Patients and Patient Representatives Privacy Notice
We are committed to protecting and respecting your privacy as a patient or family member or carer of the patient.
WHO WE ARE
St Michael’s Hospice supports people across North Hampshire who have a life-limiting illness, are facing the end of life or experiencing bereavement.
St. Michael’s Hospice (North Hampshire) is a charity, registered in England and Wales (charity number 1002856) and a Company Limited by Guarantee, registered in England and Wales (company number 02588395), whose registered office is Basil de Ferranti House, Aldermaston Road, Basingstoke, RG24 9NB.
DATA PROTECTION
We care about your personal data and ensuring that you are informed about how we use it. St. Michael’s Hospice promises to protect your data, and to manage any information you share with us in line with data protection laws.
St. Michael’s Hospice processes your personal data in accordance with the legal requirements set out in the following Data Protection legislation:
- Data Protection Act 2018 (DPA2018)
- UK General Data Protection Regulations (UK GDPR)
- Privacy and Electronic Communication Regulations (PECR)
This Privacy Policy sets out how and why St. Michael’s Hospice will collect and use your personal data in line with the above legislation, to ensure you remain informed and in control of your information.
Please read this privacy notice carefully, along with our Terms and Conditions and any other documents referred to in this notice, to understand how we collect, use and store your personal information.
If you have any questions about how St. Michael’s Hospice processes your information, please get in touch using the details in the Contact us section.
WHY WE PROCESS INFORMATION ABOUT YOU
In order to support your care, health professionals maintain records about you. We take great care to ensure your information is kept securely, that it is up-to-date, accurate and used appropriately. All of our Hospice staff are fully trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to. They will only look at what they need to in order to do things like arrange to visit you, give palliative care advice, provide you with care and, if necessary, refer you on to other services.
Your care will sometimes be discussed with colleagues within the service to ensure that your care is co-ordinated and/or to obtain further advice from other team members (e.g. doctors, occupational therapists, pharmacists, physiotherapists, psychologists, nurse specialists, dieticians, chaplains, social workers, patient equipment and transport services etc).
We have a small number of highly skilled volunteers who may be involved in processing your data in order to deliver care and support, for example, in Bereavement Support, Chaplaincy and Complementary Therapy. We always ensure that these volunteers receive appropriate training, supervision, support and audit.
WHAT IS OUR LEGAL BASIS FOR COLLECTING YOUR DATA?
We will process your data when:
- When we have your consent to use your information
- When it is necessary for compliance with a legal obligation to which we are subject (for example a change in the law)
- When there is a legitimate interest to do so – for example, in order to fulfil our duty of care to you
- When it is in the public interest to do so (for example, a notification of infectious diseases (NOID) that need to be reported to the Local Authority health protection team)
- Where data disclosure may be required by law, for example to government bodies and law enforcement agencies
SPECIAL CATEGORY DATA
We may process sensitive personal data which includes racial or ethnic origin; sexual orientation; political opinions; religious or philosophical beliefs and data concerning your health.
The primary additional basis for processing that we rely on is Article 9(2)(h) where the processing is for the purposes of preventive or occupational medicine, for the assessment of the working capacity of an employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services based on legislation or pursuant to contract with a health professional.
The relevant basis in UK law is set out in the Data Protection Act (DPA) 2018, in Schedule 1 condition 2.
Article 9(3) of the UK GDPR contains the additional safeguard that the Hospice can only rely on this condition if the personal data is being processed by (or under the responsibility of) a professional who is subject to an obligation of professional secrecy.
Section 11 of the DPA 2018 makes it clear that in the UK this includes:
- (a) a health professional or a social work professional; or
- (b) another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.
Article 9(2)(f) permits us to process special category data where the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
Article 9(2)(c) permits us to process special category data where the processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent.
Article 9(2)(g) permits us to process special category data where the processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The relevant basis in UK law is set out in section 10(3) of the DPA 2018. This means that we should also meet one of the 23 specific substantial public interest conditions set out in Schedule 1 (at paragraphs 6 to 28).
Subject to the conditions and safeguards and Schedule 1 of the Data Protection Act 2018, the Hospice relies on (6) our statutory purposes as a healthcare provider, (16) where we support individuals with a particular disability or medical condition, (17) for our Counselling services and (18) where we need to safeguard children and individuals at risk.
INFORMATION ABOUT YOUR FAMILY MEMBERS, CARERS AND OTHERS THAT YOU IDENTIFY AS IMPORTANT TO YOU
We record names and contact details about your family members, carers and others that you identify as important to you in order to:
- Keep them informed of changes in your situation (unless you ask us not to)
- Ensure they are involved in planning that might affect them as well as you (e.g. if we were arranging for health or other professionals to visit you at home, or for equipment to be delivered)
- Offer support, including emotional and psychological support, if needed
- Where Next of Kin or family details are provided within clinical services, this information will be shared with our Fundraising team to enable invitations to memorial events to be sent to loved ones.
- Offer bereavement support if you were to die.
WHAT INFORMATION DO WE HOLD ABOUT YOU
We use a combination of electronic and paper records and working practices and technology to ensure that your information is kept confidential and secure. Records which the Hospice hold about you may include the following information:
- Your age, contact details and next of kin
- Your racial or ethnic origin, sexual orientation, and religious or philosophical beliefs
- Details of your referrals, appointments, telephone calls, clinic visits etc.
- Records about your symptoms and concerns, illnesses, medications, treatment and care
- Results of investigations, such as laboratory tests, x-rays, etc.
- Information from other health professionals, relatives or those who care for you.
- We may also take photographic images of you for medical purposes, with your prior consent, such as in the case of pressure ulcers. These will be processed only to assist in your care.
CCTV SYSTEM
We operate a Closed-Circuit Television (CCTV) surveillance system throughout the hospice premises with images being monitored and recorded. The system is owned, operated and managed by St Michael’s Hospice. It is used for maintaining public safety, the security of property and premises and for the detection, prevention and investigating of crime.
Disclosure of recorded material will only be made to third parties in accordance with the purposes of the system and in compliance with Data Protection legislation.
WHERE DO WE GET INFORMATION ABOUT YOU FROM
In additional to the information that you, your family and any carers give to us, we often obtain information from:
- The health professional referring you to our service such as your GP
- Records of investigations (e.g. imaging, biopsy and blood results), clinic letters and discharge summaries available electronically from local and mainland hospitals via their secure electronic information systems
- Other professionals already involved in, or who can give help and advice about, your care.
PATIENT DATA SHARING
SHARING INFORMATION WITHIN ST MICHAEL’S HOSPICE
Members of the hospice team looking after you may share your personal information with each other, for example, details about you and your family’s contact details, and notes and reports about your health and the care you need. This team may include nurses, doctors, therapists, pharmacists and clerical support staff plus students and trainees in medicine or other health and social care professionals who are looking after you.
SHARING INFORMATION OUTSIDE ST MICHAEL’S HOSPICE
Often it is necessary to share your information with professionals in other services who may be directly involved with your care or if you need treatment elsewhere. This helps provide seamless care amongst partner organisations providing care to you. Such professionals might, for example, include:
- Your GP Practice
- Acute Hospital Trusts
- Community Nurses
- Ambulance Services
- Integrated Care Board
- Social Care Services
- Fire and Rescue Services
- Police and Judicial Services
- Local Authorities
- Voluntary Sector providers such a patient groups or health charities
- Private Sector providers
- Funeral Directors
In most circumstances you will be informed who your data will be shared with and in some cases asked for explicit consent for this to happen.
HOW WE USE THE DATA WE COLLECT ABOUT YOU
We use your personal data for a number of purposes including the following:
- Information relating to diagnosis, treatment and care will be shared across our multi-disciplinary hospice and hospital teams to ensure all our healthcare professionals are updated for continuing care.
- Advising patient representatives (keeping in touch).
- If appropriate, information will be shared with external healthcare professionals such as GP’s, Hospitals and other involved health care professionals, such as our contracted Pharmacy.
- For medical research and educational purposes.
- On exceptional occasions, disclosing your data may be required by law, for example to government bodies and law enforcement agencies.
Rest assured, we never share, sell, swap or rent your data to third parties for marketing purposes.
DATA STORAGE
Like all healthcare providers, the Hospice uses an electronic clinical records programme to store your personal information. We also hold a small amount of information on paper (e.g. medication prescriptions, summaries of care and information required in the event of an electrical failure etc. when the electronic system cannot be accessed).
We have up-to-date security software and regularly review our procedures and technical measures to protect your data. Your data will be kept in a secure environment with access restricted on a need-to-know basis.
We don’t keep your data for longer than is necessary for the purpose for which it is obtained, in accordance with our internal policies. If you require any further information, please contact the Data Protection Officer at the address provided at the end of this privacy notice.
TRANSFERRING YOUR DATA OUTSIDE THE UK
Personal data will not be transferred to a country or territory outside the UK unless there is a specific operational or medical reason to do so, in which circumstance we are obliged to ensure that the country concerned ensures an equal level of data security/protection and confidentiality procedures (i.e. compliant with the UK General Data Protection Regulation) for your rights and freedoms, in relation to the processing and storage of personal data.
HOW WE LOOK AFTER YOUR DATA
We never use clinical data for educational or research purposes without encrypting or anonymising so that no recognisable personal information is released.
This privacy notice is reinforced with our internal policies such as Confidentiality and Information Governance.
We are committed to protecting your privacy and will only use personal data that we collect lawfully, in line with all current applicable data protection laws and regulations. Our compliance is mandatory and governed by the Information Commissioners Office (details on request).
To monitor the protection of Data we have an appointed Caldicott Guardian who is a senior person responsible for ensuring the confidentiality of patient and service-user information.
In addition, we have a Data Protection Officer who advises on all matters concerning data and its securities.
The Hospice participates and contributes to efforts by the NHS to use your information in an anonymous and safe way to:
- protect the health of the public
- help us anticipate, plan and provide care
- audit, review, monitor and evaluate the quality of services provided.
Information used for these purposes will not identify you but if you would like further details about this, or if you do not want us to use your information in this way, please contact the Hospice Data Protection Officer at the address provided at the end of this privacy notice.
DATA RETENTION
Records of clinical care often inform future clinical decision making, for example, responses to medication such as allergies and diagnoses that might recur in the future. Therefore, your details will be held on our systems after you have been discharged from the Hospice so that your patient record can be shared across various services in the event that it needs to be accessed by other professionals to ensure decisions about any future treatment are informed.
YOUR DATA PROTECTION RIGHTS
You have certain rights in relation to your personal information, although those rights will not apply in all cases or to all the information that we hold about you. For example, we may need to continue to hold and process information to establish, exercise or defend our legal rights.
You have the right to be informed about how we use the data you provide. We will try to be as transparent as possible in our interactions with you. Any time you give us personal information you have a right to be informed about why we need it and how we will use it. You can find most of the information you need in this Privacy Notice.
You have right of access to any of your personal data that we hold about you. You can contact us at any time to gain information about what data we hold about you and why we hold it.
If you make a formal request, we will acknowledge your request and will first require you to prove your identity. We may also ask you for information about any specific information you are seeking to help us make sure we meet your request fully and speed up the process.
If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.
We will provide you with the information that you are entitled to as soon as possible and without unreasonable delay and at the latest within one month of your identity being verified by us.
In exceptional cases, we may extend the period of compliance by a further two months if the request(s) are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.
Please note that there is normally a charge for administration costs.
You have the right to have any personal data we hold corrected at any time if you believe it to be inaccurate, e.g. the spelling of your name or your contact information.
You also have the right to ask for our processing of your personal data to be restricted. For example, if you are contesting the accuracy of data we are using about you. In such case we will restrict our processing while we verify the accuracy of the data that we hold.
You can also ask for certain information about you to be deleted. For example, if you are moving out of the area.
In certain cases, we will be unable to delete your information if there are statutory grounds to retain it (i.e. HMRC or other legal requirements).
You have the right to data portability where processing is automated, although we don’t currently carry out any such processing. If we do in future, you can make a request for this data to be exported from our systems for you.
You have the right to ask us not to process your personal data for marketing or profiling purposes.
You can exercise your right to prevent such processing by checking certain boxes on the forms we use to collect your data. You can also exercise the right at any time by contacting either the Information Governance Lead or our Caldicott Guardian:
Email: Caldicott.Guardian@stmichaelshospice.org.uk
Post: Caldicott Guardian, St. Michael’s Hospice, Basil de Ferranti House, Aldermaston Road, Basingstoke, RG24 9NB
To help us keep your personal information accurate and up to date, please tell us about any changes by writing to:
For personal data rights requests and data protection complaints and queries:
Data Protection Officer:
Phone: 01256 844744
Email: dpo@stmichaelshospice.org.uk
Post: Data Protection Officer, St. Michael’s Hospice, Basil de Ferranti House, Aldermaston Road, Basingstoke, RG24 9NB
NOTIFICATION OF CHANGES TO THIS PRIVACY POLICY
This Privacy Policy may change from time to time. For example, we will continue to update it to reflect new legal requirements. Please visit this website page to keep up to date with the changes to our Privacy Policy.
