- New Cross Hospital
- West Park Hospital
- Cannock Chase Hospital
- The Gem Centre (Children’s Therapies)
- Many GP surgeries, community venues, special schools and patients’ own homes
What information do we collect about you?
In the Physiotherapy & Occupational Therapy Department we aim to provide you with safe and effective care to the highest standards. To do this the team of health professionals caring for you will keep records about your health and any care you receive from the trust. This is called your Health Record and may be stored in a paper form or on computer systems. This may include:
- Basic details such as your name, address, date of birth, NHS number, gender, next of kin, and ethnicity
- Details of your hospital appointments/visits
- Notes and reports about your health, treatment and care
- Results of x-rays, scans and laboratory tests. This may sometimes include clinical photographs but these will only be taken with your written consent.
- Relevant information from people who care for you and know you well, such as health professionals and relatives
It is very important that your personal details are accurate and up to date. We will often check with you at appointments or visits that these details are correct.
Records are created in both paper and electronic forms. Local databases may also be kept – for example, using a ‘spreadsheet’ type of document – to help us manage workloads and work flows across our various teams. These are kept securely on the Trust’s computer systems, and access is controlled and limited to only those staff that have a justifiable need to gain access. Such records may contain your hospital number but all other identifiers (such as date of birth, address, NHS number) are removed. If you are at all concerned about storage of your information in this way, please speak to the health professional in charge of your care.
How do we use this and what is the legal basis?
As a data controller the Trust must establish and publish the lawful basis that is relied on for processing personal data and data that is special categories (sensitive data). Generally most of the processing we carry out is to deliver your care and treatment, and is covered by the following legal provisions:- For the performance of a task carried out in the public interest or in the exercise of official authority, to delivery you a heath care service
- For medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems
The Physiotherapy & Occupational Therapy Department uses the above data in the following ways. For each purpose we process your personal data, the legal bases allowing us to do so are listed within the table below.
| Purpose of using personal data in GP Practices | Legal basis of processing personal data |
|---|---|
|
For commissioning and healthcare planning purposes For example:
|
GDPR Article 6(1)(c) – compliance with a legal obligation GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems Special category 9(2)(i) – public interest in the area of public health |
|
For planning, general running purposes and system improvements For example:
|
GDPR Article 6(1)(c) – compliance with a legal obligation (the GP practice) Regulation 6(1)(e) – the performance of a task carried out in the public interest (CQC) GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health |
|
For planning and running of the NHS nationally, for example: National clinical audits
|
GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health |
|
For research purposes For example: Investigating the effectiveness of health campaigns such as stop-smoking |
GDPR Article 6(1)(f) – legitimate interests…except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 6(1)(a) – explicit consent GDPR Article 9(2)(j) – scientific or historical research purposes or statistical purposes |
Who do we share your information with?
We may share information about you with other agencies in order to support the delivery of your care. This might be, for example, making referrals for additional care after a hospital stay or if an illness has left you unable to look after yourself without assistance. The health professionals looking after you will tell you about these before sharing your information. These are some of the other agencies we might contact:- Department of Health and other NHS bodies
- Clinical Commissioning Groups (CCG’s)
- Other providers involved in your care- such as other hospitals, residential or care homes, care agencies
- General Practitioners (GP’s) in Wolverhampton and out of area if you are not from Wolverhampton.
- Ambulance Services
- Mental health services
- Social services
- Education services (usually for children)
- Local authorities
- Voluntary sector providers (for example, charities who support rehabilitation or provide assistance with daily activities)
- Private sector companies (for example, specialist equipment companies who may need to supply you with specific items of equipment)
- Check the quality of treatment or advice we have given you
- Protect the health and/or safety of the general public
- Manage the health service
- Help investigate any concerns or complaints you or your family have about your healthcare
This will be done with protocols or agreements in place to govern the sharing of data to ensure it is adequate and relevant to the purposes listed above.
Some information we have to share is used for statistical, research or audit purposes. In these instances we take strict measures to ensure that individual patients cannot be identified and where appropriate, anonymisation and pseudonymisation techniques will be used to protect your identity. An example of this is:- National clinical audits (for example, for collecting data about pulmonary rehabilitation, stroke services, falls prevention services or cardiac rehabiliation)
Please ask a member of staff if you require further details about who your information may be shared with. We will always seek your consent for any identifiable information to be shared for audit or research purposes.
If you do not wish personal data that we hold about you to be used in the way that is described in this notice, please discuss the matter with us. You have the right to object in certain circumstances, such as where you have given consent to the processing or have entered into a contract you have given consent, but this may affect our ability to provide you with care or advice.
Who and where do we obtain your information from?
The Physiotherapy & Occupational Therapy Department will collect data about you in a number of ways. The main method of collection is from you directly.
Face to face:
Most of the information we hold about you will be collected from you at the time you engage with the service. Any data provided will be used for the reasons listed in this notice and will only relevant data will be requested and recorded.
Video calls:
As services develop it is increasingly likely that some consultations will be conducted remotely rather than face to face. This usually involves the use of a smart device and enables the physiotherapist/occupational therapist to see a live video stream of you as the patient. The therapist will be in a secure and private location, and the software used for this purpose has been approved as secure by the NHS.
These sessions are not recorded by the trust and are therefore not available to view once the consultation has ended.
Telephone calls:
Information you disclose over a telephone call may be noted down within your written records if it is relevant to your care. This may for example include requests to change appointments, or any new or updated information you share with us about your health.
Remote consultations also take place by telephone. The information discussed during the call and the outcome of the consultation will be recorded in your written hospital notes by the therapist who makes the call.
Emails:
If you email us we may keep a record of your contact and your email address for our record keeping. It is possible that in the future the trust may use your email address to contact you but you have the right to decline if you prefer not to be contacted using email.
Other organisation:
We may receive information from other organisations that are also required by law to share information with us about you, to help us have a full picture of your needs and provide you with care.
Referrals - We may receive referrals or a transfer of your notes from specific specialties as a result of your care being transferred to our services. This can be from another Trust, your GP or any health or social care provider initiating a referral. Additionally, voluntary sector agencies, charities and public services (such as the Fire Service) may refer you to Physiotherapy & Occupational Therapy after their contact with you – this should only be with your explicit consent. If you feel that you have been referred to our services without your knowledge or consent you should contact the Data Protection officer (DPO) of the referring organisation.
Direct access - The Trust and its staff may, on a need to know basis have access to specific clinical systems from other organisations such as the summary care record or other Trust clinical systems in order to access information about you that is relevant to your care delivery. All systems are auditable and access is on a need to know basis.
What rights do I have in relation to my information?
Below is a list of the rights you have in relation to your data and when they apply. To make an application for any of the below rights please contact the Health Records Access Team rwh-tr.healthrecordsaccess@nhs.net in the first instance. All rights should be considered within 30 calendar days from date of receipt, but may be extended if complex.
The Right of Access
You have the right to request a copy of any information held by the Trust as well as any supplementary information. See How do I request my information? for details on how to request your information.
Right to Rectification
If you believe your information may be inaccurate or incomplete you can make a request to have your information reviewed.
The right to restriction allows you to request the restriction or suppression your personal data. This right is closely linked with the right to rectify and the right to object and will only apply if:
- you contest the accuracy of your personal data and the accuracy is being verified by the trust;
- the data has been unlawfully processed (ie in breach of the lawfulness requirement of the first principle of the GDPR) and you oppose erasure and requests restriction instead;
- the personal data is no longer needed but we need to keep it in order to establish, exercise or defend a legal claim.
National Data Opt Out: How we use your information for purposes in addition to your individual care
RWT is working in the health and care system to improve care for patients and the public.
Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.
The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:- improving the quality and standards of care provided
- research into the development of new treatments
- preventing illness and diseases
- monitoring safety
- planning services
This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.
Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.
You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care. This is called the National Data Opt Out.
To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters
On this web page you will:- See what is meant by confidential patient information
- Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
- Find out more about the benefits of sharing data
- Understand more about who uses the data
- Find out how your data is protected
- Be able to access the system to view, set or change your opt-out setting
- Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
- See the situations where the opt-out will not apply
You can also find out more about how patient information is used at:
https://www.hra.nhs.uk/information-about-patients/ (which covers health and care research); and https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made).
You can change your mind about your choice at any time.
Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.
Health and care organisations have until 2020 to put systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care.
Our organisation is currently compliant with the national data opt-out policy.
How do I request my information?
You have a right to see or have copies of any information held by the Trust that relates to you free of charge. We have the right to charge an administration fee in situations where repeated requests are received for the same information or the request is excessive. You will be required to prove your identity when making requests.
Subject Access Requests under GDPR rules (post 25 May 18) will be processed within 30 days. However, once our teams have established the volume of records requested there may be a requirement to extended this up to a further 2 months. We will contact you within 30 days should this be the case.
To request access to health records please complete a Subject Access Request form, link provided below, and forward on to:
Health Records Access Team
Health Records Library
Location B19
New Cross Hospital
Wednesfield Road
Wolverhampton
WV10 0QP
Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Extension 85544/85545/88093
Subject Access Request form (PDF, 171Kb)
Subject Access Request form (Word, 54Kb)
How long is my information kept for?
All our records are destroyed in accordance with the NHS Retention Schedule, which sets out the appropriate length of time each type of NHS records is retained. We do not keep your records for longer than necessary.
All records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required. For more information please see the Record Management Code for Practice for Health and Social Care 2016, retention schedules
There are longer retention periods for children’s records – please speak to your child’s therapist if you wish to know more.
If paper records are created they are scanned and uploaded to the Trust’s Clinical Web Portal once an episode of care is concluded. This is a web-based repository for all of your clinical records which can be accessed by staff who have a legitimate need to do so. Once the paper copies have been uploaded they are destroyed confidentially.
How to make a complaint
If you have any questions about your care or a complaint, please speak to the health professional involved with your care in the first instance. If this is not resolved to your satisfaction you can contact the Patient Advice and Liaison Service (PALS).
If you have any concerns about how your information is being processed or any of the rights as detailed above, please contact the Trust in the first instance through:
Health Records Access Team
Health Records Library
Location B19
New Cross Hospital
Wednesfield Road
Wolverhampton
WV10 0QP
Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Extension 85544/85545/88093
Data Protection Officer (DPO): Raz Edwards
Email: rwh-tr.IG-Enquiries@nhs.net
Telephone: 01902 307999 Extension 88124
You also have a right to complain directly to the Information Commissioner’s Office if you feel the Trust has not responded effectively to any of the above.
Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk
