Carehome Selection Ltd (trading as CHS Healthcare) (we or us or CHS) are a ‘controller’ for the purposes of the Data Protection Act 2018, General Data Protection Regulation 2016 and other legislation relating to privacy (Data Protection Laws), and we are responsible for, and control the processing of, your personal information as we operate our business as follows:
- Hospital Discharge or Placement Services: this is where we make recommendations about your (or your family member’s) ongoing care options following a referral from a hospital/doctor or if you engage with us on our website, and in both instances you are a self-funded patient; and
- Continuing Healthcare Services: this is where we carry out assessments and reviews of your care needs on behalf of a hospital or clinical commissioning group, including data management for the ongoing provision of continuing healthcare; and
- Trusted Assessor: one of our healthcare professionals carries out an assessment of the patient’s needs to inform either the hospital discharge or continuing healthcare services;
- Marketing: promotion of our services to customers and potential customers who work in provision of health and social care; and
- Enquiries: general enquiries made by potential patients when you contact us.
For all our other services, we act as a ‘processor’, so for information about how your data is used, you should refer to your hospital’s or doctor’s privacy notice.
We take your privacy very seriously and we ask that you read this Privacy Notice carefully as it contains important information on:
- the personal information we collect about you
- what we do with your personal information
- security and retention of personal information
- who your information might be shared with and
- your rights.
Please contact us if you have any questions about this Privacy Notice, the information we hold about you, want to raise any concerns or to exercise any of your rights.
Point of contact: Privacy Team
Registered Office: CHS Healthcare, 1 Wrens Court, 53 Lower Queen Street, Sutton Coldfield, West Midlands, B72 1RT
If you would like this notice in another format (for example: audio, large print, braille) please contact us.
Changes to the Privacy Notice
We may change this Privacy Notice from time to time. You should check this Privacy Notice occasionally to ensure you are aware of how we need to use your information.
We may use your information to protect you and others during the Covid-19 outbreak.
The health and social care system is facing significant pressures due to the Covid-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak.
In the current emergency it has become even more important to share health and care information across relevant organisations. Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. Using this law the Secretary of State may require health organisations such as CHS Healthcare to share confidential patient information to respond to the Covid-19 outbreak. Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data.
During this period of emergency, opt-outs will not generally apply to the data used to support the Covid-19 outbreak, due to the public interest in sharing information (see paragraph below entitled ‘National Data Opt-Outs’). Where data is used and shared under these laws your right to have personal data erased will also not apply.
In order to look after your health and care needs, we may share your confidential patient information including healthcare records with clinical and non-clinical staff in other healthcare providers, for example GP practices, hospitals and NHS 111. We may also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak.
During this period of emergency, we may offer you a consultation via telephone or videoconferencing. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation.
In such circumstances where you tell us you’re experiencing Covid-19 symptoms we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require, and we will ensure that any information collected is treated with the appropriate safeguards.
What information do we collect?
We collect the following categories of information about our patients:
|Basic details||Name, address, email address, NHS number, date of birth, next of kin, etc|
|Contact history||Details of contact we have had with you, for example enquiries on our website, questions you contacted us to answer or recommendations we made to you|
|Medical information||Notes and reports about your health and any relevant assessments by a health professional
Details of diagnosis and treatment given
Information about any allergies or health conditions.
Results of x-rays, scans and laboratory tests.
Relevant information from people who care for you and know you well such as health care professionals and relatives
|Financial information||Details of your income, savings, investments, assets and other financial information relevant to assessments for hospital discharge and placement services|
If we send marketing to you, we collect your name, contact details, job title and organisation for whom your work.
It is essential that your details are accurate and up to date. You can always check that your personal details are correct when we visit you or when you speak to us. Please inform us of any changes to your contact details as soon as possible. This minimises the risk of you not receiving important correspondence or other communications from us.
How we use your personal information
In order to provide our services to you, we need to keep records about you and any advice you receive from us. These records help to ensure that you receive the best possible advice and care.
In general, your records are used to direct, manage and deliver the advice and care that you receive through our services. Under Data Protection Laws, there are specific grounds we have to use to process your data, which we have to tell you about. As we process health data, there are additional grounds that we have to satisfy in order to process this.
|Service||What do we use data for?||Lawful grounds for processing|
|Hospital discharge and placement services||
||Legitimate interest to provide services that assist patients with finding suitable care homes/arranging domiciliary care packages and assist the NHS with patient flow by efficiently discharging patients.
|Continuing healthcare service||Assessing your clinical means to determine funding available for ongoing care and suitable care options.||Legitimate interest to assess patient’s needs and funding available prior to finding suitable care homes and assist the NHS with patient flow by efficiently discharging patients.
Health data: provision of health or social care or treatment.
|Trusted Assessor||Assessing your clinical need for ongoing care||Legitimate interest to assist the NHS with patient flow by efficiently discharging patients to suitable care homes. These assessments are required by the care homes before admitting patients.
Health data: provision of health or social care or treatment.
|Marketing||Providing you with information about our services which may be of interest to you or your organisation||Legitimate interest to promote our services.|
If we were ever subject to a legal claim or needed to exercise our legal rights, we would need to use your information to exercise and defend our legal rights.
Please be aware that you have the right to object to the processing of your data where we process based on our legitimate interests.
If you have given consent to our processing, you can withdraw your consent at any time, but you should be aware that we will not be able to provide our services without knowing your medical history.
Security and retention of information
We take our duty to protect personal information and confidentiality very seriously and we are committed to comply with all relevant legislation and to take all reasonable measures to ensure the confidentiality and security of personal data for which we are responsible, whether computerised or on paper.
The Records Management Code of Practice
The Records Management Code of Practice for Health and Social Care 2020 is a guide for the NHS to use in relation to the practice of managing records. It is relevant to organisations who work within, or under contract to, NHS organisations in England and this includes CHS Healthcare.
The Code is based on current legal requirements more broadly than just Data Protection Laws for all medical records and professional best practice.
How long health records are retained
All patient records are destroyed in accordance with the NHS Records Retention Schedule (which forms part of the Records Management Code of Practice for Health and Social Care 2020), which sets out the appropriate length of time each type of NHS record is retained.
All records are destroyed confidentially once their retention period has expired unless there is a specific reason to retain them e.g. ongoing public inquiries, litigation.
When do we share information about you?
We share information about you with companies who provide business-as-usual services to us to enable us to provide our services, such as hosting of our software and systems, providing IT support and service services. We are responsible for their processing and we have contractual controls in place to ensure that your data is protected. You can contact us at the details at the top of this Privacy Notice for more details on suppliers we use.
Everyone working within CHS and the NHS has a legal duty to keep information about you confidential. Similarly, anyone who receives information from us also has a legal duty to keep it confidential.
Direct Care Purposes
We may need to share some information about you with other organisations involved in your care or advice that we give to you about your care if they have a genuine need for it or we have your permission so we can all work together for your benefit. Therefore, we may also share your information, subject to strict agreement about how it will be used, with:
- NHS Trusts and hospitals that are involved in your care
- NHS Digital and other NHS bodies.
- General Practitioners (GPs).
- Ambulance Services.
- Private Sector Providers
- Voluntary Sector Providers
- Social Care Services
- Education Services.
- Local Authorities.
Indirect Care Purposes
We also use information we hold about you to:
- Review the care and advice that we provide to ensure it is of the highest standard and quality
- Ensure our services can meet your needs in the future
- Investigate your queries, complaints and legal claims
- In rare circumstances where we believe you, or another , is at risk of harm, if we are instructed to do so by a court, in connection with a crime, or where required to do so for public health reasons e.g. infectious diseases
Nationally there are strict controls on how your information is used for these purposes. These control whether your information has to be de-identified first and with whom we may share identifiable information. You can find out more about these purposes, which are also known as secondary uses, on the NHS England and NHS Digital’s websites:
You have the following rights under the Data Protection Laws:
- the right of access to your personal data;
- the right to correct any mistakes in your information;
- the right to ask us to stop contacting you with direct marketing;
- the right to object to processing where it is based on our legitimate interests;
- the right to restrict or prevent your personal data being processed;
- the right to erasure; and
- The right to withdraw consent
These rights are explained in more detail below. If you want to exercise any of your rights or if you have any comments, concerns or complaints about our use of your personal data, please contact us at the details set out at the top of this Privacy Notice. We will respond to any rights that you exercise within a month of receiving your request, unless the request is particularly complex, in which case we will respond within three months.
Right to access your personal data
You may ask to see what personal data we hold about you and be provided with:
- a copy;
- details of the purpose for which it is being or is to be processed;
- details of the recipients or classes of recipients to whom it is or may be disclosed, including if they are overseas and what protections are used for those oversea transfers;
- the period for which it is held (or the criteria we use to determine how long it is held);
- any information available about the source of that data; and
- whether we carry out an automated decision-making, or profiling, and where we do information about the logic involved and the envisaged outcome or consequences of that decision or profiling.
To help us find the information easily, please give us as much information as possible about the type of information you would like to see and provide evidence of your identity e.g. copy of passport or driving licence.
Right to correct any mistakes in your information
You can require us to correct any mistakes in your information which we hold free of charge. If you would like to do this, please let us have enough information to identify you and let us know the information that is incorrect and what it should be replaced with.
Right to ask us to stop contacting you with direct marketing
You can ask us to stop contacting you for direct marketing purposes. If you would like to do this, please contact Wendy Hawkins, Executive Assistant on 0121 362 8844 or you can also click on the ‘unsubscribe’ button at the bottom of the email newsletter. It may take up to 14 days for this to take place.
Right to object to processing where it is based on our legitimate interests
You may object to us processing your personal data where we rely on a legitimate interest as our legal grounds for processing. If you object to us processing your personal data we must demonstrate compelling grounds for continuing to do so. We believe we have demonstrated compelling grounds in the section headed “How we use your personal information”. The key point to note is that much of the processing under this heading is beneficial to you, so we can find a care home suitable for your needs or assess your financial situation for funding to assist with your care.
Right to prevent processing of personal data
You may request that we stop processing your personal data temporarily if:
- You do not think that your data is accurate. We will start processing again once we have checked whether or not it is accurate;
- the processing is unlawful but you do not want us to erase your data;
- we no longer needs the personal data for our processing, but you need the data to establish, exercise or defend legal claims; or
- you have objected to processing because you believe that your interests should override our legitimate interests.
Right to erasure
You can ask us to erase your personal data where:
- you do not believe that we need your data in order to process it for the purposes set out in this privacy notice;
- if you had given us consent to process your data, you withdraw that consent and we cannot otherwise legally process your data;
- you object to our processing and we do not have any legitimate interests that mean we can continue to process your data; or
- your data has been processed unlawfully or have not been erased when it should have been.
Right to withdraw consent
A key element of consent is that you can withdraw it. If you want to withdraw your consent, please contact us at the details at the top of this Privacy Notice,
The possible consequences of refusing consent will be fully explained to you at the time, and could include delays in receiving our advice or care.What will happen if your rights are breached?
You may be entitled to compensation for damage caused if we do not comply with the Data Protection Laws.
Complaints to the regulator
It is important that you ensure you have read this Privacy Notice – and if you do not think that we have processed your data in accordance with this notice – you should let us know as soon as possible. Similarly, you may complain to the Information Commissioner’s Office. Information about how to do this is available on his website at www.ico.org.uk.
National Data Opt Out
Your records contain confidential information, which can be used to help with research and planning. If you would like this to stop, you can opt out of this yourself or on behalf of someone else.
If you choose not to allow your confidential patient information to be used for research and planning, your data may still be used in some situations.
- When required by law
Your confidential patient information may still be used when there is a legal requirement to provide it, such as a court order.
- When you have given consent
Your confidential patient information may still be used when you have given your consent. Such as, for a medical research study.
- Where there is overriding public interest
Your confidential patient information may still be used in an emergency or in situations where there is an overriding benefit to others. For example, to help manage contagious diseases and stop them spreading, like meningitis. In these situations, the safety of others is most important.
- When information that can identify you is removed
Information about your health care or treatment may still be used in research and planning if the information that can identify you is removed first.
- Where there is a specific exclusion
Your choice does not apply to a small number of specific exclusions. In these cases, your confidential patient information may still be used at any time. For example, when information is used to collect official national statistics, like the Population Census.
To find out more visit: nhs.uk/your-nhs-data-matters