Data Controller: Processing for the Coding Review Service

Fair processing notice

The Summary Hospital Mortality Indicator (SHMI) - has increased steadily over the last three years and the Trust is currently undertaking a review looking at ways of improving this and fully understands the reasons behind this increase. This includes looking at both clinical care and the data.

As a part of this work, the Trust has engaged with an external expert, Price WaterHouse Cooper LLP (PWC), to undertake some work on our behalf relating to the Trusts hospital mortality statistics.

In order to support this work, the Trust will be sharing data in a pseudonymised form (removing any identifiable elements), comprising of all inpatient episodes and discharge data, with PWC, who will then use analytics to analyse data and return outcomes to help the Trust to improve.

This work will start from November 2018 and will be provided on a monthly basis for the next three years.

What is the purpose of this data sharing?

At RWT we aim to provide you with safe and effective care to the highest standards. To do this your doctor and the team of health professionals caring for you will keep records about your health and any care you receive from the Trust. From this all patient episodes are ‘coded’ to help the Trust identity activity which assists the Trust in effectively managing your care and the quality of our services.

The PWC coding review is aimed a reviewing all coded inpatient episodes to identify possible missing / potentially coded diagnosis /procedures. The output will be shared with the Trust to ensure your record is accurate.

Return to top

How do we use this and what is the legal basis?

As a data controller the Trust must establish and publish the lawful basis that is relied on for processing personal data and data that is special categories (sensitive data). The following table indicates for the main processing legal basis that the Trust is relying on for this activity.

Type of processing	GDPR Article 6 Condition for personal data	GDPR Article 9 Condition for special categories (sensitive data)
Lawful basis for direct care and administrative purposes All health and adult social care providers are subject to the statutory duty to share information about a patient for their direct care. This would also include: (d) the provision of health care or treatment, (f) the management of health care systems or services (h) performance against national targets (i) activity monitoring	6(1)(e) ‘…for the performance of a task carried out in the public interest or in the exercise of official authority…’	9(2)(h) ‘…medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems…’

Return to top

Who do we share your information with?

Identifiable information will only be shared with internal teams within the Trust, in order to prepare data sets and strip out any identifiers. This will be limited to a small team of up to 4 people. Once data is stripped of identifiers it will be shared via a secure portal with a contact at PWC, in a pseudonymised form.

This will be done with protocols or agreements in place to govern the sharing of data to ensure it is adequate and relevant to the purpose listed above.

Return to top

Who and where do we obtain your information from?

The Trust will collect data about you in a numbers of ways. The main method of collection is from you directly. When a patient or service user is treated or cared for, information is collected which supports their treatment. This information is also useful to 'secondary' purposes - purposes other than direct or 'primary' clinical care:

Secondary Uses Service (SUS) is a comprehensive data set which is used nationally to for healthcare data in England which enables a range of reporting and analyses to support the NHS in the delivery of healthcare services. The Trust is required to submit this data nationally on a monthly basis in line with its statutory requirements. This data set is also be used to support the review of mortality review in this project.

This data will be combined with a monthly extract of hospital discharge data (the information that is recorded about a patient when they leave hospital about their discharge).

All data will be linked together internally by the Trust and stripped of any identifiers in order to produce a non –identifiable data set. This is then shared with PWC for analysis. This data will not identify a patient directly. The only way a patient can be identified is by a member the Trust, and this would only be to support your care.

Return to top

What rights do I have in relation to my information?

Below is a list of the rights you have in relation to your data and when they apply. To make an application for any of the below rights please contact the Health Records Access Team rwh-tr.healthrecordsaccess@nhs.net in the first instance. All right should be considered within 30 calendar days from date of receipt, but may be extended if complex.

The Right of Access
You have the right to request a copy of any information held by the Trust as well as any supplementary information. See How do I request my information? for details on how to request your information.

Right to Rectification
If you believe your information may be inaccurate or incomplete you can make a request to have your information reviewed.

Use of Profiling
Profiling is automated processing of personal data to evaluate certain things about an individual. The Trust may use profiling techniques in this project to review the way in which your clinical episodes have been coded and ensure that this is done correctly. This is done using an algorithm developed by PWC based on the Charleston Comorbidity Index, using pseudonymised data provided to PWC. PWC will not be making any decisions on patients. Any output of this review will be returned the Trust who will review the patient clinical episodes in their entirety to ensure the clinical episodes are correctly coded based on the recommendations by PWC, which will assist in improving the quality of your health records.

Return to top

How long is my information kept for?

All our records are destroyed in accordance with the NHS Retention Schedule, which sets out the appropriate length of time each type of NHS records is retained. We do not keep your records for longer than necessary.

All records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required. For more information please see the Record Management Code for Practice for Health and Social Care 2016, retention schedules.

Return to top

Further Information

If you have any questions about this particular project, please speak to Health Records Access Team.

If you have any concerns about how your information is being processed or any of the rights as detailed above, please contact the Trust in the first instance.

Email: rwh-tr.healthrecordsaccess@nhs.net

You also have a right to complain directly to the Information Commissioner’s Office if you feel the Trust has not responded effectively to any of the above.

Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/

Return to top