Purposes for processing
NHS England is responsible for the routine commissioning of health and justice services. The current estate constitutes:
The Children and Young People’s Secure Estate including:
- Young Offender Institutions
- Secure Training Centres
- Secure Children’s Homes
- Prisons (including Youth Offender Institutions)
- Immigration Removal Centres (IRCs)
- Public Health services for persons in detained and secure settings across England
We process personal data for our commissioning purposes, in order to conduct clinical reviews and conduct investigations into deaths in custody.
Sources of the data
The information may be collected from any organisation that provides health services to the NHS, including Prison Health care providers, NHS Trusts, NHS Foundation Trusts, and other health and justice care providers. Data may also be submitted by other agencies to support commissioning and ensure the delivery of individual packages of care.
Categories of personal data and recipients
NHS England uses data that has been anonymised in accordance with the Information Commissioner’s Anonymisation code of practice, and summary data (numbers) for monitoring and payment for these services. This data is provided to us by NHS Digital who collects and analyses personal data submitted by providers on our behalf – see Data services for commissioners. The data processed by NHS Digital includes personal details such as NHS number, date of birth, postcode, and details of the diagnosis and treatment received.
Data that does not identify patients directly may be submitted by providers and other agencies in relation to the commissioning individual packages of care.
We also hold health care records in from prisons and other institutions within the secure estate. These records relate to prisons which have closed, or prisoners who have been released. The records document the care and treatment a prisoner has received. The records are held as they may become important, if there is a complaint or claim, which may typically be made months or years after the care received.
Legal basis for processing
For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’. For processing special categories (health) data the basis is Article 9(2)(h) – ‘…health or social care…’.
NHS England is a joint data controller for records held on the system that we provide for prisons.