing

To protect the child or vulnerable adult

Lawfulness conditions and special categories

For consented processing;

6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”

For unconsented processing;

Article 6(1)(e) “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;

And the following Article 9 condition for processing special category personal data:

Article 9(2)(b) “...is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of ...social protection law in so far as it is authorised by Union or Member State law..”

We will consider your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”.

Survey data collection

The ICB may sometimes conduct surveys to obtain valuable insights on how to improve services, enhance organisational efficiency and address the needs of residents in the county. The key reasons why the ICB may collect and use your information in surveys are:

To analyse and evaluate services
To assess patient and service user satisfaction and experience
For quality improvement and accreditation
To measure outcomes of services, projects and pilots
To assess community health needs
To assess the engagement and satisfaction levels of health and social care professionals

Purpose of processing

The collected data is used solely for the purposes outlined above. Your feedback helps us understand your experiences, preferences, and areas where we can improve our offerings.

Data we collect

The ICB will always ensure the information obtained is not excessive, in line with the Data Protection Principles of GDPR Article 5(1)(c) adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation').

Our surveys will not ask for information that will identify you or special category data (sensitive data) and we will always advise participants against sharing such data in their responses. However, in some instances participants may inadvertently provide personal and sensitive data in response to a question. All survey responses will be treated with the utmost confidentiality and shared with only the employees who need to access it in order to fulfil their roles. The survey questions will vary, and you may choose to skip any questions you are not comfortable answering.

Your survey responses will be anonymised and aggregated for analysis. Individual responses will be kept confidential, and your identity will not be linked to your specific feedback.

Lawfulness conditions and special categories

Article 6(1)(a) ‘…the data subject has given consent to the processing of his or her personal data for one or more specific purposes;…’

And

Article 9(2)(g) ‘processing is necessary for reasons of substantial public interest..’

We will always obtain your consent prior to your participation in a survey. You have the right to withdraw your consent at any time by contacting us using the “contact us” link below.

Data retention

We will retain your survey responses for a period necessary to achieve the survey's purpose. After this period, your data will be securely deleted.

Recipients or categories of recipients of shared data

Data may be shared with:

general practices
service providers
health and social care organisations
Support staff and diagnostic and treatment centres who contribute to personal care
local authorities
community pharmacies
care homes
Arden & GEM Commissioning Support Unit
arm’s length bodies (such as Public Health England/UK Health Security Agency)
Sugarman Health
Disclosure and Barring Service
NHS Shared Business Services
HMRC
Our solicitors or legal team
- The Court processing the claim
- Any regulatory body who has a statutory basis for evidencing, overseeing, investigating or substantiating litigation, a claim or national or professional standards such as the GMC, the Care Quality Commission and other bodies or the outcomes of such action
Public Health England/UK Health Security Agency
Prescribing Services Ltd

Search the Integrated Care Northamptonshire website