Your Choice About Your Information

Fair Processing Notice – Data Protection Act 1998

Your Information and how we use it

Who we are

The Small Area Health Statistics Unit (SAHSU) is a long-standing and internationally-recognised centre of excellence in spatial and environmental epidemiology. SAHSU was established in 1987 following a recommendation from the Black Enquiry into clusters of leukaemia and lymphoma around the Sellafield nuclear power plant. 

What we do

SAHSU undertakes statistical analyses on health, environmental, and demographic and socioeconomic data. Our work assists Public Health England in fulfilling their duties to protect and improve the health of the population. Our research programme is supported by on-going infrastructure funding from Public Health England and the Medical Research Council. The focus of SAHSU’s work is to investigate key public health issues associated with environmental factors at a small area level and provide evidence about population health risks to inform public health policy.

Type of Information we hold and process

We hold national health data on a secure network, with restricted access, no internet links or connection to the Imperial College network. The data come from a number of data providers, including records collected by the Office for National Statistics (ONS), the Welsh Cancer Intelligence & Surveillance Unit (WCISU), Public Health England, NHS Digital and other national sources. We hold information about cancer and tumour diseases, visits to hospital - accident and emergency attendances, hospital admissions and other NHS services.
The data we receive do not include patients’ names but they may include information such as NHS number, postcode, date of birth, date of death, ethnicity and gender as well as coded information. We also hold information from deaths and births registries. There are rigorous controls in place which enable us to access your information and to use it responsibly. These include restricting access to trained SAHSU researchers and ensuring data in research outputs will not identify you as an individual. In order to use your data, we have to meet strict conditions that we are legally required to follow, which include making a written commitment to our data providers.
All our research applications are reviewed by an expert independent scientific committee -National Research Ethics Service (NRES) every five years with an annual report submission to the committee to report progress and any changes. The Secretary of State for Health has given us limited permission to use confidential patient information when it is necessary for our research work. This approval is given under Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002 – also known as Section 251 of the NHS Act 2006 and is based on the advice of the Health Research Authority’s Confidentiality and Advisory Group (CAG).
The NHS Digital’s Independent Group Advising on the Release of Data (IGARD), and other data providers assess advice from the CAG and NRES and also need to approve our data applications before releasing your information to us.

How we use your information

Your information is an invaluable asset to us without which we would not be able to conduct research and surveillance to protect public health and to support improvements in health and care outcomes. We are committed to protecting your rights to confidentiality. Having information on the entire population is essential to allow us to investigate national environmental health concerns, conduct disease surveillance and detect disease clusters.

SAHSU has a programme of work agreed with Public Health England and are defined by the following terms of reference:

• To develop and maintain databases of health data, environmental exposures and socio-demographic factors
• To carry out substantive research studies on environment and health issues including studies of the relationship between socio-economic factors and health, in collaboration with other scientific groups as necessary
• In collaboration with other scientific groups, to build up reliable background information on the distribution of environmental exposure, socio-economic data and disease amongst small areas
• To develop methods for analysing and interpreting health outcomes related to small areas
• To act as a centre of expertise, disseminating information on developments in spatial epidemiological methods to national and regional groups
• To respond rapidly, with expert advice, to ad hoc queries from the Department of Health and Public Health England about unusual clusters of disease, particularly in the neighbourhood of industrial installations

Our confidentiality pledge – Keeping your information secure and confidential

We ensure anyone who has access to your personal information has had compulsory training on data security awareness and confidentiality. All staff have contractual obligations of confidentiality, enforceable through disciplinary procedures and they are required to comply with the Data Protection Act 1998 and from May 2018, the General Data Protection Regulation to ensure your personal information is handled and stored securely.

Information provided to us will only be used for the purposes stated in our data applications. We undertake strict organisational and technical measures to ensure your personal information is held securely at all times. We have a robust information governance framework which sets a high standard with the way we handle and process your information.

We protect your information using the following security measures:
• We do not share your information with any third parties
• We will remove your information at the end of our research or our data sharing agreements with our data providers have ended or at your request
• We recognise that you are sharing personal information with us and we will treat it as confidential.
• We use your information for statistical purposes and we are committed to protecting your privacy.
• We adhere and conform to national guidelines to supress small numbers in all our publications and we will not publish anything that may identify you as an individual.
• We maintain the security of our systems and our premises so that your data remain secure at all times
• We keep our Information Technology (IT) systems up-to-date to protect us against viruses and any other threats
• We restrict access to your information by using passwords or swipe cards to control access to data, and using encryption so your personal data can only be read with a code.

Data Protection Registration

Imperial College is a ‘Data Controller’ under the Data Protection Act 1998 and is legally responsible for ensuring that all personal data that we hold and use is done so in a way that meets the data protection principles Imperial College's registration number is Z5940050 and our registered entry can be found on the Information Commissioner’s website.

All of our staff receive training to ensure they remain aware of their responsibilities. They are obliged to uphold confidentiality, and may face disciplinary procedures if they do not do so. A limited number of authorised staff have access to personal data where it is appropriate to their role.

Your choice about your information

Patient control of information

At any time, you have the right to refuse/withdraw consent, in full or in part, to the sharing or
processing of information from which you could be identified. You may want to prevent confidential information about you from being shared or used for any purpose other than providing your care.

The two choices that are currently available to you are:
1. 'Type 1' objection - You can object to information about you leaving your GP Practice in an identifiable form for purposes other than your direct care, which means confidential information about you will not be shared with any organisation for non-direct care purpose.
2. 'Type 2' objection - You can object to information about you leaving NHS Digital in identifiable form, which means confidential information about you will not be sent to anyone outside NHS Digital.
Refer to Your personal information choices for available choices regarding your information.

Any request to access, delete or obtain a copy of your information will be considered under the Data Protection Act. You will need to send a written request to Dr Anna Hansell (see contact details below).

Dr Anna Hansell
Assistant Director
Small Area Health Statistics Unit (SAHSU), MRC-PHE Centre for Environment and Health,
Department of Epidemiology and Biostatistics, School of Public Health, Faculty of Medicine,
Imperial College London, St Mary's Campus, Norfolk Place, London W2 1PG

Email: a.hansell@imperial.ac.uk

Raising a concern

If you have a concern regarding the way your records are managed or to learn more about how we use, manage and maintain confidentiality of your information, please contact:

Hima Daby
Data and Information Services Manager
Small Area Health Statistics Unit (SAHSU), MRC-PHE Centre for Environment and Health,
Department of Epidemiology and Biostatistics, School of Public Health, Faculty of Medicine,
Imperial College London, St Mary's Campus, Norfolk Place, London W2 1PG

Email: h.daby@imperial.ac.uk