Who owns your data once you submit it
Knowsley Metropolitan Borough Council and GP surgeries who have signed up to deliver the contract for delivery of the NHS Health Check Programme.
Why we need your information
Knowsley Council has a responsibility for improving the health of the local population under the Health and Social Care Act 2012 which requires us to commission services to support the health and wellbeing of the local population.
Knowsley Council commissions services to identify residents’ cardiovascular risk to reduce their likelihood to have a heart attack or stroke within the next 10 years. The NHS Health Check is a mandated service that the Council is required deliver and the Knowsley GPs are contracted as the Provider of this service. Eligible patients between the ages of 40-74 years old are called every 5 years to have their NHS Health Check as part of a rolling programme. Patients consent to the GP undertaking the NHS health Check by attendance at their appointment. Onward transmission of their data for matters relating to lifestyle support (e.g., smoking cessation) must be given via consent during the check. Referrals for further investigation or treatment of a health-related issue identified by the check will not require the patient’s consent.
The provision of this service requires the processing of personal data. Adequate recording must be made regarding an individual’s clinical health and cardiovascular risk factors in line with NICE Guidance, communicating the 10-year Qrisk Score following the results of clinical metrics such as blood tests (some may be point of care testing) to assess cholesterol and blood sugar levels, and any onward referrals to be made. If the individual is not registered with the GP where they have received the service, the GP practice that has carried out the service must gain consent to transfer data to the individual’s registered practice.
As part of the delivery of this service, GP practices must produce and maintain an up-to-date register of all individuals, indicating:
- Name
- Date of birth
- NHS number
- Name and designation of person carrying out the NHS Health Check
- Consent obtained
- Date of NHS Health Check
- 10 -year QRisk Score
- Onward referrals and treatment plan
In addition, GP practices must ensure that details of the individual’s monitoring as part of the contract is included in their lifelong record. If the individual is not registered with the GP practice that has carried out the service, then the patients are asked if they consent to their data being shared with their own GP
With consent the practice must send this information, including any outcomes and reasons for onward referrals, treatment plans to the individual’s registered practice for inclusion in their notes.
Why we can use your information
Knowsley Council Public Health Service has responsibility for improving the health of the local population under the Health and Social Care Act 2012. The Act requires the Council to commission services to support health and wellbeing, including the provision of the NHS Health Checks Programme. The Council’s Public Health team is required to commission a set of ‘mandated services’ through the Public Health Grant. There are five core mandatory public health functions and one of these relates to the provision of NHS Health Checks.
In line with the UK General Data Protection Regulation (UK GDPR) we are using the following lawful bases to process personal information about you:
- Article 6(1)(a), which states that the individual to whom the data relates has given consent to the processing of their personal data for one or more specific purposes.
- Article 6(1)(e), which states the processing is necessary for the performance of a task carried out in the public interest.
Any special category personal data, which includes information relating to health, will be processed using the following lawful bases which are available under the UK GDPR:
- Article 9(2)(a), which allows the processing of special category personal data if the individual to whom the data relates has given explicit consent to the processing of the data.
- Article 9(2)(h), which allows the processing the processing of special category personal data for the purposes of preventive medicine, medical diagnosis, and the provision of health or social care or treatment or the management of health and social care systems and services.
- The right to subject access – you have the right to see a copy of the personal data that the council holds about you and find out what it is used for
The associated lawful condition under the Data Protection Act 2018 is Schedule 1, Paragraph 6, statutory and government purposes.
Who your information will be shared with
| An Individual’s GP |
During the NHS Health Check the patient will undergo a series of diagnostic metrics, including blood tests, BMI, smoking status, and alcohol levels to assess their 10-year Cardiovascular Risk known as the QRisk Score. Eligible patients (those not already on a disease register e.g. individuals who are diabetic) will be called to participant in the scheme every 5 years between the ages of 40-74 years old.
If an individual is not registered with the GP practice that has carried out the service, then the practice that has carried out the service, will ensure patients are given the opportunity to consent to their data being shared with their own GP and to any onward referrals being made.
|
| Relevant Hospital & Community Treatment Providers | Information may also need to be shared with Hospital and Community Treatment Providers e.g., consultants and specialist practitioners for any patient identified needs, such as the treatment and management of Hypertension, Diabetes and Chronic Kidney Disease. |
| Appropriate Lifestyle services -Healthy Knowsley Service (Mersey Care NHS Trust) | Following an NHS Health Check, a patient may consent to support with weight management, smoking cessation, and increasing physical activity. The GP can make a direct referral into the Council commissioned Healthy Knowsley Service for support via a referral from the practice EMIS system. Information shared with Lifestyle services includes name, contact details, and what the patient requires support for. This information is shared via a secure NHS email with Mersey Care NHS Trust. No information is shared regarding the diagnostics outcomes of the NHS Health Check. |
Submitting your information
Knowsley Council has responsibility for improving the health of the local population under the Health and Social Care Act 2012, which requires them to commission services to support the health and wellbeing of the local population. This includes the commissioning of services to improve cardiovascular health. Without the provision of information referenced in this privacy notice, GPs would be unable to perform tasks related to the NHS Health Check.
How long we will keep your data
The Provider must ensure that details of the patients monitoring as part of the contract is included in their lifelong record. If the patient is not registered with the Provider, then the Provider must send monitoring information, including any reasons why the check may not have been completed, to the patients registered practice. This must only be done after obtaining explicit consent from the patient.
How your information be stored
Any information collected by the GP carrying out the services will be stored on the secure EMIS platform, which is a health record system used across the NHS in line with NHS data processing requirements. Information will also be shared securely between GPs as and when required using secure GP systems such EMIS and, if required, secure email.
Automated decisions about you
This information will not be used to make automated decisions about you.
Where your data can be sent
Data will not be transferred abroad. To find out more about your rights under the DPA 2018/UK GDPR, please visit the Information Commissioner’s website.
What rights you have
Under the Data Protection Act (DPA) 2018/ UK General Data Protection Regulation (UK GDPR), you have the following rights with regards to your personal data:
- The right to rectification – you have the right to ask the council to correct or remove any inaccurate data that we hold about you.
- The right to erasure (right to be forgotten) you have the right to ask the council to remove data that we hold about you
- The right to restriction – you have the right to ask for your information to be restricted (locked down) on council systems
- The right to data portability – you have the right to ask for your data to be transferred back to you or to a new provider at your request
- The right to object – you have the right to ask the council to stop using your personal data or to stop sending you marketing information, or complain about how your data is used
- The right to prevent automated decision making – you have the right to ask the council to stop using your data to make automated decisions about you or to stop profiling your behaviour (where applicable)
To find out more about your rights under the DPA 2018/UK GDPR, please visit the Information Commissioner’s website.
More information
To ask questions about how it is used, please download a copy of our form and send it to:
Post
Data Protection Officer
Knowsley Council
Westmorland Road
Huyton
L36 9GL
Complaints
You can complain directly to the Council’s Data Protection Team.
Post
Data Protection Officer
Knowsley Council
Municipal Building
Archway Road
Huyton
Liverpool
L36 9YU
data.protection.officer@knowsley.gov.uk
Other complaints
You also have the right to complain to the Information Commissioner’s Office using the following details.
Post
The Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Telephone
08456 30 60 60
or
01625 54 5745