Purpose
The Children and Families (C&F) Act 2014 places statutory duties on NHS commissioning and provider organisations to work with local authorities and educational establishments to provide support to children and young people (CYP) with SEND who are aged 0-25 years. This requires all partner agencies to work collaboratively to improve outcomes for CYP with SEND (0-25)
The formulation and implementation of Education, Health and Care Plans (EHCPs) addresses the statutory requirements of the C&F Act, bringing together all the services that currently support CYP with SEND and their families as part of the Education, Health & Care (EHC) assessment process and the issuing of EHC plans.
The EHCP process requires that personal information is shared between Education, Health and Social Care in order for all partners to be able to assess, plan and review the needs of CYP who have SEND. Information processed by the ICB as part of the EHCP process will be used for the purpose of appeals and tribunals. Anonymised information may also be used for the planning of future services and for the commissioning and monitoring of health services.
As a party involved in developing EHC Plans, the ICB process personal data to enable their completion and review, in compliance with the structure of EHCPs outlined in the ‘Special Educational Needs and Disability Code of Practice 2014’.
Lawful basis
The ICB’s lawful basis for processing personal data under UK GDPR is under Article 6(1)(e) – public task.
For processing special category personal data, the legal basis is Article 9(2)(h) – management of healthcare systems.
Relevant legislation: Children and Families Act 2014 and Special Educational Needs and Disability Code of Practice 2014.
Type of information used
Personal data: name, date of birth, contact details, address and postcode of residence and NHS number.
Special Category data: racial/ethnic origin, physical and mental health data, including diagnosis.
Who we will share the information with (recipients)
We may be required to share this information with:
- Local Authority SEND assessment team.
- Other NHS provider services, dependent upon the needs of the CYP.
- Education providers for the CYP.
- Local Authority Social Care as required.
Do we use any processors
The Health Informatics Service (THIS), our IT supplier who store all our information securely on their servers.
Microsoft Azure, supported by IT staff, host our data.
The Phoenix Partnership – supplier of the SystmOne electronic patient records system, where the health care part of the EHCP is managed.
How we collect (the source) and use the information
Initially, the information that the ICB receive will come from the Local Authority. Further information will be obtained as part of the EHC assessment process, and this will come from a variety of health care providers that are involved in the care of the CYP.
All information collected will be used for the EHC assessment process and in the event that an EHC plan is issued, all information will then be shared with the CYP, parents or carers, the current educational establishment, all health partners currently involved in providing care to the CYP and social care if they are working with the CYP.
How long we will keep the information
The EHCP records on SystmOne will be held and destroyed by the relevant Health Providers in line with the NHS Retention Schedules.
Your Rights
With regards to Assuring Transformation under the UK GDPR you have the following rights:
- The right to be informed about the processing of your data (this notice)
- The right of access to the data held about you
- The right to have that information amended in the event that it is not accurate
- The right to have the information deleted
- The right to restrict processing
- The right to object to processing
- Right not to be subjected to automated decision making and profiling
- To be notified of data breaches
For more information about these rights, please visit the Information Commissioner's Office website.