Privacy Policy

National Audit of Cardiac Rehabilitation Privacy Policy

1.       Data Protection

NHS England is responsible as controller for processing of personal data by the National Audit of Cardiac Rehabilitation (NACR) to meet the delivery of some elements of the National Cardiac Audit Programme (NCAP).  

The NHS England NCAP is required to comply with the laws and regulations that apply to protecting the patient information that we collect and how it is used. These are the United Kingdom General Data Protection Regulation (UK-GDPR) and the Data Protection Act 2018 (DPA).  The NHS England NACR is committed to protecting your privacy in the collection and use of data required for us to provide our services.

2.       NACR Clinical Audit

NACR is delivered by NHS Arden and Greater East Midlands Commissioning Support Unit (Arden & GEM CSU) and is part of the National Cardiac Audit Programme (NCAP).  Arden & GEM CSU is part of NHS England.

3.       Privacy Notice

This privacy notice for NACR can be found on the NACR website:  NACR Privacy Policy and NHS England’s privacy notice can be found on the NHS England website:  NHS England » Privacy notice.  NACR’s privacy notice applies to all personal data processed by the NHS England NACR service.  

4.       What information we collect about you and from whom?

Depending on where you live in the UK, we may collect personal data about you. We collect your “Relevant Personal Data” (see the full list later in this section but this includes personal health and demographic details) from hospitals in England, Wales, Northern Ireland, Isle of Man and the Channel Islands.  Additionally, some private hospitals in England and Northern Ireland provide patient information to the NACR service.

The following is the relevant personal data that most hospitals submit to NACR:

  • Forenames and Surname
  • Date of Birth
  • Full postcode of usual address at date of diagnosis
  • Hospital Number
  • NHS Number
  • Demographic details of age, sex, marital status and ethnicity
  • Date of event and treatment
  • Date of death if appropriate
  • Clinical data relating to their referral to Cardiac Rehabilitation

5.       Who commissions the NACR Audits?

NHS England commissions the NACR service via NHS Arden & GEM CSU, and is the controller  for the processing of data about patients treated in England and Wales.

Health organisations in Northern Ireland, Isle of Man and the Channel Islands commission NHS England to deliver NACR for them. These authorities are controllers for the processing of personal data that NHS England carries out on their behalf.

6.       Why do we collect your information?

We collect your information as part of national clinical audit for assessing and reporting on service improvement and for benchmarking. The information collected is also useful for quality assurance and evaluation purposes. We provide the commissioners of NHS services and policy makers with information for commissioning purposes and to improve the delivery of cardiac rehab services.

7.       How do we use your information?

We use your personal information for the following purposes:

  • Linking your information with other national databases for audit purposes. NACR data is analysed alongside Hospital Episode Statistics data, held by NHSE, to calculate uptake to Cardiac Rehabilitation (CR) for Acute Coronary Syndrome and Heart Failure patients. Patient identifiers, including patient’s name, date of birth, NHS number, gender and post code are used for linkages of NACR information with other national databases.
  • Publication of Quality Improvement and Benchmarking Reports. These are useful for all our stakeholders including NHS commissioners, patients and members of the public, and service providers (hospitals and clinicians providing CR).  NHS regulators also use these for quality assurance and patient safety purposes. NACR reports regularly to NHS England, the All Wales Group and Northern Ireland, cardiac networks, and Integrated Care Boards. Our published reports contain aggregated data and do not identify any individual patient.  NACR runs a joint National Certification Programme for CR with the British Association of Cardiovascular Prevention and Rehabilitation where programmes are assessed on seven KPI standards.  We also produce ad hoc reports by request for individual programmes and networks/ICBs/regions. Programmes can also view and download their data for local analyses.
  • Onward sharing audit information for medical and scientific research. NACR only pass on data that includes personal details to researchers that have obtained the appropriate approval i.e. ‘section 251 support’ (see below) and HRA research ethics approval. Such personal details are almost always required only for the purposes of linkage to other datasets. The final documents in these cases, i.e. final audit or research reports, do not allow the identity of any individual patient. This is strictly controlled.  

8.       What is our legal basis to process your personal data?

Data Protection

Under the UK GDPR, the lawful basis for NHS England’s processing of personal data for NACR purposes is Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

For the processing of special categories of personal data the following apply:

For clinical audit:

  • article 9(2)(h) “…necessary for …the provision of health …or the management of health… systems…”; and 
  • article 9(2)(i) “…necessary for reasons of public interest in the area of public health…” as NACR aims to drive improvements in the quality and safety of care and to improve outcomes for all patients. 

NHS England has in place Data Processing Agreements with providers in Northern Ireland, the Isle of Man and Guernsey. These organisations are controllers for the processing that NHS England does, and the legal basis is theirs.  

The common law duty of confidentiality

The Secretary of State for Health and Social Care has the power under Regulation 5 of the Control of Patient Information (COPI) Regulations 2002, to approve the processing of confidential patient information for medical purposes, without patient consent. Such approval sets aside the duty of confidentiality. It is known commonly as ‘section 251 support’ and is given on the recommendation of the Confidentiality Advisory Group of the Health Research Authority (HRA).

NHS England has section 251 support for NACR to collect, use and store patient data from England and Wales without patient consent. This approval sets aside the duty of confidentiality owed by the submitting Trusts and NHS England.

When researchers apply to NHS England for data to support their projects, in each case we assess how they will respect the common law duty of confidence before agreeing to provide the data. The project may have section 251 support, or alternatively, we may provide the data in a form that doesn’t identify individuals.

The National Data Opt Out

People can choose to stop their confidential patient information being used for research and planning and can also make a choice for someone else like their children under the age of 13. This choice applies only to the health and care system in England. It does not apply to health or care services accessed in Wales, Northern Ireland, Isle of Man or the Channel Islands.

The Secretary of State for Health and Social Care has granted NHSE an exemption from the National Data Opt-Out Policy for national clinical audit purposes, so that hospitals in England and Wales will collect and submit information on all patients required for the NACR programme, irrespective of whether they have registered an opt-out.

As there is no such exemption for research purposes, the National Data Opt-out Policy will be implemented by the NACR service, as necessary, when requested to share identifiable data with other organisations for research.

Whilst the National Data Opt-out Policy applies in England only, everyone has the right to object to the processing of their personal data by NHS England. So, any patient may apply to NHS England to object to the uses of their data for the NACR programme audit.  Details on how patients can opt specifically out of NACR using their data can be found here: NACR Patient Opt-Out

9.       How we safely store, use and disclose your information

The following security measures are in place to safeguard your information:

  • Your information is kept strictly confidential and stored and analysed in a very secure environment. We are very careful with the information hospitals provide about patients and their care and follow strict rules about how we keep it and who can use it.
  • patient data is entered by appropriately registered CR teams into a secure web-based database provided by Clinical Audit, NHS England.  Clinical Audit, NHS England staff access the data only where necessary, and the NACR team receive data with patient identifiers removed for analysis and to facilitate operational support of the audit.
  • Everyone working within the NACR programme has a legal duty to maintain the highest levels of confidentiality, and all our staff receive training in how to handle your information securely. Except in certain specific circumstances, your information will generally only be available to NHS England staff on a ‘need to know’ basis, i.e. staff members who are involved in the management of the database containing your information or those involved in analyses and reporting.
  • We ensure the information collected conforms to the strict rules of confidentiality established by Acts of Parliament, including the Data Protection Act 2018, the United Kingdom General Data Protection Regulation (UK-GDPR) and NHS Act 2006 and Health and Social Care Acts 2001/12.
  • The data received by NACR are stored on a secure system, which is a password-protected file repository, accessible only by named individuals. The data are retained for as long as approved by NHSE. When appropriate, the supplied data are securely destroyed using industry standard file shredding software and removed from any backup tapes.
  • Wherever possible analyses, reports and data derived from our audits and registries are anonymised and do not contain any information that can be used to identify individual patients. NHS England sometimes grant researchers access to data that identifies patients, if it is necessary for their study, and they have the relevant ethics and confidentiality approvals to use it with the right security controls in place.

10.   How long is your information kept?

Personal data for the national clinical audit is retained in order to show whether patients repeat rehabilitation as prior CR is associated with a lower likelihood for attending future CR. It is also important to retain data for possible linkage for longitudinal analysis of CR, readmission and mortality trends over a number of years.  

It is also used to demonstrate variations and changes in clinical practice and for improvements in quality of care. The minimum retention period for NACR audit records is duration of the audit plus eight years; this is consistent with NHS Retention and Disposal Schedule guidelines.

For reasons mentioned above, there is no maximum retention period for national clinical audits. All records identified for retention for a period greater than eight years are subject to review and justification, including specific outcomes and level of statistical merit derived from the individual audits by audit project groups.

The disposal of any data will be clearly documented including date of disposal, details of the data destroyed and the method of data destruction. Disposal methods include secure destruction of computer media in which the backups are held and the erasure of data from NHSE servers to the current NHS guidelines/standards.

11.   Transferring your information to other countries

The NACR programme only processes patient information in England.  Data is not transferred to other countries.

12.   Your rights as a data subject

Your data protection rights and how they apply are explained below.

The right to be informed

We are required to inform you about how we collect and use your personal information (for example, by publishing the information given in this Privacy Notice).

The right to access

By law you are entitled to request a copy of any information we hold on you. This is known as a Subject Access Request. We will aim to provide the requested information to you within 30 days, but if we are unable to do so then we will explain the reasons to you. In most cases we will provide a copy of the information to you for free, but there are some circumstances where we will need to charge.

You can do this by writing to Jon Moore (interim DPO) at NHS England using the contact details provided below.  

The right to rectification

You may also request that we make changes to any information we hold about you that is incorrect or incomplete. We will take action to rectify inaccuracies in the personal information we hold about you when it is drawn to our attention. Sometimes it may be necessary to add an explanatory note to your information rather than change the original record.

The right to erasure

Due to the nature of national clinical audit (whereby as many patients as possible need to be included in the analyses) which is linked to the direct care you have received and for public health purposes we would consider any Subject Rights Requests from individuals (under GDPR) on a case-by-case basis.  

The right to restrict processing

You may request that we restrict the processing of your information in certain circumstances, for example if you believe it to be inaccurate. In most cases a restriction of processing is a temporary measure while we investigate your concerns. The right to restrict processing is not an absolute right, and we may decide not to restrict the processing of your information if we consider that processing to be necessary for the purpose of the public interest or for the purpose of your legitimate interests.

The right to data portability

NACR’s NHS England’s basis for processing your information under the GDPR means that we are not legally required to provide your information in a machine-readable form, although we will try to provide information that you have asked us for (such as under a Subject Access Request) in the format you prefer if it is practical for us to do so.

The right to object

You are entitled to object to the processing of your personal data by NHS England. This right is not absolute and we will consider each request on a case-by-case basis. This right operates separately from the National Data Opt-Out, described above.

In order to exercise any of the above-mentioned rights please refer to NHS England’s privacy notice for contact details https://www.england.nhs.uk/contact-us/privacy-notice/.

E-mail: england.dpo@nhs.net

13.   Data Controller Details

NHS England has a Data Protection Officer (DPO) who is responsible for ensuring that we respect your rights and follow the law. If you have any concerns about how we look after your personal information, please contact the data protection officer at NHS England, by email: england.dpo@nhs.net or by telephone: 0300 311 2233.

If you are not satisfied with NHS England’s response, in addition to your right to contact the data protection officer(s) at NHS England, you have the right to make a complaint to the Information Commissioner’s Office (ICO) at:

Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Website: Information Commissioners Office