Occupational Health

Data Controller

The data controller responsible for keeping your information is Harrogate and District NHS Foundation Trust. We are registered with the Information Commissioner’s Office (ICO). The ICO is the UK’s independent body set up to uphold information rights. Our registration number is: Z7089698.

Data Protection Officer

It is a requirement that organisations appoint a Data Protection Officer. The Data Protection Officer is responsible for:

• informing and advising us and its employees about their obligations to comply with data protection laws
• monitoring compliance with data protection laws
• being the point of contact regarding data protection

Our Data Protection Officer is:

Sam Layfield, Head of Performance & Planning
Harrogate and District NHS Foundation Trust
Harrogate District Hospital
Lancaster Park Road
Harrogate
North Yorkshire
HG2 7SX
01423 885959
[email protected]

Why we collect your information

We collect information about you to deliver occupational health services.

What information we collect

These records may be written down or held electronically. Your records can include:

• demographic details, such as name, date of birth and address
• job details
• details about your occupational health assessments such as pre work checks, health surveillance and immunisations
• results of investigations, such as x-rays and laboratory tests
• relevant information from other healthcare or social care professionals or those who care for you or your employer

CCTV

We have CCTV systems in some of our premises used by members of the public, for the purposes of public and staff safety and crime prevention and detection. CCTV is also installed on the outside of some of our buildings for the purposes of monitoring building security and crime prevention and detection.

Images captured by CCTV will not be kept for longer than necessary. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated. We operate CCTV and disclose in accordance with the codes of practice issued by the Information Commissioner.

Who we may share your information with

We may share relevant information with:

• Your employer
• GP or other healthcare professionals involved in your care

We will not disclose your information to any other third parties without your permission unless there are exceptional circumstances, such as a serious crime has been committed, there is a risk to the public or staff or we have a legal duty to pass on information.

How we maintain the confidentiality of your information

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• Data Protection Act
• The General Data Protection Regulations 2016
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• Confidentiality Code of Practice 2003
• Information Security Management Code of Practice 2007
• Records Management Code of Practice for Health and Social Care 2016
• Information: To Share or Not to Share Review

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential. Staff also undertake annual data security training.

How long we keep your information for

We store information for the time stipulated in Records Management Code of Practice for Health and Social Care 2016.

Your rights

Data protection laws give individuals rights in respect of the personal information that we hold about you. These are:

1. To be informed why, where and how we use your information.
2. To request access to your information.
3. To request information to be corrected if inaccurate or incomplete.
4. To request for your information to be deleted or removed where there is no need for us to continue processing it.
5. To request us to restrict the use of your information.
6. To request us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information.
7. To object to how your information is used.
8. To challenge any decisions made without human intervention (automated decision making).

Accessing your information

Data protection laws give you the right to request access to your information. Please contact the Occupational Health Department:

Occupational Health Department
Heatherdene
Lancaster Park Road
Harrogate
HG2 7SX

01423 553400

[email protected]

Requesting information to be corrected

If you believe your health information is inaccurate or incomplete please contact the Occupational Health Department:

Occupational Health Department
Heatherdene
Lancaster Park Road
Harrogate
HG2 7SX

01423 553400

[email protected]

Concerns

Should you wish to raise a concern about the use of your information, please contact:

Occupational Health Manager
Heatherdene
Lancaster Park Road
Harrogate
HG2 7SX

01423 553400

[email protected]

If you remain unhappy with the outcome of your enquiry you can contact the Information Commissioner:

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

0303 123 1113

www.ico.org.uk