Privacy Notice for Oxford Monitoring System and Mortality Follow-up
PRIVACY NOTICE
Oxford Monitoring System for Self-harm
Our organisation
The Oxford Monitoring System for Self-harm
University of Oxford Department of Psychiatry
Warneford Hospital site
Headington OX3 7JX
Organisation representative
Deborah Casey on 01865 613195
Email: csr@psych.ox.ac.uk
Data protection officer
data.protection@admin.ox.ac.uk
Sponsor
The Oxford Monitoring System for Self-harm is sponsored by Oxford Health NHS Foundation Trust.
This project collects information based on hospital records and we have no direct contact with patients. However, we have a Patient Information leaflet available in the Emergency Department waiting room and in the PALS (Patient Advice and Liaison Service) office that explains briefly how we use the information and directs people to our webpages for further information.
This privacy notice lets you know about:
- personal data/special category data that we process and what is done with this information
- who this personal information could be shared with
- the legal basis for processing of personal data
- transfers of data
- when data will be erased
- your rights under the GDPR
Personal data processed
The personal data we process includes full name, date of birth, gender, full postcode and NHS Number.
The purposes of the data processing for the Oxford Monitoring System for Self-harm is
(i) To identify whether someone presenting to the Emergency Department in Oxford has self-harmed
(i) To collect sufficient personal information to know whether that person has presented to the hospital before with self-harm and to link presentations for self-harm to individuals using project-generated ID numbers (pseudo ID)
(ii) To provide sufficient information to NHS England to find out if and when a patient has died, and their cause of death (ICD-10 codes).
Once these purposes have been fulfilled, the identifying items are removed so that the data used for analyses are de-identified (pseudonymised).
Special category data
We consider all the data we collect to be special category data because all of the participants have presented to the emergency department following self-harm.
In addition, we collect data on all age groups, including children and the elderly, those with mental health conditions. We also process data relating to ethnicity, information about criminal record and health information. We collect these items because we know that self-harm, repetition of self-harm and suicide is more common in certain ethnic groups and in people who have been in trouble with the law. We also process clinical information such as the method of self-harm.
Sharing of personal data
We share personal data with NHS England so that they can tell us if and when a patient has died and the cause of death (ICD-10 code).
The lawful basis of the processing
The processing of these data are considered to be in the public interest so we have support under Section 251 of the NHS Act (2006) to collect personal data items for this project by the Health Research Authority’s independent Confidentiality Advisory Group, who advises the Secretary of State.
The legitimate interests for the processing
Under the GDPR, the bases for processing special category data include:
Article 9 (j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
The results of studies we conduct using information processed are used by the Department of Health & Social Care as part of the National Suicide Prevention programme. The information helps inform national policy on how self-harm patients should be cared for, for example, by providing information of the categories of patients most at risk of further self-harm presentations or even suicide.
The recipients or categories of recipients of the personal data
The only people who will have access to personal data are a small number (currently four) of named, authorised data processors for this project. People who analyse the data are not able to access any identifiable information.
Transfers of the personal data
No personal information is transferred to any third parties whatsoever, nor to any international countries
The retention periods for the personal data
Arrangements are in place for secure disposal and/or destruction of personal data/special category data when it is no longer required.
- Identifying self-harm presentations to the hospital: All personal data are destroyed as soon as a calendar year’s worth of data are collected and processed.
- Paper data collection forms: these have been kept since the beginning of the project because ongoing analysis often requires us to check back to the raw data, especially where not all information from data collection forms was entered electronically from the start.
- Electronic data files: We retain an electronic file from the year 2000 onwards that contains our pseudo ID and the identifiable information needed for flagging patients with NHS Digital. This is held securely, is encrypted, and not accessible to any data analysts – only named, authorised NHS approved data processors.
- NHS England data files are kept only until processing is completed (mortality data merged with non-identifiable datasets. It is part of our contracts with NHS England that any identifiable data must be destroyed by the end of each contract period.
The rights available to individuals in respect of the processing and the right to withdraw consent
Individual specific consent does not form the basis of data processing and we do not apply the National Data Opt Out to our data (both with support from the Secretary of State for Health and Social Care). Nevertheless, patients retain their rights under the GDPR. Any patient may still request to opt-out of having their information used in our project simply by contacting us. Contact details are available in our Patient Information leaflet and on-line.
The right to lodge a complaint with the ICO
If someone is not happy with our response to their queries or concerns, they may contact the ICO at: https://ico.org.uk/global/contact-us/contact-us-public/
The source of the personal data
The personal data we collect comes from medical records, not from individual participants.
Obligation to provide personal data
Individuals are under no statutory or contractual obligation to provide personal data. They may ask us not to use their information at any time.
Automated decision-making, including profiling
Personal data/special category data of participants are not and will not be used in relation to measures or decisions that affect individual participants. The information is not used in any form of automated decision-making or profiling of patients. The work we do does not have any direct bearing on current or future health care.
Data protection impact statement
We have completed a Data Protection Impact Statement for this project using a University template from the information compliance team. We believe that the level of security used is appropriate to the risks represented by the data processing. Data are stored securely and encyrpted so that no unauthorised access is possible.
Mortality Follow-Up Privacy Notice
As part of our work we look at whether individuals we collect information on in the general hospital in Oxford are still alive, if they died, or if they have lost contact with the NHS - for example by leaving the country. To do this we securely share some patient identifiable information with services at NHS England who link these data to Civil Registration data and then provide us with the follow-up information about patients.
A limited amount of personal data, as listed below, is shared anonymously with similar self-harm monitoring projects based at the University of Manchester and Derbyshire Healthcare NHS Foundation Trust, who in turn share their data with us, as part of the Multicentre Study of Self-harm in England https://www.psych.ox.ac.uk/research/csr/ahoj .
We do not share any names, addresses, dates of birth or NHS numbers of individuals included in the study, but we do share date and cause of death with the other centres.