Who Are We:
Cheshire Occupational Health Service is the provider of your workplace health needs during your employment. Cheshire Occupational Health Service is a collaborative service between East Cheshire NHS Trust and Mid Cheshire Hospitals NHS Foundation Trust. As a service we are committed to handling your information securely and in line with UK data protection laws. The Data Controller for any data held by the Cheshire Occupational Health Service is Mid Cheshire Hospital NHS Foundation Trust.
Why Do We Collect Information About You:
The Occupational Health doctor, nurse and the team of healthcare professionals working in the Occupational Health service keep records about your health, fitness and capability regarding work. These records help to ensure that you receive the best possible care. Your records may be held in paper format electronically on computer.
These records include:
- Your name, address, date of birth, country of origin
- Payroll number and job title
- Immunisation records
- Notes and reports about your health detail and records about your work and care
- Results of any x-rays, laboratory tests etc.
- If relevant clearance for exposure prone procedures, i.e., your HIV and hepatitis B and C status
- Details of any sharps/accidental inoculation injuries and source patient blood tests (if relevant)
- Details of health surveillance undertaken
- Details of health promotion events you have attended
- Copies of health declarations you have completed
- Copies of management referrals and correspondence to Occupational Health from managers regarding you and vise-versa
Access and Security of Your Personal Data:
All paper files are kept in locked cabinets within the Occupational Health departments only Occupational Health personnel have access to your files. Electronic data are encrypted are kept secure in line with the Trusts IT Security Policies with only Occupational Health clinical staff having legitimate access to clinical data.
Everyone working for the NHS has a legal duty to keep information about you confidential and secure We use the minimum necessary information about you to be able to provide you with the care and services required.
How We Obtain Your Personal Data:
Information provided by you, for example pre-placement health questionnaires, self-referral forms, vaccination records from your GP or other Occupational Health service
Information we get from other sources, for example information provided by your employer such as management referrals, GP or treating specialist information following your consent
How We Use Your Personal Data:
We use your personal data to enable us to:
- Assess your health and decide the most appropriate plan of care for you
- Investigate any complaints, concerns or legal claims that you have raised
- Provide continued support and care if you see another OH doctor or nurse
- Refer you to another specialist as required
- Improve the Occupational Health Service and help protect the health of the public
- National audit and benchmarking E.g., MoHaWK (Management of Health at Work Knowledge) which is the national web-based benchmarking tool which supports local audit for occupational health services
- Local Audit and benchmarking to ensure that OH policies and procedures are effective
- To provide research opportunities and enable our patients to partake in research projects and programmes
- Make sure our services can meet employees’ needs in the future
- Prepare statistics on Occupational Health service performance
- Review the care we provide to ensure it is of the highest standards
Some of your information is used for statistical or audit purposes. In these instances, OH takes strict measures to ensure that individual employees cannot be identified.
Sharing Information:
To ensure you receive the best possible care, we sometimes need to share your personal data Your personal data will only be shared on a case-by-case basis when it is lawful and necessary to do so. In most situations information will only be shared with your consent. Some examples of recipients of your data are included below:
- You, your family, associates and/or representatives
- OH Staff
- Your line manager
- Your General Practitioner
- Integrated Care Systems
- Strategic Health Authorities
- Other NHS Practitioners
- Other Occupational Health Services
- Health and Safety Executive
- NHS Resolution
As an Occupational Health provider, we may receive requests to share your personal data with external providers, for example with insurance companies or solicitors. In these circumstances Occupational Health will only share your personal data with your consent or where it is legally required to do so (e.g. under the requirement of a court order). Only in very exceptional circumstances will we disclose information to a third party without your consent, for instance, when the health and safety of others, or yourself, is at risk or if the law requires us to.
Where we need to share your personal data, Occupational Health will only ever do so in a secure manner to protect the confidentiality of your information.
Legal Basis for Processing Your Information:
Occupational Health will only ever process your personal data where it is able to do so by law and using one of a number of legal basis under UK data protection law. Occupational Health will use the following legal basis to process your personal data:
- Performance of a Task (GDPR Article 6,1(e)) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller for example, the processing of Occupational Health reports following an Occupational Health assessment.
Where we process your sensitive personal data or special categories of data (i.e. racial or ethnic origin, religious beliefs, trade union membership, health, sexual orientation, criminal convictions and disabilities), Occupational Health will the use the following legal basis:
- Preventative or Occupational Medicine (GDPR Article 9,2(h)) - assessing the working capacity of our employees.
For further information on the legal basis for processing please refer to your Trust’s or employer’s local privacy notice.
Your Rights:
Under the legislation you are entitled to a number of rights in accordance with the specific legal basis which has been used to process your data. These are:
- To be informed why, where and how we use your information.
- To ask for access to your information.
- To ask for your information to be corrected if it is inaccurate or incomplete.
- To ask for your information to be deleted or removed under certain circumstances.
- To ask us to restrict the use of your information under certain circumstances.
- To ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information.
- To object to how your information is used under certain circumstances.
If you wish to make such a request, you should submit a Subject Access Request to the Trust. Details of how to do this are provided here - Subject Access Request form :: Mid Cheshire Hospitals NHS Foundation Trust.
Retaining Your Information:
The Trust will retain your information in line with Health and Social Care Records Management Code of Practice a copy of which can be obtained at Records Management Code of Practice - NHS Transformation Directorate.
Further Information:
Should you have any further queries on the uses of your information, please speak to:
Cheshire Occupational Health Service
Leighton Hospital
Middlewich Road
Crewe, Cheshire
CW1 4QJ
Email: occupationalhealth.
Telephone: 01270 612372
Should you wish to lodge a complaint about the use of your information, please contact the Trusts Data Protection Officer:
Head of Information Governance, IT Security and Data Protection Officer
Mid Cheshire Hospitals NHS Foundation Trust
Leighton Hospital
Crewe
Cheshire
CW1 4QJ
Email: DPO
If you are still unhappy with the outcome of your enquiry you can write to: The Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF - Telephone: 01625 545700.