How we protect your personal information Privacy (fair processing) notice

In October 2020, The Royal Bournemouth and Christchurch Hospitals NHS Foundation Trust (RBCH) and Poole Hospital NHS Foundation Trust (PHFT) merged to become University Hospitals Dorset NHS Foundation Trust (UHD). All records from RBCH and PHFT are now held and controlled by UHD.

We are governed and monitored by a number of different organisations, including:

• NHS England and NHS Improvement;
• The Information Commissioner’s Office;
• Care Quality Commission;
• Department of Health;
• NHS Digital;

Our doctors, nurses and healthcare professionals are also regulated and governed by professional bodies and Royal Colleges.

Medical care

Within the hospitals, your personal and medical information is held electronically on secure IT systems, and in some cases, in paper files within a secure records library.

We record the information about you and your health in order to provide all aspects of your care and treatment as a patient of the hospitals. Medical information may also be used, where necessary, to plan and manage the services provided to you by the hospitals.

This is limited only to the information that we need, and every care is taken to keep information about you secure and confidential.

Outpatients portal

The UHD Outpatients Portal is a secure online information and communication resource for patients under the care of the vast majority of UHD's specialist services.

By using this portal, you will be able to:

• receive appointment reminders by text message via your mobile phone
• view appointment letters digitally
• view clinic information about your upcoming appointment
• add your appointment to your personal calendar on your device, and
• view all upcoming appointment details and letters in one place.

Patients due to attend an outpatient appointment will receive a text message from +44 7860 039092 which will include their appointment reminder and a link to access the portal. To access the portal, patients will simply need to confirm some demographic details or use their existing NHS log in details, if known. For younger patients, the message will be sent to their existing primary contact, usually a parent or carer.

Further information is available here: https://www.uhd.nhs.uk/news/latest-news-list/1753-new-way-for-patients-to-connect-with-their-care-is-coming

Local clinical audit

As part of providing your care and treatment, your information may also be used for the assurance of safe and high quality care and treatment through local audits, carried out by the doctors involved with your care. These reviews are carried out under the approval of the Trust's Chief Medical Officer, and no personal details are released as a result of this work unless you have given your permission for this.

National clinical audits and registers

In some cases, NHS organisations are mandated to submit information about patients to national clinical audits or registers. Examples include the National Joint Registry and National Vascular Registry. This enables practice to be monitored on a national level, as well as enabling the review of patient outcomes in order to improve the care provided. This information is only shared with legal approval from the Department of Health and Social Care and the Secretary of State for Health. You have the right to opt out of being included in any such registers or national audits. Please see the section “Your rights”, below.

Incident management

If you are involved in an incident, for example if you slip or fall while in the hospitals, your information will be included in the incident report and used as part of the investigation process.

Research and teaching

UHD participates in various medical research studies, and you may be asked to participate in these. While always preserving confidentiality, your records can also help us with teaching and training. Any reports or papers resulting from this work will not identify named individuals or contain any information that could lead to you being identified unless you give your permission.

Complaints and queries

If you raise a complaint or a query with the hospitals’ Complaints or Patient Advice and Liaison Service (PALS), or Patient Experience team, the relevant team will hold information about you within their secure database in order to ensure your complaint or query is answered appropriately by the relevant person or department. Details of complaints or queries will not be stored within your medical records.

CCTV

UHD uses CCTV in order to protect its staff and patients, as well as to protect its sites and NHS property. CCTV footage will be used for the prevention and detection of crime. In some areas, body-worn cameras are used to supplement static CCTV.

Video consultations

UHD is offering secure video consultations to some patients, where appropriate. The information collected and used for this service is the same as described above under “Medical care”. For more information please visit our website.

Telephone calls

Some departments within UHD record telephone calls for the purposes of staff training and quality monitoring.

Car parking

Car parks are managed by CP Plus on behalf of the Trust. For information about how CP Plus collect and use personal information, please visit http://cp-plus.co.uk/policies/ or telephone 020 7431 4001.

Other contexts

We may hold limited information about you if you have provided it to us outside of the above situations; for example if you have attended an event run by UHD or completed a feedback survey. This information will only be used for the purposes for which it was collected.

We know that good communication with other healthcare professionals involved with your care is beneficial for you, and so we work closely with many organisations in order to provide you with the best possible care. This means that if another healthcare professional or service is involved in your care, it might be appropriate for us to share information with them in order that you can receive the required care.

Sharing information within the hospitals

Your information will be shared between those involved in providing care to you. This includes doctors and nurses, but may also include administrative staff who deal with booking appointments or managing hospital services.

Access to information is strictly controlled and restricted to those who need it in order to do their jobs. All Trust staff receive annual training on confidentiality and have strict clauses within their employment contracts, which oblige them to respect Data Protection law and your right to confidentiality.

Sharing information outside the hospitals

There may be occasions when we need to share information with other NHS organisations as part of your care and treatment. After your treatment we write to your GP (family doctor) or whoever referred you to us to let them know the outcome. We will also share information about you with other NHS organisations if you have received unplanned treatment from us, such as in an Emergency.

We may also need to share information about you with organisations outside of the NHS, such as social services or organisations providing medical equipment, in order for you to continue receiving care and support after you leave hospital.

Some departments within the Trust outsource aspects of your care to specialist third party organisations, in order to expedite your care and treatment and to help reduce waiting times. These organisations are employed under contracts with strict confidentiality and information handling clauses. Only the minimum necessary information is ever shared with third parties.

Dorset Care Record

UHD contributes to the Dorset Care Record (DCR), which is an electronic record linking health and social care information from Dorset General Practices (doctors’ surgeries), Bournemouth, Christchurch and Poole Council, Dorset County Council, University Hospitals Dorset NHS Foundation Trust, Dorset County Hospital NHS Foundation Trust, Dorset HealthCare University NHS Foundation Trust, and NHS Dorset, to improve care in Dorset.

The DCR brings together records from all of these organisations to provide a single overall picture of your health and wellbeing, which is then accessible to the agencies that you are involved with.

For further information on the DCR, please contact your GP (family doctor) or see the following website: https://news.dorsetforyou.gov.uk/dorset-care-record/

GP records

After your treatment we write to your GP (family doctor) or whoever referred you to us to let them know the outcome. If you would like a copy of this correspondence then please ask.

In some cases, it might be helpful for designated hospital staff to check your GP records, for example to check what medicines you are taking or to see if you have any allergies. These records will only be viewed with your explicit permission (except in an emergency where it is not possible to discuss this with you first), in accordance with the preferences that you have set with your GP. If you have chosen for nobody other than your GP to be able to view the records that they hold, hospital staff will not be able to see these.

Care and Health Information Exchange (CHIE) – formerly Hampshire Health Record

If you are registered with a GP (family doctor) in Hampshire, and you have opted in to having a record within the CHIE, UHD will share copies of discharge letters directly to the CHIE. If you have opted out of having a record with the CHIE, your information will still be shared with your GP via other means.

For further information on the CHIE, please contact your GP (family doctor) or see the following website: https://careandhealthinformationexchange.org.uk/

Third party organisations

UHD works closely with third party organisations to provide some of its specialist and support services, such as providing appointment reminders to patients, or providing online video consultations. These organisations are employed under contracts with strict confidentiality and information handling clauses. Only the minimum necessary information is ever shared with third parties.

In some very rare cases we may need to share information about you with companies outside of Europe, for example where highly specialised, bespoke medical devices or components are being manufactured overseas. Wherever possible this information will not include your name, address or contact information and will be strictly limited to the information that is necessary for the service being provided. Your doctor will discuss this with you before any information is shared.

Overseas patients

If you usually live outside of the United Kingdom, we will share information about you with the relevant government agencies in order to establish whether you are entitled to NHS treatment. We may also share information about your care with your insurance company or with organisations within your country of residence for the purpose of recovering the cost of your care.

Legal disclosures

Sometimes the law requires that we must disclose or report certain information without needing to seek your permission, such as for the investigation of serious crime, child abuse or infectious diseases that may endanger the safety of others. That is only done after formal authorisation from a qualified health professional, or an official request from the Courts.

We may share information about you in order to participate in important national audits and disease registries. Wherever possible this will be shared in an anonymous format that cannot identify you. However in some cases legal authorisation is granted by the Secretary of State for Health and Social Care for NHS organisations to use identifiable information without the need for permission. Details of these audits are published on the Trust’s website within the annual Quality Report, or further information can be provided by your consultant.

Unless there is a legal reason to do so, we will not disclose your information to third parties without your permission.

You have the right to request that your confidential information is not used beyond your own care and treatment by refusing or withdrawing your permission to information sharing at any time. If you choose to prohibit your information from being disclosed to other health professionals involved in providing care, it might mean that the care that can be provided is limited and, in extremely rare circumstances, that it is not possible to offer certain treatment options. More information can be found in the “Your rights” section below.

UHD will keep information for the amount of time required as set out in the NHS Records Management Code of Practice 2021. For most hospital records this is 8 years, however some records, such as records of cancer treatment, may need to be kept for longer.

Further details regarding retention periods can be found here: https://www.nhsx.nhs.uk/information-governance/guidance/records-management-code/

You have the right to:

• restrict or object to the use of your information in certain circumstances
• ask us for a copy of information held about you, including your medical records
• ensure that we hold accurate information about you by asking for errors to be corrected
• withhold or withdraw your permission to use and share information in certain circumstances
• raise a complaint with the UK data protection regulator, the Information Commissioner’s Office (ICO)

To make a request for copies of your records, please see “Accessing your information” section (below). For queries about other rights, please contact the Data Protection Officer in the first instance (see “Contact Us” section).

The national data opt-out

As explained in this notice, your information will primarily be used for providing care and treatment. However it is sometimes useful for the NHS to use this information for other purposes beyond this; for example, to research new treatments, decide where to put GP clinics and plan for the number of doctors and nurses in local hospitals.

You can choose whether your confidential patient information is used for these purposes beyond your care and treatment, and may opt out if you wish. This will not affect the care or treatment that you receive, and you will also be able to participate in individual research trials if you wish.

The national data opt-out is managed centrally by NHS Digital. You can set or change your opt-out preference at any time. For more information, visit https://www.nhs.uk/your-nhs-data-matters, or telephone 0300 303 5678.

You have the right to know what information is held about you and you can apply to access your medical records by contacting the Medico/Legal Department.

Guidance can be found here: UHD Requesting Access to Information - Guidance

Please note that whilst some records systems are shared, the majority of records will be held at the hospital where you received treatment. To access your records, please contact the relevant hospital as detailed below. You may use the application forms below to ensure that you provide the information needed to locate your information.

For records from Royal Bournemouth Hospital or Christchurch Hospital:

Medico/Legal Department – Stour Building
Royal Bournemouth Hospital
Castle Lane East
Bournemouth
Dorset
BH7 7DW

By email: This email address is being protected from spambots. You need JavaScript enabled to view it.

By telephone: 0300 019 4742

For records from Poole Hospital:

Medico/Legal Department (Medical Records)
Poole Hospital
Longfleet Road
Poole
Dorset
BH15 2JB

By email: This email address is being protected from spambots. You need JavaScript enabled to view it.

By telephone: 0300 019 8311

• Application for Access to Information

You can also write directly to the Data Protection Officer (see “Contact Us” section).

The Data Protection Act and General Data Protection Regulation sets out the rules for protecting personal information held on computer systems, on paper and in other formats, which we must follow.

UHD is registered with the Information Commissioner’s Office (ICO) as a data controller. The registration number is ZA784218.

UHD must have a legal reason (known as a “lawful basis”) to hold and use your information. We are legally allowed to hold and use personal information in the exercise of official authority – that is, so the hospital can provide NHS services to you in its role as a public sector organisation. Additionally, UHD is legally allowed to hold and use sensitive information about your medical history and treatment for the purposes of providing you with direct medical care and managing healthcare services, and to protect your vital interests. Certain medical information is used for the purposes of the protection of public health, such as for notification of infectious diseases.

If you are dissatisfied with the handling of your personal information, you have the right to make a complaint. In the first instance, formal complaints should be addressed to:

Complaints Department
University Hospitals Dorset NHS Foundation Trust
Poole Hospital
Longfleet Road
Poole
Dorset
BH15 2JB
This email address is being protected from spambots. You need JavaScript enabled to view it.
0300 019 8499

You also have the right to make a complaint directly to the Information Commissioner – the UK's independent body set up to uphold information rights. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
https://ico.org.uk/global/contact-us/

If you have any questions about this notice or about how your information is used, you can contact us.

Please write to:
Data Protection Officer
University Hospitals Dorset NHS Foundation Trust
Poole Hospital
Longfleet Road
Poole
Dorset
BH15 2JB
Email: This email address is being protected from spambots. You need JavaScript enabled to view it.
Telephone: 01202 303626