Data Controller
NHS West Yorkshire Integrated Care Board
Purpose
Under the NHS Complaints Procedure, individuals can complain to providers and commissioners about NHS services.
A complaint may relate to a service that the ICB is directly responsible for or a service we have commissioned for the patients we are responsible for, such as hospital services. The ICB requires this information to investigate and help resolve complaints.
We assure you that we will only use your personal information to process your complaint and monitor our service quality.
We compile and publish statistics that reveal information, such as the number of complaints we receive. This information will be presented in a way that does not identify anyone.
Lawful basis
UKGDPR Article 6(1)(e) – processing is necessary for performing a task carried out in the exercise of official authority vested in the controller.
UKGDPR Article 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.
Type of information used.
Identifiable: Personal (such as name, address, date of birth) and NHS number.
Special Category data: The UK GDPR singles out some types of personal data that are likely more sensitive and gives them extra protection. This may include racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic data, health data, sex life, and a person’s sexual orientation.
‘data concerning health’ is defined under the Act as personal data related to a natural person's physical or mental health, including the provision of health care services, which reveal information about his or her health status”.
Health data can be about an individual’s current or future health status. It covers specific details of medical conditions, tests, or treatment and includes any related data that reveals anything about someone’s health.
Who we will share the information with (recipients)
Where complaints relate to a service we commission, such as hospital care, the complaint will be shared with that organisation. You will be informed where this occurs.
If you file a complaint about your GP, dentist, optometrist, or pharmacist, we may share the relevant information with the NHS England independent clinical advisors, who will review your complaint on behalf of West Yorkshire ICB. We will only do this with your consent, which you can provide by submitting a consent form.
Where the complainant is not the patient, the ICB will usually need to disclose the complainant’s identity to whoever the complaint is about to obtain consent under the Common Law Duty of Confidentiality to proceed with the complaint and for the complainant to correspond with us on behalf of the patient.
We typically must disclose the complainant's identity to the care provider to investigate the complaint. However, if a complainant wishes to remain anonymous, we will try to respect their wishes. Nevertheless, handling a complaint anonymously may not always be possible.
Do we use any Data Processors?
Our IT suppliers, the Health Informatics Service (THIS) an(THIS) and West Yorkshire ICB Leeds IT and Leeds City Council IT Integrated Digital Service (IDS), store all our information securely on their servers.
Microsoft Azure, supported by IT staff, hosts our data.
CRM software provided by NHS England records complaints relating to primary care service providers received by the ICB.
How we collect (the source) and use the information
Once you raise your complaint with the ICB, we create a complaint file that usually includes the data you provided, such as your identity, the patient's identity (if different), and details of your complaint, including health information you have shared with us.
We will only use the identifiable information collected from you to process the complaint and to evaluate the quality of service we provide.
How long will we keep the information?
Complaint files are kept for ten years from the date your case is closed.
Your rights
Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the ICB holds about them. Not all rights apply equally to all our processing activities as certain rights are not available depending on the lawful basis for the processing.
If you require further detail each link below will take you to the Information Commissioner’s Office website where further detail is provided in the section ‘When does the right apply’.
These rights are:
- The right to be informed about the processing of your data
- The right of access to the data held about you
- The right to have that information amended in the event that it is not accurate
- The right to have the information deleted
- The right to restrict processing
- The right to have your data transferred to another organisation (data portability)
- The right to object to processing
- Rights in relation to automated decision making and profiling
Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure.
If you have an enquiry in relation to your data protection rights please contact wyicb.