Privacy notice

Please note: Information that has been held previously by NHS Morecambe Bay Clinical Commissioning Group (CCG), NHS Blackpool CCG, NHS Fylde and Wyre CCG, NHS Chorley South Ribble CCG, NHS Greater Preston CCG, NHS West Lancashire CCG, NHS Blackburn with Darwen CCG and NHS East Lancashire CCG was transferred to NHS Lancashire and South Cumbria (LSC) Integrated Care Board (ICB) on 1 July 2022, who became the new data controller.

Any questions about the use of data (including patient data) should be directed to lscicb.contactus@nhs.net.

At NHS Lancashire and South Cumbria ICB we are committed to protecting and respecting your privacy.

The Integrated Care Board (ICB) has various roles and responsibilities, but a major part of our work involves making sure that:

• Contracts are in place with local health service providers to ensure that you can receive healthcare free at the point of delivery.
• Routine and emergency NHS services are available to patients;
• Those services provide high quality care and value for money; and
• Paying those services for the care and treatment they have provided.

This is called “commissioning”.

Accurate, timely and relevant information is essential for our work to help us to design and plan current and future health and care services, evidence and review our decisions and manage budgets.

As a commissioning organisation, our purpose is not to provide direct care and so we do not routinely hold or receive information about patients and service users in relation to your care.

We do however sometimes hold information from which people can be identified to enable us to fulfil our responsibilities as outlined above and this is explained in this notice.

A privacy notice is a statement that describes how an organisation collects, uses, retains and discloses personal information. Different organisations sometimes use different terms and it can be referred to as a privacy statement, a fair processing notice or a privacy policy.

To ensure that we process your personal data fairly and lawfully we are required to inform you:

• Why we need your data
• How it will be used and
• Who it will be shared with

This information also explains what rights you have in controlling how we use your information.  The key laws are:

• The Data Protection Act 2018 (DPA)
• UK General Data Protection Regulations 2021 (UKGDPR)
• The Human Rights Act 1998 (HRA) and;
• The Common Law Duty of Confidentiality.

Within these pages we describe instances where NHS Lancashire and South Cumbria ICB is the ‘Data Controller’, for the purposes of the Data Protection Act 2018, and where we direct or commission the processing of patient data to help deliver better healthcare, or to assist the management of healthcare services.

NHS Lancashire and South Cumbria ICB recognise the importance of protecting personal and confidential information in all that we do, whilst taking great care to ensure our legal obligations are met.

Please see https://www.lancashireandsouthcumbria.icb.nhs.uk/contact-us/customer-care-team for ICB contact details.

If, however, you are not satisfied that your complaint has been resolved, you have the right to contact the Information Commissioner to lodge a complaint:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow SK9 5AF
ico.org.uk
Tel: 0303 123 1113

We keep our privacy notice under regular review and we will place any updates on this web page. This notice was last updated on 23rd January 2025.

NHS Lancashire and South Cumbria ICB is a ‘Data Controller’ under the Data Protection Act 2018 (DPA18). We have notified the Information Commissioner that we process personal data and the details are publicly available from the:

Information Commissioner’s Office
Wycliffe House
Water Lane,
Wilmslow SK9 5AF
ico.org.uk

Registration number: ZB392902

Please contact us via our data protection officer if you have any questions about our privacy notice or information we hold about you:

Hayley Gidman
Data Protection Officer
Tel: 01782 916875
Email: mlcsu.dpo@nhs.net

We only collect and use your information for the lawful purposes of administering the business of NHS Lancashire and South Cumbria ICB.

We process personal information to enable us to support the provision of healthcare services to patients, maintain our own accounts and records, promote our services, and to support and manage our employees. To enable us to do this effectively we are often required to process personal data i.e. that which identifies a living individual.

We also process special category data. This is personal data which the Data Protection Act 2018 (DPA18) says is more sensitive, and so needs more protection:

• Racial and ethnic origin
• Offences (including alleged offences), criminal proceedings, outcomes and sentences
• Trade union membership
• Religious or similar beliefs
• Employment tribunal applications, complaints, accidents, and incident details.

This information will generally relate to our staff.

In terms of patient information, the special category data we process includes:

• Physical or mental health details
• Racial and ethnic origin
• Sexual orientation
• Details of care

Whenever you use a health or care service, such as attending Accident & Emergency or using community care services, important information about you is collected to help ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be provided to other approved organisations for purpose beyond your individual care, for instance to help with:

• improving the quality and standards of care provided
• research into the development of new treatments
• preventing illness and diseases
• monitoring safety
• planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law, and would never be used for insurance or marketing purposes without your explicit consent.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. 

On this web page you will:

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to access the system to view, set or change your opt-out setting
• Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
• See the situations where the opt-out will not apply

Type 1 opt-out 

If you do not want personal confidential data that identifies you to be shared outside your GP practice, for purposes beyond your individual care, you can register a ‘Type 1 opt-out’ with your GP practice. This prevents your personal confidential information from being used for anything except your care, except when it is required by law, such as a public health emergency like an outbreak of a pandemic disease.

Patients are only able to register this opt-out at their GP practice. If you would like to opt-out or discuss further, then please talk to your GP or the healthcare professional supporting you.

You can also find out more about how patient information is used at:

https://www.hra.nhs.uk/planning-and-improving-research/best-practice/public-involvement/putting-people-first-embedding-public-involvement-health-and-social-care-research/ (which covers how public involvement is embedded in health and care research) and

https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made)

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

NHS continuing healthcare (CHC) is explained here.

ICBs are responsible and accountable for system leadership for NHS continuing healthcare within their local health and social care economy.

NHS CHC means a package of ongoing care that is arranged and funded solely by the NHS where the individual has been assessed and found to have a ‘primary health need’.

To determine if someone is eligible for CHC and to then arrange a care and support package that meets their assessed needs, information about the individual will need to be collected, reviewed and shared with care providers such as care homes.

As the ICB has a duty to commission CHC services, this allows for the collection of information about individuals for CHC purposes, the use of that information and the sharing of it with third parties who need to be involved in the process. Acting as data controllers, under the Health and Care Act 2022, under section 14, each ICB must exercise its functions, effectively, efficiently and economically.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(c) ‘processing necessary for compliance with a legal obligation to which the controller is subject or….’

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine….’

Records that relate to you need to be obtained and may include Care Home records, Health Records (for example GP, Hospital, Mental Health, District Nursing) and Social Care Records.

The information ICBs use to assess eligibility, and which may be submitted to an Independent Review Panel, fall under the following headings:

• Behaviour
• Cognition (understanding)
• Communication
• Psychological/emotional needs
• Mobility
• Nutrition (food and drink)
• Continence
• Skin (including wounds and ulcers)
• Breathing
• Symptom control through drug therapies and medication
• Altered states of consciousness
• Other significant needs.

Your data relating to an application for CHC is received by the ICB and may then be passed to members of the review panel.  An independent review panel is made up of:

• An independent chair
• A representative nominated by an Integrated Care Board (not involved in the case)
• A representative nominated by a Local Authority (not involved in the case)
• At times there is also a clinical advisor in attendance.

NHS Lancashire and South Cumbria ICB offers various services to the public giving them the opportunity to engage with us. This could be providing people with the latest news and information from the ICB, opportunities, events and details on how to get involved. When people subscribe to a service, for example our email newsletter, they can cancel their subscription at any time and are given an easy way of doing this.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6 (1)(a) ‘the data subject has given consent to the processing of his or her personal data for one or more specific purposes’

We have to hold the details of the people who have requested their involvement in order to provide it. However, we only use these details to provide the service the person has requested and for other closely related purposes. 

We might use information about people who have requested a publication to carry out a survey to find out if they are happy with the level of service they received or if the information is useful to them. We will never ask you to provide personal data in response to a survey. Any personal data received in responses is removed before the responses are collated, analysed and disseminated.

• Name
• Postcode
• Address
• Personal email address

The information you provide is never shared outside of the ICB.

MLCSU insight team may also conduct events on our behalf, this information will never be shared with any other organisation other than ourselves.

NHS Lancashire and South Cumbria ICB regularly liaise with local patient groups, and, in order to do this, we collate contact details of some group members as required. Personal data collected for the above purposes is only processed with the explicit consent of the data subject unless it becomes apparent that we are required to process the personal data due to statutory obligations such as investigating a complaint.

• To carry out a survey to find out if you are happy with the level of service you have received, where you have indicated an interest in this specific service/area. We will never ask you to provide any personal data in response to a survey. Any personal data received in responses to surveys will be removed before responses are collated, analysed or disseminated
• To provide information that may be of interest
• To invite people to attend specific focus groups in areas of interest
• To invite people to be involved in decision making processes

Under the UK GDPR, the lawful basis we rely on to process your personal data are:

• Article 6 (1)(a) ‘the data subject has given consent to the processing of his or her personal data for one or more specific purposes’
• Article 6(1)(e) ‘the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.’

Under the UK GDPR, the lawful basis we rely on to process your special category data are:

• Article 9 (2)(a) ‘the data subject has given their explicit consent to the processing of their personal data for one or more specific purposes….’
• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine….’

The personal data is provided by data subjects (the individual it relates to) when signing up to receive one of our newsletters, either via our website or by completing a sign-up form at a local stakeholder event.

We only require you to provide us with your name, email address or postal address and telephone number so that we can send you our publications. Information regarding your gender, sexual orientation, marital status and disabilities is collected so that we can ensure that our patient involvement groups are representative of our local population. We may also use it to send you targeted information or news. However, it is not mandatory to provide this information.

The information you provide as a member of one of our patient involvement groups is never shared outside of NHS Lancashire and South Cumbria ICB.

Invoice validation is an important process. It involves using your NHS number to check that we are the ICB that is responsible for paying for your treatment.

In such cases service providers are required to send identifiable patient data such as the NHS number to a Controlled Environment for Finance (CEfF). MLCSU is an accredited Controlled Environment for Finance (CEfF) under a Section 251 exemption which enables them to process patient identifiable information on behalf of the ICB without consent for the purposes of invoice validation – CAG 7-07(a)(b)(c)/2013.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(c) ‘processing is necessary for compliance with a legal obligation to which the controller is subject’

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as ensuring high standards and quality of healthcare'

The sources of data are providers who submit invoices to NHS Shared Business Services who administer a national financial system on behalf of NHS England and MLCSU.

We will also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.

We will also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.

Other data we may require includes, Invoice number, Unique Patient Event Identifier, location, provider, point of delivery, data of treatment, Organisation Data Service (ODS) code, service, treatment, prescribed drug, price of drug.

There are situations where identifiable patient personal data is required to ensure that the correct service provider is paid.

Liaison Finance receive personal data relating to invoice validation.

Risk stratification uses data to better understand, plan, and manage the current and future health needs of our local patient population.

The process of collecting, analysing and using data is called risk stratification.

The data is run through a computer-based programme that calculates which people are at high risk of experiencing certain outcomes, such as unplanned emergency care.

This is done through:

• Targeting individuals at high-risk of needing additional preventive care interventions. This is known as risk stratification for case-finding. Typically, GPs use the case-finding method to help identify and support patients with long term conditions.
• Analysing a population to predict future care needs so that services can be planned and commissioned. This is known as risk stratification for commissioning. The NHS Lancashire and South Cumbria ICB uses this method to understand the current and future needs of the local population so that they can commission the rights services.

The law says commissioners, including the NHS Lancashire and South Cumbria ICB, are not allowed to access Personal Confidential Data (PCD) because they are not providing direct patient care. ICB staff therefore do not have access to Personal Confidential Data as part of the risk stratification purposes.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(e); ‘necessary… in the exercise of official authority vested in the controller’

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine….’

NHS England, as data supplier for risk stratification purposes,  can disseminate data to the NHS Lancashire and South Cumbria ICB (and other commissioners) under the Health and Social Care Act (2022).

NHS England, through its intermediary service called Data Services for Commissioners Regional Office (DSCRO), is permitted to collect, hold and process Personal Confidential Data (PCD). DSCROs specialise in processing, analysing and packaging patient information within a secure environment into an anonymised format that commissioners can legally use for their commissioning functions.

GPs are able to identify individual patients from the risk stratified data when it is necessary to discuss the outcome and consider preventative care, however the NHS Lancashire and South Cumbria ICB can never identify an individual from the risk stratified data. Where the risk stratification process has linked GP data to health data obtained from other sources i.e. NHS England or other health care provider, the GP will ask for your permission to access the details of that information.

Risk stratification activity is undertaken under Section 251 of the NHS Act 2006 which enables to common law duty of confidentiality to be temporarily lifted. In practice this means that the organisation responsible for holding the data can disclose information (for example to a research body) without breaching the common law duty of confidentiality. Section 251 support has been provided by the Secretary of State for Health and Social Care, on advice from the Confidentiality Advisory Group (CAG) which is part of the Health Research Authority (HRA). This means that the ICB can receive the data in line with specific technical and security measures being in place. Where a legal basis is established under Section 251 support, the data still has to be processed fairly and lawfully in accordance with the data protection principles.

Personal data is supplied into the national DSCRO arrangements by GPs and NHS England (commissioning data sets).

The ICB has agreements in place with the following organisations to process Risk Stratification Data:

• NHS Midlands and Lancashire Commissioning Support Unit (NHS ML). NHS ML’s  risk stratification tool is Aristotle.
• Prescribing Services Limited (PSL). PSL’s risk stratification tool is Eclipse VISTA.

Risk stratification tools use information about patients, such as age, gender, diagnoses and patterns of hospital attendance and admission collected by NHS England from NHS hospitals and community care services (Secondary Use Services data). This is linked to data collected in GP practices and analysed to produce a risk score.

The Secondary Uses Service (SUS) is the single, comprehensive repository for healthcare data in England which enables a range of reporting and analyses to support the NHS in the delivery of healthcare services. Information on care provided for all patients by Health Care Providers  must be submitted to the Secondary Uses Service according to the Commissioning Data Set Mandated Data Flows guidelines.

The combined ICB’s Secondary Use Service (SUS) data and GP data which contains an identifier (usually NHS number) is made available to clinicians with a legitimate relationship with their patients to enable them to identify which patients should be offered targeted preventative support to reduce risks.

NHS Lancashire and South Cumbria ICB does not have access to identifiable information for risk stratification purposes.

You have a choice about whether you want you confidential patient information to be used for risk stratification purposes. If you are happy with this use of information you do not need to do anything. If you do not wish your confidential patient information to be included in risk stratification you can choose to opt-out through the National Data Opt Out process (as described above in this Privacy Notice).

The National Data Opt Out does not apply to non-identifiable data that is used by the ICB for risk stratification. This is because the data is used in a format that does not directly identify you. If you do not want your data used in this way, you can contact your GP Surgery’s Practice Manager  to discuss how disclosure of your data can be limited. Please note that opting out won’t affect the care you receive, but it could affect the proactive provision of your care.

You can change your mind about your choice at any time.

The ICB is committed to supporting local practices in providing their patients with alternative routes to order repeat prescriptions. Patients who contact the ICB for this purpose will be asked by one of the prescribing clerks in the medicines management team if they can access their medical record via their GP’s record system.

Medical records will only be accessed when a patient contacts the ICB to make use of the prescribing function.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(e) ‘the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.’

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine….’

All data processed by NHS Lancashire and South Cumbria ICB in line with patients ordering repeat prescriptions will come directly from that patients’ GP practice in the form of their electronic medical record. Information is also received directly from the Data Subject.

NHS Lancashire and South Cumbria ICB will be able to access a patient’s electronic medical record to provide the patient with their repeat prescription. Only data pertinent to verifying identity of the caller and ordering a repeat prescription within a medical record will be accessed by Prescribing Clerks.

Once a repeat prescription has been ordered by a patient, this information is sent directly to their GP practice for sign off by a GP. Once approved, the prescription is then sent to a patient’s nominated pharmacy.

Most NHS care and treatment goes well but sometimes things can go wrong. If you are unhappy with your care or the service you have received, it is important to let us know so we can improve. When the ICB receive a complaint, to allow it to be fairly and thoroughly managed, in most cases personal information will be required.

ICBs have statutory duties (Section 6 of the Local Authority Social Services and National Health Service Complaints [England] Regulations (2009) (under section 113 “Complaints about Healthcare” of the Health and Social Care (Community Health and Standards) Act 2003)) which allow the processing of personal data in relation to complaints.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(e) ‘the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.’

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine….’

NHS Lancashire and South Cumbria ICB will generally collect/receive information when members of the public, their representatives, or members of Parliament, contact us with concerns or enquiries. To enable us to process a complaint, NHS Lancashire and South Cumbria ICB will collect the relevant information at the point of contact to enable the team to provide a sufficient response to the request.

Information relating to complaints would generally include the following categories of personal data:

• Patient’s name
• Patient’s address
• Patient’s contact number
• GP practice
• Patient’s NHS number
• Patient’s date of birth
• Representative details (if applicable)
• Representative address (if applicable)
• The nature of the complaint.

The recipients of personal data relating to complaints include:

• Patient Services and Quality teams within the ICB that may receive an enquiry or complaint
• Relevant providers (with the consent of the data subject) in order to fully investigate the complaint being made

The Health and Care Act 2022 set the ambition for NHSE’s commissioning functions to move to ICBs. As part of this move it was decided that complaints handling responsibility would follow commissioning functions.

ICBs took on delegated responsibility for complaint services from 1 April 2023. This responsibility covers all complaints about services where the commissioning has been delegated to the ICB, received from the time of delegation (1 July 2022).

The delegation of complaints provides opportunities through legislative reform to remove barriers to integrated care and to create the conditions for local partnerships to thrive, leading to better outcomes and experiences for patients, and less bureaucracy and duplication for patients and other staff.

Collaborative working will help health and care organisations tackle complex challenges, including:

• improving the health of children and young people
• supporting people to stay well and independent
• acting sooner to help those with preventable conditions
• supporting those with long-term conditions or mental health issues
• caring for those with multiple needs as populations age
• getting the best from collective resources so people get care as quickly as possible.

NHS England delegates its delegated functions to the ICB under section 65Z5 of the NHS Health and Care Act 2022

NHS England legal powers to receive, share and analyse data

• NHS Act 2006, Schedule 1, paragraph 13(3) to obtain and analyse data.
• NHS Act 2006, Section 2 gives NHS England the power to do anything calculated to facilitate, or that is conducive or incidental to the discharge of any of the tasks given to it by the NHS 2006 Act. This includes sharing data when this is done for a proper purpose
• The Local Authority Social Services and National Health Service Complaints (England) Regulations 2009 requires NHS England to make arrangements to manage complaints.

For the processing of the data necessary for the ICBs to undertake the delegated complaints handling functions, this is by virtue of Article 6(1)(e) UK GDPR Public Task and Articles 9(2)(h) health or social care, which includes health care systems. Supported by Part 2 of Schedule 1 of the Data Protection Act 2018 (DPA), which covers processing where there is a substantial public interest, additionally the ‘permitted disclosures of information’ provision in s.13Z3 of the NHS Act 2006. Processing is also required for the ICBs to comply with the Complaints Regulations 2009.

A Data Sharing Protocol between NHSE and the ICB will be valid until all data is migrated or no longer needed access to, from NHS England drives and NHSE CRM system to ICBs/Hubs. Following the transfer of all appropriate data to ICBs, data sharing arrangements for delegated functions will be reviewed/updated and agreed on between parties.

The intention is for NHSE to share data with ICBs via continued access to CRM and the NHS England collaboration drive until data has been migrated to ICBs file structures. This data will be accessible via current NHS England staff transferring having continued access to their England Office 365 accounts. This has been agreed nationally for delegated services in order for NHSE to support a smooth transition of staff and functions to ICBs. This is to ensure continuity of service and operational readiness from day one of transfer to ICBs. All paper records will be stored within NHS England buildings or with secure archiving services, with plans in place to transfer these records on an as required basis as most records required for this service are digital and on NHS England collab drives or CRM system. The number of ‘live’ paper records should be very limited.

Information relating to complaints would generally include the following categories of personal data:

• Patient’s name
• Patient’s address
• Patient’s contact number
• GP practice
• Patient’s NHS number
• Patient’s date of birth
• Representative details (if applicable)
• Representative address (if applicable)
• The nature of the complaint.

Lancashire and South Cumbria ICB will be the recipient of data from NHS England initially and then data will be processed as with all other complaints and enquiries.

The NHS has a duty to spend the money it receives from the Government in a fair way, considering the health needs of the whole community. The ICBs role is to ensure it gets best value for this money by spending it wisely on behalf of the public.

The ICB pay for local NHS health services and NHS England pays for highly specialised health services. The ICBs have a legal duty to provide health services for patients in the county with the fixed amount of money they have received from the Government. They have a legal duty not to spend more than this. This means that some hard choices have to be made. Not all treatments can be provided by the NHS and some are limited in certain circumstances. Further details can be obtained upon request.

However, the ICBs know that there will always be times when a patient would benefit from a particular treatment not usually given by the NHS. To apply for this treatment, an Individual Funding Request (IFR) is made. To allow the ICB to consider these requests, access to both personal and health information regarding the individual to whom the request relates is required.

As the National Health Service Commissioning Board and Integrated Care Boards (Responsibilities and Standing Rules) Regulations 2012, Part 7, Regulation 34 places a duty on ICBs in respect of the funding and commissioning of drugs and other treatments, this provides the ICB with a legal basis to use personal data as part of this process.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(e) ‘the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine….’

The information may be provided by a clinician who submits an IFR application form on behalf of a patient.

The IFR application form includes:

• NHS number
• Name
• Address
• Date of birth
• GP details
• Diagnosis
• Requested intervention
• Other information relevant to the request
• Gender and ethnicity are also collected and held in anonymous form for equality monitoring.

Applications are considered by an independent panel who has not been involved in your treatment. The panel is made up of doctors, nurses, public health experts, pharmacists, NHS England representatives and lay members and is led by a lay chair.

The IFR team access and store their data on the National Blueteq system. The Individual Funding Request (IFR) system is designed as a total solution to monitor requests from their inception from clinicians, through the panel stages to final invoice matching.

The ICB is dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently and conscientiously applied with the wellbeing of all at the heart of what we do.

Under the UK GDPR, the lawful basis we rely on to process your personal data are:

• Article 6(1)(a) ‘the Data Subject has given consent…’
• Article 6(1)(c) ‘processing is necessary for compliance with a legal obligation to which the controller is subject’
• Article 6(1)(d) ‘processing is necessary in order to protect the vital interests of the Data Subject or another Natural Person
• Article 6(1)(e) ‘the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Under the UK GDPR, the lawful basis we rely on to process your special category data are:

• Article 9(2)(a) ‘the Data Subject has given explicit consent….’
• Article 9(2)(c) ‘processing is necessary to protect the vital interests of the Data Subject or of another Natural Person….’
• Article 9(2)(g) ‘processing is necessary for reasons of substantial public interest….’
• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine….’

In order to share information legally between organisations there must be a defined and justifiable purpose that references the appropriate underpinning legislation and the associated duties and/or powers. It is therefore the responsibility of all organisations that share information that exchanges are justified and in accordance with key legislations:

Data Protection Act 2018 – Schedule 1, Section 18 & 19 – Safeguarding of children and of individuals at risk & Safeguarding of economic well-being of certain individuals

Care Act 2014

Children Act 2004

Common Law Duty of Confidence

Crime and Disorder Act 1998

Criminal Justice Act 2003

Mental Capacity Act (2005)

Domestic Violence, Crime and Victims Act 2004

Human Rights Act 1998

The data collected by NHS Lancashire and South Cumbria ICB staff in the event of a safeguarding situation will be as much personal information as is necessary or possible to obtain, to handle the situation. In addition to some basic demographics and contact details, this is likely to be special category information (such as health information).

NHS Lancashire and South Cumbria ICB will either receive or collect information when someone contacts the organisation with safeguarding concerns or we believe there may be safeguarding concerns.

The information is used by NHS Lancashire and South Cumbria ICB when handling a safeguarding incident or concern. We may share information accordingly to ensure duty of care and investigation as required with other partners such as local authorities, the police, healthcare professional (i.e. their GP or mental health team).

The ICB is committed to ensuring improved outcomes for children and young people with Special Educational Needs and/or Disabilities (SEND) and is dedicated in its duty to meet the requirements of the SEND Code of Practice (2015).

Under the UK GDPR, the lawful basis we rely on to process your personal data are:

• Article 6(1)(a) ‘the Data Subject has given consent…’
• Article 6(1)(c) ‘processing is necessary for compliance with a legal obligation to which the controller is subject’
• Article 6(1)(d) ‘processing is necessary in order to protect the vital interests of the Data Subject or another Natural Person
• Article 6(1)(e) ‘the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Under the UK GDPR, the lawful basis we rely on to process your special category data are:

• Article 9(2)(a) ‘the Data Subject has given explicit consent….’
• Article 9(2)(c) ‘processing is necessary to protect the vital interests of the Data Subject or of another Natural Person….’
• Article 9(2)(g) ‘processing is necessary for reasons of substantial public interest….’
• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine….’

In order to share information legally between organisations there must be a defined and justifiable purpose that references the appropriate underpinning legislation and the associated duties and/or powers. It is therefore the responsibility of all organisations that share information that exchanges are justified and in accordance with key legislations:

Data Protection Act 2018 – Schedule 1, Section 18 & 19 – Safeguarding of children and of individuals at risk & Safeguarding of economic well-being of certain individuals

Children and Families Act 2014

Care Act 2014

Children Act 2004

Crime and Disorder Act 1998

Criminal Justice Act 2003

Mental Capacity Act (2005)

Human Rights Act 1998

The data collected by NHS Lancashire and South Cumbria ICB staff in relation to a child or young person with special educational needs and/or disabilities will be basic demographics and contact details, including special category information (such as health information) as follows:

• Name
• Address
• Date of birth
• NHS Number
• Services who see the child or young person
• Date any health needs assessments were requested
• Date any health needs assessments were returned
• Any nil or late returns of health needs assessments
• A copy of the child or young person’s Education, Health and Care Plan (EHCP)
• EHCP working documents

NHS Lancashire and South Cumbria ICB will receive or collect information from healthcare professional and/or the local authority when a local authority contacts the ICB with regards to the following statutory activity:

• A request for health information to contribute towards an assessment and/or review for an education, health and care plan.
• A request for updated health information in response to a request for mediation around a child’s education, health and care plan.
• A request for health information in response to an appeal against a decision about a child’s education, health and care plan, including formal mediation and tribunal procedures.

NHS Lancashire and South Cumbria ICB will either collect or receive information from a healthcare professional and/or the local authority when a local authority contacts the ICB with regards to undertaking a multi-agency audit of special educational needs support and/or education, health and care plans as part of ongoing service improvement.

NHS Lancashire and South Cumbria ICB will either collect or receive information from the local authority and/or healthcare professionals in response to a complaint in order to support a parent/carer of, or a child or young person with SEND.

NHS Lancashire and South Cumbria ICB may receive information in relation to complex service delivery challenges for individual children and young people for the purpose of ensuring appropriate service provision is commissioned.

The information may be shared by NHS Lancashire and South Cumbria ICB with the local authority, education settings and health professionals as part of statutory activity to support a child or young person with SEND, a multi-agency audit or in support of a query or complaint regarding a child or young person with SEND.

If any of the information received by NHS Lancashire and South Cumbria ICB indicates a risk of harm to an adult or child, NHS Lancashire and South Cumbria ICB will share this information accordingly through local safeguarding systems.

The ICB have a duty to secure continuous improvement in the quality of services provided to individuals for or in connection with the prevention, diagnosis or treatment of illness. Taking that into account, The medicines management team supports the ICB with commissioning services that make best use of available medicines. Your personal data will be used to fulfil this duty in respect of promoting cost-effective use of medicines as well as implementing projects or actions to optimise the use of medicines to improve outcomes, enhance patient safety and improve capacity within the local health economy.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine…’

Data used to fulfil the above duties is received directly from the primary and secondary healthcare providers for which the ICB has responsibility for.

Typically, clinicians and pharmacists will require access to patient information including NHS numbers and medication lists.

Personal data is shared between the ICB and local healthcare providers including GP practices. They do this to facilitate the implementation of recommendations by the Medicines Management team.

The ICB ensures that arrangements are in place for patients to be offered an appointment which best suits their needs, including time, date and location. Patients contact the ICB’s e-Referral team following an appointment with a potential referrer, such as a GP. The aim is to ensure consistency with only appropriate referrals, as set out by the relevant ICB policy, proceeding to provide services to reduce inappropriate activity.

Under the UK GDPR, the lawful basis we rely on to process your personal data are:

• Article 6(1)(c) ‘processing necessary for compliance with a legal obligation to which the controller is subject or….’
• Article 6(1)(e) ‘the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.’

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine…’

Typically, referrals received by NHS Lancashire and South Cumbria ICB contain the name, address, contact number, NHS number and unique booking reference number. Limited clinical data and referral information relating to the request may also be processed.

Typically, data is supplied to NHS Lancashire and South Cumbria ICB from local referrers, such as GPs. Data subjects or their representatives may also contact the ICB to arrange their referral.

All information held by the ICB will only be for the purposes of processing a referral or to pass on for further triage. Subsequent sharing of data may flow to and from GP practices, the e-Referral Service, the Information Funding Request Panel and acute or community providers.

The ICB has a duty to the improvement of quality and delivery of services and uses incident events, investigation, evidence and reports relating to incidents under various policy and procedural structures.

An incident requiring investigation is defined as an incident that occurred in relation to NHS funded services and care resulting in unexpected or avoidable death, harm or injury to patient, carer, staff or visitor. In order to promote quality and compliance, The ICB has several reporting protocols for incidents and provides investigation and learning to improve systems and services they commission.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(e) ‘the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.’

Under the UK GDPR, the lawful basis we rely on to process your special category data is:

• Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine…’

NHS number and other personal details, including relevant healthcare records and information about the incident, including others involved or impacted by the event are used by the ICB to facilitate incident investigations.

Data received to fulfil the duties relating to incident investigation will be received directly from the reporting organisation, such as a GP practice or provider.

Information relating to outcomes will be sent back to the relevant providers.

The Secretary of State for Health has given limited permission for us (and other NHS commissioners) to use certain confidential patient information when it is necessary for our work and unless we have a legal basis to use identifiable data, de-identified information is used for all purposes other than direct care.

This approval is given under Regulations made under Section 251 of the NHS Act 2006 and is based on the advice of the Health Research Authority’s Confidentiality and Advisory Group.

To enable us to use this data, we have to meet strict conditions that we are legally required to follow, which includes making a written commitment to NHS England that we will not use information in any way that would reveal your identity.

Under the UK GDPR, the lawful basis we rely on to process your personal data is:

• Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Under the UK GDPR, the lawful basis we rely on to process your special category data are:

• Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health….’
• Article 9(2)(j) ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes…’

We use information collected by NHS England from healthcare providers such as hospitals, community services and GPs, which includes information about the patients who have received care and treatment from the services that we fund.

The data we receive does not include patients’ names or home addresses, but it will usually include information such as your NHS number, postcode, date of birth, ethnicity and gender as well as coded information about your visits to clinics, Emergency Department, hospital admissions and other NHS services.

Organisations we may share your information with for the above purposes include:

• NHS Trusts/Foundation Trusts
• Care Homes
• GPs
• Primary Care Networks
• NHS Commissioning Support Units
• Independent Contractors such as dentists, opticians, pharmacists
• Private Sector Providers
• Voluntary Sector Providers
• Ambulance Trusts
• Clinical Commissioning Groups
• Social Care Services
• NHS England (NHSE) and NHS Digital (NHSD)
• Multi Agency Safeguarding Hub (MASH)

We do not provide services directly to children or proactively collect their personal information. However, we are sometimes given information about children while handling a complaint or conducting an investigation. The information in the relevant parts of this notice applies to children as well as adults.

NHS Lancashire and South Cumbria ICB do not use automated individual decision-making (making a decision solely by automated means without any human involvement) as standard practice. However, the Prescription Ordering Direct (POD) service can use automated decision-making for support on determining suitability for a certain medication.

NHS Lancashire and South Cumbria ICB take our duty to protect your personal information and confidentiality seriously. We are committed to taking all reasonable measures to ensure the confidentiality and security of personal data for which we are responsible, whether computerised or on paper and is held within the UK.

Alongside the Data Protection Officer (DPO), we have appointed a Senior Information Risk Owner (SIRO) who is accountable for the management of all information assets and any associated risks and incidents, and a ‘Caldicott Guardian’ who is responsible for the management of patient information and patient confidentiality.

All staff are required to undertake annual information governance training and are provided with an information governance handbook that they are required to read and agree to adhere to. The handbook ensures that staff are aware of their information governance responsibilities and follow best practice guidelines ensuring the necessary safeguards and appropriate use of person-identifiable and confidential information.

Under the NHS Confidentiality Code of Conduct, all our staff are also required to protect your information and inform you of how your information will be used. This includes, in most circumstances, allowing you to decide if and how your information can be shared.

Everyone working for the NHS is subject to the common law duty of confidentiality.  Information provided in confidence will only be used for the purposes advised and consented to by the service user, unless it is required or permitted by the law.

You have the right to be informed about the collection and use of your personal data. This privacy notice is one of NHS Lancashire and South Cumbria ICB’s key methods for providing you with this information. In addition to this notice, we will provide you with more specific information at the time we collect personal data from you, such as when you apply for continuing healthcare or make a complaint to us.

You have the right to ask us for confirmation of whether we process data about you and if we do, to have access to that data so you are aware and can verify the lawfulness of the processing.

You can make your own application to see the information we hold about you, or you can authorise someone else to make an application on your behalf.  A child’s parent or guardian, a patient representative, or a person appointed by the court may also apply. If you wish to ask us for confirmation of whether we process data about you or access your personal data, then please contact:

MLCSU Access to Information team

mlcsusars@nhs.net
01782 916875 

You are entitled to have personal data that we hold about you rectified if it is inaccurate or incomplete. If we have passed the data concerned on to others, we will contact each recipient and inform them of the rectification - unless this proves impossible or involves disproportionate effort. If this is the case, we will explain to you why.

You have the right to have personal data we hold about you erased and to prevent processing in specific circumstances:

• Where the personal data is no longer necessary in relation to the purpose for which it was originally collected/processed.
• If you withdraw your consent for us to process your data (if this was the basis on which it was collected).
• The personal data was unlawfully processed (i.e. a breach of UK data protection laws).
• The personal data has to be erased in order to comply with a legal obligation.

However, if we have collected and are processing data about you to comply with a legal obligation for the performance of a public interest task or exercise of official authority, i.e. because we have a legal duty to do so in our functioning as a ICB, then the right to erasure does not apply.

You have the right to ‘block’ or suppress processing of your personal data which means that if you exercise this right, we can still store your data but not to further process it and will retain just enough information about you to ensure that the restriction is respected in future.

You can ask us to restrict the processing of your personal data in the following circumstances:

• If you contest the accuracy of the data, we hold about you we will restrict the processing until the accuracy of the data has been verified;
• If we are processing your data as it is necessary for the performance of a public interest task and you have objected to the processing, we will restrict processing while we consider whether our legitimate grounds for processing are overriding.;
• If the processing of your personal data is found to be unlawful but you oppose erasure and request restriction instead; or
• If we no longer need the data we hold about you, but you require the data to establish, exercise or defend a legal claim.

If we have disclosed the personal data in question to others, we will contact each recipient and inform them of the restriction on the processing of the personal data - unless this proves impossible or involves disproportionate effort. If asked to, we must also inform you about these recipients.

We will inform you if we decide to lift a restriction on processing.

The right to data portability allows you to obtain and reuse your personal data for your own purposes across different services. It allows you to move, copy or transfer personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability although it only applies where we are processing your personal data based on your consent for us to do so or for the performance of a contract and where the processing is carried out by automated means. This means that currently, the ICB does not hold any data which would be subject to the right to data portability.

Where the ICB processes personal data about you on the basis of being required to do so for the performance of a task in the public interest/exercise of official authority, you have a right to object to the processing.

You must have an objection on grounds relating to your particular situation.

If you raise an objection, we will no longer process the personal data we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing is for the establishment, exercise or defence of legal claims.

The ICB does not use automated individual decision-making (making a decision solely by automated means without any human involvement) as standard practice. However, the Prescription Ordering Direct (POD) service can use automated decision-making for support on determining suitability for a certain medication.

If the ICB processes data about you on the basis that you have given your consent for us to do so, you have the right to withdraw that consent at any time. Where possible, we will make sure that you are able to withdraw your consent using the same method as when you gave it.