How we use your information

To provide you with the highest quality health care we need to keep records about your health and any treatment and care you receive from the NHS. They will be mainly held on computer but could be on paper (manual). These may include:

• Basic details about you, such as name, address, date of birth, NHS number, gender, ethnicity and next of kin
• Contact we have had with you such as clinic visits
• Notes and reports about your health
• Details and records about your treatment and care
• Results of investigations, X-rays, laboratory tests, etc.
• Relevant information from health professionals, relatives or those who care for you.

Your records are used to guide and administer the care you receive to ensure that:

• The doctor, nurse or other healthcare professional involved in your care has accurate and up to date information to assess your health and decide the most appropriate care for you
• Full information is available about you should we need to share your information with another doctor or you need to be referred to a specialist or another part of the NHS
• We have an accurate record if we need to review your care
• Your concerns can be properly investigated if a complaint is raised
• We can teach and train the next generation of healthcare professionals
• Allow us to develop and provide services to meet the different needs of patients.

It is important that the information we hold about you is accurate and complete. If your details change, please tell us.

Your information may also be used to help us:

• Look after the health of the general public
• Pay your GP, dentist and hospital for the care they provide
• Investigate complaints, legal claims or untoward incidents
• Make sure our services can meet patient needs in the future
• Prepare statistics on NHS performance and activity
• To audit accounts, systems and procedures
• Review the care we provide to ensure it is of the highest standard
• Undertake patient surveys to obtain valuable feedback
• Conduct health research and development.

Everyone working for the NHS has a legal duty to keep your information confidential and UCLH strictly controls the passing of information to people not directly involved in your treatment.

When information is shared, it is passed securely and kept confidential by the people who receive it.

The NHS operates under the notion of ‘implied consent’ when it collects and shares data directly related to your healthcare. For example, when your GP refers you to one of our hospitals or you attend A&E (Emergency Department) we can assume you are happy for us to collect and manage your personal information to provide you with treatment.

UCLH is a complex organisation and in order for your doctor or healthcare professional to provide you with a service, a large team of professionals may have to be involved.

These may include nurses, lab technicians and technical staff (supporting medical or administrative systems).

We may also involve other healthcare professionals at other hospitals or services. If your information is used for other purposes, such as research, clinical trials or our work with affiliated charities, we will seek your consent.

With your consent, information can be shared with relatives, partners or friends who act or care for you.

To make sure you receive all the care and treatment you need, we might share relevant information about you with other organisations so we can all work together for your benefit to give you the support and care you need. They may include:

• Your GP, dentist and pharmacies
• Ambulance Services
• NHS walk-in centres
• Out of hours doctors services
• Community services such as nurses, midwives and therapists
• Private hospitals, care homes and hospices.

This now includes the Health Information Exchange, which integrates data from these other organisations across North London, and other organisation from across London for a real time summary and read only summary of that data.

If you wish to opt out of this sharing please complete the opt-out form.

We may also share your information, subject to strict agreement about how it will be used with:

• Adult or children services
• Education services
• Local Authorities
• Voluntary sector providers working with the NHS
• When a serious crime has been committed
• When there are serious risks to the public or NHS staff
• To protect children
• Third party suppliers, including suppliers located outside the European Economic Area (EEA).

In some circumstances, your data may be transferred to third party suppliers outside of the EEA. Sending data to third party suppliers outside of the EEA is only ever carried out in connection with your care. We make sure that this is done in compliance with the Data Protection Act (by sending information to an approved country with adequate privacy laws or where adequate contractual and procedural arrangements are in place). No personal data will be transferred outside the EEA for any other purposes, e.g. research or education, without your explicit consent.

There may be times when we are required by law to report certain information to the appropriate authorities. Occasions when we must pass on information include:

• Notification of births and deaths
• Where we encounter infectious diseases that may endanger the safety of others, such as tuberculosis, meningitis or measles (but not HIV/AIDS)
• Reporting gunshot wounds and violent assault to the police
• Where a formal court order has been issued

Anyone who receives information from us also has a legal duty to maintain confidentiality.

The following outlines how we may use your information to protect you and others during the COVID-19 outbreak. UCLH is involved in local, national and international responses working with the rest of the NHS and other organisations. This notice supplements our main Privacy Notice.

The health and social care system is facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak.

In the current emergency it has become even more important to share health and care information across relevant organisations. These organisations include other NHS Trusts and institutions, Public Health England and research institutions like UCL and sometimes with health and research partners overseas. We will continue to use services from companies like Microsoft, AIMES and Atos as we do currently under contracts.

Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. All healthcare bodies must legally now provide this confidential patient information to respond to the Covid-19 outbreak. Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further information and some FAQs on this law are available on gov.uk are available here.

During this period of emergency, opt-outs will not generally apply to the data used to support the Covid-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. However in relation to the Summary Care Record, existing choices will be respected. Where data is used and shared under these laws your right to have personal data erased will also not apply. It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak.

How will my information be used?

In line with the materials we refer to the kinds of work your information will be used to:

• to support include understanding Covid-19 and risks to public health as well as individual patients and how to treat them;
• understand how patients are accessing health services and the needs of our patients, including vulnerable groups and health and social care workers as direct or indirect results of Covid-19;
• conduct research and planning, where we have provided a list of research projects in Appendix 1.

Information uses – individual care

In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111. We may also use the details we have to send public health messages to you, either by phone, text or email.

Across North Central London a single list of people with Covid-19 will be created by the local hospitals that local authority social care teams need to be aware of. Information needed for the transfer of care will be uploaded into the HealtheIntent platform. Details about HealtheIntent can be found here.

During this period of emergency we may offer you a consultation via telephone or video-conferencing. By accepting the invitation and entering the consultation you are consenting to the use of telephone or video-conferencing for your consultation. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation.

When you tell us you’re experiencing Covid-19 symptoms we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.

Information uses: public health, national and international response

We will also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. Further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the COVID-19 response is here.

NHS England and Improvement and NHSX (see here) have developed a single, secure store to gather data from across the health and care system to inform the COVID-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.

We will also use information the National Immunisation and Vaccination Service (NIVS) to identify patients that might need vaccination against COVID-19 to help provide appropriate support and guidance.

Research (national and international)

To help inform the COVID-19 response UCLH will share data with other organisations as well for research purposes. The sharing will have been approved and will be subject to the same strict controls as above that meet the requirements of the data protection legislation. For COVID-19 responses we cannot implement any opt-out requests currently. (This is due for review.)

Examples are available on our privacy notice.

All research we undertake is approved by an independent Research Ethics Committee and by our Research and Development (R&D) department. We will ordinarily seek your permission before using information that could identify you for research purposes.

You have our commitment that we will use your records in ways that respect your rights and promotes your health and wellbeing. If we intend to share your information in a form that identifies you outside your direct care team, we will ask your permission first.

In some specific circumstances, we may seek consent from the Secretary of State for Health via the Health Research Authority (HRA) to either conduct research or carry out other NHS functions without your informed consent. This is usually in respect of large-scale research in the public interest. All parties maintain a strict duty of confidence and are subject to enhanced security controls in these circumstances. 

Our charities provide important support to the work of UCLH, by supporting major projects and providing benefits to patients not covered by NHS funding.

Limited contact information, for example, name, address etc., may be shared with charities, which are affiliated with UCLH NHS Foundation Trust. Your personal data will only be shared with your consent. These charities support our work by donating equipment and paying for additional facilities and amenities. The list of affiliated charities is available on request or on our website.

UCLH is a Foundation Trust and is therefore governed by its members. A separate membership database is maintained by UCLH specifically for this purpose. For further details about membership and related services, please refer to our website listed at the end of the page.

You can ask the doctor, nurse or healthcare professional looking after you if you wish to see information held about you regarding the current care or treatment you are receiving.

If you want full disclosure of your medical records, you may wish to make a formal application under the Data Protection Act 2018. The Act gives you the right to access the information we hold about you on our records. You do not have to give a reason for your request. You have the right to:

• Ask for a copy of all records about you held in paper or electronic form (a fee may apply)
• Choose someone to make decisions about your healthcare if you become unable to do so (this is called ‘a lasting power of attorney’).

UCLH is obliged to:

• Maintain full and accurate records of the care we provide you
• Keep records about you confidential, secure and accurate
• Provide information in a format that is accessible to you (for example, in large type if you are partially sighted).

To access your medical records follow the procedures below:

• Your request must be made in writing to the relevant medical records department. You can also complete an online form to access your medical records. Details of addresses and links are listed at the end of the page
• For information from another hospital or your GP you should contact them directly
• You will need to give adequate information (for example full name, address, date of birth, contact number, etc.) so that your identity can be verified and your records located
• You will need to supply us with proof of your identity. For example a current passport, EU driving licence, or a recent utility bill
• We aim to respond promptly and are required to do so within 30 calendar days of receiving your request.

We will normally be able to provide you with a copy of your records. However, we may partially restrict disclosure of information where:

• The health professional in charge of your care believes it may be mentally or physically harmful to you or another person to see certain contents of your records
• By providing access, we would reveal information, which relates to and identifies another person unless that person has given consent. This would not usually include health professionals

We would normally be able to provide your records with any such information removed and we would usually inform you if this were the case. If you think any of the information is inaccurate or incomplete, please let us know.

Other people who you authorise in writing can also apply on your behalf to access your medical records. This includes a legal representative (e.g. a solicitor) or any person appointed by a court to manage your affairs (if the court decides you are unable to manage your own affairs). If you are a parent or guardian of a child under 16, you can ask to see their medical records in the same way, if this is in the child’s best interest. If your child is old enough to make a decision about this, you may not be able to see their records without their consent.

We are required to keep confidential records of your care and treatment for a certain period of time.

The usual retention period is eight years. This can vary according to the type of record, for example:

• Adults: eight years after conclusion of treatment or death
• Children and young people: until patient’s 25th birthday or 26th if person was 17 at the conclusion of treatment, or eight years after death
• Maternity records: 25 years after the birth of the last child (even if the last birth was a stillbirth)
• Oncology, including radiotherapy: 30 years (eight years for deceased patients)

The service has been set up to help patients and their relatives and carers find a speedy and effective solution to any problems they may encounter. PALS offer the following:

• A patient-friendly, easy-to-access, confidential service designed to provide a personal contact to assist patients, relatives and carers
• On-the-spot advice and information if you have queries or difficulties
• Listen to your concerns and help you find ways of resolving them
• To take note of what you tell us to help improve the service our hospitals offer to patients
• A point of contact for all those wishing to get advice and information about the hospitals’ services.

If you would like more information, please speak to the health professional caring for you. You can also contact the relevant department; details are at the end of this page.

If you would like to express appreciation or make a suggestion, please contact the person in charge of the ward, clinic or department. You can also use UCLH feedback and comment cards available on wards and departments.

If you are not satisfied with your hospital experience, please speak to the person in charge of the ward or clinic. You can also speak to our Patient Advice and Liaison Service (PALS) who will be able to help you with your problem quickly and informally.

If you wish to make a formal complaint, please write with full details to UCLH’s Complaints Officer. Details can be found on our website.

If you have any queries about the way we use your information please contact:

Information Governance Team
UCL Hospitals Foundation Trust, 
2nd Floor, Maple House, 
149 Tottenham Court Road, 
London, W1T 7DN

Email: UCLH.IGQueries@nhs.net

University College Hospital, Release of Information Team Medical Records
2nd Floor, Maple House, 
149 Tottenham Court Road,
London, W1T 7DN

Email: UCLH.releaseofinformation@nhs.net

UCLH Website