Data Controller

NHS West Yorkshire Integrated Care Board

Purpose

Hospitals and community setting organisations that provide NHS-funded care must, by law, submit certain information to NHS Digital about services provided to you and the population we serve.

This information is known as commissioning datasets. The ICB obtains these datasets from NHS Digital. They include information about patients registered with our GP Practices. This enables us to plan, design, purchase and pay for the best possible care available for you and the whole of the population we cover.

Lawful basis

The ICB’s legal basis for processing this personal data under the UK GDPR is Article 6(1) e official authority.

For special category data the basis is Article 9(2) h management of health or social care systems and services.

A section 251 approval from the Secretary of State, through the Health Research Authority’s Confidentiality Advisory Group, enables the pseudonymised information to be sent to the ICB via NHS Digital for our Commissioning purposes.

Type of information used

Personal data (pseudonymised): age.

Special category data (pseudonymised): physical and mental health details

Who we will share the information with (recipients)

We do not share the information provided to us by NHS Digital outside of the ICB, unless the information is in aggregate and small number suppressed format.

Do we use any processors

Yorkshire Data Services for Commissioning Regional Office (DSCRO)  hosted by North of England Commissioning Support (NECS) obtains the identifiable information from the Secondary Uses Service (SUS) at NHS Digital. The DSCRO also receives identifiable information directly from providers. They pseudonymise the information and pass it to the ICB.

The Health Informatics Service (THIS), our IT supplier who store all our information securely on their servers.

Microsoft Azure, supported by IT staff, host our data.

Leeds City Council.

How we collect (the source) and use the information

The datasets we receive from NHS Digital have been linked and are in a format that does not directly identify you. Information such as your age, ethnicity and gender, as well as coded information about any clinic or Accident and Emergency attendances, hospital admissions and treatment will be included.

We also receive information from the GP Practices within our ICB that does not identify you.

  • We use these datasets for a number of purposes such as:
  • Performance managing contracts
  • Reviewing the care delivered by providers to ensure service users are receiving quality and cost effective care
  • To prepare statistics on NHS performance to understand health needs and support service redesign, modernisation and improvement
  • To help us plan future services to ensure they continue to meet our local population needs

How long we will keep the information

Datasets received via NHS Digital are retained for as long as the Data Sharing Agreement is in place.

Your Rights

With regards to Commissioning under the UK GDPR you have the following rights: