Data Controller
NHS West Yorkshire Integrated Care Board
Purpose
A Personal Health Budget is an amount of money to pay for your health and wellbeing needs agreed between you and your local NHS team. Personal Health Budgets help people with long term health conditions manage their care and support in a way that suits them. It helps them to have more choice and flexibility in the way their care and support needs are met.
Any adult or child who is eligible for NHS Continuing Healthcare can have a Personal Health Budget if they want one.
Lawful basis
The ICB’s lawful basis for processing personal data under GDPR is Article 6(1) e - processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller
For special category data the basis is Article 9(2) h - processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services
Relevant legislation: National Health Service (Direct Payments) Regulations 2013.
Type of information used
Personal data: name, age, contact details, NHS number, National Insurance number, banking and payment details for direct payments.
Special category data: ethnic origin, physical and mental health data.
Who we will share the information with (recipients)
Other health and care organisations involved in delivering or arranging the care required. The third party looking after your money where this has been arranged.
Do we use any processors
The Health Informatics Service (THIS), and West Yorkshire ICB Leeds IT and Leeds City Council IT Integrated Digital Service (IDS) our IT suppliers who store all our information securely on their servers.
Microsoft Azure, supported by IT staff, host our data.
All Pay Prepaid Cards provided by Mastercard – this is only where individuals have asked us for a direct payment via this method, subject to availability. All Pay Privacy Notice is available on the All Pay Website.
How we collect (the source) and use the information
Normally, the type of information that we process about you is information you have provided yourself, although we may seek further information in relation to your health and care needs.
We will obtain this additional information from records that may include Care Home records, Health Records (for example GP, Hospital, Mental Health, District Nursing) and Social Care Records.
How long we will keep the information
We will keep this information for 8 years.
Your rights
Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the ICB holds about them. Not all rights apply equally to all our processing activities as certain rights are not available depending on the lawful basis for the processing.
If you require further detail each link below will take you to the Information Commissioner’s Office website where further detail is provided in the section ‘When does the right apply’.
These rights are:
- The right to be informed about the processing of your data
- The right of access to the data held about you
- The right to have that information amended in the event that it is not accurate
- The right to have the information deleted
- The right to restrict processing
- The right to have your data transferred to another organisation (data portability)
- The right to object to processing
- Rights in relation to automated decision making and profiling
Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure.
If you have an enquiry in relation to your data protection rights please contact wyicb.