Data Controller
NHS West Yorkshire Integrated Care Board
Purpose
Controlled Drugs Monitoring - The ICB has a duty to assist the relevant Controlled Drug Accountable Officer (CDAO) of NHS England in the carrying out of the CDAO’s functions under The Controlled Drugs (Supervision of Management and Use) Regulations 2013. These regulations aim to strengthen the governance arrangements for the use and management of controlled drugs
Lawful basis
GDPR Article 6(1)(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
GDPR Article 9 (2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.
Type of information used
Personal and medical details.
Who we will share the information with (recipients)
Personal data is shared between the ICB and local healthcare providers, including GP practices. They do this to facilitate the implementation of recommendations by the medicines management team.
Do we use any processors
The Health Informatics Service (THIS), our IT supplier who store all our information securely on their servers.
Microsoft Azure, supported by IT staff, host our data.
How we collect (the source) and use the information
Medicines management staff access the patient clinical record from within a GP practice. They access personal and medical details in line with the current project and at all times with the knowledge and written consent of the GP practice. As a result of the information accessed, recommendations may be made to a GP, or medicines may be amended and the patient informed by telephone or letter.
Details of the audit (which includes personal or sensitive data) is retained in a restricted folder (accessible only by members of the MMT) for a short period to allow for any queries raised as a result of the work to be answered after which time it is deleted – a maximum of 12 months.
How long we will keep the information
One year
Your Rights
With regards to Medicines Optimisation, under the UK GDPR you have the following rights:
- The right to be informed about the processing of your data (this notice)
- The right of access to the data held about you
- The right to have that information amended in the event that it is not accurate
- The right to restrict processing
- The right to object to processing
- Right not to be subjected to automated decision making and profiling
- To be notified of data breaches