Privacy Notice for Public Health services
Solihull Metropolitan Borough Council is a data controller for the purposes of the Data Protection Act. The Public Health team of Solihull Metropolitan Borough Council also has a legal status allowing the processing of Personal Confidential Data for certain Public Health purposes. The use of such data will be restricted so that the principles contained in the Data Protection Act 1998 are fully adhered to. The legal basis is section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act (2012) and regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.
All Local Authorities have a duty to improve the health of the population they serve. To help with this, we use data and information from a range of sources, including data collected at the registration of a birth or death, to understand more about the health and care needs in the area. Public Health teams within Local Authorities are also required to commission and manage services for their population.
Who do we collect information about?
Solihull Metropolitan Borough Council Public Health collects and holds information for public health purposes about:
- residents of Solihull
- people receiving health and care services in Solihull
- people who work or attend school in Solihull
all of whom it has a public health duty of care
How do we collect this information?
This information is collected in two ways:
- It may be provided to us directly by a member of the public when they sign up to use a service we are providing.
- It may be shared with us by another organisation due to us being part of a service they are providing, or as part of research and intelligence necessary for Public Health functions, such as informing decisions on the design and commissioning of services. This will include organisations such as Office for National Statistics, NHS Digital, national and local NHS bodies and Clinical Commissioning Group, local authorities and schools.
What specific information do we hold and how do we use it?
Solihull Metropolitan Borough Council Public Health team uses personal identifiable information about residents and users of health care, to enable it to carry out specific functions for which it is responsible, such as:
- control of infection
- managements of risks to public health
- organising the National Child Measurement Programme
- organising and supporting the NHS Health Check Programme
- organising and supporting the 0-5 health service and school nursing services.
- organising and supporting lifestyle services provided by Solihull Active (part of the Solihull public health team)
Personal data means data which relate to a living individual who can be identified from the data or from that data and other information held by the data controller (i.e. it can be linked to become identifiable).
The Public Health team also uses the information to derive statistics and intelligence for research and planning purposes, which include:
- producing assessments of the health and care needs of the population, in particular to support the statutory responsibilities of the:
- Joint Strategic Needs Assessment (JSNA)
- Director of Public Health Annual report
- Health and Wellbeing Strategy
- identifying priorities for action
- informing decisions on (for example) the design and commissioning of services
- to assess the performance of the local health and care system and to evaluate and develop them
- to report summary statistics to national organisations
- undertaking equity analysis of trends, particularly for vulnerable groups
- to support clinical audits
In these cases, the information is used in such a way that individuals cannot be identified and personal identifiable details are removed as soon as possible in the processing of intelligence.
This information includes:
- Contact details
- NHS number
- geographic codes, such as postcodes, for the analysis of health inequalities
- date of birth
- information from birth and death certificates (persona identifiable information from NHS Digital used for public health purposes)
- information about the provision of Public Health services including:
- control of infection
- drug and alcohol treatment services
- sexual health services
- 0-5 health services
- school nursing services
- National Child Measurement Programme
- lifestyle and behaviour change services
- cancer screening
- other screening programmes
- public health initiatives
- information about lifestyles behaviours, including data collected from surveys
- information about disease prevalence including cancer registrations
- information about health and social care use, including:
- GP services
- Hospital services
- NHS community services
- Mental Health services
- Social care services
How do we keep information secure and who do we share it with?
We are required to comply with the Data Protection Act to ensure information is managed securely and this is reviewed every year as part of our NHS Information Governance Toolkit assessment.
Any personal identifiable data is sent or received using secure email. All data is stored electronically on secure equipment and is managed using the principles of medical confidentiality and data protection. The number of staff accessing and handling such data is limited to only those key professionals named on relevant signed information sharing agreements (where applicable), all who of whom undertake regular training about data protection and managing personal information.
Confidential public health data will only be shared with other areas of the NHS, local authorities or care organisations with the permission of the Caldicott Guardian, once the necessary legal basis has been established and data protection safeguards have been verified, so that the data is managed and used under the same restrictions. Anyone who receives information from Solihull Metropolitan Borough Council Public Health is also under a legal duty to keep it confidential.
In relation to births and deaths, the data will only be processed by Local Authority employees in fulfilment of their public health function, and will not be transferred, shared, or otherwise made available to any third party, including any organisations processing data on behalf of the Local Authority or in connection with their legal function.
We only keep hold of information for as long as is necessary. This will depend on what the specific information is and the agreed period of time. Data is permanently disposed of after this period, in line with Solihull Metropolitan Borough Council’s Retention Policy/Schedule or the specific requirements of the organisation who has shared the data with us.
How to opt out
You have the right to opt out of Solihull Metropolitan Borough Council Public Health receiving or holding your personal identifiable information.
There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues.
The process for opting out will depend on the specific data is and what programme it relates to. For further information, please contact the Public Health team:-
- by email: PHC@solihull.gov.uk
- by post: Department of Public Health, Solihull Metropolitatin Borough Counci, Manor Square, Solihull, B91 3QB.
- by telephone: 0121 704 8000 and ask to be put through to Public Health
How to find further information
Solihull Public Health team is part of Solihull Metropolitan Borough Council. The Council is registered as a Data Controller with the Information Commissioner’s Office (Registration Number Z5888433) under the Data Protection Act. Further details about how the Council processes personal data can be found in our registration via the Information Commissioner’s Office website https://ico.org.uk/. The Council’s NHS Information Governance Toolkit status can be found at https://www.igt.hscic.gov.uk.
Visit the council’s Statistics and Data section on the website http://www.solihull.gov.uk/solihulldata or write to: Information Governance Team, Solihull Metropolitan Borough Council, Manor Square, Solihull, B91 3QB.