Privacy notice

How we use your information

A full explanation of how we use your personal data can be found in our Privacy notice for patients [pdf] 592KB

A full explanation of how we use the personal data for job applicants, employees, temporary workers (including agency and bank staff), volunteers, trainees and those carrying out work experience can be found in our Workforce privacy notice [pdf] 240KB.

Online services

We use various platforms to provide online health services. These services are subject to this privacy notice and may be subject to their own terms, and may provide supplementary privacy notices. 

Supplementary notices

 

You can also find out more about how patient information is used from: 

NHS Federated Data Platform (NHS FDP) 

We have joined more than 150 NHS trusts in adopting the NHS Federated Data Platform (NHS FDP). This safely connects information across the NHS, making it easier for staff and clinicians to do their jobs. Already funded and established, it’s designed to turn insight to action.

  • Impact and benefits: NHS organisations using the Federated Data Platform are already seeing significant improvements, including reduced waiting lists and shorter wait times for treatments, decreased discharge delays helping patients return home sooner, and faster diagnosis times.
  • Your data is safe: Patient data is protected through multiple security measures, including encryption, purpose-based access, continuous monitoring, and regular security testing. When data is shared nationally for planning, privacy enhancing technology removes personally identifiable information such as names and NHS numbers.

NHS England ran an independent and transparent procurement exercise in line with public contract regulations. The choice of preferred supplier was not made by a single person, it was the result of assessment by many different individuals.

A consortium, led by Palantir, was awarded the contract to deliver the NHS Federated Data Platform in November 2023. Access to NHS health and social care data within the NHS Federated Data Platforms will be carefully controlled. Only authorised users will be granted access to data for approved purposes.

Palantir only operate under the instruction of the NHS when processing data on the platform and do not control the data in the platform, nor are they permitted to access, use or share it for their own purposes.

More information about the NHS Federated Data Platform and its advantages, is on the NHS England website. We will not respond to any individual enquiries in relation to FDP.

Subject Access Request (requesting copies of your personal healthcare records)

As a patient and under the General Data Protection Regulation you have the right to access your healthcare record held by us.

Is there a fee for submitting a Subject Access Request? The trust must provide a copy of the information free of charge but can charge a ‘reasonable fee’ when the request is ‘manifestly unfounded or excessive’ and particularly if it is repetitive (copies of the same information). Fees are based on administrative costs of providing the information.

How long does the Trust have to disclose? The trust must respond to your request within one month (unless advised otherwise by court order). The timescale for responding to a SAR does not begin until we have received satisfactory identification.

If clarification is needed, or if you have made a number of requests or your request is complex, we may need extra time to consider your request and this can take up to two more months to respond. If this is the case we will inform you within one month and explain why the extension is needed.

Will I always receive everything I asked for? Not always. The amount of information you receive depends on the circumstances of the request. You may receive only part of the information you have requested, or none at all. In such cases, we will inform you within one month and explain the reason.

Will I need to provide proof of identity? Identification checks are required to protect personal data from unauthorised access.

If you are requesting copies of your own healthcare record, we will require two forms of identification, one from section A and one from section B:

Forms of identification

Section A - to confirm your identity

Section B - to confirm your address (less than three months old)

UK passport Utility bill
Passport from eligible countries including EU/EEA Local authority council tax bill
UK driving licence (driving licences without a photo will not be accepted) Bank or credit card statement
EU/EEA national identify card  

If you are requesting copies of healthcare records on someone’s behalf (living or deceased) you must provide proof of your identification from section A and B above (excluding solicitors) and one of the below:

Documents required 

Request on behalf of:

Document required

Child or young person Copy of the child's full birth certificate
Deceased patient

Copy of the Will stating you are executor of the deceased's estate.

or

Probate form stating you are the deceased person's personal representative.

Living patient

Signed letter of consent from the patient confirming they are happy for you to act on their behalf

or

Court Order stating you have power of attorney for health and welfare.

How do I make a request for a copy of healthcare records? Create an account on the SAR portal. Once logged in, you can submit, manage and receive requests. Subject Access Request portal guide [pdf] 611KB

What application form do I need to complete? The type of request you choose will be determined by the information you need and how you intend to use it.

  • A personal request is when you ask for a copy of your own healthcare record, with no intention to use against the trust.
  • A request on behalf of someone is when you ask for a copy of healthcare records on behalf of someone else, whether they are living, they have died. or they are a child.
  • A third party request is when someone like a solicitor asks for a copy of healthcare records for one of their clients.

For any request that will be used for a claim against the trust you must select an application referring to Legal Services.

How will I receive a copy of the healthcare record? You will receive an email to confirm your disclosure is completed. Log in to your account to view, print and download the documents.

How long do I have to access to the copy of the healthcare record? The documents will be available to download and save from the date of notification, and we advises you to download and save them on your personal device. Once you have accessed the copy of healthcare records you become the data controller.

Will I always receive full disclosure electronically through the portal? Not always. The disclosure will depend on the information required. You may receive the information via the portal, via Image Exchange Portal (IEP) and on paper (via Royal Mail). In such cases, the Subject Access Request department will tell you you will receive full disclosure.

  • Subject Access Request Department, 32-36 Eldon Way, Paddock Wood, Kent TN12 6BE
  • 01892 638895
  • mtw-tr.SAR@nhs.net 
  • Opening hours: 9am to 5pm, Monday – Friday (excluding bank holidays).

Data protection impact assessements

June 2024: T-Pro Dictation Software (trial 6 months)

Summary: T-Pro offer an AI powered speech technology for healthcare which aims to save up to 75% of clinician’s time, improve the quality of documentation and reduce transcription costs. T-Pro also offers a digital dictation solution which aims to deliver process automation and AI-powered efficiency gains. This will help to enhance productivity, increase EPR adoption and reduce administrative costs. We are looking at using T-Pro’s voice recognition for 6 members of staff as part of a trial

Recommendation and conclusion: Accepted low risk

June 2024:  KCC homelessness data sharing

Summary: Homeless prevention and the reduction of financial exclusion is a key ambition for both Kent County Council and the districts within Kent. Following an initial pilot which was owned by Maidstone Borough Council, Kent County Council has investing in the use of analytics to support the achieving of better outcomes for individuals and enable all the districts in Kent to participate if they wish.

MBC have led the way in showing predictive analytics is a key tool to help us to identify those most at risk of presenting as homeless or financially excluded and to understand the effective interventions that can be put in place to prevent negative outcomes. Maidstone Borough Council have demonstrated the proven benefits of advanced analytics in this space since 2019, however it became clear that a wider set of data would be beneficial to enhance the model and identify early more of the households that went on to present as homeless. The provision of additional data into the system around Children’s Services and Adult’s Services from KCC has ensured that a greater set of risk factors could be used within OneView and more people could be supported before reaching crisis.

Xantura’s OneView solution gives Councils the ability to consider an individual’s vulnerability information and work in partnership with other services that residents interact with within the County Council and its District Councils. The underlying system and tool is primarily a data sharing platform, facilitating controlled, auditable sharing between council services and partners.

The OneView platform enables housing and debt advice services to proactively identify cohorts of households with certain characteristics and risks. Individual team members or managers with the right authority can then turn this into identifiable data to offer proactive support before they reach a position of crisis debt or homelessness. Those at risk can be further segmented into cohorts that can be proactively contacted in a way that is appropriate to the needs of the group. This work is an extension of the original pilot and now extends to cover the following use cases:

  1. Domestic Abuse
  2. Those at risk of homelessness because of the family being unwilling or unable to accommodate
  3. Housing and health inequalities

In addition to the risk model for preventing homelessness, MBC alongside key stakeholders would like to design and develop a Health and Housing intervention to address the links between poor housing and health, particularly relating to damp and mould. The Coroner’s verdict that the death of 2-year-old Awwab Ishak, who died in December 2020 found that mould in the family’s one-bedroom housing association flat in Greater Manchester was a significant contributory factor in the cause of his death. The Housing Ombudsman and the Regulator of Social Housing have criticised the approach adopted by many landlords that assumes a household’s lifestyle is the main issue and are calling for housing and health professionals to re-evaluate their approach and interventions in order to tackle the problem. Awwab’s death was preventable and is something we would like to address as part of the work sponsored by Kent County Council.

OneView uses matched, pseudonymised data from across Kent and Districts to determine wider risk determinants, e.g. social isolation, financial exclusion, fuel poverty and health conditions captured by social workers in case notes. Linking health data with this social care and housing data would help to optimise the consideration of health characteristics and therefore enable more targeted proactive outreach to those residents considered to be at risk of worsening health inequalities that are exacerbated through their housing situation.

There are currently 5 active districts within the Kent County roll out including Maidstone that would benefit from adding health data to the homelessness prevention model. The initial pilot for Health Inequalities would be Maidstone with the ambition of widening the data flow to the other districts over time.

The Health inequalities pilot would enable:

  • Early identification by exploring characteristics that would indicate an increased likelihood in mould growth e.g., property type, household composition, attendance at GP and/or A&E.
  • Using data and intelligence to design a mechanism for highlighting those most at risk to prioritise intervention – patients presenting with respiratory problems (related to damp and mould), vulnerable patients young or elderly.
  • Combining datasets on the property, its risks and resident occupation, we can provide an added holistic approach using the ‘making every contact count’ methodology to engage on the wider determinants of health such as fuel poverty and financial inclusion,
  • Source a solution by developing a best practice model for mould treatment, identify ways of improving properties to minimise mould growth and create a pathway for professionals and residents to understand and tackle damp and mould concerns.
  • Monitor improvements of patients and instance of non-elective admissions relating to respiratory conditions through GP and hospital admissions.

Every use of data will be properly documented to details the fields to be used, the legal basis for sharing and the expected outcomes.

Recommendation and conclusion: Accepted low risk

June 2024: Maternity grow gap tool

Summary: NHS England Business Plan 2014-15 to reduce stillbirth rates, to facilitate the requirements laid out in the Saving Babies Lives Care Bundle Version 3.

Maternity are seeking to improve a system for the identification and surveillance of fetal growth restriction by the upgrade of GAP (Growth Assessment Protocol) and GROW (Gestation Related Optimal Weight) to 2.0. This programme, and required software, has been developed by the Perinatal Institute (www.perinatal.org.uk) from whom we have purchased a licence.

This software generates individualised fetal growth charts based upon data submitted by a midwife, sonographer or doctor.

Recommendation and conclusion: Accepted low/medium risk

June 2024: Open Eyes – community usage

Summary: The community age related maculopathy service (CAMS) was set up approximately 10 years ago. The aim was to allow stable patients who do not require ongoing eye injections for their wet age-related macular degeneration to be seen by appropriately trained optometrists in the community and closer to the patients home. These patients require regular review for 2 years after their last treatment to ensure the disease does not reactivate and the CAMS practitioners are able to fully access patients and send patients back to the hospital through a fast-track process if they need to recommence injection treatments. In order to be effective this service requires imaging and clinical information to be exchanged between the hospital and the optometric practise. This was initially achieved through sending data via NHS.net emails and then by establishing a secure VPN remote access for the optometrists so they could access our imaging software and our electronic patient record (OpenEyes). These processes were reviewed and approved by the then head of information governance for the hospital trust.

Recommendation and conclusion: Accepted medium risk

June 2024: KCHFT – Transfer of COPD service (staff and patient transfer)

Summary: KCHFT is sub-contracted by MTW to provide COPD support in the patient’s home as part of an Integrated COPD service. From 1 April 2024, the Community element of the COPD service provided by KCHFT will transfer to MTW, with the existing members of KCHFT transferring under TUPE.

Recommendation and conclusion: Accepted low risk.

June 2024: KOMS — third party system review

Summary: Oncology Electronic Patient Record:

  • Core patient demographics, provides patient PMI for Oncology via R number
  • Management of oncology outpatient, radiotherapy and chemotherapy appointments.
  • Reception module providing diary functionality and appointment outcoming.
  • Generation of letters to patients about their appointments. The appointment letters are generated in a web browser, they are not automatically sent to patients from KOMS but manually managed by the users generating the letter; usually either printing to paper or a HybridMail type printing solution, depending on the Trust the user is from. In due course these may be sent to PKB for those trusts that use it.
  • Generation of clinical letters written about patients.
  • Approx. 70 clinical assessments used by clinical teams across Kent.
  • Electronic action sheets for requesting/altering patients’ appointments.
  • Facility for importing inbound documents.
  • Provides patient master index for Oncology patients in Kent through the Oncology R number.
  • webKOMS a web based currently mainly read-only version of full KOMS
  • A suite of emailed and “run yourself” web-based reports for extracting data from KOMS.

KOMS is mainly used at Maidstone & Tunbridge Well NHS Trust (MTW), East Kent Hospitals University Foundation Trust (EKHUFT), Dartford and Gravesham NHS Trust (DGT) and Medway Foundation Trust (MFT). There are also - mainly read-only - users from the Queen Victoria Hospital in East Grinstead and the following hospices: Ellenor Lions Hospice, Heart of Kent Hospice, Hospice in the Weald and Pilgrims Hospice.

KOMS is interfaced to other systems as follows:

  • Inbound demographics interfaces from AllScripts PAS at MTW, EKHUFT, MFT.
  • Inbound MDM interface from Aria Medonc for treatment summaries.
  • Outbound demographics appointment interface to Aria Medonc and Radonc.
  • Outbound appointment interface to MTW Kiosk.
  • Tab integration interface with MTW Sunrise.
  • Outbound appointment interface to MTW Sunrise.

KOMS is 27 years old and needs updating to a more modern platform both for the programme itself and the database backend. Discussions are being held with a number of Microsoft partners who would act as external consultants to help with the process.

Discussions were held with the following Microsoft Business Partners in December 2022/January 2023 Reply, Insight, Kainos, Ascent and BJSS. Each partner had been sent a single page document summarising at a top-level the current KOMS functionality and hardware/software used. A 30-minute meeting was held with each Partner with a team of four staff from Oncology and a Microsoft business manager to facilitate. The partners gave presentations on their companies and approaches to a project such as the one proposed and were able to ask the Oncology team about KOMS.

On the basis of these discussions, the list of partners has been narrowed down to three: Reply, Kainos and BJSS. At this point we need to give them an in-depth demonstration of how current KOMS works. This will take the form a presentation to the partners over Teams, with KOMS being driven by a highly experienced MTW member of staff. Written material to back this up may be provided, any figures in such written material will be anonymised or for test patients. Whilst test patients will be used for clinical assessments etc., it is possible that they will see real patient names in appointment lists in passing and so they will be asked to complete non-disclosure agreements.

The partners will not be able to access KOMS themselves. This DPIA is to provide the context for the NDAs to be drafted.

Recommendation and conclusion: Accepted low risk