Patients – privacy notice

Information security

Confidentiality affects everyone. The RHN collects information which is paper-based or held on a computer.
We take our duty to protect your personal information and confidentiality very seriously and are committed to take appropriate measures to ensure it is held securely and only accessed by those with a need to know.

The information we collect:

• Name, address, date of birth, next of kin, contact details
• Details of diagnosis, treatment and hospital visits
• Allergies and health conditions
• Relevant information from people who care for you and know you well such as your GP, other health or social care professionals, relatives or carers.

We also collect information about your ethnicity, religion, disability, language preference and sexual orientation, in order to monitor that we are treating everybody fairly.
It is essential that we have accurate and up to date information about you. Please check that your personal details are correct whenever you visit us and keep us informed of any changes e.g. address, contact details, GP practice.

Uses for personal information

The people who care for you use your information in different ways.

• To assess your health and decide on the most appropriate care for you.
• To make sure your care is safe and effective.
• To ensure appropriate information is available if you need to see another doctor or are referred to a specialist or somewhere else in the NHS or social care.
• In order for your concerns to be investigated if you have a complaint.
• The NHS and Care Quality Commission requires the RHN to undertake patient surveys and friends and family surveys to assess and monitor the quality of care we provide. External providers are sometimes contracted to
  undertake the surveys and RHN will provide the provider your contact details so that they can contact you to send the survey form.

Sharing your information

Everyone working in health or social care has a legal duty to keep information about you confidential; anyone who receives your information from us is also under legal obligation to keep it confidential.
We will normally share information about you with other health care and social professionals directly involved in our care so that you may receive the best quality care.
For example, we will send your GP a summary of any test results, diagnoses and treatment given.
We may need to share information about you so that we can all work together for your benefit, if you are receiving care from other people:

• Social care services
• NHS service
• Local authorities
• Voluntary and private sector organisations working with the us and the NHS

The RHN’s partners who contribute to care provision are not always in the UK. In all circumstances, the partners are chosen from reputable companies and are required to sign a contract and confidentiality agreement with the RHN that they will protect and keep any information secure.

There may be other circumstances when we must share your information legally with other agencies when we are not required to seek your consent. e.g.

• There is a concern that you are putting yourself at risk of serious harm.
• There is a concern that you are putting another person at risk of serious harm.
• There is a concern that you are putting a child at risk of harm.
• We have been instructed to do so by a court.
• The information is essential for the investigation of a serious crime.
• You are subject to the Mental Health Act and your nearest relative must receive information even if you object.
• If the information requires to be notified for public health or other legal reasons e.g. certain infectious diseases.

Other organisations

Other organisations which manage overall Health and Social Care services e.g. NHS Counter Fraud Services, NHS Prescription Service, organisations that have a statutory duty to undertake financial or regulatory audits on Health Care Providers e.g The National Audit Office, Care Quality Commission.
The Benefits Agency and Job Centre Plus sometimes ask us to confirm the dates you attended the hospital. We provide this confirmation only; no clinical information is shared.

Other ways in which we use your information

We also usually send a copy of letters sent to your GP to you at your home address. If you do not wish to receive this letter, please inform a member of staff or contact The Data Protection Officer at the below address.

Surveillance Cameras (CCTV)

We use CCTV around the hospital site in order to;

• Protect staff, patients, visitors and property.
• Apprehend and prosecute offenders and prosecute offenders and provide evidence to take criminal or civil action in the courts.
• Provide a deterrent effect and reduce unlawful activity.
• Help provide a safer environment for our staff.
• Assist in traffic management and car parking schemes.
• Monitor operational and safety related incidents.
• Assist with the verification of claims.

You have a right to make a Subject Access Request of surveillance information recorded of yourself and ask for a copy of it. Requests should be directed to:
Head of Facilities,
Royal Hospital for Neuro-disability
West Hill
London, SW15 3SW
or email DPO@rhn.org.uk

You will need to provide details which must contain sufficient information to identify you and assist us in finding the images on our systems.
We reserve the right to withhold information where permissible by the relevant legislation.
The RHN only retains CCTV images for a reasonable period or as long as it is required by the low. In certain circumstances, we may need to disclose CCTV images for legal reasons.

Legal background

As a UK Health Care Provider, the RHN will continue to process your information under the General Data Protection Regulations from 25 May 2018.
Article 6(1) allows the RHN to process your personal information as it does so “in the exercise of official authority vested in” it as per the Health and Social Care Act 2015.“
Article 9(2)(i) allows the RHN to process your personal information and special category (sensitive) personal information for the provision of health or social care or treatment or the management of health or social care systems.

We do so through the contractual agreements we have with the NHS to provide your care and if you are a privately funded patients, by virtue of the contract in place between you as a patient and RHN as your care provider.

The law requires that we use your information fairly, in a transparent and accountable way.

Accessing your information

You have a right to see or have a copy of the information the RHN holds about you. To obtain a copy, please write to;

Health Records Manager,
Royal Hospital for Neuro-disability
West Hill
London, SW15 3SW
or email subjectaccessrequest@rhn.org.uk

We will attempt to provide you the requested information in a format which is easy for reuse, however, until all patients’ records are electronic, this may not be possible. However, the RHN will provide you the information in the most convenient format.

If you think any of the information about you is incorrect, please contact a member of staff or the Data Protection Officer at DPO@rhn.org.uk.

The RHN will correct all demographic information after it has undertaken appropriate checks. Clinical opinions cannot be corrected however we will insert a note in the record that you wish to highlight that you disagree with the clinical opinion. We will also insert your requested amendments in the record.

You have the right to restrict how and with whom we share information in your records that identifies you.
If you object to us sharing your information we will record this explicitly within your records so that all healthcare professionals and staff involved with your care are aware of your decision.
If you choose not to allow us to share your information with other health or social care professionals involved with your care, it may make the provision of treatment or care more difficult or unavailable. Please discuss any concerns with the clinician treating you so that you are aware of any potential impact. You can also change your mind at any time about a disclosure decision.

The RHN keeps your health records for a defined period only as per the Department of Health guidance.

As a charity, under GDPR, we have a legitimate interest to send letters or newsletters by post about our work or any fundraising appeals to individuals who have previously donated.
Why would the data subject reasonably expect us to send them material?

1. They donated to us in the recent past
2. Our privacy notice indicates that we will send them marketing material in future
3. We gave them a clear opportunity to opt out and they did not do so.

Once we are sure that we are not overriding the data subject fundamental rights i.e. the individual has not objected to receiving direct marketing, the material is not intrusive and there are no other reasons to believe that the individual would rather not receive it.

Consent

Data subjects must give consent by a positive unambiguous action that they are happy to receive future communications – for fundraising consent a form of positing “opt-in”.
This could be a tickbox on a donation form or providing personal details on line or on a hard copy form provided that it is absolutely clear that it has been done in order to receive direct marketing materials.

It is important that when collecting consent, we have a system for recording consent, the conditions for consent, (i.e. can we use the data only for newsletter or also for fundraising activities etc), how will the opt-out system be managed.

The RHN is not required to refresh all existing consent. If we are sure that our previous consent meets all the new criteria, then we can continue to use this consent as the legal condition for processing personal data.

If you have any questions or concerns regarding the information we hold on you or would like to know more please contact us at Data Protection Officer, DPO@rhn.org.uk.

For independent advice about data protection you can contact the Information Commissioner at:
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5SF
Or visit their website – ico.org.uk.