Invited Review Service privacy notice

The Royal College of Psychiatrists (the College) is the professional membership organisation that educates and sets standards for psychiatrists.

The College's Invited Review Service (IRS) carries out service reviews, individual/team reviews and case note reviews (each an IRS Review) at the invitation of an NHS Trust or other organisation that provides mental health care services (Organisation). IRS Reviews are carried out by, or by persons acting under the responsibility of, appropriately qualified and trained professionals.

Our reviewers are all:

  • a) experienced psychiatrists and senior nurses (Professional Reviewers); or
  • b) lay reviewers with experience as patient representatives and/or as lay participants in health service reviews (Lay Reviewers). Further information about Lay Reviewers is set out in this Privacy Notice.

It is our aim that IRS Reviews provide independent opinions and that the findings are factually based, taking into account the experience of people involved in the service provided by the Organisation.

An IRS Review will normally involve us examining documents shared with us by the Organisation, a site visit and interviews with relevant people in the Organisation and with patients and/or their family members, friends or carers.

Our benchmark is published professional standards. In a case note review we assess the care provided against approved/evidence-based documents such as Good Psychiatric Practice, CR154, Good Medical Practice and any other faculty specific guidance, depending on the details of the case.

We aim to support NHS Trust mental health providers and independent sector organisations (and College members within those bodies), using a tailored, fair and consistent process to resolve concerns about individual, team and service quality and performance. Our aim is to provide a limited number of clear and implementable recommendations to the Organisation to improve the quality of patient safety and care.

The College is a data controller for both the personal data shared with us by the Organisation, and the personal data you provide to us during the IRS Review (for example, if you are interviewed by the IRS).

If the College instructs a Lay Reviewer to assist on an IRS Review, the College will need to share personal data with the Lay Reviewer. The Lay Reviewer is a data processor for the information that the College shares with the Lay Reviewer during the IRS Review.

Sources of information used by the IRS

Information is submitted to the IRS from a number of sources.

Once an IRS Review has been agreed, the IRS may request a package of brief but relevant information from the Organisation in advance of carrying out the IRS Review to familiarise both the Professional Reviewers and the Lay Reviewers (together the IRS Reviewers) with the context and background.

The Organisation must submit this material to the IRS in compliance with the relevant legal requirements for data protection and confidentiality under the General Data Protection Regulation and the Data Protection Act 2018 (together, the Data Protection Legislation).

The Organisation may also submit information on organisational processes and patients' care as part of their participation in the IRS Review.

The IRS also gathers information directly from the Organisation, such as contact details for the individuals responsible for the Organisation's participation in the IRS Review.

The Organisation is responsible for obtaining consent to share personal data with the IRS, if required.

Data is submitted by the Organisation to the IRS via secure web-based tools.

All NHS organisations have a Caldicott Guardian, who is responsible for protecting the confidentiality of people's healthcare information. If an Organisation has a Caldicott Guardian, the Organisation must make them aware of the IRS Review and any pertinent information being disclosed by the Organisation to the IRS.

The IRS may collect information from other sources, such as staff providing care and treatment, from patients, their family members, friends or carers, or organisations and individuals who work closely with the Organisation in question.

The IRS will draft a report for the Organisation based on their findings (Report). The Report will describe the sources of information that have been used to support the conclusions reached and the recommendations made.

Where the IRS Reviewers are making judgements about standards of clinical care, or behaviour, these will, where possible, be linked to published standards documents within the specialty concerned.

Where these do not exist, or the issues being considered are more general, documents such as the GMC’s Good Medical Practice will be referenced, and/or the IRS Reviewers will apply the test of what they consider would be the view of a reasonable body of clinical professionals in a similar situation. Draft Reports will be quality assured internally by the College.

What will we do with your information?

Your information will only be used for the stated purposes set out below or to fulfil business, legal or regulatory requirements if necessary.

We will not share any of your information with any third parties for marketing purposes or store any of your information outside of the European Economic Area.

Your information will be held securely by us whether the information is in electronic or physical format. The data is accessible only to the IRS Reviewers, the IRS Service Manager and, where necessary, the Specialist Adviser for the IRS (together, the IRS Team).

All data is held within restricted areas, is password protected and encrypted.

The IRS Team will draft a Report for the Organisation based on their findings. The draft Report is sent to the Specialist Adviser for the IRS, the College's solicitors and the College CEO. It may be necessary to send out draft extracts of the Report to individuals who have been interviewed for the IRS Review.

The College solicitors will advise on this point. A final version of the Report will then be sent by the College to the commissioning Organisation in PDF format.

What information do we process, and why?

The IRS does not process more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. The information we process is used for the purposes set out below:

  • To provide a clear and implementable recommendations to improve the quality of patient safety and care.
  • To provide an expert opinion in relation to concerns about a specific clinical service.
  • To provide an expert opinion on how a person or team is functioning.
  • To provide an independent expert opinion on whether the assessment and clinical management of a patient or patients is acceptable.

We process:

  • Patient information such as name, age, gender, ethnicity, diagnosis;
  • Staff information such as name, professional title, professional qualifications, job plans, job descriptions, CVs, personal development plans, records of continuing professional development and appraisal records;
  • Care data including dates of admission, interventions received (e.g. medication, psychological therapies), processes of care such as medication reviews;
  • Data on organisational structures, processes and procedures such as the use of staff supervision;
  • Feedback on patient’s and/or their family member's, friend's or carers’ experiences of care provided by the relevant Organisation;
  • Feedback on staff members experiences of support, training, supervision and organisational processes; and
  • Feedback about the experience of Organisations and individuals who work closely with the Organisation in question.

Within the above, we may process the following types of special category personal data:

  • Racial or ethnic origin;
  • Political opinions;
  • Religious or philosophical beliefs;
  • Trade-union membership; and
  • Data concerning a natural person's physical or mental health or condition, sex life or sexual orientation.

Who do we share your information with?

If the College instructs a Lay Reviewer to assist on an IRS Review, the College will need to share personal data with the Lay Reviewer. The Lay Reviewer is a data processor for the information that the College shares with the Lay Reviewer during the IRS Review. Further information about Lay Reviewers is set out below. 

It may also be necessary to share personal data with UK-wide Regulatory or Public Authority bodies linked to the profession of Psychiatry. We will only do this where we have a statutory or regulatory requirement to do so.

Lay Reviewers 

Lay Reviewers are not medically trained but (if the Colleges chooses to include a Lay Reviewer in the IRS Team (as defined below)), he/she will be fully involved with the IRS Review.

The Lay Reviewer will review services from the position of a layperson or patient and their perspective and input is invaluable in formulating our recommendations and producing our Report for the Organisation.

The Lay Reviewer will be engaged as a consultant by the College and will be subject to strict confidentiality and data processing obligations in respect of their participation in the IRS Review.

The Lay Reviewer will be a full member of the IRS Team and be party to all visits to services and all interviews with staff and patients, carers and family members. The Lay Reviewer will see all documents submitted to the IRS Team.

The Lay Reviewer will participate in all discussions about the visit and findings and contribute to the Report including findings and recommendations.

How long is the information retained for?

Whilst final version Reports will be securely retained by the College indefinitely, IRS Reviewers will return or securely dispose of all other information received in relation to the IRS Review as soon as the final version Report is completed and accepted by the commissioning Organisation. This includes any copies of the information that have been made and any email correspondence. 

The IRS adheres to the timescales specified in the College’s Record Retention Schedule.
If you wish to learn more about our retention periods, please contact us at dataprotection@rcpsych.ac.uk.

Legal basis for processing

The IRS processes personal data and special category personal data to help maintain and improve standards of quality and safety in psychiatry and psychiatric care.

The legal bases for processing are that the processing is necessary:

  • for the purposes of legitimate interests, specifically, helping to maintain and improve standards of quality and safety in psychiatry and psychiatric care. If you would like to see a copy of our legitimate interests assessment, please contact us at dataprotection@rcpsych.ac.uk;
  • for the performance of a task carried out in the public interest, there being a public interest in the maintenance and improvement of standards of quality and safety in psychiatry and psychiatric care;
  • for reasons of public interest in the area of public health, such as ensuring high standards of quality and safety of health care, specifically, helping to maintain and improve standards of quality and safety in psychiatry and psychiatric care; and
  • for the purposes of the management of health care systems and services, specifically, assisting the management of organisations providing psychiatry and psychiatric care. 

We do not rely on consent as the legal basis for processing your personal data for the IRS Review. However, we will only interview you for the IRS Review with your consent.  

Confidentiality and Interviews 

The information received and managed by IRS Team is treated as confidential. 

The College may use a centralised Collaboration Tool – SharePoint - for transmitting documents related to IRS Reviews. Most Organisations can use this system but where there are difficulties then secure email or encrypted stick drives can be used instead. 

Information for staff of the Organisation 

We will only interview you for the IRS Review with your consent.

Whether or not you agree to be interviewed is entirely up to you. We are unable to provide any payment for your involvement. 

We recognise that staff members may have anxieties regarding the confidentiality of the information they may provide to the IRS in the course of an IRS Review, and the safeguarding of their identity in relation to attributing specific statements to them in the Report.

We would like to make some points clear:

  • If any staff member is the subject of criticism in a Report, the College shall share the Report with that staff member prior to it being finalised and give that staff member the opportunity to make comments that will be appended to the final version of the Report.
  • The College has certain legal obligations in relation to information about individuals who may be identified in the Report, including under the Data Protection Legislation.
  • The Data Protection Legislation entitles those individuals, amongst other things, to require the College to disclose where any information about them in the Report originated (e.g. from which document, which interviewee etc.) This may include a staff member's identity in regard to being the source of specific statements in the Report.  
  • The identity of all interviewees would be included as one of the appendices to the Report, but the Report would not routinely attribute specific statements to specific interviewees.
  • If an individual made a specific request for their personal data contained within the Report, the College would be required under Data Protection Legislation to respond. 
  • Bearing in mind the nature of the Report, the College would not disclose your identity (in regard to being the source of specific statements in the Report) to the individual unless you specifically consented to that. 
  • If you did not consent to that, the individual would be entitled to submit a complaint to the Information Commissioner (Commissioner), who has responsibility for enforcing the Data Protection Legislation.  
  • The Commissioner would then make a decision, which is binding on all parties, and he may consider that it is unreasonable for your identity (in regard to being the source of specific statements in the Report) to be withheld. 
  • However, in deciding whether it would be reasonable for us to disclose your identity without your consent, the Commissioner would consider, amongst other things, whether you had expressly withheld your consent.
  • If the Commissioner ruled that it was unreasonable for the College to withhold your identity (in regard to being the source of specific statements in the Report) from the individual, we would be obliged to share that information with the individual, regardless of whether or not you had granted your consent. 

Information for patients and their family members, friends and carers

We will only interview you for the IRS Review with your consent.

Whether or not you agree to be interviewed is entirely up to you and will have no effect on your treatment or care. We are unable to provide any payment for your involvement. 

In IRS Reviews of services and individuals/teams, the information you provide may be used anonymously to illustrate the findings and recommendations that are made. 

What you tell our IRS Reviewers will be combined with a range of other information from the Organisation and other patients and staff to help us to build a comprehensive picture of what works well with the service and what could be done better. 

In IRS Reviews concerning a patient’s care, the patient is always anonymous in our documents, and we only retain anonymised documents.

The College is committed to the safety and appropriate use of the personal data you may provide. Personal data is processed within the principles of the Data Protection Legislation.

Please note that although our reviewers are health professionals they cannot give you any medical or mental health advice. If you raise concerns in your interview we will pass these onto the Organisation's medical director to be investigated separately.

Your rights under the Data Protection Legislation

The Data Protection Legislation provides the following rights for individuals. These rights are (where applicable):

  • The right to be informed
  • The right of access
  • The right to rectification
  • The right to erasure
  • The right to restrict processing
  • The right to data portability
  • The right to object
  • Rights in relation to automated decision making and profiling.

If you would like further information about your rights, please contact us at dataprotection@rcpsych.ac.uk.

Complaints or queries

If you have any queries about the process or how we handle your information, please contact us using the details at the bottom of this Privacy Notice.

The College takes any complaints we receive about the way in which we use personal data very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate.

If you want to make a complaint about the way we have processed your personal information you can contact us using the details at the bottom of this Privacy Notice.

You can also complain to the Information Commissioner’s Office directly:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Website
Tel: 0303 123 1113

Changes to this privacy notice

We keep the Privacy Notice relating to the IRS under regular review. This Privacy Notice was last updated in April 2019.

How to contact us

If you want to request information about our privacy policy, you can email us at dataprotection@rcpsych.ac.uk or at the address below:

Data Protection Officer
Royal College of Psychiatrists
21 Prescot Street
London E1 8BB

Disclaimer

Please read our disclaimer.

Please read our disclaimer.