Terms and Conditions, Privacy Policy & Cookies

Privacy Notice

How we use your patient information

What is EMRAD?

EMRAD is the East Midlands Imaging Network which provides timely and expert radiology services to benefit patients across the East Midlands, regardless of where they are being treated. EMRAD is supported by a small, core team based at the National Centre for Sports and Exercise Medicine at Loughborough University, finding new ways of working to support staffing and recruitment issues in radiology, procuring radiology services in more cost-effective ways for the NHS, and harnessing the power of innovation in diagnostics. These advances aim to improve the quality and safety of patient services, as well as help ensure the long-term sustainability of radiology services. Radiology services include imaging tests like x-rays and scans.

A key benefit for patients is that clinicians, and other staff who support your care, can access your complete radiology imaging record, including scans, reports and clinical opinions, regardless of where they are based in the East Midlands, which enables clinicians to provide more care at hospitals closer to patients’ homes and makes best use of staff resources.

It will also help to avoid unnecessary appointments and duplicate or repeat scans.

This privacy notice provides a summary of how we collect and use your information, and the rights that you have as a data subject.

Which Trusts are part of EMRAD?

The EMRAD Imaging Network comprises the following Acute NHS Trusts:

Chesterfield Royal Hospital NHS Foundation Trust
Kettering General Hospital NHS Foundation Trust
Northampton General Hospital NHS Trust
Nottingham University Hospitals NHS Trust
Sherwood Forest Hospitals NHS Foundation Trust
United Lincolnshire Hospitals NHS Trust
University Hospitals of Derby and Burton NHS Foundation Trust
University Hospitals of Leicester NHS Trust

What personal information is captured?

From the point of referral, basic personal details, such as name, address, NHS number, date of birth and GP details are held on the radiology system (please refer to appendix 1) to enable us to identify you and your records.

In addition, special category personal data is also held and processed. Examples can be found here: Special category data | ICO. The radiology system stores images from all radiology tests you undergo at any of the Acute Trust hospitals named above who are part of the EMRAD Imaging Network from where you have received your care. It also stores all radiology reports for these tests and records patient radiation exposure to x-rays which are used in some examinations, and protocol information using a system called DoseWatch.

How long are records kept?

Each Trust has policies in place for the appropriate retention and deletion of records, in accordance with NHS and legal requirements.

Who can access my information?

Staff within our hospitals who provide, support, or plan your care using our services can access your information. Your information will not be shared with anyone else, unless there is a clear legal basis for doing so, defined in the UK Data Protection legislation.

All members of the EMRAD network are committed to keeping your information secure and have operational policies and procedures in place to protect your information. Appropriate measures are taken against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

EMRAD has implemented FairWarning’s Patient Privacy Intelligence™, which is a leading compliance and information security platform to provide assurance for the privacy and confidentiality of patient health information within the picture archiving and communication system (EMRAD GE PACS) to proactively audit user activity.

In doing so, EMRAD uses the FairWarning Patient Privacy Intelligence solution to help demonstrate compliance with the UK Data Protection legislation.

Will my data be shared?

EMRAD Trusts have a duty to share images and reports with healthcare professionals, who work for providers outside the Imaging Network, to support continuity of your care.

They may also receive images and reports that have been taken by Trust’s outside of the EMRAD Network.

Some EMRAD Trusts have contracts with third parties who provide imaging and/or reporting services to supplement Trust provision.

Information about this sharing, and the controls that are in place to safeguard your information can be found in your Acute Trust’s privacy notice.

There are also non-direct care purposes that your data may be use for, such as:

To review the care we provide to ensure it is of the highest standard and quality, e.g. through audit, service improvement and research,
To help to train and educate healthcare professionals.

Do I have a choice about who can access my information?

Like most hospital systems it is not possible to tailor access to information for individual patients. However, everyone working for the NHS has a legal duty to maintain the highest levels of confidentiality, and all staff receive training on how to handle your information securely.

If you have any concerns about who is accessing your radiology information you can contact the Radiology Department at your local hospital. Furthermore, all events in the EMRAD system are logged to show who as accessed your record, when, and what changes were made.

Is my information safe?

Your rights are protected under the Data Protection Act 2018. The systems we use in the NHS comply with stringent levels of safety, security and confidentiality. In the event of a potential data breach each Trust would assess the breach against strict criteria and, if appropriate, would report within 72 hours to the relevant authorities.

What are my rights?

The right to be informed – this includes our obligation to provide fair processing information, which we do through this privacy notice.

The right of access – this is your right to obtain confirmation that we process your data and have a right to ask for a copy or to view it.

For details about how to obtain confirmation that we process your data and/or to access your personal health data, please contact your Trust’s Data Protection Officer.

The right to rectification – this is your right to have your personal data rectified if it is inaccurate or incomplete. If you believe that the information recorded about you is incorrect, please contact the Trust’s Data Protection Officer providing the service.

The right to erasure – this is also known as your ‘right to be forgotten’, where there is no compelling reason to continue processing your data in relation to the purpose for which it was originally collected or processed.

Your health record is retained in accordance with NHS national guidance, and because of our legal obligation to keep health records, it is extremely rare that we destroy or delete records earlier than the recommended retention period. However, if you believe you have compelling grounds for having all or part of your record erased you should contact your Trust’s Data Protection Officer.

The clinician in charge of your care and your Trusts Caldicott Guardian will decide whether we can safely accommodate your request. If you are unhappy with our decision you may wish to register a complaint to the Information Commissioner.

The right to restrict processing – this is your right to block or suppress the processing of your personal data. If you raise an issue relating to your health record that requires us to restrict processing, we will put an alert on our main patient system to flag that we are investigating your concerns. Please note it will not be possible to restrict processing while you are receiving care and treatment.

The right to data portability – This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and NHS England. For this to apply the data must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.

The right to object – this is your right to object to the hospital processing your health data because of your particular situation. Because of our legal obligation to keep health records it is extremely rare that we would stop processing your data if you wish to continue to be treated by the hospital. If you believe you have compelling grounds for the hospital to stop processing your data you should contact your Trust’s Data Protection Officer.

Rights in relation to automated decision making and profiling – GDPR provides safeguards for individuals against the risk that a potentially damaging decision is taken without human intervention.

Trust contacts

If you would like any further information or to raise concerns about the processing of your personal data you should contact your Trust’s Data Protection Officer in the first instance using the contact details below:

EMRAD Trust

Data Protection Officer

Chesterfield Royal Hospital NHS Foundation Trust

Privacy statement :: Chesterfield Royal Hospital

Name: Eddie Lewis