Dissent from processing of personal confidential data to the HHR

The request was successful.

Dear Hampshire Hospitals NHS Foundation Trust,

I would like to make another request under the FOI Act.

For the purposes of the Act, please take the date of your receipt of this request as 29th January 2016.

Your trust is one of a number of that process the personal confidential data of all patients treated/investigated by your hospitals and upload it to the Hampshire Health Record (HHR).

I am interested in the process by which patients may express their objection to such processing and prevent the uploading of their data to the HHR (whether they have opted out of the HHR at their GP surgery or not, or whether they are a local resident or visiting from outside of the area), and whether this has changed in any way recently.

• Please could you provide me with the process by which patients may express their objection to such processing and prevent the uploading of their personal confidential data to the HHR, pursuant to the Data Protection Act and the NHS Constitution. If patients have to fill out a specific opt-out form, please provide this to me, together with the details of what ID to include, who to send the form to etc.

I assume the process is the same across your hospitals (Andover, Basingstoke and Winchester).

I would be grateful if you would be kind enough to send me the requested information promptly and in any event not later than the twentieth working day following the date of receipt of my request.

I would be grateful if you would kindly acknowledge receipt of this request as recommended by the ICO (“It would be good practice to acknowledge receipt of requests and to refer to the 20 working day time limit, so that applicants know their request is being dealt with”).

Thank you once again.

Yours sincerely,

Dr Neil Bhatia

FOI HHFT, Hampshire Hospitals NHS Foundation Trust

Dear Neil Bhatia,

Thank you for your request for information dated 28th January 2016. We will make every effort to supply you with the information within 20 working days.

Please do not hesitate to contact this office if you have any queries.

Yours sincerely,

Freedom of Information Team
Hampshire Hospitals NHS Foundation Trust

show quoted sections

FOI HHFT, Hampshire Hospitals NHS Foundation Trust

Dear Dr Bhatia,

I am writing to inform you of the progress with your freedom of information request sent on 28th January 2016. Unfortunately there has been a delay in responding to your request and I have had to seek further information to answer the questions below. I am hoping to provide you with a response shortly and I would like to apologise for the delay in our response.

Kind Regards,

Freedom of Information Team
Hampshire Hospitals NHS Foundation Trust

show quoted sections

Dear FOI HHFT,

Thank you for your message.

You are - of course - in breach of s10 of the Act by not responding within the requisite timescale.

You have been extracting and uploading sensitive, personal, confidential information to a 3rd party database for some years now. Accordingly, I would have thought the information that I requested would be readily to hand....

Either there is such a process, or patients are denied an objection to the processing of their data by your organisation in this way.

I have made a complaint to the ICO regarding the delay. I imagine they will be in touch in due course.

Yours sincerely,

Dr Neil Bhatia

FOI HHFT, Hampshire Hospitals NHS Foundation Trust

1 Attachment

Dear Dr Bhatia,

Please find attached a formal response to your recent Freedom of Information request.

Regards,

Freedom of Information Team
Hampshire Hospitals NHS Foundation Trust
Basingstoke and North Hampshire Hospital
Tel: 01256 473202

show quoted sections

Dear Hampshire Hospitals NHS Foundation Trust,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Hampshire Hospitals NHS Foundation Trust's handling of my FOI request 'Dissent from processing of personal confidential data to the HHR'.

I requested the process, and opt-out form, that would enable patients to prohibit the processing of their hospital data by the data controller responsible - that is, Hampshire Hospitals NHS Foundation Trust.

I am aware that patients can opt-out at their GP surgery, or by applying to the HHR office, and that this will ensure that any information extracted and uploaded by Hampshire Hospitals NHS Foundation Trust will not be stored on the HHR database.

But I did not request that information from you.

I asked for *your* process and *your* opt-out form, to allow patients to prohibit the extraction and uploading of their hospital data to the HHR by the data controller responsible, i.e. *you*, Hampshire Hospitals NHS Foundation Trust.

I did not ask for the opt-out form or process by which patients can ensure that their extracted and uploaded data was not *retained* on the HHR database. I already know that process.

If no such opt-out form is available, then please say so.
The Act requires you to then state that you do not hold that information.

If no such process is available to patients, then please say so.
The Act requires you to then state that you have no such process, and so do not hold that information.

If patients *cannot* stop Hampshire Hospitals NHS Foundation Trust from extracting and uploading their data to the HHR database, whatsoever, then please say so.
That would explain why no such specific opt-out form , and no such process exists which your trust follows upon receiving such a request/dissent.

It is the responsibility of the Hampshire Hospitals NHS Foundation Trust to show that it has complied with the Act. In doing so, it must:

•assume that the public interest test starts with a presumption of disclosure
•show that the information is has withheld is exempt
•show that the public interest in keeping the exempt information confidential is greater that the public interest in its disclosure
•and if it cannot meet both the above tests, the information that I have requested must be disclosed

I would like to stress some of the reasons information should be disclosed in the public interest, namely to ensure that :

•there is informed public debate about significant decisions made by the authority
•the public are able to participate effectively in decisions affecting them
•there is adequate scrutiny of the decision-making process as regards Hampshire Hospitals NHS Foundation Trust functions
•the Hampshire Hospitals NHS Foundation Trust is accountable and transparent in the spending of public money – particularly so within this economic climate
•the public is not deceived about the way that the Hampshire Hospitals NHS Foundation Trust operates
•the Hampshire Hospitals NHS Foundation Trust deals fairly with the public

In addition, public interest tests should not take into account:

•possible embarrassment of government or other public authority officials
•the seniority of persons involved in the subject matter
•possible loss of confidence in government or other public authority
•possible loss of confidence in the HHR or any other IT programme that Hampshire Hospitals NHS Foundation Trust is responsible for

As regards the internal review, I would like to stress the following:

•The Information Commissioner considers it important that internal reviews are completed as promptly as possible.
•The Information Commissioner considers that a reasonable time for completing an internal review is 20 working days from the date of the request for review.
•There is also an implied recommendation, supported by guidance issued by the Department for Constitutional Affairs, that the complainant should be kept fully informed throughout the review process.
•The Information Commissioner does not expect an internal review of a response to an FOI request to have more than one stage.
•The Secretary of State for Constitutional Affairs' Code of Practice on the discharge of public authorities' functions under Part I of the Freedom of Information Act 2000 states the following: “Where the complaint concerns a request for information under the general rights of access, the review should be undertaken by someone senior to the person who took the original decision, where this is reasonably practicable.”

Accordingly I would expect completion of the review within 20 working days.

Yours sincerely,

Dr Neil Bhatia

FOI HHFT, Hampshire Hospitals NHS Foundation Trust

1 Attachment

Dear Dr Bhatia,

Please find attached a letter of acknowledgement for an internal review.

Kind regards,

Freedom of Information Officer
Hampshire Hospitals NHS Foundation Trust

show quoted sections

Arnold, Mark, Hampshire Hospitals NHS Foundation Trust

1 Attachment

Dear Dr Bhatia,

 

Please find attached the response to your FOI internal review.

 

Kind regards

Mark

 

Mark Arnold

Information Governance Manager

Hampshire Hospitals NHS Foundation Trust

Basingstoke tel: 01256 313025

Winchester tel: 01962 825404

Email: [1][email address]

[2]www.Hampshirehospitals.nhs.uk

 

 

show quoted sections

Peter Williams left an annotation ()

I await the outcome of your FOI request with a great deal of interest.
I have made, and am making, a number of related requests, for example:
https://www.whatdotheyknow.com/request/d...

Dr Neil Bhatia left an annotation ()

More information about NHS data sharing, including:

• care.data
• The Summary Care Record,
• The Hampshire Health Record
• The Berkshire Health Record (Connected Care)
• The Manchester Care Record
• The Stockport Health and Care Record
• The Salford Integrated Record
• The West Cheshire Care Record
• The North Staffs and Stoke-on-Trent Shared Record
• The Dorset Care Record
• Secondary uses of your information
• Local data streaming initiatives

can be found at:

www.nhsdatasharing.info