Health regulation
Purpose
The Care Quality Commission (CQC) is an organisation established in law by the Health and Social Care Act 2012. The CQC is the regulator for English health and social care services to ensure that safe care is provided. They inspect and produce reports on all trust in England. The law allows CQC to access identifiable patient data as well as requiring the trust to share certain types of data with them in certain circumstances, for instance following a significant safety incident.
For more information about the CQC see: www.cqc.org.uk
Information we collect
We do not collect any additional personal data for this purpose, but may share any or all of the information we have collected as part of the ‘Routine direct care’ and ‘emergency direct care’ sections of this privacy notice.
Our lawful basis
In order to legally be able to legally share your personal data, we must have a lawful basis under the United Kingdom General Data Protection Regulation. Our lawful basis for the stated purpose is:
UK GDPR
Article 6 (1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject.
Article 9 (2)(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law.
By processing your health data we will also recognise your rights established under English case law, collectively known as the “Common Law Duty of Confidentiality”. This means that we only use your personal data in ways that would reasonably be expected, including where we share your information with your consent or where we can reasonably expect that you would consent in order to provide you with care, or for reasons of substantial public interest.
Who we share your information with
For our stated purpose we will share information with the CQC.
Our processors
The trust does not use additional processors for the sharing of this information.
How long will we keep your data
We will keep your personal data in line with the retention periods detailed in the NHS retention schedule.
Your rights
Data protection laws give you a number of rights over your personal data. These rights are detailed below.
The right to be informed
The trust is required by law to provide you with information about how it collects and uses your personal data. The trust, by way of this privacy notice is providing you with this information.
The right of access
You have the right to access the information we hold about you. You can access some information, such as information from your hospital record, hospital appointments, test results and messages from MyHealth patient portal. You can find out more information on how to do this here. To access any other personal information we hold, please see our guidance on health records or contact the access team at rf-tr.AccessRequests@nhs.net.
The right to rectification
You have the right to have inaccurate information about you corrected or incomplete information completed. This is not that same as disagreeing with a clinical observation or opinion and asking for this to be changed. If you disagree with a clinical opinion you should discuss this with the team who’s care you are under. To update your basic contact details or address, please contact the patient advice and liaison (PALS) team.
To request any other inaccurate information corrected please contact rf-tr.AccessRequests@nhs.net.
The right to erasure
The right to erasure is also known as ‘the right to be forgotten’. The right is not absolute and only applies in certain circumstances. This right does not apply to the sharing of personal data with the CQC as we have a legal obligation to do so.
The right to restrict processing
You have the right to restrict the processing of your personal data in certain circumstances. This means that you can limit the way we use your data. This is an alternative to requesting the erasure of your data. The right is not absolute and only applies in certain circumstances.
This right does not apply to the sharing of personal data with the CQC as we have a legal obligation to do so.
The right to data portability
The right to data portability does not apply to the processing of your personal data for this purpose.
The right to object
This right does not apply to the sharing of personal data with the CQC as we have a legal obligation to do so.
Rights in relation to automated decision making and profiling
The trust’s clinical staff use tools to help assist in you diagnoses and treatment; However, the results are always reviewed and interpreted by an appropriately trained clinician who will have the final say in your diagnoses and treatment. The trust does not make any solely automated decisions about you.