Privacy Notice for the COVID-19 Clinical Risk Assessment Tool
Privacy Notice for the COVID-19 Clinical Risk Assessment Tool
V1.0 (template) 16 February 2021
Name and contact details of Controller
Tracey Fletcher, CEO
Contact details of our Data Protection Officer
Our purposes for processing your personal information
This COVID-19 Clinical Risk Assessment Tool Privacy Notice is provided to explain how your personal information is used when we use the COVID-19 Clinical Risk Assessment Tool (the Tool). This notice is an additional notice to our full privacy notice which explains how we process your personal information more generally and is available on request and on our website.
The Tool is an online tool, provided by the NHS, that assesses the risk to you of coronavirus. It has been designed for use during a consultation with a patient and otherwise to support direct patient care. Your doctor or healthcare professional (clinician) inputs information about you into the Tool, to generate individual risk assessment results for you (see section 4 below which describes how this works).
Using information provided by you or obtained by your clinician, for example your weight and information from your health record, your clinician answers the questions in the Tool. The Tool will then generate risk assessment results based on this information. The results will give you or your clinician a better understanding of your risks of infection and potential consequences for you of infection from coronavirus. Your clinician may discuss the result with you to give you personalised health advice.
In addition to using the Tool to support the individual care of our patients, we will be providing information about your experience to NHS Digital, which provides the Tool. Anonymous data collected through the Tool will also help NHS Digital and the University of Oxford, who developed the QCovid® model used in the Tool, to develop and improve the Tool.
The Tool is registered as a medical device with the Medicines and Healthcare Products Regulatory Agency (MHRA).
What is the Tool and how does it work?
Your clinician will enter information into the Tool about you, your health and the medicines you take. Some of this information will be taken from your health record but your clinician may also need to ask you some questions about you and your health. They may also need to measure your height and weight to work out your body mass index (BMI).
The Tool will generate results for absolute risk and relative risk (see below), estimating how likely it is that you will:
- catch coronavirus and go to hospital
- catch coronavirus and die
All of the information used to answer the questions in the Tool is required because it has been identified as a factor which is relevant to the risk of catching and being hospitalised or dying from coronavirus.
The Tool has been developed from research by the University of Oxford about how people have been affected by coronavirus. The Tool uses a model called QCovid® which was developed based on information about people who had coronavirus in early 2020. The University of Oxford looked at data about people who went to hospital or died as a result of coronavirus during the first wave of the pandemic and combined it with data from hospital records and GP surgeries.
To develop the QCovid® model used by the Tool, the University of Oxford analysed this data to find out if certain things impact how coronavirus affects people. Researchers found that some things make it more likely that a person will need to go to hospital or die from coronavirus – these are called ‘risk factors’.
Risk factors that were identified as important included: age; body mass index (BMI); ethnicity; certain health conditions and where people live. The University developed a model which weighted each of these factors and this is used within the Tool to generate risk assessment results from the information entered about you by the clinician. The results may support a discussion between you and your clinician about what your level of risk means for you or otherwise used by your clinician for your healthcare.
The Tool will estimate your ‘absolute risk’ and ‘relative risk’.
‘Absolute risk’ is the risk of catching and being hospitalised or dying from coronavirus. This is based on data from the first wave, alongside a second time period (May-June 2020). For example, an absolute risk of 1% (or 1 in 100), would mean that we would expect 1 person to be hospitalised or die with the same characteristics and 99 to not be hospitalised or die.
‘Relative risk’ is the risk of catching and being hospitalised from coronavirus based on your information and risk factors compared with a person of the same age and sex, but no other risk factors. For example, a relative risk of 2 would mean that we would expect you to be twice as likely to catch and be hospitalised or die from coronavirus than somebody of the same age and sex with no other risk factors.
The risks factors used to develop the QCovid® model used in the Tool, are based on data collected in the first few months of the pandemic in 2020. These risks are changing over time in line with infection rates, social distancing measures and individual behaviour. It is based on data collected between February and April 2020, at a time when different measures were in place for shielding and social distancing and different national restrictions were in place. This means that, although risk assessment results are generated for you using the Tool, your clinician will consider these alongside shielding, social distancing and local or national restrictions, which may be different from when the QCovid® model was developed.
Because we do not yet have enough research about some groups of people, risk assessment results may not be accurate for:
- People aged under 19 and over 100, because the research was done on adults aged from 19 to 100 and because very few children became seriously ill with coronavirus.
- People who are trans or intersex, because the research was done using information about the sex people were registered with at birth
- People who are pregnant, because only small numbers of pregnant people were included in the research so we cannot be confident about their level of risk.
- People who were asked to shield during the first wave because, when the research was done, many of these people were shielding at home and so were less likely to catch coronavirus. This means the Tool may underestimate the risk for these people.
Your clinician will explain more about these limitations when they tell you what your risk assessment means for you. Risk assessment results will not be used in isolation to remove anyone from the Shielded Patient List (SPL). However, your clinician may use the Tool as part of their assessment of whether you should be placed on the SPL.
Researchers are continuing to learn more about coronavirus as more information becomes available. The QCovid® model used in the Tool will change and be updated over time as more information becomes available. The online service will be updated to reflect changes to the model.
Our legal basis to process your personal information
Your clinician is processing your personal data in order to answer the questions in the Tool and to record the risk score in your health record. This is to provide you with safe care and treatment.
Under the UK General Data Protection Regulations (UKGDPR) we are allowed to process your personal information using the Tool for the purposes of providing you with healthcare services. This is called “Public Task” under the UKGDPR and is allowed under Article 6(1)(e).
We are also processing personal information about your ethnicity and health conditions to use the Tool. This is also for a healthcare purpose and this is allowed under Article 9(2)(h) of the UKGDPR and under Schedule 1 of Paragraph 2 of the Data Protection Act 2018.
Categories of personal information we process when using the Tool
Your clinician will input the following about you into the Tool using information you have provided or taken from your health record:
- age (19-100)
- sex registered at birth
- ethnic group
- living arrangements (whether you live in your own home, in a care home or are homeless)
- postcode (to identify a Townsend deprivation score, a well-known way of measuring deprivation based on data from the 2011 Census). Your postcode is deleted from the Tool once the Townsend score is created.
- health information, including
- height (cm), Weight (Kg) – used to calculate BMI
- cardiovascular diseases
- respiratory diseases and treatment
- metabolic, renal and liver conditions
- neurological and psychiatric conditions
- autoimmune and haematological conditions
- cancer and Immunosuppressants– If you have a diagnosis of certain cancers and you have been prescribed if you have been prescribed 4 or more times with certain immunosuppressants in the last 6 months.
The Tool takes the answers we have provided to the questions above and generates a risk assessment result which will allow your clinician to provide personalised advice to you about your risk and otherwise for your healthcare.
Who we share your information with
We do not include any personal information that would identify you when we are answering the questions in the Tool.
The only information which could be used to potentially identify you is your postcode. For most people, postcode alone would not identify them because usually a number of different people live within a postcode area. However, just in case you are the only person who lives at your postcode, the Tool immediately converts your postcode to a number which relates to a Townsend deprivation score, a well-known way of measuring deprivation based on data from the 2011 Census. This number, which cannot identify you, is used by the Tool to generate risk assessment results and your postcode is then deleted from the Tool.
Anonymous data, which is the information provided to answer the questions in the Tool and which cannot identify you, will be collected by NHS Digital who provide the Tool. This anonymous data may be shared with the University of Oxford and the Department of Health and Social Care to help develop and improve the Tool and the QCovid® model developed by the University which is used in the Tool.
For more information about:
- how long we keep your personal information for
- where we store your personal information
- your rights and choices in relation to how we process your personal information
- how to contact us; and
- how to complain to the Information Commissioner if you are unhappy about the way we are processing your personal information please see our full Privacy Notice which is available on our website or on request.
Changes to this privacy notice
This privacy notice may change from time to time and the latest version number and date will be shown at the top and on the version published on our website so you know when it was last updated.
Supplementary Privacy Notice on Covid-19 for Patients and Carers 8 April 2020
Covid-19 and your information - Updated on 8th April 2020
This notice describes how we may use your information to protect you and others during the Covid-19 outbreak. The notice is an addition to our main Privacy Notice which is available below.
The health and social care system is facing significant pressures due to the Covid -19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be very important in researching, monitoring, tracking and managing the outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations.
Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. Using this law the Secretary of State has required NHS Digital; NHS England and Improvement; Arm’s Length Bodies (such as Public Health England); local authorities; health organisations and GPs to share confidential patient information to respond to the Covid -19 outbreak. Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data.
Further information is available at https://www.gov.uk/government/publications/.
During this period of emergency, opt-outs will not generally apply to the data used to support the Covid-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. However in relation to the Summary Care Record, existing choices will be respected. Where data is used and shared under these laws your right to have personal data erased will also not apply. It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak.
In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non-clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111. We may also use the details we have to send public health messages to you, either by phone, text or email.
Privacy Notice (your health records).
Your personal information
This page provides you with information about how we use and manage the information we have about you, including how we share it with NHS and non-NHS organisations, and how we maintain confidentiality.
What is personal data?
Personal data is information that relates to a living individual who can be identified from that data.
Why we collect information about you
Homerton University Hospital NHS Foundation Trust keeps records about the health care and treatment you receive as one of our patients. This helps to ensure that you receive the best possible care from us. It helps you because:
- Accurate and up-to-date information assists us in providing you with the right care
- Full information is readily available if you see another doctor or are referred to a specialist or another part of the NHS
It helps the NHS to:
- Prepare statistics on NHS performance
- Audit NHS Services
- Monitor how we spend public money
- Plan and manage the health service
- Teach and train healthcare professionals
- Conduct health research and development
Data Protection Act 2018 (This is the UK’s implementation of the GDPR (General Data Protection Regulations)
The Data Protection Act 2018 governs the processing of personal data held on computer systems and in other formats. It restricts how we can use an individual’s data, and consists of the Data Protection Principles that must be applied when processing personal data.
Organisations that process personal data must register as a 'data controller', and notify the Information Commissioner (ICO) why they need to process the data.
Homerton University Hospital NHS Foundation Trust is the data controller of personal information that is collected by the Trust to help us provide and manage healthcare to our patients.
Full details of all the purposes to which data may be put are listed at the ICO website https://ico.org.uk/. The Trust is registered with the Information Commissioner. The Trust registration number is Z5917319.
What kind of information does the Trust hold about you?
- Name, address, date of birth, NHS Number and next of kin
- Contacts we have had with you such as clinic visits
- Details of diagnosis and treatment
- Allergies and health conditions
We are currently upgrading our electronic patient record system and rolling out ePrescribing to help our clinicians with decision support and easy, fast access to the information they need to provide you with the best possible care. This will also help make our records of your care more robust; help us keep your GP informed of all we do for you here, and better secure the storage of your health record for the future.
How do we keep your records confidential?
Everyone working for the NHS is subject to the General Data Protection Regulations (GDPR) and the Data Protection Act 2018 (the UK’s implementation of the GDPR), and also the Common Law Duty of Confidence. Information provided in confidence will only be used for the patient’s direct care. If it is required for other purposes, then the patient will be asked for consent, unless there are other circumstances covered by the law.
Purpose and Lawful Basis for processing
The Lawful Basis we rely on to process your personal data is article 6(1)(e) in conjunction with Article 9(2)(h) for Special Category Data of the GDPR, which allows us to process personal data when this is necessary to perform our public tasks as a National Health Service provider.
Why do you collect information about me?
Your doctor and other health professionals caring for you to keep records about your health and treatment from the National Health Service (NHS). It is in the interest of the patient for a full record to be collected. Your records are either written down (manual records) or held on a computer (electronic records).
These may include details about:
- your address and next of kin
- your hospital visits
- the treatment or the care you receive, results of investigations and /or tests
- information from other health professionals, relatives and those who care or know you well.
Why do you monitor ethnicity?
The Trust serves a multicultural population and ethnicity is monitored because it is important to understand how and why different groups suffer from different conditions. This means we can give you better care and treatment.
How do my records help me?
Your records are used to guide and administer the care you receive. They help us to make sure that:
- we have accurate, up to date information about your health
- you receive the best quality of care
- information is easily accessible within the Trust because this helps us to make decisions about your future healthcare needs
- any concerns you may have about your health are properly investigated.
Who sees my records?
Everyone working for the NHS has a legal duty to maintain the highest level of confidentiality. Your medical records are kept in secure areas, and generally your records will only be seen by those involved in providing or administering your care. A few administration processes require information that may identify you, however, most processes will use anonymous information.
To make sure you will receive all the care and treatment you need, we might share relevant information about you with other NHS organisations and those outside the NHS. These may include:
- your General Practitioner (GP) and Pharmacies (Chemists)
- another hospital
- local authority departments, including Social Services, Education and Housing
- NHS walk-in centres
- NHS Direct and Care Direct Out-of-hours doctors’ services voluntary organisations
- private sector providers such as private hospitals, care homes, hospices.
We will only share information where it is clearly in your best interests to do so or it is required by law. This includes:
- notification of new births or deaths
- if infectious diseases will endanger the safety of others such as meningitis, tuberculosis or measles (but not HIV or AIDS)
- for child protection reasons
- when a formal court order is issued.
Information will not be passed to your friends, relatives or carers without your signed consent. Your consent is also needed to share information with other organisations (i.e. employers, insurance companies). This information is passed securely and kept confidential by the people who receive it.
Under data protection law, you have rights including:
- Your right of access - You have the right to ask us for copies of your personal information.*
- Your right to rectification - You have the right to ask us to rectify the information you think is inaccurate. You also have the right to ask us to complete the information you think is incomplete.
- Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
- Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
- Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
- Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.
The National Data Opt-Out
This is a service that allows patients to opt-out of their confidential patient information being used for research and planning. By 30 September 2021 all health and care organisations are required to apply national data opt-outs where confidential patient information is used for research and planning purposes.
Patients can find out more and set their opt-out choice at nhs.uk/your-nhs-data-matters
How do my records help the NHS?
Your information helps us:
- monitor your quality of care
- meet the general public’s health needs make sure our services meet future needs
- teach and train healthcare professionals conduct health research, development and audit transfer to other providers to improve care
- investigate a complaint you have made
- prepare statistics on NHS performance.
Access to your health information used for these purposes is controlled and monitored.
When information is used for statistical purposes, we do not identify individual patient’s details. Some information may also be passed on to other organisations with a legitimate interest (i.e. planning services with other organisations outside the NHS).
Notification to the Cancer Registry
The NHS has been contributing to the Cancer Registry for many years to help understand the causes of cancer.
At the moment this is not a legal requirement however we are committed to continuing this practice for the future benefit of cancer sufferers.
Can I see my health records?
The Data Protection Act 2018, allows you to find out information held about you by the Trust.
Children, as well as adults have the right to request a copy of their records and also have the right to request that the Trust stops processing their data.
If you require access to your health records you can make a verbal or written request through the contact details below: (We will send you a request form for completion and signature. We will also require proof of identity and sometimes other information to ensure we comply with Data Protection Law. We will usually complete your request within one calendar month in line with the DPA 2018).
Health Records Manager
Homerton University Hospital NHS Foundation Trust Homerton Row
London E9 6SR
Email: firstname.lastname@example.org Telephone: 020 8510 7008
You are entitled to receive a copy of both paper and electronic records. In certain circumstances your right to see some details may be limited for your own interest or for another reason, such as the protection of others. If you believe that there is an error in your records you may request that it be corrected or you may ask that a statement from yourself stating the reason for your belief that there is an error is included in your Health Records.
We are now offering video consultations to some patients who have been identified by their doctor, nurse or other health professional as potentially suitable for this type of appointment.
Traditional face to face appointments aren’t always convenient, particularly for those who need a number of appointments during their care or who struggle to travel. Sometimes it is possible to have a video consultation rather than going to hospital for these appointments. Feedback shows that many people find this more convenient and have a better experience. For some, it saves time and money as there is no need to travel; for others, it has provided an opportunity to continue their appointments whilst self-isolating.
You can join a video consultation from wherever is most convenient and comfortable for you be that your home, your work place or even your holiday. If you don’t have the required equipment you can consider asking a friend or relative to help you.
Is a video consultation suitable for me?
You will be contacted by your health care team if they believe you may benefit from a video consultation. They will ensure that your health and care can be appropriately assessed and continued in this appointment format.
You will also need access to certain equipment to be able to join a video consultation: a microphone, camera and screen. Most smartphones, tablets and laptops will be suitable. Please note: only patients who have spoken with their clinician about using a virtual clinic and received confirmation from us of a virtual clinic consultation will be able to access virtual appointments
Where can I get more information?
If you have any questions about how your information is used contact David Waters, Data Protection Officer & Information Governance Manager at the Homerton University Hospital NHS Foundation Trust on 020 7683 4102 or email email@example.com
Everyone has the right to lodge a complaint with the ICO if they wish to:
The Information Commissioners Office (ICO) T: 030 3123 1113
Patient Advice and Liaison Service (PALS)
PALS can provide information and support to patients and carers and will listen to your concerns, suggestions or queries. The service is available between 9.30am and 4pm. Telephone 020 8510 7315, Textphone: 07584 445 400 or email firstname.lastname@example.org
For information on the references used to produce this information, please ring 020 8510 5302 or email email@example.com
A voicemail service is available out of office hours.
Additionally, you have a right to complain to the Information Commissioner if ever you are unsatisfied with the way the Trust has handled or shared your personal information:
Information Commissioner's Office
Cheshire SK9 5AF
Tel: 0303 123 1113 (or 01625 545745 if you would prefer not to call an ‘03’ number, or +44 1625 545745 if calling from overseas)
Fax: 01625 524510
Produced by: Information Governance Service Corporate
Homerton University Hospital NHS Foundation Trust