Data Controller
NHS West Yorkshire Integrated Care Board.
Purpose
NHS provider organisations (e.g. hospitals, ambulance trust) and other providers of health services such as the voluntary, community and social enterprise sector that provide NHS-funded care must, by law, submit certain information to NHS England about services provided to you and the population we serve. This information is known as commissioning datasets.
The NHS West Yorkshire Integrated Care Board (the ICB) obtains these datasets from NHS England. We receive a range of data as listed in our contracts with health care providers, this is called ‘local data’ and is received in addition to national data that all NHS organisations are required to submit. Both are used to support decision making for commissioning and enables us to evaluate, plan, design, purchase and pay for the best possible care available for you and the whole of the population we cover.
Lawful basis
The ICB’s legal basis for processing this personal data under the UK GDPR is Article 6(1) e - processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller.
For special category data the basis is Article 9(2) h - processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.
The legal basis for the dissemination of the pseudonymised datasets from NHS England to the ICB is the Health and Social Care Act 2012 Section 261 (5)(d).
Type of information used
- Personal data (pseudonymised): age, ethnic origin, gender etc.
- Special category data (pseudonymised): physical and mental health details.
Who we will share the information with (recipients)
We do not share the information provided to us by NHS England outside of the ICB, unless
- the information is in aggregate and small number suppressed format or
- where we have agreed to licence the information under a sub licencing agreement with a partner health and care provider (limited to Local Authorities, NHS Trusts, GPs and other health care providers), to support collaboration with commissioning decisions and to collectively plan health and care services to meet the needs of the population of West Yorkshire.
Do we use any processors?
Yorkshire Data Services for Commissioners Regional Office (DSCRO) hosted by North of England Commissioning Support (NECS) obtains the identifiable information from the Secondary Uses Service (SUS) at NHS England. The DSCRO also receives identifiable information directly from providers. They pseudonymise the information and pass it to the ICB.
The Health Informatics Service (THIS) and West Yorkshire ICB Leeds IT and Leeds City Council IT Integrated Digital Service (IDS) our IT suppliers who store all our information securely on their servers.
Microsoft Azure, supported by IT staff, host our data.
Leeds City Council.
How we collect (the source) and use the information
The datasets we receive from NHS England have been linked and are in a format that does not directly identify you. Information such as your age, ethnicity and gender, as well as coded information about any clinic or Accident and Emergency attendances, hospital admissions and treatment will be included.
We use these datasets for a number of purposes such as:
- Performance managing contracts
- Reviewing and evaluating the care delivered by commissioned providers to ensure service users are receiving quality and cost effective care
- To prepare statistics on NHS performance to understand health needs and support service redesign, modernisation and improvement
- To help us plan future services to ensure they continue to meet our local population needs
How long we will keep the information
Datasets received via NHS England are retained for as long as there is a Data Sharing Agreement in place between the ICB and NHS England.
Your rights
Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the ICB holds about them. Not all rights apply equally to all our processing activities as certain rights are not available depending on the lawful basis for the processing.
If you require further detail each link below will take you to the Information Commissioner’s Office website where further detail is provided in the section ‘When does the right apply’.
These rights are:
- The right to be informed about the processing of your data
- The right of access to the data held about you
- The right to have that information amended in the event that it is not accurate
- The right to have the information deleted
- The right to restrict processing
- The right to have your data transferred to another organisation (data portability)
- The right to object to processing
- Rights in relation to automated decision making and profiling
Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure.
If you have an enquiry in relation to your data protection rights please contact wyicb.