What information do we collect about you?

We use a number of locally built and 3rd party equipment/treatment specific patient databases to collect patient demographics and measurements recorded during lung function diagnostics, sleep and ventilation clinics, home oxygen assessments and for the review of treatment and compliance with sleep therapy . Namely Continuous Positive Airway Pressure devices or CPAP and Non-Invasive Ventilators (NIV).

Depending upon which clinic or diagnostic test you are attending will determine the data we may collect from you.

We will collect data such as your name, height and weight, date of birth, address, telephone numbers, GP details, next of kin, medical history, your current medication, smoking history, occupational history, alcohol intake, your collar size, driving status, family medical history. We may also ask you about your social circumstances and record this in your patient record.

We may also ask you to complete questionnaires as part of your clinic visit, the results of which will be recorded within our patient databases or in your patient record. For example we may ask you to complete an Epworth sleepiness questionnaire which gives us an idea of how sleepy you feel during the day. The results of which will be kept on your patient file within our databases.

We may also ask you about your current medication such as inhalers and other medications such as sleeping tablets, antidepressants, painkillers, steroids and other drugs known to have an impact on either respiratory function or your sleep.

Patient data is also collected for research purposes and audit but is anonymised. You will be asked to consent to your participation in any research and audit.

  How do we use this and what is the legal basis?

Direct Care and Administrative Purposes
The legal basis which allows us to process the personal data listed above for the purpose of providing you with care is covered under GDPR Article 6(1)(e) '...for the performance of a task carried out in the public interest or in the exercise of official authority...’ and Article 9 9(2)(h) ‘...medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems…' for your special category personal data.

Research Purposes
The department may also conduct research which could involve your personal data. Should this be the case, we will rely upon GDPR Article 6(1)(f) '...legitimate interests…except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject...'

  Who do we share your information with?

• Data collected from patients undergoing an oxygen therapy assessment who are to be prescribed home oxygen therapy will have some of their data shared with the regional home oxygen provider. This includes the sharing of an oxygen prescription or home oxygen order form (HOOF)
  
• This is a company called Baywater Healthcare. Data is shared using a secure application called Oxyshop
  
• We will ask patients to complete and sign a consent form allowing the sharing of this data with the oxygen provider
  
• During oxygen assessments we may also request a home safety visit by the West Midlands fire service again we will ask for your consent to organise this for you. Your details will be forwarded onto the fire service so that they can arrange a home visit
  
• The lung cancer nurse specialist team will share your information (patient demographics, medical problems and history as well as your current medication with social services, district nursing teams and palliative care providers
  
• Information is also shared with West Midlands Asbestos Support if you are diagnosed with a condition called Mesothelioma. We will obtain written consent from you to do this. We will also complete medical forms on your behalf such as DS1500

  Who and where do we obtain your information from?

• Verbally from direct questioning/clinical history taking as well as from measurements recorded such as height and weight
  
• Completion of questionnaires during clinic visits for example an Epworth sleepiness score
  
• Data is also collected from patient devices such as CPAP but this does not include patient identifiable information, the treatment data is linked to the patient within our secure database. The treatment data is obtained via an SD data card download from the medical device (i.e. CPAP, NIV)
  
• Referral letters are received from your GP and other healthcare professionals. This will include your information as well as your medical history and the reason for the referral
  
• Referrals are received via email using NHS.net, this is a secure encrypted email system
  
• Referrals into this service are also obtained from internal sources within the hospital from doctors, consultants and other healthcare professionals. This referral is sent to us electronically using a system called clinical web portal and the lung function referral administration system.
• From research and development if you are to be entered onto a research trial
  
• Verbally over the telephone from doctors and other healthcare professionals
  
• Via faxed referrals typically from your GP or community matrons, GP practice nurses

  What rights do I have in relation to my information?

Below is a list of the rights you have in relation to your data and when they apply. To make an application for any of the below rights please contact the Health Records Access Team rwh-tr.healthrecordsaccess@nhs.net in the first instance. All rights should be considered within 30 calendar days from date of receipt, but may be extended if complex.

The Right of Access
You have the right to request a copy of any information held by the Trust as well as any supplementary information. See How do I request my information? for details on how to request your information.

The Right to Erasure
The right to erasure is also known as the ‘right to be forgotten’ introduces a right for you to have personal data erased. Generally this right is not available with health care data. Where this right is available for specific processing you will be notified.

• you contest the accuracy of your personal data and the accuracy is being verified by the trust;
• the data has been unlawfully processed (ie in breach of the lawfulness requirement of the first principle of the GDPR) and you oppose erasure and requests restriction instead;
• the personal data is no longer needed but we need to keep it in order to establish, exercise or defend a legal claim.

The Right to Object
The right to object to processing means that data should cease to be processed. This right applies only where data is obtained with your consent. In most cases we rely on our legal basis to process your data and not consent and therefore for care purposes this right may not apply. If your data is used for any other reason this right may apply, but would have to be assessed on an individual basis.

  National Data Opt Out: How we use your information for purposes in addition to your individual care

RWT is working in the health and care system to improve care for patients and the public.

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

• improving the quality and standards of care provided
• research into the development of new treatments
• preventing illness and diseases
• monitoring safety
• planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care. This is called the National Data Opt Out.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to access the system to view, set or change your opt-out setting
• Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
• See the situations where the opt-out will not apply

You can also find out more about how patient information is used at:

https://www.hra.nhs.uk/information-about-patients/ (which covers health and care research); and https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made).

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Health and care organisations have until 2020 to put systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care.

Our organisation is currently compliant with the national data opt-out policy.

  How do I request my information?

You have a right to see or have copies of any information held by the Trust that relates to you free of charge. We have the right to charge an administration fee in situations where repeated requests are received for the same information or the request is excessive. You will be required to prove your identity when making requests.

Subject Access Requests under GDPR rules (post 25 May 18) will be processed within 30 days. However, once our teams have established the volume of records requested there may be a requirement to extended this up to a further 2 months. We will contact you within 30 days should this be the case.

To request access to health records please complete a Subject Access Request form, link provided below, and forward on to:

Health Records Access Team
Health Records Library
Location B19
New Cross Hospital
Wednesfield Road
Wolverhampton
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Extension 85544/85545/88093

Subject Access Request form (PDF, 171Kb)
Subject Access Request form (Word, 54Kb)

  How long is my information kept for?

All our records are destroyed in accordance with the NHS Retention Schedule, which sets out the appropriate length of time each type of NHS records is retained. We do not keep your records for longer than necessary.

All records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required. For more information please see the Record Management Code for Practice for Health and Social Care 2016, retention schedules

1. Adult health records standard retention period: 8 years
2. Clinical trial and research data retention period: up to 30 years

   How to make a complaint

If you have any questions about your care or a complaint, please speak to the health professional with your care in the first instance.If this is not resolved to your satisfaction you can contact the Patient Advice and Liaison Service (PALS).

Data Protection Officer (DPO): Raz Edwards
Email: rwh-tr.IG-Enquiries@nhs.net
Address: New Cross Hospital, Wolverhampton Road, Heath Town, Wolverhampton WV10 0QP

The Data Protection Officer is a point of contact for advice and guidance in relation to your rights. The DPO is responsible for monitoring the Trusts compliance with the Data Protection Act 2018 and the General Data Protection Regulations (GDPR) 2016 as any policies the Trust has in relation to the protection of personal data. The DPO shall perform their duties in an independent manner with due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

If you have any concerns about how your information is being processed or any of the rights as detailed above, please contact the Trust in the first instance through:

Health Records Access Team
Health Records Library
Location B19
New Cross Hospital
Wednesfield Road
Wolverhampton
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Extension 85544/85545/88093

You also have a right to complain directly to the Information Commissioner’s Office if you feel the Trust has not responded effectively to any of the above.

Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk