Coronavirus/Covid-19 key information for patients and visitors

Click/tap here for key public-relevant Coronavirus/Covid-19 information for patients, visitors and members of the public.

Harrogate and District NHS Foundation Trust and Harrogate Integrated Facilities staff

This privacy notice covers Harrogate and District NHS Foundation Trust (HDFT) and its subsidiaries. Where we state ‘Trust’ this includes the Trust’s subsidiaries.

This privacy notice covers Harrogate and District NHS Foundation Trust (HDFT) and its subsidiaries. Where we state ‘Trust’ this includes the Trust’s subsidiaries.

Data Controller

The data controller responsible for keeping your information is Harrogate and District NHS Foundation Trust. We are registered with the Information Commissioner’s Office (ICO). The ICO is the UK’s independent body set up to uphold information rights. Our registration number is: Z7089698. Its subsidiary, Harrogate Integrated Facilities, registration number is: ZA311163.

Data Protection Officer

It is a requirement that organisations appoint a Data Protection Officer. The Data Protection Officer is responsible for:

  • informing and advising us and its employees about their obligations to comply with data protection laws
  • monitoring compliance with data protection laws
  • being the point of contact regarding data protection

Our Data Protection Officer is:

Paul Nicholas, Deputy Director of Performance and Informatics
Harrogate and District NHS Foundation Trust
Harrogate District Hospital
Lancaster Park Road
Harrogate
North Yorkshire
HG2 7SX
01423 885959
hdft.dataprotectionofficer@nhs.net

Why we collect your information

The Trust has several legal bases that it uses to process your personal data, and these include consent, legitimate interest, public task, vital interest, contractual and legal obligation.

We only collect and use your information for the lawful purposes of administering the business of the Trust. These purposes include:

  • To improve the management of the Trust workforce data
  • To enable a comprehensive picture of the workforce and how it is deployed to be built up
  • To inform the development of recruitment and retention policies
  • To allow better financial modeling and planning
  • To enable monitoring of ethnicity, sexual orientation, disability and other protected characteristics
  • To keep images to identify you either as part of the various security access systems, including CCTV, or as part of an overall briefing system for senior managers
  • To keep images that appear in Trust or other publications or websites to market and promote the Trust
  • To allow the Trust policies to be implemented and acted upon when appropriate
  • To enable the Trust to conduct administration related to your employment, including ensuring that staff are paid
  • To gather evidence for disciplinary and other staff processes

What information we collect

  • Personal details such as name, address, telephone number(s), date of birth
  • Personal demographics (including gender, race, ethnicity, sexual orientation, religion)
  • Medical information
  • Emergency contact(s)
  • Education and training
  • Employment details
  • Membership of professional bodies and/or trade union(s)
  • Bank details
  • Pension details
  • Offences (including alleged offences), criminal proceedings, outcomes and sentences
  • Employment tribunal applications, complaints, accidents and incident details
  • Visual images, e.g. photographs on staff notice boards or CCTV monitoring
  • Supervision and appraisal documentation
  • Sickness absence and annual leave details

COVID-19

Vaccination Track/Covid Track

Under COVID-19 the Trust is mandated to record employee uptake of Flu/COVID vaccinations. This information is reported at a national level to UK Health Security Agency (UKHSA) and NHS England. To meet these requirements the Trust utilises a system called Vaccination Track/Covid Track to record COVID-19 and flu vaccination status.

This system will hold personal-identifiable data which is required to process vaccination uptake relating to COVID-19 and Flu, including the recent booster vaccination programme. This processing includes:

  • Name
  • Date of Birth
  • Postcode
  • NHS number
  • Gender
  • Ethnicity
  • Employee number
  • Work email
  • Work telephone number
  • Staff group
  • Job role
  • Assignment status
  • Health information, specific to purpose and provided during the clinical vaccination process

The Trust has administration access to review the data for attendees at the vaccination clinics; this information is needed for reporting purposes. Internal role-based access controls are in place to ensure access is restricted to those who require this as part of their role and responsibility. This information is then used to update the National Immunisation Vaccination System (NIVS) for healthcare workers.

National Immunisation Vaccination Service

NHS England has commissioned and implemented a National Immunisation Vaccination Service (NIVS). This is provided by NHS England and NHS Improvement and will be used to record the vaccination details of healthcare workers. This delivers a centralised data capture tool for clinical teams delivering the seasonal flu immunisation and is an essential component of NHS England’s response to the COVID-19 pandemic. The vaccination event data will feed back to GP systems and the National Immunisations Management System (NIMS).

Information will be recorded within NIVS using minimal information. This processing includes:

  • Name
  • Postcode
  • NHS Number
  • Gender
  • Date of Birth

Records are limited to employees who have identified as working for our organisation.

Data will be disseminated to NHS Digital as Data Processors on behalf of NHS England.

National Immunisations Management System

The National Immunisations Management System (NIMS) is provided by the NHS South, Central and West Commissioning Support Unit (SCW). SCW are contracted by NHS England to run NIMS for Flu and COVID. NIMS is the National Immunisation System of Record and provides data for Public Health England, NHS England and at ministerial level. Vaccinations administered at any site are stored on NIMS.

Vaccination Status

The Government has recently announced that all NHS staff in patient facing roles will need to have both their first and second COVID vaccination. As NIMS holds the vaccination records irrespective of where they were administered, employee vaccination dates will be obtained from this system.

The following data sets must be provided to NIMS to retrieve your vaccination dates:

  • Data provider
  • NHS number
  • Employee number
  • Name
  • Sex
  • Date of birth
  • Employer ODS code
  • Employer
  • Location
  • Job role code
  • Job role
  • Work email address
  • Mobile phone number

As the Trust does not hold employee NHS numbers, these will be obtained from the Personal Demographic Service (PDS). The following data sets will be submitted to retrieve your NHS number:

  • Name
  • Sex
  • Date of birth
  • Postcode

Once your vaccination status has been obtained from NIMS your NHS number will be deleted.

Vaccination dates will be stored on the Occupational Health module on your Electronic Staff Record (ESR). Details of employees who are not matched with vaccination dates will be shared with Workforce Information, Human Resources and their line manager.

CCTV

We have CCTV systems and body worn cameras in some of our premises used by staff and members of the public, for the purposes of public and staff safety and crime prevention and detection. CCTV is also installed on the outside of some of our buildings for the purposes of monitoring building security and crime prevention and detection.

Images captured by CCTV will not be kept for longer than necessary. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated. We operate CCTV and disclose in accordance with the codes of practice issued by the Information Commissioner.

Who we may share your information with

We will not routinely disclose any information about you to anyone outside the Trust without your consent. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation. We may obtain and share personal information with a wide variety of other bodies, which may include, but is not limited to:

  • Her Majesty’s Revenue and Customs (HMRC)
  • Department for Work and Pensions (DWP)
  • Disclosure and Barring Service (DBS)
  • Home Office
  • Child Support Agency
  • Regulatory bodies, e.g. NMC, GMC
  • Law enforcement agencies including the Police and the Serious Organised Crime Agency

NHS Streamlining Process: Immunisations and Vaccinations

As part of the NHS streamlining process, the aim of which is to improve efficiency when employees transfer from one provider of NHS services to another provider of NHS services, information about immunisations and vaccinations of all staff may be stored on the Occupational Health Module of the Electronic Staff Record (ESR).  This information may then potentially be accessed by a prospective employer via an Inter Authority Transfer.

How we maintain the confidentiality of your information

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential. Staff also undertake annual data security training.

How long we keep your information for

We store information for the time stipulated in Records Management Code of Practice for Health and Social Care.

Your rights

Data protection laws give individuals rights in respect of the personal information that we hold about you. These are:

  1. To be informed why, where and how we use your information.
  2. To request access to your information.
  3. To request information to be corrected if inaccurate or incomplete.
  4. To request for your information to be deleted or removed where there is no need for us to continue processing it.
  5. To request us to restrict the use of your information.
  6. To request us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information.
  7. To object to how your information is used.
  8. To challenge any decisions made without human intervention (automated decision making).

Accessing your information

Data protection laws give you the right to request access to your information. Please contact the Human Resources Team:

Human Resources Team
Harrogate and District NHS Foundation Trust
Harrogate District Hospital
Lancaster Park Road
Harrogate
North Yorkshire
HG2 7SX

01423 554494

Requesting information to be corrected

If you believe your information is inaccurate or incomplete please contact your line manager.

Concerns

Should you wish to raise a concern about the use of your information, please contact a member of the Human Resources Team:

Human Resources Team
Harrogate and District NHS Foundation Trust
Harrogate District Hospital
Lancaster Park Road
Harrogate
North Yorkshire
HG2 7SX

01423 554494

If you remain unhappy with the outcome of your enquiry you can contact the Information Commissioner:

The Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

0303 123 1113

www.ico.org.uk