Herefordshire Public Health Services privacy notice - Privacy notices

All local authorities have a duty to improve the health of the population they serve. Herefordshire Council provides public health services for the county and is responsible for protecting and improving the health of the population throughout Herefordshire. To do this we provide a range of services (such as those to help people make a lifestyle change and contraceptive services), provide guidance and advice to the public and professionals (such as about infections) and monitor and publish intelligence about trends in health to help the NHS and other providers design services that meet the needs of the residents of Herefordshire.

To help with this, we use data and information from a range of sources, including data collected at the registration of a birth or death, to understand more about the health and care needs in the area.

Herefordshire Council collects and holds information for public health purposes about:

• Residents of Herefordshire
• People receiving health and care services in Herefordshire
• People who work or attend school in Herefordshire
• All to whom it has a public health duty of care

How we collect this information

This information is collected in two ways:

• It may be provided to us directly by a member of the public when they sign up to use a service we are providing.
• It may be shared with us by another organisation due to us being part of a service they are providing, or as part of research and intelligence necessary for Public Health functions, such as informing decisions on the design and commissioning of services. This will include organisations such as Office for National Statistics, NHS Digital, national and local NHS bodies and Clinical Commissioning Group, Public Health England, local authorities and schools.

What data we collect

In order to perform specific Public Health functions for which it is responsible Herefordshire Council uses personal identifiable information[1] about residents and users of health care. This includes:

• Control of infection
• Managements of risks to public health
• Organising the National Child Measurement Programme
• Organising the NHS Health Check Programme
• Organising and supporting the 0-5 health service and school nursing services.

The information is used to derive statistics and intelligence for research and planning purposes. This includes:

• Producing assessments of the health and care needs of the population, in particular to support the statutory responsibilities such as the Joint Strategic Needs Assessment (JSNA), the Director of Public Health Annual report and the Health and Wellbeing Strategy
• Identifying priorities for action
• Informing decisions on (for example) the design and commissioning of services
• To assess the performance of the local health and care system and to evaluate and develop them
• To report summary statistics to national organisations
• Undertaking equity analysis of trends, particularly for vulnerable groups
• To support clinical audits

In these cases, the information is used in such a way that individuals cannot be identified from them and personal identifiable details are removed as soon as is possible in the processing of intelligence. Such personal identifiable data includes:

• Contact details
• NHS number
• Geographic codes such as postcodes for the analysis of health inequalities
• Date of birth
• Information from birth and death certifications (personal identifiable information from NHS Digital used for public health purposes).
• Information about the provision of Public Health services including:
  • Immunisations
  • Control of infection
  • Drug and alcohol treatment services
  • Sexual health services
  • 0-5 health services
  • School nursing services
  • National Child Measurement Programme
  • Lifestyle and behaviour change services
  • Cancer screening
  • Other screening programmes
  • Public health initiatives
• Information about lifestyle behaviours, including data collected from surveys
• Information about disease prevalence including cancer registrations
• Information about other health statuses including blood pressure
• Information about health and social care use, including:
  • GP services
  • Hospital services
  • NHS community services
  • Mental health services
  • Social care services

These data are provided to Public Health Service either direct from the public (with consent) or by national and local NHS and Local Authority data services and organisations and shared with Public Health in accordance with the Data Protection Act 2018 and GDPR principles.

Herefordshire Council is a data controller for the purposes of the General Data Protection Regulations (GDPR) and the Data Protection Act 2018. The Public Health team of Herefordshire Council process of personal data for specific Public Health purposes. The use of such data will be restricted so that the principles contained in the Data Protection Act 2018 and GDPR are fully adhered to. The legal basis is section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act (2012) and regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

Information provided direct by members of the public to Herefordshire Council is collected in appropriate systems and used to provide or administrate that service. These systems are access controlled, so only relevant employees have access to them. With consent we may also make referrals to other services, such as a GP from these systems. Information provided by other national and local NHS and Local Authority data services and organisations is stored in secure systems within the Council network in line with the NHS Information Governance framework. All staff are regularly trained to understand the importance of and their duty towards protecting data and good information governance procedures.

Confidential Public Health data will only be shared with other local NHS or care organisations, once the necessary legal basis has been established and data protection safeguards have been verified, so that the data is managed and used under the same restrictions. Anyone who receives information from Herefordshire Council is also under a legal duty to keep it confidential.

We sometimes cross reference data between systems, always in accordance with the Data Protection Act 2018 and General Data Protection Regulations 2016 and wherever possible using non identifiable data. For example information from death certificates may be used with information from healthcare provider records (GPs and hospital) to investigate the events leading up to the death, to see if there are lessons to be learnt. In the event of a suspected suicide, next of kin information may be shared, with their consent, to bereavement support services.

We will only keep your information for the minimum period necessary. The information outlined in this privacy notice will be kept for up to 10 years. All information will be held securely and destroyed under confidential conditions.

You have a number of rights under data protection law, including the right to request your information and to request that the information be amended or erased if incorrect.

To request your records, you will need to put your request in writing and provide proof of identification to the Information Governance Team, Herefordshire Council, Plough Lane, Hereford HR4 0LE or via email to informationgovernance@herefordshire.gov.uk

You also have a right to make a complaint about our handling of your personal data to the Information Commissioner's Office

If you have any questions or concerns about how your information is used, please contact researchteam@herefordshire.gov.uk in the first instance. You can also contact the Data Protection Officer, Herefordshire Council, Plough Lane, Hereford HR4 0LE, email: informationgovernance@herefordshire.gov.uk

More information about data protection and how it applies to you can be found on the Information Commissioner's Office website.

Health and wellbeing section