GDPR & the Hampshire Health Record/CHIE

Dr Neil Bhatia made this Freedom of Information request to Hampshire Hospitals NHS Foundation Trust

This request has been closed to new correspondence from the public body. Contact us if you think it ought be re-opened.

The request was partially successful.

Dear Hampshire Hospitals NHS Foundation Trust,

I would like to make a request under the FOI Act.

For the purposes of the Act, please take the date of your receipt of this request as Tuesday 24h April 2018.

I am interested in how Hampshire Hospitals NHS FT is planning to comply with the EU GDPR requirements for the data that it processes (extracts & uploads) to the Hampshire Health Record (HHR/CHIE).

My understanding remains that HHNHSFT extracts and uploads data to the HHR purely for direct care purposes (i.e. it does not permit secondary uses).

I am requesting the following information:

1) Please could you tell me which lawful basis, as set out in Article 6 of the GDPR, will you be relying upon to enable processing of personal data in this way (e.g. "Article 6(1)(e)")?

2) Please could you provide me with the procedure that patients must follow in order to express their right to object to such processing (as is their right under Article 21).
Please could you provide me with:

a) the form that they must fill in, or a description of the information that you require from them in order to process their objection

b) to whom they must send their objection (e.g. department, address or email address)

c) confirmation that patients will not simply be told to "go and see your GP" when expressing their right to object (i.e. that *you*, as the data controller, will deal with their objection as per Article 21 and Recital 69)

d) confirmation that any upheld objection will ensure that no data about the patient will be extracted and uploaded to the HHR by HHNHSFT, yet still allowing the patient to have a HHR consisting of records derived from the other contributing organisations (including their GP practice)

e) any such policy that you have that, in part or whole, details how HHR "right to object" expressions will be managed by *(your* organisation

I would be grateful if you would be kind enough to send me the requested information promptly and in any event not later than the twentieth working day following the date of receipt of my request.

I would be grateful if you would kindly acknowledge receipt of this request as recommended by the ICO (“It would be good practice to acknowledge receipt of requests and to refer to the 20 working day time limit, so that applicants know

their request is being dealt with”).

Thank you once again.

Yours faithfully,

Dr Neil Bhatia

FOI HHFT, Hampshire Hospitals NHS Foundation Trust

Thank you for your email.


We will make every effort to supply you with the information within 20
working days.


Kind regards,


Freedom of Information Team

Hampshire Hospitals NHS Foundation Trust

show quoted sections

Dear Hampshire Hospitals NHS Foundation Trust,

Just a reminder that you must respond to my FOI request by the end of today.

Yours faithfully,

Dr Neil Bhatia

FOI HHFT, Hampshire Hospitals NHS Foundation Trust

1 Attachment

Dear Dr Bhatia,

Please find attached a formal response to your Freedom of Information request.

Many thanks

Gemma Taylor
Legal Assistant & Information Officer
Hampshire Hospitals NHS Foundation Trust
H 01256 314917 [email address]

This message and any attachments are confidential and may be privileged or otherwise protected from disclosure.

show quoted sections

Dr Neil Bhatia left an annotation ()

More information about NHS data sharing, including:

• The Summary Care Record,
• The Hampshire Health Record (CHIE)
• The Berkshire Health Record (Share Your Care)
• The Manchester Care Record
• The Stockport Health and Care Record
• The Salford Integrated Record
• The West Cheshire Care Record
• The North Staffs and Stoke-on-Trent Shared Record
• The Sutton Integrated Digital Care Record
• The Wirral Care Record
• The Dorset Care Record
• The Bolton Care Record

• Secondary uses of your information
• The National Data Opt Out

• Local data streaming initiatives
• Remote consultations
• Secure online access to your GP record

can be found at: