Public Health
Privacy Notice
This statement provides details about how personal data (information about a particular person) is collected, stored and used by Hampshire County Council Public Health to improve the public’s health.
Introduction
Hampshire County Council (HCC) complies with the UK General Data Protection Regulation and is a registered Data Controller (Reg. No Z7534309). All upper tier local authorities, including HCC, are now formally responsible for public health. Public health means services to help people to stay healthy and avoid getting ill.
We may use your information under Article 6 and Article 9 of the UK General Data Protection Regulation (UK GDPR). The lawful basis for the processing of your personal data by Hampshire County Council Public Health include:
- Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’
- Article 6(1)(c) processing is necessary to comply with a legal obligation
- Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health’
We do not use your personal data for the purposes of solely automated individual decision-making
Partnership Agreement between HCC and Isle of Wight Council
HCC and Isle of Wight Council (IWC) have a partnership agreement whereby
- specific authorised HCC staff may access IWC records to carry out public health analysis, with HCC acting as third-party data processors under the instruction of IWC, and
- specific authorised IWC staff may access HCC records to carry out public health analysis, with IWC acting as third-party data processors under the instruction of HCC
Providing services
HCC Public Health commissions a number of services which fulfil their statutory obligations to improve the health of the local population, including most sexual health services, services for children aged 0 to 19 years, domestic abuse services, weight management services, oral health promotion, NHS health checks and services aimed at reducing smoking, drug and alcohol misuse.
Analysing, planning and evaluating
We use personal data for insight purposes to allow us to analyse patterns and trends of lifestyle behaviours and service usage or for service and financial planning, to help us create policy, strategies and inform decision making.
In order to improve the health of the population we serve, we use data and information from a range of sources, including NHS Health Checks, National Child Measurement Programme, hospitals, births and death information, and our own public surveys (these surveys each have their own privacy notice). This data may be personal (include information such as your NHS number, postcode, date of birth), anonymised (does not include person identifiable information) or pseudonymised. Pseudonymising data means replacing personally identifiable information such as your NHS number with an alternative ‘identifier’ such as a random reference number to make it more difficult for individuals to be identified. We use anonymised data and information from commissioned services about their performance. Further details on data we receive are listed below under ‘Data we receive from other organisations.
The information enables us to understand more about the nature and causes of disease and ill-health in the area by measuring the health, mortality and care needs of the population and ill-health in the area and how we live. This enables us to plan and evaluate services to monitor health and ensure the services are effective and working for the benefit of the population by improving or protecting public health.
We may sort, analyse and evaluate your information and the information belonging to other people. For example, evaluating or predicting the health needs of individuals and groups of people, so that we can plan, assess and manage how needs can be met.
We may sort, analyse and evaluate your information and the information belonging to other people. For example, evaluating or predicting the health needs of individuals and groups of people, so that we can plan, assess and manage how needs can be met.
We may employ third-party processors, such as consultancy agencies and professional researchers, to undertake work under our instruction.
Quality and monitoring
We may also look at the personal data we hold about you for quality and monitoring purposes, for example checking that staff are following correct procedures.
Keeping information secure
All information is collected, stored and shared in accordance with the UK GDPR and the Data Protection Act 2018. Personal data is held and transferred securely and only made available to authorised professionals for the purpose of carrying out their work. All staff are trained in data protection and comply with the Council’s information security, confidentiality and safe information handling policies and procedures. We are committed to keeping your personal data accurate and up to date. We only keep information for as long as is necessary and in accordance with the law and the Council’s records retention schedules. We will keep personal data for seven years. No personal data is accessed from or stored outside the UK and /or the EEA.
Sharing information
There are some additional circumstances where we may share your personal data with other organisations for example:
- Where personal data needs to be shared in order to protect vital interests.
- Where there is a court order requiring us to provide information.
- Where personal data are needed to detect, prevent or investigate a crime.
- And where otherwise permitted by law.
In each case, we make an individual decision about sharing personal data.
Aggregate Public Health information (not identifiable personal data) may be shared with our partners or service providers, such as government bodies, the Police, health and social care organisations and educational establishments.
You have some legal rights in respect of the personal data we collect from you. Please see our website Data Protection page for further details. You can contact the County Council’s Data Protection Officer at [email protected]
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office.
Data received from other organisations
Data supplied by services we commission
NHS Health Checks:
Under the Health and Social Care Act 2012 and Local Authorities (Public Health Functions and Entry to Premises by Local Healthwatch representatives) Regulations 2013, HCC has a legal responsibility to offer an NHS Health Check to 100% of our eligible population once every five years. GPs are contracted to the deliver the health checks. The GPs share with HCC some pseudonymised and some aggregated data to enable HCC to monitor inequalities in patient Health Check access and outcomes and inform and facilitate targeted actions to improve patient outcomes specifically related to NHS Health Checks as required. This data does not contain any links to any individual’s identity but does contain detailed information taken at the check such as your ethnicity, weight and blood pressure readings, and the date they were taken which could potentially make you identifiable e.g. to a health professional. If you do not want your data to be pseudonymised and shared with HCC, please tell your GP practice.
NHS Health Checks undertaken by a third-party provider:
HCC has commissioned a third-party provider to carry out catch up NHS Health Checks. GP’s will issue invitations to eligible patients for the Health Checks and if patients chose to take up the invitation the provider will share the results of that check with their GP. Your GP will share with HCC some pseudonymised and some aggregated data for the purpose of performance monitoring to enable HCC to monitor inequalities in patient Health Check access and outcomes and inform and facilitate targeted actions to improve patient outcomes specifically related to NHS Health Checks as required. This data does not contain any links to any individual’s identity but does contain detailed information taken at the check such as your ethnicity, weight and blood pressure readings, and the date they were taken. These details could potentially make you identifiable e.g. to a health professional. If you do not want your data to be pseudonymised and shared with HCC by your GP, please tell your GP practice. If you refuse sharing of your data by your GP, you can still access the service.
HCC does not receive identifiable information in relation to Health Checks. If you wish to submit a Data Subject Rights Request, please contact your GP in the first instance.
Integrated Sexual and Reproductive Health Service:
Hampshire County Council and the service provider (Solent NHS Trust Jan- March 2024, Hampshire and Isle of Wight Healthcare NHS Foundation Trust from April 2024) are joint data controllers. The provider will use personal data in order to provide the service. Whilst Hampshire County Council has a legal basis to use personal data under The Local Authorities (Public Health Functions and Entry to Premises by Local Healthwatch Representatives) Regulations 2013’ to “provide or secure the provision of open access sexual health services”, HCC will only receive and use anonymised aggregated data from the provider, which will be used to provide an understanding of the take up and effectiveness of the service. HCC does not receive identifiable information for this service. If you wish to submit a Data Subject Rights Request, please contact the service provider in the first instance.
Data supplied by NHS England
We hold the following collections of data supplied by NHS England that contain various different types of data about individuals and populations:
- Hospital Episode Statistics (HES) - We hold pseudonymised records about health care and treatment you may have received in any English hospital in the form of Hospital Episode Statistics (HES). HES include inpatient and day case admissions, outpatient appointments and Accident and Emergency attendances. The data includes clinical information about each patient’s diagnoses and operations, their age group, gender, ethnicity, dates and methods of admission and discharge, and geographical information such as where patients are treated and the area they live. This data is supplied by NHS England to us under license. We will not try to identify individuals from this hospital data.
- Civil Registration Data: Primary Care Mortality - Access to Civil Registration Data is provided by NHS England. It provides us with access to personally identifiable mortality data as provided at the time of the registration of the death, along with additional General Practice details, geographical indexing and coroner details where applicable. This includes the address, postcode of residence of the deceased, postcode of the place of death, NHS number, date of birth, date of death, name of certifier, and cause of death. Our access to the data is limited to the geographical boundary of Hampshire County Council and the NHS Integrated Care Board area which also includes the Isle of Wight Council and Southampton City Council. The files are downloaded from NHS England’s Secure Electronic File Transfer (SEFT) system and transferred to a secure database. This data is only supplied to us by NHS England under strict license and data disclosure controls.
- Civil Registration Data: Births data tables - This dataset provides us with access to personally identifiable data about the number of births that occur within our geographical boundary as a County Council and the NHS Integrated Care Board area which also includes the Isle of Wight Council and Southampton City Council. It includes the address of usual residence of mother, place of birth, postcode of usual residence of the mother, postcode of place of birth of child, NHS number of child and the date of birth of the child. This data is only supplied to us by NHS England under strict license and data disclosure controls. The files are downloaded from NHS England’s Secure Electronic File Transfer (SEFT) system and transferred to a secure database. This data is only supplied to us by NHS England under strict license and data disclosure controls.
How we use births and deaths data
Hampshire County Council Public Health have an agreement with NHS England for the use of Office of National Statistics (ONS) births and deaths data. Public Health analysts use this data for statistical purposes to support the Council’s Public Health functions.
Data are supplied to us by NHS England under section 42 (4) of the Statistics and Registration Service Act 2007, as amended by section 287 of the Health and Social Care Act 2012, and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.
In order to use births and deaths data appropriately and safely we:
- Store the data on our IT network at a location that is restricted to those staff who have signed the appropriate NHS England data access agreements
- Restrict access to data, whose source is identifiable, to those staff who have been nominated as data processors for the births and deaths data.
- Remove the identity from any data used for secondary analysis (referred to as 'de-identified' data).
Publication of the outcome of secondary analysis is limited to permitted purposes and is restricted to the aggregate results of that analysis in line with our Data Access Agreement and Office of National Statistics Disclosure Control Guidance for Birth and Death Statistics guidance.
Retention of data obtained from NHS England
A maximum of ten years data will be retained at any point, such that as each new data year is received from NHS England, the oldest year will be deleted (i.e. at any point in time only ten historic years of data plus the current year may be held).
Opting out of the use of your information obtained from NHS England
You have the right to opt out of Hampshire County Council Public Health receiving or holding your personal data obtained from NHS England where it is held. The process for opting out will depend on what the specific data is and what programme it relates to. For further information, please contact the Public Health Team by email ([email protected]), or in writing to Adults’ Health and Care, Public Health, Elizabeth II West, The Castle, Winchester, SO23 8UQ.
Data supplied by other sources
Real Time Suicide Surveillance
Hampshire and Isle of Wight Constabulary share with us information on incidents where people have died by suspected suicide, including information about the deceased person. We receive this information to help us work to prevent further suicides.
COVID-19 data
Hampshire County Council Public Health have access to COVID-19 data held by UK Health Security Agency, including information on patients who test positive and vaccination data. These data are de-identified so we do not receive data such as name, NHS number and date of birth but do receive postcode.
The data will be used to fulfil the statutory obligation for monitoring and diseases and risks surveillance of public health threats and emerging trends in communicable diseases and other risks to public health e.g. COVID-19 variants that could impact populations.
We may use the information as specified in the Regulation 3 Notice:
- Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002, provides specific support for confidential patient information to be disclosed to, and processed by, the persons or bodies listed Regulation 3(3) when processing is intended to diagnose, control or prevent, or recognise trends in, communicable diseases and other risks to public health. These powers can only be used where it is not practical to obtain consent and anonymised information cannot be used, having regard to the cost and available technology. Where the processing of confidential patient information will rely on Regulation 3 to set aside the common law duty of confidentiality; the purposes for processing must be compatible with Regulation 3(1) and such processing under Regulation 3 must be reviewed at intervals no more than 12 months.
Hampshire County Council Public Health review this every 12 months to confirm the processing activities described below continue to be appropriate:
a) Diagnosing communicable diseases and other risks to public health.
b) Recognising trends in such diseases and risks.
c) Controlling and preventing the spread of such diseases and risks.
d) Monitoring and managing outbreaks of communicable disease.
e) Monitoring and managing incidents of exposure to communicable disease.
f) Monitoring and managing the delivery, efficacy and safety of immunisation programmes.
Crime Data
Hampshire County Council Public Health have an information sharing agreement with Hampshire Constabulary for the use of crime data. The data are sent annually. Public Health analysts use this data for statistical purposes to support the Council’s Public Health functions. This will enable Hampshire County Council to conduct research and analysis which will inform the work of the Hampshire and Isle of Wight Violence Reduction Unit. This will in turn be used to inform priorities and take action against crime and anti-social behaviour. It will incorporate measures aimed at:
- Facilitating a coordinated approach that targets crime and anti-social behaviour.
- Facilitating the collection and exchange of relevant information
- Facilitating the gathering of vital research which will contribute towards the Violence Reduction Problem Profile.
- Producing anonymous violence profiles of the Hampshire area.
Data are retained for a rolling five years to enable trend analysis. In order to use the crime data appropriately and safely we:
- store the data on our IT network at a location that is restricted to those staff in the Public Health Intelligence Team
- remove the identity from any data used for secondary analysis (referred to as ‘de-identified’ data)
Population Health Management Data Platform (HealtheIntent)
Hampshire County Council Public Health have an information sharing agreement with Hampshire and Isle of Wight Integrated Care Board. This enables Public Health analysts to securely access the HealtheIntent platform and a pseudonymised data set which includes demographic and health data from GPs and Hospital Trusts. Public Health analysts use this data for statistical purposes to support the Council’s Public Health functions. This will enable Hampshire County Council to conduct research and analysis which will inform the work of partners and agencies across the Hampshire and Isle of Wight Integrated Care Board. This work will include:
- Understanding the needs of the care system’s population, including health inequalities.
- Targeting support to where it will have the most impact, using segmentation and stratification toolsets.
- Identifying early actions to keep people well, not only focusing on people in direct contact with services, but also looking to join up care across different partners.
- Assessing patterns of service utilisation, morbidity and mortality across the local population and other segmentations.
Further information
The above information is the specific privacy notice for this service. For more information about your rights in relation to your personal data, see the County Council’s general privacy notice.
You have some legal rights in respect of the personal information we collect from you. See our Data Protection page for further details.
You can contact the County Council’s Data Protection Officer by email [email protected].
If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office.