Confidentiality and data protection policy

Effective From: 13/01/2017

Version Control

Introduction 

QEF holds processes and shares personal data on a daily basis for various purposes during service  provision. 

All data must be treated securely and lawfully to deliver an effective services and to maintain  confidence of its users. The current information security landscape and the legislative framework  compels QEF to handle data that is in context with the components of the Information Governance  Toolkit, the Department of Health (DoH) and Information Commissioner’s Officer (ICO)’s guidelines and the legal obligations that arise from GDPR, the Common Law Duty of Confidentiality (including  the NHS Confidentiality Code of Practice) and the Caldicott Principles.  

Purpose 

The purpose of this Policy is to:- 

• Establish the principles of data handling for all staff; 
• Promote how QEF will execute its duty to keep personal information safe and confidential  whilst at the same time not compromising its ability to share information with other  departments and partner agencies, where necessary; 
• Provide assurance that QEF has full regard for the law and will only process information in  order to provide the best possible care to its users; 
• Establish a framework to provide assurance for the data protection and confidentiality  components of QEF’s Information Governance Toolkit;  
• Ensure appropriate resources are allocated to QEF’s training programme so that staff are  adequately briefed.  

Scope of this Policy  

This Policy covers all QEF sites and applies to any individual employed, in any capacity, who is  employed either under a letter of authority or on a permanent/part time or honorary contract or as a  third party such as contractors, students, volunteers and visitors who handle information as part of  their course of work. 

The Policy covers all aspects of information within the organisation, including but is not limited to:- ∙ Service user/staff/client information; 

• Personal information; 
• Organisational information considered confidential or a trade secret; 

It covers all aspects of handling information, including but not limited to:- 

• Structured and unstructured record systems – paper and electronic; 
• The transmission of information – fax, email, post and telephone; 
• Photographic images, digital, text or video recordings including CCTV; 
• Information held on mobile devices for e.g. Dictaphones, USB Memory sticks, laptops,  tablets/IPADs, mobile phones and cameras etc.; 
• Information systems managed and/or developed by or used by QEF; 
• The purchase, development and maintenance of information systems in respect of the  management of confidential/patient information.  

This Policy will formally adopt the guidelines as set out in the Confidentiality: NHS Code of Practice  (2003) set out by the Department of Health and the new superseded guidance “A Guide to. 

Confidentiality in Health and Social Care” recently published by the HSCIC in September 2013. QEF will observe the principles in these codes when making decisions regarding personal data.  

Objectives of this Policy  

The objectives of this Policy are to ensure that QEF will:- 

• Publish (via Privacy Notices) and observe the conditions of fair and lawful processing so that  staff and third parties are proactively informed of how their data will be used;  ∙ Identify a legal justification for every data flow processed; 
• Only use information for the purpose it was provided for unless exceptional circumstances permit where the public interest test prevails or an overriding legal statutory obligation exists that outweighs any patient confidentiality owed to a patient or client(s); 
• Collect and process only information to the extent that it is needed to fulfil operational  needs to comply with regulatory and statutory legal obligation(s); 
• Ensure the accuracy and quality of the information used; 
• Apply strict checks (i.e. retention periods) to the information it holds so that information is  not held or kept for longer than necessary; 
• Ensure that the rights of all data subjects are observed and actioned;  
• Implement appropriate technical and organisational security measures to safeguard the use personal information; and 
• Not transfer personal data abroad without adequate protection in place. 

This Statement is in compliance with the principles of GDPR which includes the following rights for  data subjects 

• the right to be informed; 
• the right of access; 
• the right to rectification; 
• the right to erasure; 
• the right to restrict processing; 
• the right to data portability; 
• the right to object; and 
• the right not to be subject to automated decision-making including profiling. 

The Information Handling Principles 

QEF will:- 

• Regard all personal identifiable data relating to patients, staff and business clients as  confidential and will treat it with the respect it deserves by implementing an appropriate  framework to achieve, monitor and maintain practice unless national policy on accountability  and openness dictates otherwise
• Establish appropriate procedures to ensure compliance with the GDPR, The Data Protection  Act 2018, the Human Rights Act and the Common Law Duty of Confidentiality, Freedom of  Information Act 2000 and the Environmental Information Regulations 2004 and other related  legislation
• Ensure that staff who have a legitimate right of access as part of their duties are given  authorisation to confidential information. Unauthorised access to personal data, regardless of format i.e. electronic or paper, will be considered a breach of GDPR and will invoke staff  disciplinary procedures, where this has been breached
• Ensure staff only share information where it is appropriate to do so and where the  transmission is secure and provides safe and effective care to individuals

Only make information disclosures where it is considered appropriate and is in respect of but  not limited to:- 

• Auditing and assurance purposes for the improvement of quality care
• The planning and management of services
• Risk management
• The investigation of complaints, notifications and legal enquiries/claims
• Legal statutory duties and requirements
• Only use only identifiable information where it is only absolute necessary for a specified  purpose in disclosure. The need for patients to be identified will be considered at each  stage of satisfying the purpose(s). In all other cases anonymised data will be used to satisfy  requests i.e. data will be stripped of its personal identifiers, where possible. Any sharing of  anonymised data will specifically be for the benefit of the community or for a statutory duty  
• Ensure where the use of personal confidential data is considered essential, the inclusion of  each individual item of data is justified so that only the minimum amount of personal  confidential data is transferred or accessible as necessary for a given function to be carried  out
• Ensure all individuals have a legal right to object to the processing and sharing of their  personal data, but any final decisions for disclosure will rest with QEF
• Ensure individuals have a right to correct or delete data
• Ensure every proposed use or transfer of personal confidential data within or from an  organisation is clearly defined, scrutinised and documented with continuing uses regularly  reviewed, by the appropriate Information Asset Owner, the Information Governance  Manager, the SIRO and the Caldicott Guardian
• Ensure staff are briefed on their roles and responsibilities so that they conform to the terms  and conditions of their contract and understand their legal obligations when accessing  confidential information
• Ensure staff awareness is routinely assessed with appropriate training and informative  communication
• Conduct risk assessments, in conjunction with any planning of organisational activity where  appropriate data protection privacy controls need to be determined and put into place.  

QEF recognises that failure to adhere to these standards could form the basis of a complaint or legal  claim. Staff are therefore required to take these necessary precautions when handling confidential  data.  

Staff and Management Responsibilities

Definitions 

General Data Protection Regulation  

The EU General Data Protection Regulation (GDPR) replaces the Data Protection Directive 95/46/EC  and is designed to harmonise data privacy laws across Europe, to protect and empower all EU  citizens data privacy and to reshape the way organisations across the region approach data privacy.

In general terms, this gives individuals a legal right to:- 

• Privacy
• To know the purposes for which their data is held and processed
• To have data corrected or deleted
• To know who their data may be disclosed to or shared with; and 
• To prevent the use of their data in certain circumstances. 

The underlying aim of GDPR is to:- 

• Promote openness about the processing of people’s personal data; and  
• To ensure information relating to an individual is treated as confidential and is not  communicated to anyone who is not authorised to receive it. Unauthorised persons including  staff not involved in either the clinical care of a patient or the associated administration  process. In the case of staff records, unauthorised persons including staff not involved in the  management of that member of staff or associated administrative processes.  

For deceased individuals a duty of confidence still continues.  

Key areas of change:-  

Breach Notification

Data Breaches will be reported via the Trusts Risk Reporting system (DATIX) and  it is noted that potential fines will now increase to a maximum of 20 million euros (equivalent  sterling at the exchange rate on the day the fine is issued). The requirement is for breaches to be  reported within 72 hours.  

Individuals Rights

Individuals have greater rights under the General Data Protection Regulation  including the right of access, right to rectification, right to erasure (right to be forgotten), right to  restriction of processing, right to data portability and the right to object. These rights will be  considered by QE Facilities when in receipt of an application. 

Contractual Requirements

The GDPR requires all third parties who process data on behalf of the QE  Facilities to comply with relevant contractual provisions. The provisions are detailed in the  Information Governance Policy for new Systems and changes to existing Systems. 

Privacy Impact Assessments (PIAs)

The use of Privacy Impact Assessments is a statutory  requirement under the General Data Protection Regulation for all fundamental changes in the way  that personal data is stored, transferred and used. 

Changes to Subject Access Requests

Key changes to subject access requests include the timescale is  now one month to respond and charging has been removed. Further detail is contained within the  Subject Access Request Policy. 

Employment Contracts

Information Governance provisions within contracts and employment  handbooks will be updated to include the relevant provision. 

Privacy Notices/Fair Processing Notices

All privacy information will include the provisions of the  new General Data Protection Regulation. This includes information on the identity and contact  details of the controller, purpose and legal basis, recipient or categories of recipient, retention  periods and the right to withdraw consent (if applicable).

Information Asset Register/Data Flow Maps

There is a statutory requirement under the GDPR to  ensure that the there is a record of data processing activities which will be maintained and updated  by the Information Governance Team. 

Data Protection Act 2018  

The Data Protection Act 2018 will make provision for the processing of personal data and states that  “most processing of personal data is subject to the GDPR”. 

Data Protection Act 2018 Principles:- 

Principle 1 – Processing of personal data must be (a) lawful and (b) fair and transparent. 

Principle 2 – (a) the purpose for which personal data is collected on any occasion must be specified,  explicit and legitimate, and (b) personal data so collected must not be processed in a manner that is  incompatible with the purpose for which it is collected  

Principle 3 – Personal data must be adequate relevant and not excessive in relation to the purpose for  which it is processed 

Principle 4 – Personal data undergoing processing must be accurate and where necessary kept up to  date  

Principle 5 – Personal data must be kept for no longer than is necessary for the purpose for which it  processed  

Principle 6 – Personal data must be processed in a manner that includes taking appropriate security  measures as regards risks that arise from processing personal data  

Definition of Personal Data  

The definition of personal data under Article 4 of the General Data Protection Regulation is defined  as follows:- 

“personal data” means any information relating to an identified or identifiable natural person (“data  subject”); an identifiable natural person is one who can be identified directly or indirectly in  particular by reference to an identifier such as a name an identification number location data an  online identifier or to one or more factors specific to the physical, physiological, genetic, mental,  economic, cultural, or social identity of that natural person. 

The definition of sensitive personal data is as follows under Article 9 with regards the processing of  special categories of personal data:- 

Processing of personal data revealing racial or ethnic origin, political opinions, religious or  philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data  for the purpose of uniquely identifying a natural person, data concerning health or data concerning a  natural persons sex life or sexual orientation shall be prohibited. 

Caldicott Principles  

• Justify the Purpose  
• Don’t use personal confidential data unless it is absolutely necessary  
• Use the minimum necessary personal confidential data 
• Access to personal confidential data should be on a strict need to know basis  ∙ Everyone with access to personal confidential data should be aware of their responsibilities  ∙ Understand and comply with the law  

The duty to share information can be important as the duty to protect patient confidentiality.

Common Law Duty of Confidentiality 

The Common Law Duty of Confidentiality prohibits use and disclosure of information, provided in  confidence unless there is a statutory court order or requirement to do so. This duty is not absolute  but should only be overridden if the holder of the information can justify disclosure as being in the  public interest for example to protect the vital interests of the data subjects or another person or for  the prevention or detection of a serious crime.  

Confidentiality and Data Protection  

QE Facilities will:- 

Regard all personal identifiable data relating to patients, staff and business clients as confidential and  will treat it with the respect it deserves by implementing an appropriate framework to achieve,  monitor and maintain practice unless national policy on accountability and openness dictates  otherwise; 

Ensure that staff who have a legitimate right of access as part of their duties are given authorisation  to confidential information. Unauthorised access to personal data, regardless of format i.e. electronic  or paper, will be considered a breach of the Data Protection Act and will invoke staff disciplinary  procedures, where this has been breached; 

Ensure staff only share information where it is appropriate to do so and where the transmission is  secure and provides safe and effective care to individuals; 

Only use only personal identifiable data where it is necessary for a specific purpose. The need for  patients to be identified will be considered at each stage of satisfying the purpose(s). All who work  for QEF will observe their own behaviour and the following standards of this Policy . Such obligations  to confidentiality will include but not limited to:- 

• Not gossiping or uploading confidential statements or posts involving staff, patients and  suppliers onto social media, blogs or forum websites without consent etc
• Not making inaccurate libellous, defamatory, harassment, threatening statements that may  otherwise be illegal or which could bring QEF into disrepute
• Not leaving systems logged on so that other staff members can access IT systems. All logins  will be locked down or closed down when not in active use
• Not leaving storage areas/rooms unlocked or not conforming to health and safety  requirements for flood, theft, fire and environmental damage
• Ensuring computer screens and whiteboards that contain personal confidential data (PCD)  are not visible in public areas, especially in reception areas
• Not using personal data for secondary purposes for e.g. research and development  purposes without consent
• Adhering to QEF wide and local procedures.
  
  This covering but not limited to:-
  
• The Caldicott Safe haven procedure for guidance on the transfer of personal data using fax machines, emails, and post (internal and external)
• The protocol for dealing with telephone calls and leaving messages on patients/employees mobiles and answer machines 
• The destruction and disposal of confidential waste/removable media; 
• The use of NHSnet mail for emailing patient or personal identifiable data to external  agencies
• The restrictions on access to secure areas
• The protocol for transferring and signing in and out personal/patient information

Policy 

Breaches of Confidentiality 

All breaches of confidentiality must be reported via the Trusts DATIX reporting system and will be  investigated to determine the seriousness of the breach and any associated action that is required.  Incidents can include but are not limited to:- 

• Unlawful disclosure of personal or sensitive data ; 
• Inappropriate direct access healthcare or personal information relating to individuals where  there is no direct care relation e.g. friends, family, acquaintances, celebrities; • Sharing of passwords and smartcards where the person has not been given authorised  access; 
• The accidental disclosure of staff or patient information to third parties.

New Systems, Processes and Services  

Before procurement or development of new systems/processes/services staff should refer to the  Information Governance Policy for new Systems and changes to existing Systems which details a  three stage approach. This includes:- 

• Initial screening questions for a Privacy Impact Assessment (PIA) and the completion of a full  where required  
• New systems and service providers should complete the screening questions as appropriate  (additional screening questions for IT systems) 
• All organisations who have access to QE Facilities data must sign up to the relevant terms  and conditions required as a data processor under UK Data Protection legislation.  

IT Security 

Gateshead Health NHS Foundation Trust hosts the network and server architecture on behalf of  QE Facilities. The Trust will ensure that it meets the required standard in the Data Security and  Protection Toolkit which encompasses Cyber Security elements e.g. Patching, Anti-Virus and  Malware Protection. The Trusts approach to cyber security is further detailed in their IT and  Information Security Policy. 

IT/Systems Testing 

The use of personal identifiable data will be avoided for system testing. Where there is no practical  alternative to using live data sign off will be required by the SIRO.  

Training 

All staff are required to undertake annual Information Governance Training which will encompass the  key requirements including Data Protection and the Common Law Duty of Confidentiality.

Equality and Diversity 

QE Facilities is committed to ensuring that, as far as is reasonably practicable, the way we provide  services to the public and the way we treat staff reflects their individual needs and does not  unlawfully discriminate against individuals or groups on the grounds of any protected characteristic  (Equality Act 2010). This policy aims to uphold the right of all staff to be treated fairly and  consistently and adopts a human rights approach. This policy has been appropriately assessed. 

An equality analysis has been undertaken for this policy, in accordance with the Equality Act  (2010).”

Monitoring and Compliance 

Compliance with this Policy will be undertaken by the Information Governance Lead in the following  manner:- 

Disclosures with Respect to the Law  

Permitted Disclosures 

There may be occasions when QEF is bound to make a disclosure without consent.  Information disclosures made under statue include:- 

• Poisonings and serious accidents in the work place
• Serious road traffic accidents
• The prevention/detection of a serious crime i.e. terrorism, murder, GBH etc

Permitted Disclosures without Consent 

Although rare, there may be occasions when patient confidentiality may be overridden following  consultation with either senior management or a senior clinician lead. This includes but is not limited  to:- 

• There is serious danger to people and the right to patient confidentiality is superseded by the  need to protect others for e.g. there is a serious threat to QEF, to a health care or admin  professional; 
• There is a serious threat to national security or to the local community e.g. terrorism; ∙ There is a legal obligation to make a disclosure in respect of a Court Order or a s29(3) request  in respect of a serious crime, taxation or fraud enquiry by either the Police of a Government  Body e.g. HMRC or DWP; 
• To pursue the discharge of QEF’s regulatory functions (e.g. safety and welfare of people at  work); 
• In other circumstances, based on professional consideration and consultation QEF will always observe the principle of proportionality when serving the public good. 

Disclosures Unrelated to Healthcare or Other Medical / Statutory Purposes 

There are a number of other situations where QEF would be expected to make an information  disclosure without the person’s consent. Such examples include:- 

• Government departments (excluding the Department of Health for Healthcare purposes) e.g.  DWP, HMRC conducting fraud investigations etc
• The Police
• Acting Agents and Solicitors
• Non-statutory investigations, e.g. Members of Parliament 
• The courts, including a coroner’s court, tribunals and enquiries. 

Disclosures for Non-Healthcare Secondary Purposes 

Patient personal data for non-healthcare purposes may be disclosed for: 

• Service evaluations / complaints process

Processing Information  

Data Sharing Agreements 

Any routine sharing of personal/patient information between professional and organisational  boundaries such as the Local Authorities, the Police etc. will be covered by formal data sharing  agreements. The agreement will underpin the formal arrangements and document the detail of what  is to be shared, why, with whom and any other house-keeping arrangements (for e.g. security  controls for data transfer, media interest, the handling of complaints and information requests etc.) 

All data sharing agreements will be reviewed by the IG Manager and signed off by QEF’s Caldicott  Guardian and/or SIRO. 

Third Party Contractors 

Any contractors commissioned on behalf of QEF that have access to personal data will be required to  sign formal confidentiality agreements to ensure they have the appropriate security arrangements in  place and do not compromise QEF’s data protection legal requirements.  

Consultation and Review 

This Policy will be reviewed on a two year basis unless subject to legislative or case law changes or  any changes or releases in NHS good practices or where deficiencies of information risks have been  identified following the report of a significant data security incident 

Associated Policies and Documentation 

This Policy is part of a suite of supporting Information Governance related policies that sets out QEF’s  standards for those who work with personal or confidential data on a day to day basis. Further  guidance can be sought from the policies stipulated below:- 

• Freedom of Information Policy  
• Information Security Policy  
• Records Management Policy  
• Subject Access Request Policy  
• Information Governance Policy for new Systems and changes to existing Systems
• Data Protection Procedure  
• Caldicott and Safe Haven Procedure 
• Staff Confidentiality Code of Conduct  

References 

• General Data Protection Regulation  
• Data Protection Act 2018  
• Common law duty of confidentiality 
• Freedom of Information Act 2000  

Information Acts 

• GDPR and Data Protection Act 2018
• Access to Health Records Act 1990 (where not superseded by the Data Protection Act 1998)
• Health and Social Care Act 2012
• The Human Rights Act (HRA) 1998 (Article 8)
• The Access to Health Records (NI) Order 1993
• Freedom of Information Act 2000
• Environmental Information Regulations 2004
• Protection of Freedoms Act 2012
• Public Records Act 1958
• Regulation of Investigatory Powers Act 2000 (& Lawful Business Practice Regulations 2000)
• Common law related to the duty of confidentiality
• Copyright, Designs and Patents Act 1988 (as amended by the Copyright (Computer Programs)  Regulations 1992
• Electronic Communications Act 2000
• Audit & Internal Control Act 1987 

Crime Acts 

• Crime and Disorder Act 1998
• Police and Criminal Evidence Act 1984
• Prevention of Terrorism (Temporary Provisions) Act 1989 & Terrorism Act 2000
• Road Traffic Act 1988
• Coroners and Justice Act 2009
• Public Interest Disclosure Act 1998