DATA PROTECTION POLICY Version Number 5 Version Date March 2017 Policy Owner Chief Information Officer Author Information Governance Manager First approval or date July 2013 last reviewed Staff/Groups Consulted Data Protection Officer Information Governance Steering Group Discussed by Policy March 2017 Group Approved by Information Governance Steering Group Next Review Due March 2020 Policy Audited Equality Impact Assessment Completed Yes
Table of Contents 1. Rationale... 3 2. Aim... 3 3. Definitions... 4 4. Roles and Responsibilities... 5 4.1. Chief Executive... 5 4.2. Hospital Management Team... 5 4.3. Senior Information Risk Officer (SIRO)... 5 4.4. Data Protection Officer... 6 4.5. Caldicott Guardian... 6 4.6. Information Governance Lead... 6 4.7. Clinical Governance Department... 6 4.8. Information Governance Steering Group... 6 4.9. All Staff... 6 5. Data Protection... 6 6. Data Protection Principles... 7 6.1. First Principle... 7 6.2. Second Principle... 7 6.3. Third Principle... 7 6.4. Fourth Principle... 7 6.5. Fifth Principle... 7 6.6. Sixth Principle... 7 6.7. Seventh Principle... 8 6.8. Eighth Principle... 8 7. Individuals... 8 8. Subject Access Requests... 8 9. Disclosures To Others... 9 10. Exemptions... 9 11. Cost and Timescales... 9 12. Human Resources... 10 13. Breaches... 10 14. Legal and trust related policies... 10 15. Year on year improvement plan and assessment... 10 16. Training... 10 17. Applicability... 11 18. Implementation, Monitoring and Evaluation... 11 19. References... 11 Appendix 1 Equality Impact Assessment Tool... 13 2
1. RATIONALE The Trust needs to collect and use certain types of information about people with whom it deals in order to operate including personal data as defined by the Data Protection Act. These include current, past and prospective employees, suppliers, patients and others with whom it communicates. In addition, it may occasionally be required by law to collect and use certain types of information of this kind to comply with the requirements of government departments for business data, for example. This personal information must be dealt with properly however it is held whether: manually stored paper data, e.g. health records, personnel records etc computer referenced paper data e.g. health records, personnel records etc computerised data held in computer applications and databases tapes and other data from CCTV systems data held offsite in archive storage data held on CD, disks, computer disks, memory sticks etc The Trust regards the lawful and correct treatment of personal information very important to providing services and to maintaining confidence between partnership organisations. The Trust ensures that personal information is treated lawfully and correctly. To this end, the Trust fully endorses and adheres to the Principles of data protection, as defined in the Data Protection Act 1998. This policy covers all aspects of business relating to personal information within the Trust and is not solely patient related: It includes information held by all areas such as: Healthcare covering: Acute, Community & Intermediate Care Mental Health Learning Disabilities Primary Care Safeguarding Children Human Resources including Criminal Records Bureau checks on staff Payroll and Finance Procurement Estates Occupational Health 2. AIM This policy aims to help Trust staff understand their legal obligations to protect personal information and details how the Trust meets its legal obligation and NHS requirements concerning confidentiality and information security standards as laid down in the Data Protection Act 1998. This Policy applies to all Trust employees, Independent Contractors and n-executive Directors. 3
3. DEFINITIONS Data is any information which: Is processed using equipment operating automatically in response to instructions Is recorded with the intention of being processed Is recorded as part of a relevant filing system Forms part of an accessible record, including health records Personal data is data held in any format that relates to a living individual, from which an individual can be identified. It includes factual details as well as expression of opinion about the individual and any indication of the intentions of the data controller or any other person in respect of that individual. Sensitive data includes: Racial or ethnic origins Political opinions Religious other similar beliefs Membership of a trade union Physical or mental health or condition Sexual life The commission of any offence, any proceedings for any offence, or the sentence of any court in such proceedings. Patient Identifiable Information is any of the following information collected in the course of the patient s care: Name Address Postcode Date of Birth NHS Number National Insurance Number Carer s details Next of kin details Contact details Bank details Lifestyle Family details Voice and visual records i.e.: photographs, tape recordings) Data subject is an individual who is the subject of personal data Data Controller is a person(s) who determines the purposes for which and the manner in which any personal data are, or are to be, processed Data Processor refers to any person or organisation (other than an employee of the data controller) who processes (including storing or otherwise managing) the data on behalf of the data controller Data user is a person who holds data recorded in a form by which it can be processed by equipment operating automatically. Recipient refers to any person or organisation to whom the data are disclosed, but does not include any person to whom disclosure is made as a result of, or with a 4
view to, a particular inquiry by or on behalf of that person made in the exercise of any power conferred by law. Automated decision-making means decisions made or processed by IT systems. Relevant Filing System means any set of information relating to individuals structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible. Processing in relation to information or data, means obtaining, recording or holding the information or carrying out any operation or set of operations on the information, including: acquiring the data organising and managing the information or data retrieving and using the information or data disclosing or sharing the information or data by fax, letter, email, or any other means of transmission or dissemination archiving, disposing of or destroying the information or data European Economic Area (EEA) refers to the following European countries or territories: Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark (excluding the Faroe Islands), Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, rway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, United Kingdom (excluding the Isle of Man and the Channel Islands). Information Governance Toolkit (IGT) is an online system which allows NHS organisations and partners to assess themselves against the Department of Health Information Governance policies and standards. It also allows members of the public to view participating organisations' IG Toolkit assessments. Breach. A breach refers to an event or action occurring that is in contravention of laws, rules, contracts, or promises. Information Commissioners Office (ICO) is the UK s independent public body set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals. 4. ROLES AND RESPONSIBILITIES 4.1. Chief Executive The Chief Executive has ultimate responsibility for ensuring that the Trust has suitable arrangements in place for the management of Data Protection 4.2. Hospital Management Team The Hospital Management Team is responsible for raising awareness of any incidents reported by the SIRO to the Board of Directors and Chief Executive. 4.3. Senior Information Risk Officer (SIRO) The SIRO is responsible for reporting any Data Protection breaches to the Hospital Management Team and if necessary informing the Information Commissioners Officer 5
4.4. Data Protection Officer The Data Protection Officer has responsibility for maintaining awareness of confidentiality and security issues for all staff. 4.5. Caldicott Guardian The Caldicott Guardian has responsibility for reflecting patients interests regarding the use of patient identifiable information and overseeing disclosures of patient information including extraordinary disclosures (those which are not routine) in accordance with the NHS Confidentiality Code of Practice (vember 2003) 4.6. Information Governance Lead The Information Governance Lead is responsible for providing support and delivering the appropriate education to all individuals to ensure they are clear about their responsibilities when handling information and how to report any breaches of confidentiality. 4.7. Clinical Governance Department The Clinical Governance Department monitors any breaches of confidentiality reported through the Trust Incident Reporting System (Safeguard) adding any risks to the Risk Register ready for review by the Information Governance Steering Group 4.8. Information Governance Steering Group The Information Governance Steering Group reviews any breaches of The Data Protection Act as logged on the Risk Register addressing any issues and updating the SIRO. 4.9. All Staff All staff must: Understand their legal obligation to keep personal information confidential, to ensure they do not breach the data protection principles and uphold individual s rights. Participate in induction, mandatory and awareness training sessions. Be aware of the nominated Data Protection/Caldicott Guardian leads in the Trust. Challenge and verify where necessary the identity of any person who is making a request for confidential information and determine the validity of the reason for requiring that information. Report actual or suspected breaches of confidentiality to their line manager. Ensure data is recorded accurately and in a legible manner. 5. DATA PROTECTION The Data Protection Act 1998 is about ensuring that personal data about an individual is processed fairly and lawfully in order to protect the rights of an individual. Whether held in electronic or paper form, Personal Data, within the Trust, is taken to include: All identifiable patient information, including health records All identifiable staff information Any other identifiable personal information held on suppliers, contractors etc. Certain types of data are regarded as sensitive, and the Act stipulates that special measures must be taken in the process and protection of this type of data. All staff employed by the Trust are affected by the DPA: They have rights as employees about whom data is held and They have obligations as healthcare professional who collect data about patients and clients. 6
6. DATA PROTECTION PRINCIPLES 6.1. First Principle Personal information shall be processed fairly and lawfully and, in particular, shall not be processed unless specific conditions are met. There is a requirement to make the general public, who may use the services of the NHS, aware of why the NHS needs information about them, how this is used and to whom it may be disclosed. The Trust is obliged under the DPA and Caldicott to produce a patient information leaflet. 6.2. Second Principle Personal Information shall be obtained only for one or more specified and lawful purposes, and shall not be further processed in any manner incompatible with that purpose or those purposes. The Trust is required to complete a notification with the Information Commissioner on all databases which hold and/or process personal information about living individuals. It is a criminal offence if this notification is not kept up to date. 6.3. Third Principle Personal information shall be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed. Information collected from individuals should be complete and should all be justified as being required for the purpose they are being requested. 6.4. Fourth Principle Personal information shall be accurate and, where necessary, kept up to date. The Trust must ensure that all information held on any media is accurate and up to date. The accuracy of the information can be achieved by implementing validation routines. Users of software will be responsible for the quality of the data, carrying out quality assurance checks. 6.5. Fifth Principle Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for that purpose or those purposes. All records are affected by this principle regardless of the method of media by which they are held, stored, retained. This is in line with DoH issue, HSC 1999/053 http://webarchive.nationalarchives.gov.uk/20130107105354/http://www.dh.gov.uk/en/publica tionsandstatistics/lettersandcirculars/healthservicecirculars/dh_4003513 6.6. Sixth Principle Personal information shall be processed in accordance with the rights of data subject under the Act. Under this principle of the DPA individuals have the following rights: Right of subject Access 7
Right to prevent processing likely to cause harm or distress Right to prevent processing for the purposes of direct marketing Right in relation to automated decision taking Right to take action for compensation if the individual suffers damage Right to take action to rectify, block, erase or destroy inaccurate data Right to make a request to the Information Commissioner for an assessment against an organisation to establish whether any part of the Act has been contravened 6.7. Seventh Principle Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal information and against accidental loss or destruction of, or damage to, personal data. The Trust has a legal obligation to maintain confidentiality standards for all patient identifiable information. This includes the disposal of non-clinical waste. The Trust must ensure all electronic systems are maintained in-line with BS7799 6.8. Eighth Principle Personal information shall not be transferred to a country or territory outside the level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. Patient identifiable information should not be sent to any countries outside of the EEA as these countries do not have the necessary legislation in place to protect the data covered by the DPA 1998. 7. INDIVIDUALS 7.1. Individuals have rights under the DPA 1998 in respect of their own personal data held by others. They have the right to: be informed about the use made of personal data be informed about the purpose of processing, the source and the recipients of the data be informed of any logic used in automated decisions be provided with a copy of their record, where the effort to provide such is reasonable have incorrect data corrected, blocked, erased or destroyed have previous recipients of such data informed object where substantial damage or distress may be caused object where personal data are used for direct marketing take action for compensation if an individual suffers damage make a request to the commissioner for an assessment to be made as to whether any provision of the Act has been contravened 8. SUBJECT ACCESS REQUESTS 8.1. All data subjects, or someone acting on their behalf, can request to view their personal data held by the Trust. 8.2. All applications regarding patient personal data must be made in writing to the Health Records Manager as outlined in the Trust s Health Records Policy. 8
9. DISCLOSURES TO OTHERS 9.1. Statutory Requests All statutory requests from courts or Coroner s offices etc. will be complied with by the Clinical Governance Team, if appropriate; the patient may be informed that the data has been disclosed unless this would prejudice criminal investigations 9.2. Medico-Legal Requests 9.3. Police All requests from Solicitors and healthcare providers will only be complied with if the Trust is in receipt of written consent of the patient or their representative. These requests will be managed by the Health Records and Clinical Governance departments All requests from the police for personal data will be viewed on a case by case basis via the Clinical Governance and Communications departments who will decide if the information can be disclosed. All requests must be in writing using the documentation provided by the Police authority. The most likely legal basis for disclosure (without the patient s consent) to the police are: Prevention of Terrorism Act 1989 and Terrorism Act 2000. It is a statutory duty to inform the police about information gained (including personal information) about terrorist activity The Road Traffic Act 1988. It is a statutory duty to inform the police, when asked, the name and address (not clinical information) of drivers who are allegedly guilty of an offence. Court order. Where the courts have made an order the information must be disclosed unless the Trust decides to challenge the order of the court. 10. EXEMPTIONS 10.1. There are specific reasons why access to personal data may be denied including: Where the data released may cause serious harm to the physical or mental condition of the patient, or any other person Where access would disclose information relating to or provided by a third party. (where consent had not been received by the third party to release their data) N.B. this does not include information recorded by Trust employees as part of their normal duties Where it is assessed that a patient, under the age of 16, cannot understand the implications of accessing their records. 11. COST AND TIMESCALES 11.1. An application for data access can cost up to a maximum of 50. The Department of Health recommends that Subject Access Requests should be complied with within 21 days but no longer than 40 days. 9
12. HUMAN RESOURCES 12.1. Staff Contracts of employment are monitored by the Trust s Human Resources Department. All contracts of employment include a data protection and general confidentiality clause. Agency and contract staff are subject to the same rules 12.2. Any member of staff current, past or potential (applicants) who wishes to have a copy of their information under the subject access provision of the DPA have the right to access information held on them. 12.3. The Trust is required to undertake criminal records check on certain groups of staff. The DBS (Disclosure Barring Service) is fully committed to compliance of the DPA 1988 and the Freedom of Information Act 2000 13. BREACHES 13.1. n-compliance with this policy or breaches of the Data Protection Act will be managed through the Trust s Disciplinary Procedure. 13.2. All staff have a duty to report any breaches to their Manager, Data Protection Officer or Information Governance Lead. This will be reported through the Trust Incident Reporting System and recorded on the Risk Register. 13.3. Minor or suspected breaches will be addressed by the relevant line manager, the Data Protection Officer, and the Caldicott Guardian. Where the breach has occurred, disciplinary action may be taken and working practices and procedure will be reviewed. 13.4. Serious Breaches, or serious untoward incidents, will be addressed by the Trust Senior Information Risk Officer (SIRO), by raising a Serious Untoward Incident Form and by informing the Information Commissioner s Office. Where a serious breach has occurred, disciplinary action may be taken and working practices and procedure will be reviewed. 14. LEGAL AND TRUST RELATED POLICIES The Trust has a comprehensive range of policies supporting the information governance agendas: reference must be made to these alongside this policy. Legal and professional guidance should also be considered where appropriate 15. YEAR ON YEAR IMPROVEMENT PLAN AND ASSESSMENT 15.1. Confidentiality and Data Protection Assurance form part of the Information Governance Toolkit (IGT). An assessment of compliance with requirements will be undertaken each year. Annual reports and proposed action/development plans will be presented to the Board of Directors for approval of submission to the IGT. 16. TRAINING 16.1. To ensure the successful implementation and maintenance of Data Protection staff will attend Information Governance training as part of the Trust s Induction and Mandatory Training Programme. Any additional or specialised training will be identified at staff appraisal. 10
16.2. All training provided will be recorded on the Trust staff training system. 16.3. Agency and contract staff are subject to the same rules. 17. APPLICABILITY This policy applies to staff employed by the Trust. Patients, visitors and the general public will be made aware of this policy as required 18. IMPLEMENTATION, MONITORING AND EVALUATION Data Protection compliance will be monitored through: The Information Governance Steering Group, monthly meetings The Information Governance Toolkit Incident Reports Audits External Reports 19. REFERENCES Information Governance Policy Information Security Policy YDH Staff Code of Confidentiality Department of Health Confidentiality Code of Conduct Data Protection Act 1988 Freedom of Information Act 2000 Incident Reporting Policy Disciplinary Policy Medical Records Policy NHS Confidentiality Code of Practice (vember 2003) HSG(96)15 The NHS IM&T Security Manual Ensuring Security and Confidentiality in NHS Organisations HSG (96)18 The Protection & use of Patient Information HSC 1999/012 Caldicott Guardians HSC 2002/003 Caldicott Guardians& Implementing the Caldicott Standard into Social Care HSC 1999/053 For the Record BS7799 Information Security Standards HSC 1999/217 Preservations, retention and destruction of GP General Services Records Relating to Patients Protection of Children Act 1999 Police Act 1997 Legislation to restrict disclosure of personal identifiable Information Human Fertilisation and Embryology (disclosure of information) Act 1992 Venereal Diseases Act 1917 and Venereal Diseases Regulations of 1974 and 1992 Abortion Act 1967 The Adoption Act 1976 Legislation requiring disclosure of personal identifiable information 11
Public Health (Control of Diseases) Act 1984 and Public Health (Infectious Diseases) Regulations 1985 Educations Act 1944 (for immunisations and vaccinations to the NHS Trusts from Schools) Births and Deaths Act 1984 Police and Criminal Evidence Act 1984 12
APPENDIX 1 EQUALITY IMPACT ASSESSMENT TOOL To be completed and attached to any procedural document when submitted to the appropriate committee for consideration and approval. Yes/ Comments 1. Does the policy/guidance affect one group less or more favourably than another on the basis of: Race Ethnic origins (including gypsies and travellers) Nationality Gender Culture Religion or belief Sexual orientation including lesbian, gay and bisexual people Age 2. Is there any evidence that some groups are affected differently? 3. If you have identified potential discrimination, are any exceptions valid, legal and/or justifiable? 4. Is the impact of the policy/guidance likely to be negative? N/A 5. If so can the impact be avoided? N/A 6. What alternatives are there to achieving the policy/guidance without the impact? 7. Can we reduce the impact by taking different action? N/A N/A If you have identified a potential discriminatory impact of this procedural document, please refer it to Yeovil Academy, together with any suggestions as to the action required to avoid/reduce this impact. Name: Karen Carter Date: 22 March 2017