CCQI quality improvement and accreditation networks and prescribing observatory for mental health (POMH) privacy notice

The Royal College of Psychiatrists’ (the College) Centre for Quality Improvement (CCQI) run several projects (including quality improvement and accreditation networks and the Prescribing Observatory for Mental Health) which aim to improve the quality of care provided for people with mental health conditions and problems.

CCQI projects work with individual services within an NHS Trust or organisation, or with the NHS Trust or organisation overall[1].

The College is the data controller for the information you provide to us as part of a CCQI project.

If you have any queries about the process or how we handle your information, please contact us at dataprotection@rcpsych.ac.uk

Sources of information used by CCQI Networks and POMH

Information is submitted to the CCQI project from a number of sources

NHS Trusts or organisations submit information on organisational processes and service users' care as part of their participation.

Some of this information is collected from hospital records, although most of the information on organisational processes is collected specifically for their participation in the project. Data is submitted via secure web-based tools.

Security and confidentiality is maintained through the use of passwords and registration processes.

Where NHS Trusts or organisations submit data about service users’ care, the data is pseudonymous or anonymous.

The CCQI project teams cannot identify the individual service user from the information they receive.

Where the data is pseudonymised, the individual NHS Trusts or organisation, hold the information needed to link a service user to the information submitted about the individuals care.

The CCQI projects also gather registration information directly from NHS Trusts or organisations to support the management of the CCQI project, such as contact details for the local individuals responsible for the Trust or organisations participation in the CCQI project.

Most CCQI projects collect information from other sources, such as staff providing care and treatment, from service users, their family members, friends or carers, or organisations and individuals who work closely with the Trust/organisation in question.

Data is submitted via a third party secure web-based tool or paper questionnaires received by pre-paid post.

The data collected from these sources is anonymous.

What will we do with the information you provide to us?

All of the information you provide will only be used for the purpose for which you provided it or to fulfil business, legal or regulatory requirements if necessary.

The CCQI projects will not share any of the information provided to us with any third parties for marketing purposes.

Information is held in secure data centres in the EU and US which comply with ISO 27001 security standards.

The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format.

All the data is accessible only to staff members working on the individual project and data processors by approval.

All data is held within restricted areas, is password protected and encrypted.

The CCQI projects produce public reports on the aggregated data at NHS Trust or organisation and national levels at specific points during the project.

Individual team, service or NHS Trust or organisation reports are only made available to the NHS Trust or organisation who provided the data.

Reports produced by the POMH project containing only aggregated data may also be provided to Trusts and organisations that have not supplied data, if they are current members of the POMH project.

CCQI projects may also publish data on its website and in appropriate scientific journals.

We will use the staff contact details at the NHS Trust or organisation provided to us at registration to contact you and in connection with any ongoing relationship with the relevant CCQI project.

You can request for the information to not be used to communicate with you about events or other communications such as newsletters. 

What information do we ask for, and why?

CCQI projects do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. 

The information we ask for is used to either maintain a record of you and to contact you, or for the purpose of assessing compliance against the agreed standards and providing reports on compliance and performance.

We process:

  • Service user information such as age, gender, ethnicity, diagnosis;
  • Care data including date and time of admission, interventions received (e.g. medication, psychological therapies), processes of care such as medication reviews;
  • Outcome data including date of discharge, re-admission, discharge destination and clinical improvements (e.g. scores on outcome measures such as HoNOS);
  • Data on organisational processes and procedures such as the use of staff supervision;
  • Information waiting times and length of stay;
  • Feedback on service user’s and/or their family member, friend or carers’ experiences of care provided by the relevant NHS Trust or organisation;
  • Feedback on staff members experiences of support, training, supervision and organisational processes;
  • Feedback about the experience of organisations and individuals who work closely with the Trust/organisation in question.

Use of data processors 

Data processors are third parties who process data for us.  We have contracts in place with our data processors.

This means that they cannot do anything with the information unless we have instructed them to do it.

All the information provided to our data processors is pseudonymised and they will not share your personal information with any organisation apart from us.

They will hold it securely and retain it for the period we instruct. 

The data processors we use are:

  • Software providers/hosts for databases which hold the data;
  • External statisticians for detailed analysis of anonymised sections of data.

How long is the information retained for?

The CCQI adheres to the timescales specified in the College’s Record Retention Schedule.

If you wish to learn more about our retention periods, please contact us using the details below.

Legal basis for processing

CCQI projects process data under the contract the NHS Trust or organisation has entered with us or with consent from the individual providing the data (for example the staff member, service user, family member, friend or carer submitting feedback).

Confidentiality

The information received and managed by the CCQI project teams is treated as confidential. 

The information is available to the project teams in an anonymous or pseudonymised format.

In the case of pseudonymised data, individual patients are only identifiable by the submitting NHS Trust/organisation using their coded service user lists which are held by them.

The CCQI project teams do not have access to these lists. 

The CCQI project teams will not publish information that can enable individual service users, family, friends or carers, or staff to be identified, nor allow third parties to access the data.

The confidentiality and security of information is maintained in the following ways:

  • All reports include aggregated data at the relevant level (national, NHS Trust/organisation);
  • Reports on individual services, NHS trusts or organisations is only shared with the relevant organisation concerned;
  • Small numbers are supressed, and qualitative feedback is either aggregated or shown only where there is no identifiable information.
  • Occasionally, we may share information with Regulatory or Public Authorities, for example:
  • NHS Trusts or organisations;
  • Care Quality Commission or the equivalent.

We will only do this where we have a statutory or regulatory requirement to do so, for example where we identify that staff or patients may be in imminent danger, concerns about unsafe practices or where they may be breaches of human rights.

Further information on situations where we may do this are available on our website or in the terms and conditions of membership.

Your rights

Under the Data Protection Act 1998, and incoming General Data Protection Regulation (GDPR) you have rights as an individual which you can exercise in relation to the information we hold about you.

What if I do not want my information used by the audit?

Service users, family members, friends or carers, or staff members can choose to opt-out of the CCQI project.

Opting out of the audit will not affect the care an individual receives or their employment with the relevant organisation.

For more information about how to opt-out of the audit, please contact you the person responsible for the CCQI project in your local NHS Trust/organisation directly as the CCQI project teams do not hold identifiable information. 

Complaints or queries

The College takes any complaints we receive about the way in which we use personal data very seriously.

We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate.

If you want to make a complaint about the way we have processed your personal information you can contact us using the details at the bottom of this notice.

You can also complain to the Information Commissioner’s Office directly:

Wycliffe House

Waterlane Wilmslow

Cheshire

SK9 5AF

Website: http://www.ico.org.uk/

Tel: 0303 123 1113

Changes to this privacy notice

We keep our privacy notice under regular review. This Privacy Notice was last updated in April 2018.

How to contact us

If you want to request information about our privacy policy you can email us at dataprotection@rcpsych.ac.uk or at the below address:

Data Protection Officer

Royal College of Psychiatrists

21 Prescot Street

London

E1 8BB

[1] For the purpose of this notice, both of these will be referred to as NHS Trusts or organisations as they hold overall control for the information submitted as part of CCQI projects.

Please read our disclaimer.