Why do we collect information about you?
The NHS aims to provide you with the highest quality of health care. To do this we must keep records about you, your health and the care we have provided, or plan to provide to you.
Health records are held on paper and electronically and we have a legal duty to keep these confidential, accurate and secure at all times in line with the Data Protection Bill.
Our staff are trained to handle your information correctly and protect your privacy. We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never collected for direct marketing purposes, and is not sold on to any other third parties. Your information may be processed overseas.
Information is held for specified periods of time as set out in the Records Management Code of Practice for Health and Social Care.
The following information aims to explain:
What information we hold
Why it is required
How it is used
Who it is shared with
What records do we hold?
If you are a patient, we hold records about you which may include:
Basic details such as address, date of birth, next of kin/emergency contact details
Name, address, date of birth. We collect your name, address and date of birth to enable us to send you letters about your care such as appointment letters. Additionally, your name, address and date of birth are used to identify you and distinguish you from other patients. A change of name or incorrect date of birth can result in misidentification.
Telephone numbers. We will collect contact telephone numbers for you which will be used to contact you about your care. We will use any mobile telephone number that you provide us to send a text message reminder of a forthcoming appointment.
If you do not wish for your mobile number to be used in this way, please contact the Information Governance Department.
Next of kin / emergency contact. We collect details of your next of kin as a person you would like to be contacted in an emergency. The person you name as a next of kin has no legal right to any confidential information held by us about you or to make any decisions about your care. An individual who wishes to make a decision about your care must obtain the appropriate legal Power of Attorney. If a patient dies in the hospital, we will contact the patient’s relatives and/or the named next of kin to provide information on the bereavement services managed by the Trust such as a bereavement meeting with an Emergency Department consultant or the annual memorial service. If a named next of kin or patient’s relative does not wish to be contacted in this way, they should inform the member of staff involved with the care of their relative.
Ethnicity. We are legally required to collect your ethnicity to ensure that we provide a fair and open service where all patients receive equal treatment. An individual’s ethnicity can also have a bearing on the type of illnesses an individual is susceptible to. Anonymised information on patient’s illnesses/disease and their ethnicity is passed by us to the Department of Health who share this information with the World Health Organisation to identify patterns in illness or diseases.
Disability or language preferences. This information is collected to enable the Trust to provide care which meets your needs such as accommodating wheelchair users or providing interpreters.
Religion. We offer all patients a Chaplaincy service. Your religion is passed to the Chaplains who run this service to enable them to visit you whilst in hospital to ensure the pastoral and spiritual needs of patients, their families and staff members are adequately supported.
Details about contact the Trust has had with you such as clinical visits
We maintain manual and electronic information about your inpatient and outpatient visits, and visits to the Emergency Department. Details of your outpatient clinic visits, stays in hospital, appointment letters, notes, x-rays, laboratory tests and reports relating to your health and treatment are stored in a manual and electronic record.
Your record is shared with clinical staff providing your care, to ensure consistent, appropriate and safe healthcare is provided to you.
Details and records about your treatment and care
To ensure the treatment and care provided to you by the Trust is appropriate and consistent, details and records about the treatment and care you have been provided will be recorded. This will ensure that there is a full and comprehensive record which is available to all clinical staff who are involved with providing you care and treatment.
We work in partnership with other NHS organisations such as:
Ashford and St Peter’s Hospitals NHS Foundation Trust
Royal Surrey County Hospital NHS Foundation Trust
Hampshire Hospitals NHS Foundation Trust
Oxford University Hospitals NHS Foundation Trust
Royal Berkshire Hospital NHS Foundation Trust
St George’s University Hospitals NHS Foundation Trust
Surrey & Sussex Healthcare NHS Trust
The clinical staff from these organisations may attend a Multidisciplinary meeting (MDT) at Frimley Health to review a patient’s care and treatment to ensure the best care and treatment is being provided.
During your treatment the healthcare professional you see will make notes, write a report or letter about the care they have provided to you. Copies of letters will be sent to your GP and a copy will be placed in your manual and electronic record. Therefore it is very important we have your correct GP details.
Where we do not have your correct GP details, information about the care you have been given may not be received by your GP in a timely manner. This could affect your on-going care.
Results of X-rays and tests
As part of your care, you may have provided samples e.g. urine or blood etc. which will be processed by the Trust’s laboratory, or, if a specialised test, with a partner laboratory. The results of these tests are stored by the Trust. The Trust is part of Berkshire Surrey Pathology Services (BSPS). BSPS is a joint venture between Frimley Health, Royal Berkshire, Royal Surrey and Ashford and St Peters NHS Foundations Trusts.
Where you have had an x-ray as part of your treatment, the Trust will keep an electronic copy of this x-ray.
Relevant information from other NHS Professionals who care for you e.g. your GP
When you visit your GP or another NHS Trust and they refer you to Frimley Health for treatment, they will write to the hospital detailing your current medical conditions and the treatment required.
We may also obtain information to assist in giving you the best, most appropriate care from other people who care for you and know you well, for example health and social care professionals and relatives.
It is good practice for people in the NHS who provide care to discuss and agree with you, what they are going to record about you. Open the bar below for further information.
Discuss and agree with you what they are going to record about you
The NHS has seven key principles, one of which is “The NHS aspires to put patients at the heart of everything it does”. Trust staff will work with you to deliver the best possible care including discussing with you the care they are going to provide.
We try to make sure that patients are involved with the decisions about their care. A copy of letters sent to your GP about your care will also be sent to you.
Show you what they have recorded about you, if you ask
To continue to include you in decisions about your care whilst you are in hospital, if you ask, staff can show you what they have written in your medical record about the care you are being provided. However, if you wish to obtain a copy of your medical records, you will need to put your request in writing to the Access to Health Records Team. Information on how to request a copy of your medical record can be found in the 'Our Obligations' section below.
How your records are used
The legal basis for the processing of data for these purposes is that the NHS is an official authority with a public duty to care for its patients, as guided by the Department of Health and Data Protection law says it is appropriate to do so for health and social care treatment of patients, and the management of health or social care systems and services.
If we need to use your personal information for any reason beyond those stated above, we will discuss this with you. You have the right to ask us not to use your information in this way. However, there are exceptions to this which are listed below.
the public interest is thought to be of greater importance for example:
if a serious crime has been committed
if there are risks to the public or our staff
to protect vulnerable children or adults.
we have a legal duty, for example registering births, reporting some infectious diseases, wounding by firearms and court orders
we need to use the information for medical research. We have to ask permission from the Confidentiality Advisory Group (appointed by the NHS Health Research Authority)
The people who care for you use your records to:
Produce a record of all health decisions made about you and the care provided to you
Your information is used by clinical, support workers and administrative staff. This could include professionals based in another location. Clinical staff access your information to view the care you have been provided and to ensure the care they give you is appropriate, safe and effective.
Clinical support workers and administrative staff may also access your records to support our clinical staff e.g. medical secretaries in the delivery of your care, additionally administrative staff ensure the care you have been provided with is recorded correctly and will communicate this with your GP.
Where appropriate, information about your care will be shared with other organisations to enable continuation/support of your care e.g. other NHS hospitals, hospices, community services, your GP and Social Services.
If you need to be transferred to another hospital for further treatment, information about your medical condition and care will be sent to the hospital you are being transferred to.
If needed, we work with social services staff whilst you are still in hospital to plan your discharge home. Information relating to your discharge arrangements will be recorded by social services within their manual and computerised records.
We are a Vascular Hub and a Cardiac Centre for Surrey, Hampshire and Berkshire. Therefore, details of your clinical care could be shared between the NHS Trusts in these counties to support and deliver your care e.g. your x-ray images taken at Hampshire Hospitals NHS Foundation Trust could be shared with clinicians based at Frimley Park Hospital to discuss your care, and then passed to Royal Surrey County Hospital where your care will be provided.
For example, we have a contract with Dial-a-Ride to provide transport to and from the hospital. Therefore, information such as your name and address will be shared with Dial-a-Ride to enable them to transport you to and from the hospital. The company will also be provided with basic information about your medical condition to ensure they provide the correct type of transport e.g. room for a wheelchair, oxygen supply, etc.
Support you during your time in hospital
Information collected about you will be shared with Trust staff to support your time in hospital e.g. the Trust offers all patients a Chaplaincy service. Your religion is passed to the Trust Chaplains running this service to enable them to visit you whilst in hospital, to ensure the pastoral and spiritual needs of patients, their families and staff members are adequately met.
Any dietary requirements are passed to the Catering Department with your choice of meal to ensure your dietary needs are met.
Charities such as the Stroke Association, Samaritans, Age Concern and Macmillan can be contacted to support patients both in hospital and after a patient has been discharged. This will only be done with patients’ explicit consent.
Check the quality of care provided (e.g. clinical audit)
The Department of Health mandates all NHS Trusts to undertake clinical audits on care delivered to patients, which can be undertaken by clinical staff employed by us or by external audit companies. This could involve individuals who have not been involved with your direct care accessing your medical records. Further information on national clinical audit can be found by clicking on the link below.
We have an annual clinical audit programme which requires all clinical staff to participate. Clinical staff consider patient medical records to review the care provided, and to identify ways in which the care could be improved in the future.
The Trust participates in a number of National Clinical Audits. Further information can be found at: National Clinical Audits
Occasionally, external companies will audit our treatment of patients to provide assurance to the Trust and our Commissioners on the care and treatment provided to patients. In some instances the auditors may review a patient’s medical record. These individuals are bound by strict codes of confidentiality. If you do not wish your records to be accessed by these staff, please write to the Information Governance Department.
Investigate any concerns or complaints you or your family have raised to the Trust about your health care
In order to deal with issues raised by you or to process your complaint or legal claim, staff within our Legal Department and Complaints Department will access your medical records and may share this information with other staff as well as external third parties where applicable, including our solicitors or the NHS Litigation Authority (NHSLA).
We take patient safety very seriously. If an incident occurs which was not expected we will investigate it, therefore the staff involved in your care, with support from the Risk Management Department, will access your medical records.
To help teach and train new members of staff
We teach and train student and newly qualified Doctors and Nurses and help them to gain valuable experience and practice in delivering medical care.
If you do not wish for your medical records to be used for teaching and training new staff, please write to the Information Governance Department.
Manage the services provided by the Trust
Every NHS Trust is performance managed. Statistical information about patient care is collated by the Trust e.g. the length of time patients are treated in the Emergency Department, how long patients have waited for an outpatient appointment, etc.
The Trust will use and share coded patient information to undertake statistical analysis on the management and performance of NHS Services locally and the NHS as a whole. In these instances, we take strict measures to ensure that individual patients cannot be identified.
We use statistical information about patients to improve the services it provides such as reviewing the length of time a patient has stayed in hospital or the number of hospital infections. Normally this information is anonymised so individual patients cannot be identified.
NHS Digital (formerly known as the Health and Social Care Centre) manages all the information sent to the Department of Health. Further information on how they process your information can be obtained via NHS Digital. We will use anonymous information to further support patient care including teaching or training of staff.
Undertaking research is an important element of providing healthcare. Clinical staff are actively encouraged to participate in research trials. The Research and Development Department manages all research projects undertaken by us. Your participation in a research project will only take place with your explicit consent. The Trust occasionally works with other organisations e.g. universities and external organisations to pilot new ways of working, with the aim to provide improved and more efficient services to patients. Where the Trust undertakes this work you will be informed and be asked if you wish to participate.
If you do not wish for your information to be used please write to the Information Governance Department.
Keep track of NHS spending
We receive payment for the services we provide to patients.
Clinical Commissioning Groups (CCG’s) are responsible for paying us for these services. In order to be paid for the services delivered, information on patient’s treatment needs to be passed to these clinical commissioning groups.
The information will be coded so individual patients cannot be identified. In some cases, the names of the patients will need to be provided; for instance when requesting funding for high cost drugs, or specialised care such as IVF treatment.
Ensure the Trust is delivering the right services to the right patients
To help ensure the Trust is meeting the needs and satisfaction of the community it serves, it will commission companies to run questionnaires or surveys on the Trust’s behalf, only the minimum will be shared with these companies and your permission will be gained before sharing the information.
Annoymised information about patient care is sent to NHS Digital (formerly known as the Health and Social Care Information Centre) on a daily basis. This information is used by NHS Digital to review the treatment provided to patients across the NHS and identify trends/changes in the health of the population. Further information on the work undertaken by NHS Digital can be found at: NHS Digital.
Sharing your information with NHS/External Organisations
We will also share your information with other organisations, to assist with giving you the best care possible. Where we share your information with these organisations, they are subject to strict information sharing protocols. Anyone who receives information from the Trust has a legal duty to keep it confidential and secure. Only information that is required and appropriate to support your care and treatment will be provided.
Permission from yourself will be sort before sending the information unless we have a legal obligation to provide the information or we have to because the interest of the public is thought to be of greater importance.
We accommodate both Hampshire, Slough and Surrey Social Services and work with Social Services staff whilst you are still in hospital to plan your discharge home. Information relating to your discharge arrangements will be recorded by Social Services within their manual and computerised records.
We share patient information with other external NHS organisations which operate to oversee and address issues relating to the management of the whole NHS such as NHS Protect and NHS Prescription Service. Sharing patient information with these organisations contributes to providing an efficient and effective NHS.
NHS Protect is responsible for policy and operational matters relating to the prevention, detection and investigation of fraud in the NHS. In some instances information relating to patients will be shared within NHS Protect. Further information on the NHS Counter Fraud Service can be found at: http://www.nhsbsa.nhs.uk/Protect.aspx
The NHS Security Management Service collects information on reported security incidents (e.g. thefts of patient/staff property, assaults on NHS staff) from each NHS hospital, to collate information to identify patterns in these incidents.
There are occasions where we have a legal duty to pass patient information to external organisations. These include: notification of new birth, notification of infectious diseases e.g. meningitis or where a formal court order has been issued.
We will notify the Central Registrar of Births every time a baby is born and when there is a death in our hospitals. Additionally, if it is identified that a patient has an infectious disease, the Trust has a legal obligation to notify the Health Protection Agency.
To protect your best interests, your information may be shared in an emergency situation. We have developed extensive emergency contingency plans including in the event of fire, flood, loss of power, etc. If an emergency occurred within the hospital, details of patients currently within the hospital or due to come into hospital might be shared with external organisations that are assisting us to manage the emergency. For example, in the case of severe weather the Trust has a contract with a company to provide vehicles to enable patients to get to and from hospital. Patient information would be shared with the company providing this service.
We occasionally use external companies based outside of England e.g. Scotland and the United States of America to measure and monitor outcomes of clinical procedures to enable us to provide the best possible care.
The Radiology Department has a contract with Alliance Medical to provide out of hours reporting on x-ray images. This means that if you attend the Trust late at night and have an x-ray, a clinician is available to review the x-ray and provide a report to the consultant providing your care.
We are working with the Kent Surrey Sussex Academic Health Science Network as part of the Enhancing Quality Programme & Enhanced Recovery Programme. The Enhancing Quality Programme (EQ) is a clinical change programme which triangulates information to drive quality improvements in clinical interventions, patient reported outcomes and patient experience.
The Enhancing Quality (EQ) Programme began data analysis with patients discharged from hospital in July 2010. The acute clinical conditions for which quality measures exist are:
• Heart Failure (HF)
• Hip and Knee replacement surgery (H&K)
• Pneumonia (PN)
• Acute Myocardial Infarction (AMI)
Further information can be found at: http://www.enhancingqualitycollaborative.nhs.uk/
All organisations we share your information with are subject to strict information sharing protocols. Anyone who receives information from us also has a legal duty to keep it confidential and secure. Where we share your information with these organisation we will let you know.
Clinical IT systems which meet strict security requirements and protocols may be used to connect patient care with other NHS services to ensure the best treatment.
We will not share information with external organisations unless:
• It supports your care and treatment
• You ask us to do so
• We ask your permission
• We have to by law
• We have special permission for health or research purposes; or
• We have to because the interests of the public are thought to be of greater importance than your confidentiality.
Everyone working for the NHS has a legal duty to keep information about you secure and confidential
We will not disclose any patient/personal information to a third party such as a private organisation, solicitor, employer, police officer without obtaining your explicit consent.
Where you have asked a company to act on your behalf e.g. solicitor, we will not release information about you without your explicit consent.
Explicit consent is when an individual is given the option to agree or disagree with the use of their personal information being used, collected or disclosed to others.
Our guiding principle is that we are holding your records in strict confidence
We will not disclose any patient or personal information to a third party such as a private organisation, solicitor, employer or police officer without obtaining your explicit consent.
Where you have asked a company to act on your behalf e.g. solicitor, we will not release information about you without your explicit consent.
Where we receive requests relating to your care by a police officer or employer your information will not be released without your explicit consent.
Staff must only access your information if they are involved in your care
All staff working for the NHS are bound by the Common Law Duty of Confidentiality which means only staff involved with your care are entitled to access information relating to you. This is detailed within the confidentiality agreements signed by staff working at the Trust and is included within mandated training provided to staff.
All clinical staff are bound by strict professional codes of conduct which incorporate confidentiality clauses. Further information can be found on the British Medical Association (BMA) and Nursing and Midwifery Council (NWC) websites.
We audit staff access to patient information to ensure they continue to abide by the Common Law Duty of Confidentiality.
You have the right to confidentiality under the Data Protection Act 1998, the Human Rights Act 1998 and the Common Law Duty of Confidence
Data Protection laws gives individuals rights in respect of the personal information that we hold about you. These are:
To be informed why, where and how we use your information.
To ask for access to your information.
To ask for your information to be corrected if it is inaccurate or incomplete.
To ask for your information to be deleted or removed where there is no need for us to continue processing it.
To ask us to restrict the use of your information.
To ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information.
To object to how your information is used.
To challenge any decisions made without human intervention (automated decision making)
The above Acts outline the legal framework which governs that information provided by patients to the Trust, has been provided in confidence and must remain confidential unless the patient has given their consent for their information to be shared.
Staff must only use patient information to provide healthcare to a patient. Where staff wish to share information about a patient’s treatment with another organisation (e.g. Social Services, GP, other NHS Trusts), they must inform the patient. Where staff wish to use patient information for another reason (e.g. teaching, training, research), then explicit consent must be obtained from the patient.
You have the right to ask for a copy of your medical records and for your information to be correct and up to date.
If you think any information about you held by the Trust is incorrect, please contact the Data Quality Team.
Should you wish to lodge a complaint about the use of your information, please contact our Complaints team.
If you are still unhappy with the outcome of your enquiry you can write to: The Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF - Telephone: 01625 545700.
We have a duty to:
Maintain full and accurate records of the care we provide to you
We have a legal obligation to store your medical information. The length of time we will store your information is set out by the Department of Health. The longest we will keep a patient’s record is 30 years after their care has stopped. More information on the retention of records in the NHS can be found on the NHS Digital website: https://digital.nhs.uk/codes-of-practice-handling-information
We have a legal obligation to ensure your information is accurate and up to date. If any of the information held about you is incorrect, please contact the Trust's Data Quality Team.
To ensure information is always accurate and up to date, our staff will check with patients that we have the most accurate and up to date information. However, where patients identify information held by us is inaccurate, they are asked to notify us either in person when they attend an appointment, or by contacting the number above.
Keep records about you confidential and secure
All staff working for the NHS are bound by strict confidentiality agreements. We also ensure all staff are trained on both the Data Protection Act 1998 and the Common Law Duty of Confidentiality to ensure they know and understand how to keep your information secure and confidential at all times.
The Trust’s Information Technology Department has deployed technical security measures to keep your information secure when stored.
Provide information in a format that is accessible to you (e.g. large type if you are partially sighted)
For support in accessing patient information or for a translation of this document, an interpreter or a version in large print, Braille or audio; please contact the Patient Advice and Liaison (PALS) Office.
To provide you with a copy of your records when you ask (in accordance with the Data Protection Act 1998)
Under the Data Protection Act 1998, individuals have the right to obtain a copy of their own information held by us. To obtain a copy of your medical records, please place your request in writing to:
Access to Health Records Team
Information Governance Department, 2nd Floor, Pine House, Frimley Health NHS Foundation NHS Trust, Portsmouth Road, Frimley, Surrey, GU16 7UJ
Frimley Park Hospital: 01276 52 2427
You will need to provide your information (e.g. full name, address, date of birth, Hospital/NHS number) and two forms of identification. This ensures we are providing confidential information to only the patient. Whilst you might have been regularly treated in the hospital, the staff who process your request for information will never have met you and need to ensure they do not disclose your confidential records to the wrong person.
If you wish for another person to process your request on your behalf they will need to obtain your written permission to do so before the Trust can provide copies of medical records.
Due to the Common Law Duty of Confidentiality, we are unable to provide copies of a deceased patient’s medical records. However, there are some very restricted circumstances when a person could be provided copies of a deceased individual’s medical record. Further guidance and assistance can be obtained from the Access to Health Records Team.
The Trust charge £10 for copies of electronic patient records such as x-rays and £50 for copies of the paper health record. When you submit your request to the Trust, we will confirm the administration charge and methods of payment. Upon payment we will process your request for information. We are required to respond to you within 40 calendar days from date of receiving the administration fee. We aim to prioritise patient requests for copies of their medical records. However, occasionally there are technical reasons why this might not be possible.
From the 1st April 2015 Frimley Health NHS Trust instigated a new policy concerning the completion of health insurance forms for NHS admissions. If the form only requires verification of dates of admission and a hospital stamp, patients can send their forms to Admissions Office to be processed.
If any medical details are required, the forms must be sent to your consultant’s secretary to be completed by the consultant or a member of his or her team for which there may be a charge. If the consultant is unable to complete the form, copies of your medical records can be obtained by contacting the Access to Health Records Team.
To enable and support clinical care we will no longer process private health insurance forms for Emergency Department attendances.
Any queries relating to this change of process, please contact the Access to Health Records Team.
To request a copy of your Medical Records:
Access to Health Records Team (based at Frimley Park): 01276 52 2570 or 01276 52 2427
To update your contact details:
Data Quality Team (Frimley Park): 01276 52 2403
Data Quality Team (Heatherwood and Wexham Park): Switchboard 01753 633000
The Information Governance Department set the policies and procedures to help ensure your information is kept secure and confidential. If you are concerned about how the Trust is using your information please contact:
Information Governance Team: 01276 52 6607