Privacy notice - your information; why it is collected and what it is used for

Sutton Council is registered as a data controller under the Data Protection Act 1998 as we collect and process personal information about you. We process and hold your information in order to provide public services. This notice will explain how we use and share your information. Information may be collected in many different ways such as on paper, by telephone, electronically, by photograph or by a member of staff in person.

Why information is kept and shared

In order to be able to provide the right kind of services for you, Sutton has to find out first of all what your needs are. To do this it will collect information about your needs in discussion with you and those caring for you.

This will help the council:

• make decisions with you about how to provide the right kind of support services to meet your needs
• make sure your support is safe and effective
• work effectively with others who also provide you with support on their behalf
• make sure your care is well coordinated
• help investigate any worries or complaints you have about your care
• keep track of spending on care services
• check the quality of care
• effectively research and plan new services
• local authorities have a duty to improve the health of the population they serve. To support this, we use health and other data from a range of sources. This includes data collected at the registration of a birth or death in fulfilment of the Public Health function in order to understand more about health and care needs in Sutton (see section below on Births and Deaths Registration data)

The types of information kept

You will be asked personal questions about all your personal needs, your home circumstances, your health, social life and in some cases financial circumstances. Also, there will be information provided by staff who care for you – nurses, doctors, therapists, social workers – in the form of reports about your needs. This information will include details about:

• your medical history
• what you can do for yourself, and what you may need help with
• where you live
• family and friends, particularly if they give any support to you
• your money, and of any financial problems you may have
• anyone in your life who may pose a threat to you

How your data is used

In order for Sutton Council to help you and meet its legal responsibilities we may need to share information about you with other agencies or organisations. This enables everyone working with you to support you effectively. It will also save you giving your details over and over again.

Some of the agencies or organisations that we may need to share information with include: health services, care providers, voluntary organisations or the police. However, your data will never be sold to a third party. The information you agree to provide may be written down and kept on file. It is also likely to be kept on a computer. You can be assured that:

• any personal information you provide will be held in confidence
• information will only be shared other organisations if they need to know
• only certain people in each organisation will be allowed to see any personal information
• information about you will be kept in a secure place
• you can ask to see what information the council keeps about you

Sutton Integrated Digital Care Record

The Sutton Integrated Digital Care Record (SIDCR) is an electronic health and social care record for patients registered with a GP in Sutton. SIDCR is: Integrated because organisations responsible for the majority of your health and wellbeing will be sharing information in an effort to make a difference for the better; Digital because it’s electronic and so much more immediate and secure than paper; and a Care Record because it takes information from several health and social care record systems within Sutton and creates a combined care record about you, that can be looked at by the professionals who are caring for you so that they can give you the best possible care, with accurate, up-to-date, clinical and social care information.

As a patient of a Sutton GP your health information will be included in the Sutton Integrated Digital Care Record. With your consent, social care information such as details about your support plan and the care you receive, who your social worker is and when your plan was last reviewed will be also included in the Sutton Integrated Digital Care Record.

The health and social care professionals who need to look at your record must ask for your permission when they want to look at it, unless you are so ill that you are not able to be asked.

To understand how services support you and how they can improve in the future, Sutton Council would like to use information about your care shared across health and social care organisations. Any information that is used for this secondary purpose will not identify you as your information will be anonymised.

Use of your NHS Number in Adult Social Care

If you are receiving support from adult social care then the NHS may share your NHS number with Adult Social Care.  This is so that the NHS and Adult Social Care are using the same number to identify you whilst providing your care.  By using the same number the NHS and Adult Social Care can work together more closely to improve your care and support.

Your NHS number is accessed through an NHS service called the Personal Demographic Service (PDS).  Adult social care sends basic information such as your name, address and date of birth to the PDS in order to find your NHS Number. Once retrieved from the PDS the NHS Number is stored in the Council’s Adult Social Care Case Management System.

These data are retained in the Adult Social Care System in line with the Council’s record retention policies.  These policies are in accordance with the Data Protection Act 1998, Government record retention regulations and best practice.  Further information is available on request.

In terms of the Data Protection Act the Council is both the Data Controller and the Data Processor.

The NHS Number then has two uses, the first being a unique identifier to allow Social Care information to be displayed in the Council’s adult social care case management system, for the provision of direct care. We will also use this Number in an integrated care record system (Sutton IDCR) across a number of support services including GP’s, hospitals, community matrons, district nurses and social care practitioners.

The Council will share information only to provide health and social care professionals directly involved in your care access to the most up-to-date information about you.  It will do this by sharing appropriate information between health and social care services at the time of patient contact.  Access to information is strictly controlled, based on the role of the professional.  For example, social workers will only have access to information that is relevant to the execution of their care duties.

The Council’s IT security and confidentiality policies ensure that your information is protected, and available only to staff directly involved in your care. These policies are available for inspection upon request, please email contactcentre@sutton.gov.uk.

The use of joined up information across health and social care brings many benefits. One specific example where this will be the case is the discharge of patients into social care.  Delays in discharge (commonly known as bed blocking) can occur because details of social care involvement are not readily available to the staff on the hospital ward.  The hospital does not know who to contact to discuss the ongoing care of a patient.  The linking of social care and health information via the NHS Number will help hospital staff quickly identify if social care support is already in place and who the most appropriate contact is.  Ongoing care can be planned earlier in the process, because hospital staff will know who to talk to.

The addition of the NHS Number to social care data will bring additional benefits:

• Better coordinated and safer care across health and social care enabled through the sharing of real-time information.
• Better coordination of discharges from hospital into social care, as explained above.
• More time to spend on planning and coordinating social care because health staff can identify and involve social care staff earlier in the process.
• Earlier intervention to maximise the opportunities or reablement services leading to greater independence for patients.
• Less paperwork and more efficient use of social care resources.​​​

You have the right to object to the processing of your NHS Number in this way.  This will not stop you from receiving care, but will result in the benefits outlined above not being realised.  To help you decide, we will discuss with you how this may affect our ability to provide you with care, and any other options you have.

If you wish to opt-out from the use of your NHS Number for social care purposes, please talk with your social worker, by contacting us on 0208 770 5000 or email to contactcentre@sutton.gov.uk , marking your email for the attention of the Adult Social Care Information Governance Officer.

Processing of Sutton Births and Deaths Registration data

Personal information about deaths in Sutton is supplied to local authorities by NHS Digital and contains mortality data provided at the time of registration of death along with additional GP details, geographic information and coroner details where applicable. Sutton Council has a Data Access Agreement with NHS Digital and data are supplied under section 287 of the Health and Social Care Act 2012. Information held includes date of birth, date of death, place of death, address of deceased, causes of death, age, sex, GP and practice, occupation and place of birth. The Public Health Intelligence team at Sutton Council uses this information for the purposes of statistical analysis, the monitoring of population health and demographic change in Sutton, and the planning and commissioning of health services.

Information is used specifically to identify patterns and trends in mortality rates, life expectancy and premature death, highlighting differences between geographic areas, age, sex and other characteristics. It is also used to identify differences between areas and inform the planning and targeting of health, care and public health services. This information is used in the Joint Strategic Needs Assessment and other health needs assessments, as well as for monitoring trends for particular causes of death. No personal-identifiable information is published, and numbers and rates in published reports based on counts fewer than five are removed to further protect confidentiality and anonymity.

Information is used to ensure that services are designed to address local health needs and are focused on reducing health inequalities, with specific reference to life expectancy and mortality rates and for work on suicide and accident prevention to identify specific hotspots and risk factors locally.

This dataset is not disclosed to anyone other than those stated above. Information is held in a secure database only accessible to analytical staff within the Sutton Public Health Intelligence team consistent with the data access agreement between NHS Digital and Sutton Council.

The legal basis for the flow of data is as follows: Section 42(4) of the SRSA (2007) as amended by section 287 of the Health and Social Care Act (2012) and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.

The ICO (Information Commissioner’s Office) can be contacted for independent advice at: www.ico.org.uk
Sutton Council contact details: Contact us

Opting Out, and how this can be done:

Objection: You have the right to request that Sutton Public Health stop processing your personal data in relation to any council service. However, if this request is approved this may cause delays or prevent us delivering a service to you. Where possible we will seek to comply with your request but we may need to hold or process information in connection with one or more of the Council’s legal functions.

Opting out: You have the right to opt out of Sutton Public Health receiving or holding your personal identifiable information. There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues. The process for opting out will depend on the specific data is and what programme it relates to. For further information, please contact the Public Health team at Sutton by email to contactcentre@sutton.gov.uk indicating For Attention of Public Health. 

Rules for sharing information

If Sutton shares personal information about you, it has to follow a set of rules. These rules are based on the requirements of the Data Protection Act 1998. Any organisation we share information with has to comply with these rules too. The Council will:

• tell you who the information is shared with
• only share information about you with your permission. In exceptional circumstances it does not have to get your permission but, must have a strong lawful reason for doing this
• tell you what its collecting and using your information for and only use it for those purposes
• not keep information which is not relevant to your care
• make efforts to keep the information up to date so that it is accurate
• only keep the information for a limited period after it has stopped providing you with a service
• allow you access to files kept on you, but there are limits to this which will be explained further if necessary
• protect your Information from being misused
• will transfer information about you outside of this country only to countries which have similar legal protections in place

How your permission to share personal information about yourself will be recorded

You will be asked to complete a consent to share information form that will be kept with your care records. If you are unable to complete the form yourself a member of staff or carer can complete it on your behalf, but you must sign the form yourself. 

If the council receives a request to share information about you with another organisation, a member of staff will check the details on your consent form to check you have agreed to it. Information will only be shared on the basis of the rules described above.

What happens if you refuse permission to share information

You have the right to withhold permission for the council to share personal information about you with another organisation. If you do not want information to be shared with other organisations, three things could happen:

1. you may find that certain care needs are not met
2. other organisations may not be able to provide you with a service until you give them more information yourself to enable them to do their job properly
3. Health and social care professionals treating you may not be aware of your current medication in order to treat you safely and effectively. They may not be made aware of current conditions and/or diagnosis leading to a delay or missed opportunity for correct treatment.