Purpose

To share information with interested parties about ICB activities, functions, opportunities, events and training.

Legal Basis

NHS Act 2006 and Consent

Processing Activities

You may have expressed an interest and requested to be added to the list or you may have been involved in an event and shared your details.

Email contact details are securely retained for communication purposes.

You have the right to opt out/un-subscribe of receiving these messages at any time.

Purpose

All persons who are required to make a declaration of interest(s) or a declaration of gifts or hospitality should be aware that the register(s) may be published on the ICB’s website. This information may also be provided to individuals identified in the registers because they are in a relationship with the person making the declaration.

Legal Basis

Section 140 and section 14z8 of the NHS Act 2006

Processing Activities

An annual summary of the register(s) of interests (including the register of gifts and hospitality) are published as part of the ICB’s Annual Report and Annual Governance Statement. Where appropriate person identifiable information is excluded from our public registers.

Purpose

To enable the Learning Disability Funding Panel, and discuss the package of care price split between health and social care for a particular patient.

Legal Basis

Provision and management of care

Processing Activities

Data is received so the ICB can discuss with Norfolk County Council(NCC) ,in the Learning Disability Funding Panel, the package of care price split for a particular patient.

The package quality and support needed for the patient are also discussed Information is shared between the ICB and Norfolk County Council.

Data is only shared with staff who is directly involved with the patient's care.

Data is anonymised as much as possible when referring and discussing the patient.

Purpose

To process your personal information if it relates to a complaint where you have asked for our help or involvement. From 01/07/2023 this included complaints regarding primary medical services.

Legal Basis

Explicit Consent – We will need to rely on your explicit consent in writing to conduct such activities.

Processing Activities

If you have a complaint about the ICB or a service that we commission, we will use your information to communicate with you and to investigate any concern that you raise with the ICB in line with its complaint policy.

Where the ICB is investigating a complaint involving several organisations then the information provided by the complainant (including personal details like for example name, address) may need to be shared as appropriate in order for the complaint to be investigated.

The ICB will use your postcode for monitoring to understand our community engagement and to ensure equality of service. This information will be anonymised by using Lower layer Super Output Areas Lower Layer Super Output Area (datadictionary.nhs.uk)

Purpose

NHS Norfolk and Waveney ICB is accountable for effective governance and learning following all Serious Incidents (SIs) that occur within Norfolk and Waveney.

Legal Basis

Statutory Obligation – Serious Incident Framework 2015

Processing Activities

NHS Norfolk and Waveney ICB work closely with all provider organisations as well as neighbouring ICBs to ensure all SIs are reported and managed appropriately. The Francis Report (February 2013) emphasised that commissioners, as well as providers had a responsibility for ensuring the quality of health services provided.

The ICB investigate, manage and reporting of all SIs.

Purpose

NHS Norfolk and Waveney ICB is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing, or administering public funds, or where undertaking a public function, in order to prevent and detect fraud.

Legal Basis

The Cabinet Office is responsible for carrying out data matching exercises under its data matching powers set out in Part 6 of the Local Authority and Audit Act 2014 as part of the National Fraud Initiative (NFI).

Processing Activities

Under this legislation the Cabinet Office:

• May carry out data matching exercises for the purposes of assisting in the prevention of and detection of fraud;
• May require certain bodies to provide data for data matching exercises;
• May accept data submissions on a voluntary basis;
• Must prescribe a scale or scales of fees for mandatory data matching exercises;
• May charge a fee for voluntary data matching exercises; and
• Must consult mandatory participants and relevant stakeholders before prescribing the mandatory scale or scales of fees

Data matching involves comparing computer records held by one body against other computer records held by the same or another body to see how far they match. This is usually personal information. Computerised data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency which requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.

NHS Norfolk and Waveney ICB participates in the Cabinet Office’s National Fraud Initiative to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise, as detailed here. The Cabinet Office has published a privacy notice in respect of the National Fraud Initiative below:

National Fraud Initiative Privacy Notice

The use of data by the Cabinet Office does not require the consent of the individuals concerned under the Data Protection Act 2018.

Data matching by the Cabinet Office is subject to a Code of Practice.

For further information on the Cabinet Office’s legal powers and the reasons why it matches particular information, please refer to: www.gov.uk/government/collections/national-fraud-initiative

Purpose

If you have asked us to keep you regularly informed about the work of the ICB or if you are actively involved in our engagement and consultation activities, we will collect and process personal information that you have shared with us.

You input is invaluable in shaping health and integrated care services.

Legal Basis

Statutory Obligation – 14Z2 of the Health and Social Care Act 2012 Explicit Consent

Processing Activities

We will only use the information you have provided for this purpose. You will be actively informed how your information will be used for engagement and consultation activities. Your personal information will only be accessible by authorised staff from our Engagement Team will be retained for the minimum time necessary to satisfy the original purpose for collection.

Purpose

To provide monetary reimbursements to GP Practices where they must  employ  a  locum  GP  to  cover  GP  long  term  sickness

/maternity/paternity cover.

Legal Basis

NHS Act 2006, Health and Social Care Act 2012.

Processing Activities

Locum reimbursement applications received and processed from GP Practices containing details of the GP clinician who is off sick/maternity/paternity in order to calculate the reimbursement amount due. Applications may also include invoices from Locum GPs, which may contain Locum GP Name and Address.

Purpose

When an individual applies to work for NHS Norfolk and Waveney ICB, we will use the information they supply to us to process their application and to monitor the recruitment statistics. Where we want to disclose information to a third party, for example to take up a reference or obtain a “disclosure” from the Disclosure and Barring Service, consent is obtained during the application process, unless the disclosure is required by law.

Legal Basis

Consent: the individual has given clear consent to process their personal data for a specific purpose.

Processing Activities

NHS Norfolk and Waveney ICB uses the Trac Jobs recruitment platform to process its applications. Any information submitted by an applicant in relation to a vacancy within the organisation is provided with the candidate’s consent with a view to potentially entering into a contract of employment.

Further information on how your information is handled can be found here.

Personal information about unsuccessful candidates will be held for 12 months after the recruitment process has been completed. It will then be securely destroyed using our confidential waste facilities or deleted from our network. We only retain anonymised statistical information about applicants to help inform our recruitment activities.

Once an individual has taken up employment with us, we will compile a file relating to their employment. The information contained in this will be kept secure and will only be used for the purposes directly related to the individual’s employment. Once their employment has ended, we will retain the file in accordance with the Records Management Code of Practice for Health and Social Care.

Purpose

The NHS needs to plan for, and respond to, a wide range of incidents and emergencies that could affect health or patient care. These could be anything from extreme weather conditions to an outbreak of an infectious disease or a major transport accident. The Civil Contingencies Act (2004) requires NHS organisations, and providers of NHS-funded services, to show that they can deal with such incidents while maintaining services.

Legal Basis

The Civil Contingencies Act 2004, Civil Contingencies Act 2004 (Contingency Planning) Regulations 2005, NHS Act 2006 and Health and Care Act 2022 underpin EPRR within health. All acts place EPRR duties on NHS England and the NHS in England.

Processing Activities

The NWICB can receive information from or send information to health system partners, Local Resilience Forum members, regional and national partners. Depending on the nature of the workstream or incident being dealt with, the extent of organisations or points of contacts is very wide ranging and would be directly related to the incident or emergency which is occurring.

The type of information being shared will be employees names, emails and contact details to enable the system to respond to the incident whilst keeping services running as practically as possible.

Purpose

For the NWICB to manage applications for training courses and expressions of interest to support the ICS workforce in undertaking professional development.

Legal Basis

NHS Act 2006 - 14Z41Duty to promote education and training

Processing Activities

Purpose

The purpose of sharing this information is to enable the ICB to capture and hold information about programmes applicants for us to review prior to sharing with training providers to ensure eligibility.

Passing this information onto training providers securely ensures that applicants are put forward for training programmes to support their learning and development as well as career progression. If they were not applying through our team, they would be submitting this information directly to the training providers via online application forms on their websites.

The NWICB apprenticeship levy is only for internal ICB staff and range from levels 2-6. The NWICB encourages Primary Care to utilise apprenticeship schemes.

Legal Basis

Consent is obtained for the sharing of information from controller to controller. This is obtained via the application form (Expression of Interest form).

Processing Activities

Data is collected via a Microsoft Office Word form directly from individuals across primary care and ICB workforce, and shared with their preferred training provider. By sharing this information, their application to the apprenticeship programme is progressed and removes requirement for duplicated processes by all parties.

The information you share with us such as personal contact information, job role, training needs and location, may be shared with the below organisations, if they an apprenticeship you wish to undertake. Please find the non-exhaustive list of training providers used at present in Primary Care N&W:

• University of East Anglia
• Open University
• University of Suffolk
• Anglia Ruskin University
• City College Norwich
• West Suffolk College
• Buttercups Training
• Poultec
• Lighthouse Training Group
• Damar Ltd
• Cambridge Spark

Purpose

To support and manage recruitment posts for the wider Workforce, Commissioning and Planning.  Such as:

• Supporting newly qualified registered clinicians into roles in general practice, to assist workforce planning, recruitment and retention.
• Supporting Volunteer’s

The ICB processes individual staff information on initiatives such as Career Intentions Information, and to support Volunteers to Career Applications.

Legal Basis

These incentives are managed under contract and on a consent basis for expressions of interest.

Processing Activities

Depending on the type of recruitment the ICB will hold Expressions of Interests, HR1 forms, and share the information with partners on the recruitment panel, as advised on application.

For Career Intention information, the NWICB will hold information entered onto MS Forms from training GP’s

Purpose

This programme aims to enhance the recruitment and retention of dental professionals by offering a national incentive. By participating in the National Dental Recruitment incentive programme, individuals consent to the collection and use of their personal data as outlined in National Dental Recruitment Incentive Agreement. Consent is obtained to hold this data by the individual signing the agreement.

Legal Basis

Consent: the individual has given clear consent to process their personal data for a specific purpose.

Processing Activities

Data is collected from service recipients, and aggregated. We share the aggregated data with NHS England to enable them to monitor the appropriate use of incentive funds and outcomes of the project.