LYPFT Akrivia (Research)

Data Protection Privacy Notice

Leeds and York Partnership NHS Foundation Trust (“the Trust”) are using the Akrivia Health platform to help to support research, service evaluation and auditing processes. This is a system which uses service user data held within our electronic patient records to identify trends and other useful information, to help us improve patient care and carry out more research into mental health. The Trust has a contract with Akrivia Health. Akrivia are our Data Processor, and they process patient data on our behalf and only as we instruct them. Leeds and York Partnership NHS Foundation Trust are the accountable Data Controller for data processed within the Akrivia Health platform.
Information about Akrivia Health is available on About Akrivia Health.
Contact addresses are as follows:

Research and Development

St Mary’s House
St Mary’s Road
Leeds
LS7 3JX

Head Office

St Mary’s House
St Mary’s Road
Leeds
LS7 3JX

Data Protection Officer

St Mary’s House North Wing,
St Martin’s View,
Leeds
LS7 3LA

During processing, all information that can be used to identify service users is removed so that it is
not possible to link it back to individuals.

The Trust will also join a network of other NHS mental health Trusts in the UK who also partnerwith Akrivia Health. This will mean we can collaborate on larger research projects across the country by combining the anonymous data from all the partner Trusts. This data set is one of the largest every collected and will include over 3 million records.

What Data do we Collect and Use?

We will use data from the electronic health records of our current service users. We will not usethe data of previously discharged service users, however, if you are discharged after the launch of the system, your data will still be included, unless you tell us you would not like your data to be used in this way (see Opting Out below).

The information we collect will include gender, diagnosis, symptoms, ethnicity, medication and information from clinical letters and assessment forms will also be included. To keep information up to date, the data will be extracted from the electronic patient record and updated every two weeks and will be stored for 90 years to ensure it is possible to meaningfully assess life-long impacts of treatments or services.

How do we Comply with Data Protection Law?

The processing of service user data via the Akrivia Health platform has a basis in law as follows:

For personal data:

UK-GDPR, Article 6, subsection 1-e: processing is necessary for the performance of a taskcarried out in the public interest or in the exercise of official authority vested in the controller;

And, for ‘special category’ data, including healthcare data:

UK-GDPR, Article 9, subsection 2-h: processing is necessary for the purposes of preventiveor occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

UK-GDPR, Article 9, subsection 2-j: processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

In balancing the individual’s right to confidentiality against the public interest, the public interest overrides and outweighs the right to confidentiality of the individual because of the comparably large gains to be made from making de-identified and then anonymised data available for research set against the relatively low risks of a breach to the individual’s confidence.

This rationale is supported by the lawful basis for the processing of healthcare data under UK-GDPR, which relies on Article 9, subsection 2-h, where the purpose of data processing is to improve patient care, accelerate research, and evaluate services, all of which are manifestly in the public interest. Improving patient care is in the public interest, furthermore, given that many of the data controllers are public bodies, they are also exercising their official authority as NHS bodies who provide care / treatment to the public.

The platform uses the absolute minimum amount of personal data, ensuring that directly identifiable personal data are redacted and / or truncated. The only directly identifiable personal data retained in the system is to ensure that service users can opt out.

The resulting anonymised data does not contain any personal data and therefore falls outside of data protection regulation.

All data processing on the Akrivia Health platform is undertaken entirely in the UK. No overseas processing takes place.

Is my Data Secure?

Data processed on the Akrivia Health platform is very secure. The processing takes place entirely in the UK, at a data centre hosted by Amazon Web Services (AWS) in their London site. AWS have appropriate information security accreditations and are a world leader in secure data hosting services. Data sent to the Akrivia Health platform will be transmitted via the secure Health & Social Care Network (HSCN), in the same way as other NHS systems.

Do you Share my Personal Data?

We have a data sharing agreement with other NHS organisations in the Akrivia Network. This means that researchers at these organisations can ask us to share data with them and we can ask them to share their data with us. These requests will be reviewed and authorised by a local governance group.

Opting Out: What if I don’t want my Data Processed on the Akrivia Health
platform?

If you object to the use of your personal data in the Akrivia Health platform, you can email us and
we will remove you from the data extract. Opting out of using your personal information for this
purpose will not affect the care and treatment we will give you, and you are still able to agree to
participate in any local research studies which may interest you.

To opt out, e-mail Akrivia Admin.

The Trust has also decided that if you have already registered a National Data Opt-Out for all secondary processing of your healthcare data, we will honour this opt-out and exclude your data from inclusion in the Akrivia Health Platform.

Your Rights

As a ‘data subject’ you have certain rights under Data Protection law, although not all of these apply in all cases. Your rights in relation to the data processed on the Akrivia Health platform are below:

• Your right of access – You have the right to ask us for copies of your personal information.
  As the data in the Akrivia Health platform is anonymised, you can use this right to access
  the data the Trust holds about you via the Medical Records Subject Access Request
  procedure.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. As the data in the Akrivia Health platform is taken from your Trust health record, you can use this right to seek correction of factual errors in your Trust health record.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. If you opt out of your data being processed in the Akrivia Health platform, it will be removed. You do not have this right for data held in your Trust healthcare record.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances. You may opt out of your data being processed in the Akrivia Health platform.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances. You may opt out of your data being processed in the Akrivia Health platform.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances. As the data in the Akrivia Health platform is anonymous, this right does not apply.

You are not required to pay any charge for exercising your rights. If you make a request, we have
one calendar month to respond to you.

Please contact us at Akrivia Admin. if you wish to make a request.

How to Complain

If you have any concerns about our use of your personal information, you can make a complaint to
the Trust Data Protection Officer:

Carl Starbuck – Head of Information Governance, Data Protection Officer
Freedom of Information Officer, Deputy Caldicott Guardian
Email Information Governance.

You can also complain to the Information Commissioner’s Office if you are unhappy with how we have used your data.

The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
ICO website