Purposes for processing
NHS England operates a customer contact centre which gives a central contact for members of the public, patients or their representatives to contact NHS England. This can be for individuals to register a complaint, request information (Freedom of Information, Subject Access), submit an enquiry or provide feedback.
Sources of the data
NHS England collects information when members of the public contact us. This can be when they ask a general enquiry through our contact centre or directly with teams. In doing so, we collect relevant information at the point of contact to resolve their enquiry.
Categories of personal data
The data collected by NHS England about the enquiry is primarily stored on our contact centre customer relationship management system. This includes a record for the individual with an associated file relating to their case (i.e. a general enquiry, freedom of information request, subject access request, access to medical records request, complaint etc.). Case files contain records of previous requests/contact types from that individual. They hold name, contact information and any other information relating to their case. There may also be instances where individuals contact specific teams in NHS England and information provided at this point will be collected (i.e. name and contact information).
Categories of recipients
The information is used by the contact centre and relevant teams to manage the response to the query within the organisation.
Subject access requests and access to medical records requests
- Primary Care Support England (PCSE) delivered by Capita Ltd manages responses to subject access requests and access to medical records requests for GP records. PCSE acts as a data processor for NHS England to manage GP health records for un-registered or deceased individuals.
- The Corporate Information Governance team manages responses to subject access requests and access to medical records requests for records held by NHS England other than GP records.
Freedom of Information and Environmental Information Regulations Requests
Information including personal data about the applicant is used by the Freedom of Information team to log and progress requests and for reporting purposes.
Information not including personal data about the applicant is used by:
- NHSE teams that hold any information relevant to the request.
- Capita under contract with NHS England in the handling of any relevant information that they hold on behalf of NHS England.
- Commissioning Support Units (CSUs) under contract with NHS England in the handling of any relevant information that they hold on behalf of NHS England.
- The NHSE Chief Executive Office and Media Team receive reports from the FOI team in-line with the monitoring of request types and trends.
The information is used by the regional complaints teams to investigate and respond to the complaint.
Anonymous information from complaints may also be used by relevant teams within NHS England to learn from complaints to drive improvement to services and appropriately allocate resources.
Please see our contact centre webpage for more information.
Legal basis for processing
For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’. For the processing of special categories (health) data the basis is 9(2)(h) – ‘…health or social care…’.