Privacy and Cookies

Sandwell and West Birmingham NHS Trust, also referred to as Sandwell and West Birmingham Hospitals NHS Trust or SWBH is a public NHS organisation providing medical and health care services across a wide range of departments. We operate across a number of sites:

• Sandwell Health Campus (West Bromwich)
• City Health Campus (Birmingham)
• The Midland Metropolitan University Hospital
  • The Birmingham Treatment Centre (BTC)
  • The Birmingham Midland Eye Centre (BMEC)
• Rowley Regis Community Hospital
• Leasowes Intermediate Care Centre

We are registered with the Information Commissioners Office (ICO), registration number Z6719634

We need information about you in order to provide our services when you attend one of our sites. Information about you is used to help deliver care services and may include sharing with other organisations within Health and Social Care to ensure you receive the best possible treatment and support.

Information will also be used to support the management of healthcare systems, e.g. to ensure we are paid correctly for the services we provide or to be held accountable for the quality of our services.

We may also receive information about you from other individuals or organisations, for example when you are referred from your GP or another organisation. We need this information to be able to provide you with the most appropriate healthcare services.

The personal information we use includes information that identifies you like your name, address, date of birth and postcode.

We also use more sensitive types of personal information, including information about racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic and biometric data, health; sex life or sexual orientation.

The information we use can relate to:

• personal and family details
• education
• lifestyle and social circumstances
• visual images
• details held in the patient record
• responses to surveys.

The Trust may need to process your information in order to:

• Provide healthcare services to you
• Review our standards of care
• Train healthcare professionals
• Carry out audit and research
• Manage complaints, legal claims and incidents

As an NHS organisation we have a duty to protect your health and the health of the general public for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller as a healthcare provider.

Where we process sensitive (special category) information such as medical information we are doing so as it is necessary for the purposes of preventative medicine, medical diagnosis, the provision of healthcare or treatment or the management of healthcare systems.

As a healthcare provider we may, on occasion, have to share information when someone is at risk of serious harm i.e. to protect their vital interests.

We also have an obligation to protect the health of the general public, any processing that takes place will be for the performance of a task carried out in the public interest for reasons of public interest in the area of public health.

We may also have to process your information to comply with a court order or coroners instruction this is to comply with a legal obligation.

On rare occasions we may rely on your explicit consent as our legal basis for using your personal information.  When we do this we will explain what it means, and the rights that are available to you.  You should be aware that we will continue to ask for your consent for other things like taking part in a drug trial, or when you are having an operation.

You may be receiving care or support from other people as well as the NHS so where necessary we will share appropriate, relevant and proportionate personal information in compliance with the law, with the following (only the minimum amount of information will be shared in accordance with legislation):

• Other healthcare professionals (e.g. doctors, nurses, ambulance services)
• Health and Social Care partner organisations (e.g. GP’s, social services, private sector providers)
• Carers, guardians or others with parental responsibility
• NHS organisations and the Department of Health for management of healthcare services
• General Medical Council, Care Quality Commission, Audit Commission, Healthcare Ombudsman or others with statutory investigative powers
• Government departments (e.g. Department of Health or the Home Office)
• Solicitors, police, the courts and other parties for purposes of tribunals and enquiries.
• Research organisations

SWBH will never share your information for marketing, social media or insurance purposes unless we have your consent to do so.

On occasion it may be necessary to transfer personal information overseas (e.g. for research or processing or for medical emergencies abroad). When this is required we will ensure that all relevant safeguards and legislation are complied with and only the minimum information required will be transferred.

The NHS follows a comprehensive set of guidance which governs the length of time that we keep records for. SWBH comply with these retention schedules.

There may be occasions where the Trust is obliged to vary from the retention schedules (e.g. in response to a court order or other legal requirement).

The NHS Retention Schedules and further details can be found on the NHS Digital website:

https://digital.nhs.uk/data-and-information/looking-after-information/data-security-and-information-governance/codes-of-practice-for-handling-information-in-health-and-care/records-management-code-of-practice-for-health-and-social-care-2016

SWBH takes our duty to protect your information and confidentiality seriously. All our staff follow the NHS Code of Confidentiality and undertake annual training in data security.

We have appointed a Data Protection Officer who, along with our Caldicott Guardian and Senior Information Risk Owner are responsible for the management and protection of personal information within SWBH.

Everyone working for the NHS is subject to the common law duty of confidentiality. Information provided in confidence will only be used for the purposes advised, unless it is required or permitted by the law.

We have control systems in place to allow only those with a reason to access your medical records are able to do so.

Unless subject to an exemption you have the following rights with respect to your personal information:

• The right to request a copy of the information that SWBH holds about you (we must provide this information free of charge, however we can charge a reasonable fee if you request the same information more than once or your request is considered excessive or unfounded)
• The right to request that any inaccurate information is corrected
• The right to withdraw consent for processing of your information (if consent was previously given)
• The right to object to the processing of personal information
• The right to request that SWBH provide you with your personal information and, where possible, transmit the data directly to another organisation, where your information has been processed with your consent
• The right to lodge a complaint with SWBH
• The right to lodge a complaint with the ICO
• There are other rights under current data protection law, however these rights only apply in certain circumstances.

More detailed information on your rights can be found on the ICO’s website: https://ico.org.uk/for-the-public/

A new patient portal is available where patients can view their appointment letters.

You will now be able to access appointment details, letters, and clinical information which are currently available in our patient portals provided by Healthcare Communications via the NHS app. You do not have to access them via the NHS app, you can continue to access this information directly within the portals; this information will only be accessible to you via the NHS app if you provide consent (this is done within the NHS app).

The Trust will share NHS numbers of people signed up to our patient portals with NHS England. For this purpose the NHS app needs to know who is associated with Healthcare Communications so it can find the information you want and access.

For more details on the NHS app please visit https://www.nhs.uk/nhs-app/

For information regarding this project visit: Future developments for the NHS App – NHS Digital.

Sandwell and West Birmingham NHS Trust are actively taking part in the Transforming ovarian cancer diagnostic pathways (SONATA) study. Under The Data Protection Act 2018 we are legally required to explain how your personal information and data will be used. The below Privacy notice is specific to the SONATA study. It explains how and what patient data will be collected throughout the trial.

To learn more about the SONATA study, please view the trial webpage here.

To view Sandwell and West Birmingham’s full privacy notice please click here.

Privacy notice v1

The SONATA study helps gynaecological services to improve the care they provide to women who are undergoing investigation for possible ovarian cancer. This information will be used to help services in England, to improve the care and outcomes for other women undergoing testing in primary care for possible ovarian cancer.

When patients see their GPs with symptoms that might indicate ovarian cancer, a CA125 blood test is carried out but this test does not identify all patients with ovarian cancer and wrongly identifies some patients as at risk of having ovarian cancer. It is possible that this can be improved by carrying out an additional test, HE4, on the same blood sample and calculating a score called the ROMA score: this is being investigated in the SONATA study with the aim of improving ovarian cancer diagnosis.

As part of your investigation, staff record information in an electronic record and obtain a sample for testing. They will use this sample and information gathered as part of your testing to improve care and outcomes for patients who have symptoms that might suggest ovarian cancer in the future. Identifiable data will only be accessed to link data from different sources prior to anonymisation for analysis.

As a very large number of representative patients are needed for this research, it is not possible to contact everyone who will be included. The application was reviewed by the Confidentiality Advisory Group (CAG). CAG is an independent group of lay people and professionals which provides expert advice on the use of confidential patient information without consent. CAG recommended that our application should be supported and the Maker within the Health Research Authority approved this. If you do not want your data to be used in the study, that is still possible

• If you do not wish your data to be used for any research and have opted out of your data being used for purposes other than direct care, your data will not be used in this project as the National Data Opt Out will apply to the SONATA study.
• If you have not opted out and do not wish your data to be used in this project, please email the study team at v.do@nhs.net giving your NHS number.  If you do not know your NHS number, please give your date of birth and the date (or approximate date) at which you had your blood test after seeing your GP instead.  Your data will then be excluded from the study.

Background

The Health and Social Care Act 2012 (the 2012 Act) gives NHS England statutory powers,
under section 259(1)(a), to require data from health or social care bodies, or organisations
that provide publicly funded health or adult social care in England, where it has been
directed to establish an information system by the Secretary of State for Health and Social
Care.

The data, as specified by NHS England in this published Data Provision Notice, is required
to support a direction from the Secretary of State for Health and Social Care to NHS
England. Therefore, organisations that are in scope of the notice are legally required, under
section 259(5) of the Act, to provide the data in the form and manner specified below.

Purpose

The purpose of the EDI data collection is to understand inclusion, representation and
participation in health and care research, identify variation in participation in health and care
research, based on demographics, to assess and improve equality, diversity and inclusion in
such research, to ultimately improve access to good quality, evidence-based health and
care.

The Equality, Diversity and Inclusion in Health and Care Research Pilot Directions 2005 (EDI
Directions) issued to NHS England by the Secretary of State for Health and Social Care
require the collection of data from participating Health Care Organisations in England,
linkage and analysis of data, the development and implementation of a dashboard and the
provision of analytics and data products around equality, diversity, and inclusion in health
and care research.

The provision of analytics and data products around equality, diversity, and inclusion in
health and care research will help funders, researchers, and the healthcare system to
address these issues, and ultimately ensure their health research studies, (including clinical
trials), are representative and inclusive.

In addition, this pilot will support funders and studies to identify variation of participation in
research – initially based on age, gender (recorded in Patient Demographics Services (PDS)
as administrative gender. Also provided by the General Register Office and as gender is
written on the birth certificate), geographic location and deprivation.

Benefits

Patient/public benefits

• Give patients and the public confidence that the National Institute for Health and Care
  Research (NIHR) is serious about its commitments to EDI policy.
  Help to identify and reduce inequalities in access to health research and ensure that
  research takes place where the need is greatest.
  Help to ensure that research is representative and therefore applicable to the patient
  population, thereby ensuring that patients only receive treatment where there is robust
  evidence of the benefit versus risk for them.

NHS Benefits

• Help ensure that research is representative and therefore provide healthcare
  professionals with the evidence they need to make the best clinical decisions.
• Help ensure that research is representative and provide evidence that interventions
  will be work in practice in the healthcare system.
• Provide NHS research and development (R&D) teams with the data they need to
  understand the demographics of participants in their research compared with their
  local population and thereby enable targeted EDI improvement activity where needed.

User Benefits

• Department of Health and Social Care (DHSC) – Fulfils DHSC’s duty under the
  Equality Act 2010 and enable NIHR corporately to achieve public accountability.
• National Institute for Health and Care Research (NIHR) – Help ensure that the
  evidence generated by NIHR supported research is robust and therefore best value
  for money.
• NIHR – Provide NIHR with the data it needs to understand inequalities in access to
  research across the portfolio and Regional Research Delivery Networks (RRDNs) and
  thereby support implementation of the EDI strategy, activity to improve the diversity
  and inclusivity of research and target research to areas of greatest need.
• RRDNs – RRDNs are a major customer of the outputs of this data collection as it gives
  them a means of baseline equity of access, track performance, drive local EDI
  strategies and measure impact.

Legal basis for collection, analysis, publication and
dissemination

NHS England has been directed by the Secretary of State for Health and Social Care under
the EDI Pilot Directions 2025 under section 254 of the 2012 Act to establish and operate a
system for the collection and analysis of the information specified in the Direction and the
associated Requirements Specification. The direction and accompanying requirements
specification are published in this NHS England webpage.

The information NHS England is required to collect under the EDI Directions is required by
NHS England from the organisations within the scope of this Data Provision Notice under
section 259(1)(a) of the 2012 Act.

In line with section 259(5) of the Act, all organisations in scope of this Data Provision Notice
in England, must comply with the requirement and provide information to NHS England in
the form, manner and period specified in this Data Provision Notice.
This Notice is issued in accordance with the procedure published as part of an NHS England
duty under section 259(8) of the 2012 Act.

Limitation on publication

NHS England is directed not to publish the data obtained by virtue of the EDI Directions
under section 260(2)(d) of the 2012 Act.

Legal basis for disclosure:

• NHS England is directed under section 261(3) of the Act to provide data to:DHSC, in the form of aggregate, with small number suppressed data through the EDI
  Dashboard
• NIHR, in the form of aggregate, small number suppressed, tabulated summary tables
  and through the EDI Dashboard.

Data will not otherwise be made available by NHS England.

Persons consulted

NHS England has, as required under section 258 of the Act, carried out consultation
including:

a. NHS England has consulted with the issuing organisation the Department of Health
and Social Care (DHSC) on behalf of Secretary of State (SoS) for Health and Social
Care and this consultation is ongoing
b. NHS England/DHSC has consulted and will continue to consult with the prime users
of the information including DHSC, National Institute for Health and Care Research
(NIHR) and Local Clinical Research Networks (now known as RRDNs)
c. The Department of Health has engaged with nine NHS Trusts and all 12 Local Clinical
Research Networks who have a representative role in this context
d. NHS England has consulted with members of the public, this involved:
o Eight online discussion groups involving around eight people per group were
held on the topics of Equality, Diversity, Inclusion in health and care research
and data collection by the NHS
o People representative of the target user group population were recruited, with a
mix of attitudes towards the NHS and data sharing
o Outcome measures included attitude and opinion in terms of their nonidentifiable
data being collected to monitor and improve the inclusivity of health
and care research participation
o These discussion groups were run by an external agency and held with
participants who had given their informed, opt-in consent to participate in the
research.

Scope of the collection

Under section 259(1)(a) of the 2012 Act, this Notice is served in accordance with the
procedure published as part of the NHS England duty under section 259(8) on the following
persons:

• publicly funded health organisations in England which have been funded by NIHR to
  deliver health research studies who have agreed to participate in the collection. These
  may include NHS Trusts, General Practices or organisations commissioned by these
  to deliver clinical trial functions (HCOs).
• All HCOs will initially be asked if they agree to participate in the collection; those
  which agree to participate will then be sent this Notice. This will inform them of the
  legal basis for the collection.A list of the participating HCOs is maintained on the NHS England website published
  alongside this DPN.

Under section 259(5) of the 2012 Act the participating HCOs must comply with the Form,
Manner and Period requirements below.

The list of volunteering organisation that must comply with the Notice is published in this
NHS England webpage.

Form of the collection

NHS England will be collecting patient level, identifiable data for the purposes of the EDI
Pilot. The data items to be collected are identified in the EDI Technical Data Specification
published alongside this DPN.

Data to be collected includes:

• participant NHS number
• name of study and study identification code
• physical/mental health or condition (as part of the ‘Project_ Speciality’ data item in the
  Project file. These are the clinical groupings by which NIHR Clinical Research
  Network (CRN) manages its portfolio of clinical studies and is at a high level e.g.,
  Dermatology
• study funding type

The EDI Technical Data Specification is published alongside this DPN.

Manner of the collection

Two files of data, Project and Participant are to be provided by University of Southampton,
as a processor for the participating HCOs, monthly into the NHS England DPS MESH
mailbox from EDGE.

Message Exchange for Social Care and Health (MESH) is a standard NHS England tool
which meets security standards.

The University of Southampton will submit the following two record level csv files from its
EDGE system as set out in the EDI Data Specification:

• Project file: 9 fields of data on research study (clinical trial) projects, a full refresh each
  month.
• Participant file: 5 fields of data which relate an individual (clinical trial participant) to
  the research study (clinical trial) projects; this file contains personal data (NHS
  Number), this will be appended with a monthly update of data.

The expected volumes are about 100,000 participants per year. Project data will accumulate
but is unlikely to exceed 10,000 records for the foreseeable future. This is because the
participants will be collated from the latest month, whereas the project file will contain all
projects submitted since the outset.

These will be automatically ingested into the DPS database via generic data pipelines
(GDPs) into two tables participant raw and project raw.

No validation steps are conducted. Anything that is submitted by the University of
Southampton via EDGE will be ingested. Any DQ issues arising from this will need to be
manually fixed by the HCO or the University of Southampton.

Period of the collection

Files will be received monthly from the first submission date which will be 7th November 2025
and then monthly updates on [5th] until 28 February 2027.

Full Directions will be sought for the continuation of this project continuous beyond the pilot
phase, subject to evaluation of the Pilot.

Burden of the collection

Steps taken by NHS England to minimise the burden of
collection

NHS England has a statutory duty under section 253(2) of the Act to seek to minimise the
burden it imposes on others. In seeking to meet these obligations in relation to this
collection, NHS England has:

• Worked closely with DHSC, NIHR and the University of Southampton to ensure that
  the data specification is implementable.
• Sought to only collect the necessary items required to meet NIHR and DHSC
  requirement and minimise the collection of personal identifiable data

In addition, in support of its obligation under 265(3) of the Act, NHS England has an
assessment process to validate and challenge the level of burden incurred through
introducing new information standards, collections and extractions.

This process is carried out by the Data Assurance Service (DAS) which assures burden
assessment evidence as part of the overarching Data Assurance Board (DAB) approval
process. The DAB, acting under authority of the Secretary of State, oversees the assurance,
approval and publication of information standards and data collections. for the health and
social care system. in England.

At the time of publishing this Data Provision Notice, the assurance process, undertaken by
DAS, agreed that a more accurate assessment of Burden would be easier to complete as
part of the Post Implementation Review (PIR) of the data collection, after it had been
operating for an agreed period, (normally 12 months).

This recommendation was included in the report sent to DAB requesting approval of the data
collection. DAB has set a PIR date to be completed no later than 12 months after approval of
the collection, this will include the assessment of burden on the health and care system.