The browser you are using is no longer supported. Please switch to Edge or Chrome

Privacy notice

This privacy notice is to inform you of the type of information that we hold, who it might be shared with and how it is used and stored.


The health and social care system is facing significant pressures due to the COVID-19 outbreak. In the current circumstances it could be more harmful not to share health and care information than to share it.

NHS Kernow and its partner organisations will be working in different ways from usual whilst following guidance from NHS England, NHS Information, the National Data Guardian, NHS Digital and endorsed by the Information Commissioner.

Information is critical to support health and social care services, protect public health, research, monitor, track and manage the outbreak and incidence of exposure. A notice was issued by Secretary of State using existing Control of Patient Information Regulations 2002 which allows us and our partner organisations to lawfully use confidential patient information for purposes relating to COVID-19

The notice included a non-exhaustive list of COVID-19 related purposes. The effect of the notice is that any processing which is undertaken in pursuance of those purposes will be deemed lawful irrespective of any limitations which the common law duty of confidentiality would ordinarily impose. This is, however, subject to some specific caveats as set out in the COPI Regulations themselves. These include that organisations’ use of the information is limited to that which is necessary for the particular purpose. In addition, that as far as is practical individual identifiers are removed if they are not required for the purpose.

This notice remains in place until 30 June 2022 at which time a review of arrangement will take place.

It is essential that during the COVID-19 outbreak health and social care professionals can talk to each other. Health organisations will need to share appropriate information about patients. It is important to note that national data opt out will not apply under current circumstances.

The Cornwall and Isles of Scilly Health and Care Partnership are responding to the COVID-19 pandemic to provide real-time, live reporting functionality across public health, adult social care, primary care, community and acute services, together with support and voluntary services. The ability to share data, resource and capabilities at this time of unprecedented demand is vital.

General Data Protection Regulations

The UK General Data Protection Regulations (UK GDPR) allows information to be shared for individual care, planning and research when health and care information is shared for either individual care or to help tackle disease through research and planning. Article 6 and Article 9 of UK GDPR make allowances for this.

How we use your data

What we do

NHS Kernow is responsible for planning, buying and monitoring (also known as commissioning) health services from healthcare providers, such as hospitals and GP practices. We also have a performance monitoring role of these services to ensure the highest quality of healthcare, which includes responding to any concerns from our patients on services offered.

The purpose of this notice is to inform you of the type of information (including personal information) that NHS Kernow holds, how that information is used, who the information may be shared with, how it is kept secure and confidential and what your rights are in relation to this.

Person identifiable information or data relates to a living individual who can be identified from that data and/or other information. This information may already be in our possession or is likely to come into our possession. It includes any expression of opinion about the individual and any indication of our intentions.

In line with the requirements of the first principle of the NHS Constitution, the requirements of the Equality Act 2010 including the public sector Equality Duty, and the clinical commissioning group (CCG) improvement and assessment framework, NHS Kernow collects and monitors equality and diversity information about members of the public and staff.

Identifiable information may be gathered with the consent of staff or patients. Identifiable and non-identifiable information may be gathered for purposes listed below:

  • working fairly, to ensure that no one is being discriminated against
  • treating people with respect
  • operating honestly
  • ensuring people can access services when they need them

To assist with meeting the above values and responsibilities, NHS Kernow also gathers information from members of the public, partner organisations and contractors which may be in the form of anonymised information or statistical analysis.

Why we hold information about you

The purpose of gathering information is to make sure funding for health and care services is targeted where it is needed the most, to ensure appropriate care and treatment is provided where and when it is needed, is of the highest standards and, people can lead longer, healthier lives. For example, services are commissioned or provided from hospitals, community health services, GPs and dentists.

You can read more about each of these roles by visiting the websites for those organisations or selecting the internet links which are contained within this privacy notice.

The collection of accurate information about you is vital in assisting your GP, primary care team and NHS Kernow in providing you with the right services and health care for your needs. This enables you to be given appropriate information about your care, to make informed choices and where possible improve the services you receive.

Records may be electronic, paper or a mixture of both and may be used in combination or separately, with working practices and technology to ensure that your information is kept confidential and secure.

All health and social care organisations and their staff are committed to protecting your privacy, will only use information collected lawfully in accordance with the Data Protection Act 2018 and will not use any information held about you for purpose other than that described when it was collected, unless your consent has been obtained first.

Keeping information secure and confidential

All staff have contractual obligations of confidentiality, enforceable through disciplinary procedures. Staff with access to patient identifiable information have received appropriate ongoing data security and protection training to ensure they are aware of their responsibilities and our staff are only granted access to personal data on a need-to-know basis only.

We also honour any duty of confidence attached to information and apply Common Law Duty of Confidentiality requirements. This will mean where a legal basis does not exist to use your personal or confidential information we will not do so.

NHS Kernow abides by the GDPR which enables the sharing of personal information, where appropriate, with other European Union countries. Information collected will not be sent to any other countries where the laws do not protect your privacy to the same extent as that required by GDPR, where standard contract clauses are in place and there is an approved secure transfer mechanism. Unless required to do so by law, your information will not be shared, sold or distributed to any third party without your consent.

The care record guarantee is the commitment that all NHS organisations and those providing care on behalf of the NHS will use records and information about you in ways that respect your rights and promote your health and wellbeing. Everyone who works for the NHS or for organisations delivering services under contract to the NHS must comply with this guarantee.

We make sure the information we hold is stored securely and access to it is restricted to authorised personnel. We have organisational and technical security in place to protect personal and confidential information. For example, using encrypted laptops and being especially carefully with disposal of items, like paperwork, computer disks and memory sticks.

How information is used

We use the following types of information and data:

  • identifiable (containing details that identify individuals)
  • pseudonymised which is about individuals but with identifying details (such as name or NHS number) replaced with a unique code; the linked data sets may be used in this way:
    • to gain an understanding of local population health and care needs and will be used to support the co-production of a range of different scenarios of service configuration across the local community to meet these needs
    • health and care service modelling to support an understanding of the impact different configurations of providing health and care services could have on patient outcomes, the numbers, types and skill sets of practitioners, the types of activity per setting of care and the cost implications, supporting the sustainability of the health and care system
  • anonymised (about individuals but with identifying details removed)
  • aggregated (information grouped together so that it does not identify individuals)

Definition of data types

This section provides definitions for key terms which are used throughout this text to describe different data types.

Anonymised data which is data about you but from which you cannot be personally identified.

De-identified data with pseudonym identifier, which is data about you, but we can track you through the patient pathway without using your personal information, and you cannot be personally identified.

De-identified data with weak pseudonym identifier such as the NHS number. We use this to link 2 or more types of datasets together using your NHS number. For example, using your NHS number to link and analyse datasets such as acute data with community data to see the full picture of your patient pathway. No other personal information is used during this process, and you will not be personally identified. However, there may be times whereby you may be re-identified in the event of patient safety requirements or re-identified for direct care purposes where we pass on information to your GP to treat you.

Anonymised in context data (for commissioning purposes), which is de-identified data about you, but you cannot be personally identified within a commissioning environment. You may be personally identified if this data was available to a hospital or your GP. Like the above, we replace the NHS number with a locally generated pseudonym like an information system number.

Anonymised statistical information may also be passed to organisations with a legitimate interest, including universities, community safety units, and research institutions to help with future development of services.

Examples of how this information is used:

  • working out what illnesses people will have in the future so we can all work with the local primary care services, community services and hospital services to ensure that patient needs are met now and, in the future
  • planned hospital care
  • rehabilitation care
  • some mental health and learning disability services
  • responding to patient concerns about services
  • checking accounts and services
  • audit and public health services

We use anonymised data to plan health care services. Specifically, we use it to:

  • check the quality and efficiency of the health services we commission
  • prepare performance reports on the services we commission

Some of the areas where personal information will be used are:

  • to provide direct patient care
  • referral management processes to ensure you are referred to the right service when requested by your GP
  • individual funding requests (a process where patients and their GPs or consultants can request special treatments not routinely funded by the NHS)
  • continuing healthcare assessments (a package of care for those with complex medical needs)
  • responding to your queries, concerns or complaints
  • assessment and evaluation of safeguarding concerns for individuals
  • incident investigations
  • where there is an overriding public interest
  • where we have gathered your consent
  • when there is a legal requirement for us to do so

NHS Kernow also processes personal information in relation to the staff it employs (and contractors it works with). Collecting equality and diversity information helps NHS Kernow to know whether it is:

  • recruiting employees who may be disadvantaged or under-represented
  • broadly representative of our local population
  • promoting people fairly, whatever their background
  • checking that men and women’s pay is comparable
  • making progress towards the aims set out in our equality work

Further information regarding the confidentiality of staff information can be found towards the end of this privacy notice.

What is primary care data and secondary care data?

Around 90% of public contact with the NHS is with primary care services. Primary care includes services such as those provided by GP practices, dental practices, community pharmacies and high street optometrists. Primary care data relates to information which has been sourced from these types of services.

Secondary care covers the treatment and care provided by specialised medical services. These include specialist doctors and nurses, within a health facility or hospital that may have been made via a referral from your primary care clinician (for example your GP). Secondary care data relates to information which has been sourced from these types of services.

Data linking

When reviewing current health services and proposals for developing future services it is sometimes necessary to link separate individual datasets to be able to produce a comprehensive report. This may involve linking primary care GP data with other data such as secondary use service data which covers attendances at a secondary care provider. For example, an emergency department outpatient attendance, an emergency or planned inpatient stay.

In some cases, there may also be a need to link local datasets which could include a range of acute hospital services such as radiology, physiotherapy, audiology, as well as mental health and community-based services. This linked data may be used to improve access to psychological therapies (IAPT), district nursing, podiatry.

When carrying out this type of review, the linkage of these datasets is always done using a unique identifier that does not reveal a person’s identity.

NHS Digital

The law provides some NHS bodies, particularly NHS Digital, to collect sensitive personal data directly from care providers for secondary purposes, such as assessing care provided at population level.

The dataset collected by NHS Digital from secondary care providers, for example hospitals is referred to as the secondary uses service. This is the single, comprehensive storage place for healthcare data in England which enables a range of reporting and analyses to support the NHS in the delivery of healthcare services.

When a patient or service user is treated or cared for, information is collected which supports their treatment.

Data may be de-identified and linked by these special NHS bodies so that it can be used to improve health care and development and monitor how the NHS is performing. When data is used for these statistical purposes, very strong security measures are taken to ensure individual patients cannot be identified.

The Data Services for Commissioners Regional Offices (DSCRO) is a specialist data processor acting on behalf of commissioners such as NHS Kernow and have legal basis to receive data from NHS Digital.

The following types of organisations send data to NHS Digital. Data from NHS Digital is sent to DSCRO in an anonymised format or a de-identified format with NHS number to link and analyse the data.

Acute trust hospitals

For example, Royal Cornwall Hospital NHS Trust and University Hospitals Plymouth NHS Trust. NHS Digital receive anonymised acute data such as emergency department attendances, waiting times, diagnosis, treatments, and follow-ups, length of stay, discharge information and next steps.

Community trusts or community organisations

For example, Cornwall Partnership NHS Foundation Trust. NHS Digital receive anonymised community data such as outpatient information, waiting times, diagnosis and treatments, referrals and next steps, domiciliary and district nursing (which includes home visits) and community rehabilitation units.

Mental health trusts or mental health organisations

For example, Cornwall Partnership NHS Foundation Trust for Cornwall. NHS Digital receive anonymised mental health data such as rehabilitation and outpatient attendances, waiting times, diagnosis, treatment, length of stay, discharge, referrals and next steps.

Primary care organisations

For example, your local GP practice. NHS Digital receive anonymised primary care data such as attendances, diagnosis, treatment, GP or GP practice visits, referrals, medication and prescriptions information and follow-ups.

As a commissioner, we are required by law to report certain information to the appropriate authorities such as NHS Digital. The information may include basic details about you, such as your name and address, NHS number and date of birth but in some instances may also contain more sensitive information about your health and information such as outcomes of needs assessments. There may be a performance monitoring role of services, which includes responding to any concerns from patients and/or the public on the services offered and which are dealt with through, for example, complaints department.

Sensitive personal data is personal data consisting of information as to:

  • racial or ethnic origin of the individual
  • political opinions
  • religious or philosophical beliefs or other beliefs of a similar nature
  • trade union membership (within the meaning of the Trade Union and Labour Relations (Consolidation) Act 1992)
  • genetic data, for example those aspects relating to the inherited or acquired genetic characteristics
  • biometric data when used for identification purposes, for example fingerprint scanning or facial recognition
  • physical or mental health condition
  • sexual life
  • commission or alleged commission of any offence
  • any proceedings for any offence committed or alleged to have been committed, the disposal of such proceedings or the sentence of any court in such proceedings

Data processors

We may contract with other organisations to process data on our behalf. These organisations are known as data processors. We ensure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.

NHS Kernow also uses the following data processors:

  • Royal Cornwall Hospital NHS Trust for purposes of staff payment, pensions, recruitment, occupational health and IT support services
  • Cornwall Partnership Foundation NHS Trust for records management and archiving services
  • DSCRO for data linkage purposes (for NHS Kernow this is the NHS South, Central and West Commissioning Support Unit)

This is how all the above processing works.

Invoice validation

There may be times when one healthcare organisation will need to invoice another healthcare organisation for treatment given to a patient. This can occur, for example, when a patient needs hospital treatment while away from home on holiday. The hospital at which the patient is seen may need to invoice the patient’s own CCG for the treatment they received.

Before paying, the CCG will need to be sure that they are responsible for the patient and that the amount they are being billed for is correct. This process is known as invoice validation. For invoice validation to occur, a limited amount of information about the patient needs to be shared between the organisations concerned.

The use of your information for this purpose has been allowed under section 251 of the NHS Act 2006, for more information visit the Health Research Authority website.

Risk stratification

Your GP uses your data to provide the best care they can for you. As part of this process your GP will use your sensitive personal data to undertake risk stratification, also known as case finding.

Risk stratification is a process that uses personal data from health care services to determine which people are at high risk of experiencing certain outcomes, such as unplanned hospital admissions.

Risk stratification tools can be useful in analysing the overall health of a population (known as risk stratification for commissioning) and for identifying which patients should be offered targeted preventative support to reduce those risks (known as risk stratification for case finding). These tools use a mix of limited historical information about patients (such as age, gender, diagnoses, and hospital attendance) as well as data collected in GP practices.

Your GP surgery uses the services of the DSCRO, NHS South, Central and West Commissioning Support Unit to identify those most in need of preventative or improved care. NHS Kernow arranges this contract.

Neither NHS Kernow nor the DSCRO will at any time have access to your personal or confidential data. They act on behalf of your GP to organise this service with appropriate contractual and security measures only.

The DSCRO will process your personal and confidential data without any staff being able to view the data. Typically, they will process your data using indicators such as your age, gender, NHS number and codes for your medical health to identify those patients who will benefit from clinical intervention. Processing takes place automatically and without human or manual handling. Data is extracted from your GP computer system, automatically processed and only your GP can view the outcome, matching results against patients on their system.

We have implemented strict security controls to protect your confidentiality and recommend this as a secure and beneficial service to you. At all times, your GP remains accountable for how your data is processed. However, if you wish, you can ask your GP for your data not to be processed for this purpose and your GP will mark your record as not to be extracted so it is not sent to the DSCRO for risk stratification purposes.

Your GP will provide information about any risk stratification programmes they are planning to use. The GPs can use their data to identity which of their patients would benefit from a certain preventative service. Risk stratification is a helpful tool to support GPs in identifying patients at risk.

The lawful basis to use this information for risk stratification has been allowed by section 251 NHS Act 2006 and is processed by the DSCRO or other approved providers only.

Information sharing with non-NHS organisations

Information may be required to be shared for your benefit with non-NHS organisations, from which you are also receiving care. These organisations would include social services, out- of-hours-service, NHS 111, or other providers from whom services are commissioned. Where information sharing with third parties is required, health information will not be disclosed without your explicit consent. However, there could be exceptional circumstances such as when the health or safety of others is at risk or to help to resolve critical incidents. There could be a need to share information with the local authority and care providers to provide co-ordinated packages of care. This is very important when information is needed to facilitate patient discharge in the event of acute hospital bed shortage; or where the law requires it.

We may be asked to share basic information about you, such as your name and address which does not include sensitive information. This would normally be to assist other organisations to carry out their statutory duties. In these circumstances, where it is not practical to obtain your explicit consent, we are informing you through this notice, which is referred to as a privacy notice, under the Data Protection Act (2018).

Non-NHS organisations may include, but are not restricted to:

  • education services
  • local authorities
  • police
  • voluntary and private sector providers

We will not share information about you for any reason unless:

  • you have consented for us to do so
  • where a formal court order has been served on us
  • to assist the police in the prevention and detection of crime
  • to protect children and vulnerable adults
  • we have special permission for health and research purposes (granted by the Health Research Authority)
  • for the health and safety of others, for example to report an infectious disease such as meningitis or measles

Patient rights

If NHS Kernow is processing an individual’s personal data, they have the rights to:

  • be informed
  • gain access
  • request rectification
  • request erasure
  • restrict processing
  • request data portability
  • object to processing
  • be informed about automated decision-making and profiling

These rights are set out in the Data Protection Act 2018, the Common Law Duty of Confidentiality and the NHS Constitution. For more information visit the Information Commissioners website.

Your right to withhold consent to share your information is not absolute. In exceptional circumstances where you are unable to do this NHS Kernow will always explain the reason and any sharing will be done in accordance with duties and responsibilities laid out within the Data Protection Act 2018.

When your request to withhold consent is respected and carried out, please be aware this may adversely affect the care you currently receive or may receive in the future. Always consult your GP or relevant health professional before deciding to withhold consent to sharing your information, as they will be able to advise you on the possible outcomes of this decision.

The national data opt out

You can choose whether your confidential patient information is used for research and planning.

Patients have a right under the NHS Constitution to request that their personal confidential data is not used beyond their direct care and the national data opt-out provides an easy and accessible way for patients to exercise this right.

You do not need to do anything if you are happy about how your confidential patient information is used. You can change your choice at any time.

National data opt-outs are not recorded at the GP practice and instead you can change your national data opt-out using the link to the webpage above.

All health and care organisations in England are required to apply your national data opt-out by March 2020, including hospitals and GP practices.

Young adults from the age of 13 can set and change their own national data opt-out.

NHS Kernow, as a data controller, must take note and apply national data opt-outs whenever confidential patient information is to be shared either internally or outside the organisation. The national data opt-out does not apply to information that is anonymised or is aggregate or count type data.

How can you access your records?

Under the Data Protection Act 2018 (and for relatives of deceased patients, the Access to Health Records Act 1990), you are entitled to receive copies of all personal information held about you. Each organisation has 30 days to provide the requested information. If it is complex, a further 2-month extension may be required.

Any requests made will be managed by the organisation to which you apply. You do not need to give a reason. If you want to access your records you should make a written request to (or contact by phone) the NHS organisation(s) where you are being or have been, treated or have been in contact with. You should also be aware that in certain circumstances your right to see some details in your health records may be limited in your own interest or for other reasons.

For information held by NHS Kernow please complete a subject access request.

The following websites may also provide useful information:

Facilities may be available to allow you to view parts of your health record via computer. Whilst there is no charge for the first copy of your record, NHS Kernow may be entitled to charge a reasonable amount for any further copies requested.

Caldicott Guardian and senior information risk owner

We have assigned a Caldicott Guardian and senior information risk owner who have oversight of the handling of personal and confidential information within NHS Kernow as well as offering support to the organisations we may buy services from.

The Caldicott Guardian is a clinical director with responsibility for protecting the confidentiality of patient information and enabling appropriate information sharing. The senior information risk owner is the director accountable for information risk. Both roles are supported by the head of information governance and the information governance sub-committee which meets regularly to discuss issues related to information governance. The group is formed of senior representatives from teams within NHS Kernow and is chaired by the deputy director of finance. The head of information governance also fulfils the data protection officer role for the organisation.

The Caldicott Guardian is a director with responsibility for protecting the confidentiality of patient information and enabling appropriate information sharing. The senior information risk owner is the director accountable for information risk. Both roles are supported by the information governance sub-committee which meets regularly to discuss issues related to information governance. The group is formed of senior representatives from teams within NHS Kernow and is chaired by the deputy director of corporate governance. The deputy director of corporate governance also fulfils the data protection officer role for the organisation.

Our Caldicott Guardian, senior information risk owner and data protection officer can be contacted at the address and telephone number below.

Employee information

We collect information about people who work for us for the following purposes:

  • administration of prospective, current and past employees including self-employed, contract personnel, temporary staff or voluntary workers
  • recruitment and selection process
  • administration of non-NHS Kernow staff contracted to provide services on our behalf
  • planning and management of our workload or business activity
  • occupational health service
  • administration of agents or other intermediaries
  • payment or pensions administration
  • declarations of interest including gifts and hospitality received or refused
  • appraisal, sickness, grievance, disciplinary matters, staff disputes, employment tribunals
  • staff training and development
  • ensuring staff are appropriately supported in their roles
  • vetting checks and security purposes such as photo identity of staff
  • assessing our performance against equality objectives as set out by the Equality Act 2010
  • staff and workforce information is used for scenario modelling to support planning of future service provision

Members of staff can apply for a copy of the records we hold about them by following the same processes outlined above in how you can get access to your records.

How long we will keep your information and how we will destroy information

There are different retention schedules for different types of information and types of record. In the NHS, all commissioners and providers apply retention schedules in accordance with the Records Management Code of Practice.

When destroying personal data we ensure that we, or third parties we contract to destroy data on our behalf, meet guidelines set out within principle 5 (storage limitation) of the Data Protection Act 2018, the European Standard EN 15713 for paper copies and standards for secure destructions of electronic data.

Managing conflicts of interest

We manage conflicts of interest as part of our day-to-day activities. Effective handling of conflicts of interest is crucial to give confidence to patients, taxpayers, healthcare providers and parliament that NHS Kernow commissioning decisions are robust, fair, transparent and offer value for money. It is essential to protect healthcare professionals and maintain public trust in the NHS. Failure to manage conflicts of interest could lead to legal challenge and even criminal action in the event of fraud, bribery and corruption.

Section 14O of the National Health Service Act 2006 (as amended by the Health and Social Care Act 2012) (the Act) sets out the minimum requirements of what both NHS England and CCGs must do in terms of managing conflicts of interest. More recent conflict of interest guidance was issued for CCGs by NHS England in June 2017.

NHS Kernow is required to publish its registers of interests detailing the declarations of all staff and others working with NHS Kernow. There is a process for exempting publication of individual declarations in certain exceptional and approved circumstances.

Questions or concerns

If you have any questions or concerns about the information held about you or how it is used, you can get in touch by post, e-mail or via online feedback forms.

Further information can also be obtained from the Data Protection Act 2018, GDPR and the Information Commissioners Office.

The following links may be useful:

Changes to this privacy notice

We keep our privacy notice under regular review. This privacy notice was last updated in March 2022.

Contact us

You can write to or call us about our privacy notice.

Head of information governance
NHS Kernow Clinical Commissioning Group
Room 210, Cornwall Council offices,
39 Penwinnick Road, St Austell PL25 5DR

Call 01726 627800.

Google Translate

Text Size

Change font