Privacy notice for Child Health Information Service
29 November 2023
SCW CHIS is commissioned by NHS England to support the monitoring of the care delivered to children across regions in the UK. This notice sets out the types of personal data that we collect about children and will explain how and why their personal data is used.
CHIS is responsible for collecting childhood immunisation and screening information from healthcare professionals in a specified area and maintaining a single child health record.We are commissioned to provide CHIS services to the following local authorities across England:
- Bath and North East Somerset,
- Berkshire,
- Bristol,
- Buckinghamshire,
- Cheshire,
- Cornwall,
- Devon,
- East Midlands (Glossop, Derbyshire, Leicestershire & Rutland, Lincolnshire, Northamptonshire, Nottinghamshire),
- Gloucestershire,
- Greater Manchester (Bolton, Bury, Manchester, Oldham, Rochdale, Salford, Stockport, Tameside, Trafford & Wigan),
- Halton,
- Isles of Scilly,
- Knowsley,
- Liverpool,
- North Somerset,
- Oxfordshire,
- Somerset,
- South Gloucestershire,
- St Helens,
- Swindon,
- Surrey,
- Warrington,
- Wiltshire,
- Wirral.
This notice sets out the types of personal data that we collect about children and will explain how and why their personal data is used. We also explain how long the data will be kept and when, why and with whom the data may be shared. The notice sets out the legal basis for processing and the various rights and choices that you and your child have when it comes to your personal data.
Controller
NHS England is the controller for our processing of personal data for Child Health Information Service (CHIS) and is registered with the Information Commissioner. SCW CHIS acts as data processor under contract to NHS England. NHS SCW is a commissioning support unit, hosted by NHS England.
What personal data do we collect about a child and where from?
Health screening, physical examination and vaccination services are monitored to ensure that every child has access to all relevant health interventions.
In support of this SCW CHIS maintains a record of all children resident in the areas we look after. We maintain a record of all children aged 0-19 years old and their mothers/related parties, and mothers-to-be. The data set includes personal data and special category data relating to:
Demographics, NHS number, Ethnicity, Newborn Bloodspot and Newborn Hearing, Newborn and Infant Physical Examinations, Vaccination and Immunisations status, Looked After Children status. We record demographics and HepB status for mothers and mothers-to-be.
We receive data from GPs, maternity departments, independent midwives, health visitor providers, screening laboratories, school-age vaccination providers, school nurses and local authorities, and other CHIS providers.
Who do we share the personal data with?
SCW CHIS will keep information about all children to ensure we deliver a safe and quality service. In support of child services relevant data is shared with professionals involved in delivering services to children:
- GPs
- Newborn (neonatal) hearing screening providers
- Newborn blood spot providers
- Independent midwives
- Maternity departments
- Safeguarding teams
- Local authorities (children services)
- School-age vaccination providers
- School nurses
- Health visitor providers
- Other CHIS located outside the region (supporting children as they move around).
How long do we keep the personal data?
All information is managed in accordance with the NHS Code of Practice for Records Management - available on the NHS England website.
CHIS will retain a record until the patient's 25th birthday, or 26th if the patient was 17 when treatment ended. If a new CHIS provider is appointed, the data will be securely transferred to the new provider under instruction from NHS England.
What other organisations process the data on behalf of NHS SCW?
SCW CHIS IT System
All SCW CHIS information is securely held on two systems; the CarePlus IT System provided by System C and the SystmOne IT system provided by The Phoenix Partnership (TPP). Only authorised SCW CHIS staff, local authority and healthcare professionals have access to relevant information in these systems. Regular audits are undertaken to monitor access. System C and TPP do not access the data.
Communication to parents
SCW CHIS currently sends newborn blood spot result letters & GP immunisation reminder letters to parents via Synertec Ltd who securely print and dispatch our letters by Royal Mail business class. The letter information is only retained for a short period to allow printing and dispatch. Once letters have been dispatched, the data is securely destroyed.
Automated collection of GP data
We may collect relevant CHIS data from GP Practices by automated transfer using software supplied by Magentus Data Management Services (also known as Apollo Medical Software Solutions Ltd). Magentus does not access the data.
How will we communicate with you?
In addition to this website notice, we may communicate with you when necessary for CHIS purposes by letter, text, email or telephone. We will never contact you for marketing purposes.
What legal basis do we have for processing the information?
Healthcare data
The Secretary of State delegates several public health functions to NHS England. The public health functions agreement enables NHS England to commission certain public health services which will drive improvements in population health, including CHIS. SCW is commissioned by NHS England to provide the CHIS as part of their public health duties.
GDPR legal basis: 6 (1) (e) Public task
Local Authority data
SCW may provide local authorities with information necessary to support their legal obligations. Under S 436A Education Act 1996 each local authority has a legal obligation to:
- Be aware of children residing in its area
- Investigate cases of children missing from education and ensure children not receiving statutory provision are receiving an adequate education
- Planning and development of services for children and young people
Local authorities will provide data to SCW CHIS for the planning of appropriate services enabling the health and wellbeing of children and families, e.g. school immunisation programme.
GDPR legal basis: 6 (1) (e) Public task
Safeguarding children and adults at risk
SCW CHIS has a statutory responsibility under the Children Act 2004, Care Act 2014 and safeguarding provision within the Data Protection Act 2018 (Schedule 1, Part 2, Subsections 18 and 19) to ensure the safety of all children, and the safety of adults at risk of physical, mental or emotional harm.
GDPR legal basis: 6 (1) (e) Public task
Complaints
All complaints are managed by our Patient Advice and Complaints Team. More information can be found on our Contact us page.
GDPR legal basis: 6 (1) (a) Consent
Common law duty of confidentiality
In our use of health and care information, we satisfy the common law duty of confidentiality because either:
- you have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses)
- we have a legal requirement to collect. share and use the data
How do we protect your information?
SCW CHIS ensures all personal data is processed in a secure way and access is strictly controlled.
Examples of our security include:- Encryption – meaning that the information is hidden so that it cannot be read without special knowledge (such as a password).
- Controlling access to systems and networks, this allows us to stop people who are not allowed to see the data from accessing it.
- Controlling access for different user roles, so only certain data required for a specific role is accessible.
- Training our staff to ensure they know how to handle data responsibly and securely.
- Regular testing of our technology including keeping up with the latest security updates.
- We do not process any personal data outside of England.
- Third-party contracts are regularly reviewed and updated
How to access the information
We collect certain information from health and care organisations providing care to your child and would advise contacting your GP directly for a more complete record of their care or treatment.
Where information from which a person can be identified is held by SCW CHIS, you have the right to view or request copies of this information free of charge.
If you would like a copy of the information that SCW holds about you or your child, or you have any queries or concerns about how CHIS uses the personal data, please send your request using the contact details below:
Address:
SCW CHIS Information Team
4th Floor, South Side,
Burlington House,
Crosby Road North,
Liverpool
L22 0QB
Telephone: 0300 561 1850
Email:
Contact details for each area can be found here.
Do we use 'cookies' on our websites to collect personal data?
The site does not use cookies to store information about you. A simple cookie is created when you first visit the site but is removed when you leave. This is purely to allow the website to function correctly.
We are committed to protecting your personal information. We want our services to be safe for everyone.
More information on privacy and cookies.
Where can I get further information?
If you have any queries or concerns about how SCW handle personal data, you can contact:
Adam Tuckett – SCW Deputy Data Protection Officer (DDPO) –
Laura Tully – Caldicott Guardian – email:
SCW is a Commissioning Support Unit (CSU) hosted by NHS England, and we fulfil our requirement for a DPO through NHS England’s DPO, their Head of Information Governance.
Independent advice and complaints
For independent advice and complaints about data protection, privacy, and data-sharing issues, please contact:
Information Commissioner
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 08456 306060 or 01625 545745 Website: https://ico.org.uk/.