West Midlands Regional Research Delivery Network (WM RRDN)

WM RRDN Communications
To allow us to support staff in our partner organisations to conduct research we collect, store and use their personal contact details. We also keep records of which sites are participating in research studies.

WM RRDN Research Delivery Service
With the necessary agreements in place the WM RRDN Research Delivery Service may manage patients who are potentially eligible, have expressed interest or are taking part in a research study.

Patient and Public Involvement and Engagement (PPIE)
Patients and members of the public are invited to share their experiences of research with WM RRDN.

In order to carry out the above activities and obligations as an employer we handle data in relation to:

• Name
• Addresses
• Email addresses
• Date of birth
• Gender
• Marital status
• Telephone numbers

We may also collect, store and use the following “special categories” of more sensitive personal information for example:

• Information about ethnicity
• Health and clinical information
• Results of investigations such as laboratory tests
• Smoking status
• Any learning disabilities
• Religion
• NHS Numbers

We only process information relating to you as long as there is a lawful basis, and it is necessary to do so. We may use one of the following lawful bases:

• Contract – in order to perform a contract with you.
• Consent – Where your consent has been given
• Legitimate interests – For the performance of a task carried out in the public interest or in the exercise of official authority, to deliver you a health care service. To support the health of the general public. To review care provided to ensure it is of the highest standard possible
• Direct care – For medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

WM RRDN may need to share relevant personal information with other NHS organisations. For example, we may share your information for healthcare purposes with health authorities such as:

• NHS England
• Public Health England
• National Institute for Health Research
• Health Research Authority
• Other NHS Trusts
• General Practitioners (GP’s)
• Ambulance Services
• Primary Care Agencies
• External Health Care Companies outside of the NHS
• Universities
• NHS Digital

We may need to share information from your health records with other non-NHS organisations from which you are also receiving care, such as Social Services or private care homes. However, we will not disclose any health information to third parties without your explicit consent unless there are circumstances, such as when the health or safety of others is at risk or where current legislation permits or requires it.

If you are a research participant, the specific patient information sheet (PIS) for the research you are participating in will explain how your information will be shared. WM RRDN will be required to share information with study teams as stipulated in the PIS in order to answer the research question. In addition, any requirement to transfer your data internationally outside the UK, will be covered in the PIS

There are occasions where WM RRDN is required by law to share information provided to us with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.

There may also be situations where we are under a duty to share your information, due to a legal requirement. This includes, but is not limited to, disclosure under a court order, the Health & Safety Executive if you are involved in a reportable accident whilst on site, the police for the prevention or detection of crime or where there is an overriding public interest to prevent abuse or serious harm to others, and other relevant public bodies.

WM RRDN will collect data about you in a number of ways. The main method of collection is from you directly.

Face to face: Most of the information we hold about you will be collected from you at the time you engage with us. Any data provided will be used for the reasons listed in this notice and only relevant data will be requested and recorded.

Telephone calls:  The information you disclose over a telephone call may be recorded by C WM RRDN either to support your care or as a record of the conversation. Ordinarily we will inform you if we record or monitor any telephone calls you make to the WM RRDN. This is to increase your security, for our record keeping of the phone call and for training and quality purposes.

Emails: If you email us we may keep a record of your contact and your email address for our record keeping

Other organisations:  We also work with a number of health and social care organisations whereby we could access information about you, for example; Hospitals, Care Homes, GP Surgeries, Community Hospitals, Prisons, Schools, Hospices and other settings where health and social care services are provided.

Below is a list of the rights you have in relation to your data and when they apply. To make an application for any of the below rights please contact the Health Records Access Team rwh-tr.healthrecordsaccess@nhs.net in the first instance. All rights should be considered within 30 calendar days from date of receipt, but may be extended if complex.

The Right of Access
You have the right to request a copy of any information held by the Trust as well as any supplementary information. See How do I request my information? for details on how to request your information.

The Right to Rectification
If you believe your information may be inaccurate or incomplete you can make a request to have your information reviewed.

The Right to Erasure
The right to erasure is also known as the ‘right to be forgotten’ introduces a right for you to have personal data erased. Generally this right is not available with health care data. Where this right is available for specific processing you will be notified.

The Right to Restrict Processing
The right to restriction allows you to request the restriction or suppression of your personal data. This right is closely linked with the right to rectify and the right to object and will only apply if:

• you contest the accuracy of your personal data and the accuracy is being verified by the trust;
• the data has been unlawfully processed (ie in breach of the lawfulness requirement of the first principle of the GDPR) and you oppose erasure and requests restriction instead;
• the personal data is no longer needed but we need to keep it in order to establish, exercise or defend a legal claim.

The Right to Data Portability
The right to data portability allows you to obtain and reuse your personal data across different services. The process should allow for moving, copying or transfer of personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. The right to data portability is not an absolute right and generally will not apply to your health care record unless:

• The processing is based on your consent or in the performance of a contract;
• When processing is carried out by automated means

The Right to Object
The right to object to processing means that data should cease to be processed. This right applies only where data is obtained with your consent. In most cases we rely on our legal basis to process your data and not consent and therefore for care purposes this right may not apply. If your data is used for any other reason this right may apply, but would have to be assessed on an individual basis.

We will always try to keep your information confidential and only share information when absolutely necessary.

You have a right to see or have copies of any information held by WM RRDN that relates to you free of charge. We have the right to charge an administration fee in situations where repeated requests are received for the same information or the request is excessive. You will be required to prove your identity when making requests.

Subject Access Requests under GDPR rules (post 25th May 2018) will be processed within 30 days. However, once our teams have established the volume of records requested there may be a requirement to extend this up to a further two months. We will contact you within 30 days should this be the case.

To request access to information WM RRDN holds about you please email  wm.rrdn@nihr.ac.uk

WM RRDN is working in the health and care system to improve care for patients and the public.

Whenever you use a health or care service, such as attending a GP appointment, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• improving the quality and standards of care provided
• research into the development of new treatments
• preventing illness and diseases
• monitoring safety
• planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.  This is called the National Data Opt Out.

To find out more or to register your choice to opt out, please visit NHS – Your Data Matters. On this web page you will:

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to access the system to view, set or change your opt-out setting
• Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
• See the situations where the opt-out will not apply

You can also find out more about how patient information is used at: NHS – Information About Patients (which covers health and care research); and  Understanding Patient Data – What You Need to Know (which covers how and why patient information is used, the safeguards and how decisions are made)

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Please note that the national opt out does not restrict members of your health care team contacting you to ask if you are interested in taking part in research.

GP Practices can now accurately record a patient’s wish to dissent from receiving research invitations from their GP practice. Please inform your GP practice if you wish to have these codes applied to your electronic health record:

• 1771641000000107 | Dissent to receive invitation from  general practitioner practice to participate in research
• 1771651000000105 | Dissent withdrawn to receive from general practitioner practice to participate in research

NIHR Dissent Codes

All our records are destroyed in accordance with the NHS Retention Schedule, which sets out the appropriate length of time each type of NHS records is retained. We do not keep your records for longer than necessary. All records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required. For more information please see the Record Management Code for Practice for Health and Social Care 2016, retention schedules

For clinical trials records retention schedules please see the MHRC guidance available at Good Clinical Practice for Clinical Trials

If you have any questions or a complaint in relation to GDPR, please email wm.rrdn@nihr.ac.uk  in the first instance. If you are not satisfied with the outcome, you can contact our Data Protection Officer who will investigate the matter further. rwh-tr.IG-Enquiries@nhs.net.

Address: New Cross Hospital, Wolverhampton Road, Heath Town, Wolverhampton WV10 0QP

The Data Protection Officer is a point of contact for advice and guidance in relation to your rights. The DPO is responsible for monitoring the Trusts compliance with the Data Protection Act 2018 and the General Data Protection Regulations (GDPR) 2016 as any policies the Trust has in relation to the protection of personal data. The DPO shall perform their duties in an independent manner with due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

If you have any concerns about how your information is being processed or any of the rights as detailed above, please contact the Trust in the first instance through:

Health Records Access Team
Health Records Library
Location B19
New Cross Hospital
Wednesfield Road
Wolverhampton
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Extension 85544/85545/88093

You also have a right to complain directly to the Information Commissioner’s Office if you feel the Trust has not responded effectively to any of the above.

Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Telephone: 0303 123 1113
Website: Information Commissioner’s Office