Purposes for processing
Legacy records from Primary Care Trusts (PCTs) and Strategic Health Authorities (SHAs) were transferred to successor organisations as part of a legal transfer in 2013. This work was led by Department of Health. Departments within NHS England that are now responsible for a particular function received the records and information that they required for the function to progress within this transfer.
The NHS England Records Management Team is responsible for the management of closed legacy records. These paper legacy records are stored securely all over the country with 23 suppliers and are available to teams if needed for business needs. The personal data in these records may be provided in response to subject access requests and is subject to the other GDPR rights.
Categories of personal data
The categories of legacy records that we hold are as follows:
- Audit / Clinical Audit
- CAMHS (Child and Adult Mental Health Services) / Children’s and Young Persons Service / Family Planning Clinics and Services
- Clinical i.e. specialist commissioning / performance management / Serious Untoward Incidents
- Dental (includes patient records)/ Dental GP Contracts / Emergency Dental Service
- Enhanced Services
- Estates Management
- GP Appraisals [deregistered and RIP GP patient files held by PCS]
- Incidents (including infection prevention and control)
- Legal claims/issues
- Management and use of Controlled Drugs / Medicines Management / Medical Director
- Mental Health Commissioning
- Nursing & Quality – Safeguarding
- PEC (Professional Executive Committee)
- Primary Care Commissioning and Contracting – Dental / GP / Director / Medical / Medicines Management / Pharmacy / Optometry / Non Acute Commissioning / Non Funded Care / Extra Contractual Referral
- Quality and Clinical Governance
- Safety and Quality
- Ophthalmology (payments)
Many but not all of these records include personal data.
Legal basis for processing
For GDPR purposes NHS England’s lawful basis for processing when directing NHS Digital is Article 6(1)(e) – ‘…exercise of official authority…’. For the processing of special categories (health) data the basis is Article 9(2)(h) – ‘…health or social care…’.