Data Controller

NHS West Yorkshire Integrated Care Board

Purpose

Under the NHS Complaints Procedure, individuals can complain to providers and commissioners about NHS services.

A complaint may relate to a service that the ICB is directly responsible for or a service we have commissioned for the patients we are responsible for, such as hospital services. The ICB requires this information to investigate and help resolve complaints.

We assure you that we will only use your personal information to process your complaint and monitor our service quality.

We compile and publish statistics that reveal information, such as the number of complaints we receive. This information will be presented in a way that does not identify anyone.

Lawful basis

UKGDPR Article 6(1)(e) – processing is necessary for performing a task carried out in the exercise of official authority vested in the controller.

UKGDPR Article 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

Type of information used.

Identifiable:  Personal (such as name, address, date of birth) and NHS number.

Special Category data: The UK GDPR singles out some types of personal data that are likely more sensitive and gives them extra protection. This may include racial or ethnic origin, political opinions, religious or philosophical beliefs, genetic data, health data, sex life, and a person’s sexual orientation.

‘data concerning health’ is defined under the Act as personal data related to a natural person's physical or mental health, including the provision of health care services, which reveal information about his or her health status”. 

Health data can be about an individual’s current or future health status. It covers specific details of medical conditions, tests, or treatment and includes any related data that reveals anything about someone’s health.

Who we will share the information with (recipients)

Where complaints relate to a service we commission, such as hospital care, the complaint will be shared with that organisation. You will be informed where this occurs.

If you file a complaint about your GP, dentist, optometrist, or pharmacist, we may share the relevant information with the NHS England independent clinical advisors, who will review your complaint on behalf of West Yorkshire ICB. We will only do this with your consent, which you can provide by submitting a consent form.

Where the complainant is not the patient, the ICB will usually need to disclose the complainant’s identity to whoever the complaint is about to obtain consent under the Common Law Duty of Confidentiality to proceed with the complaint and for the complainant to correspond with us on behalf of the patient.

We typically must disclose the complainant's identity to the care provider to investigate the complaint. However, if a complainant wishes to remain anonymous, we will try to respect their wishes. Nevertheless, handling a complaint anonymously may not always be possible.

Do we use any Data Processors?

Our IT supplier, the Health Informatics Service (THIS), stores all our information securely on their servers.

Microsoft Azure, supported by IT staff, hosts our data.

CRM software records complaints relating to primary care service providers received by the ICB.

How we collect (the source) and use the information

Once you raise your complaint with the ICB, we create a complaint file that usually includes the data you provided, such as your identity, the patient's identity (if different), and details of your complaint, including health information you have shared with us. 

We will only use the identifiable information collected from you to process the complaint and to evaluate the quality of service we provide.

How long will we keep the information?

Complaint files are kept for ten years from the date your case is closed.  

Your Rights

With regards to Complaints under UKGDPR, you have the following rights.