What is a Fair Processing or Privacy Notice?

The purpose of this notice is to inform you of the type of information including *personal confidential data that Salford CCG processes about you, how that information is used, who we may share that information with, and how we keep it secure and confidential.

Salford CCG has a duty to ensure this is kept confidential, secure and used appropriately.  

Who are we and what do we do?

Clinical Commissioning Groups (CCGs) were created following the Health and Social Care Act in 2012, and replaced Primary Care Trusts on 1 April 2013. Salford CCG is therefore a commissioning organisation, our purpose is not to provide care and so we do not routinely hold or receive information about patients and service users in a format from which they can be identified.

Salford CCG has various roles and responsibilities, but a major part of our work involves making sure that:

  • Contracts are in place with local health service providers
  • Routine and emergency NHS services are available to patients
  • Those services provide high quality care and value for money
  • Paying those services for the care and treatment they have provided.

This is called “commissioning” and is explained in more detail here. Accurate, timely and relevant information is essential for our work to help us to design and plan current and future health and care services, evidence and review our decisions and manage budgets.

The following information explains why we use information, who we share it with, how we protect your confidentiality and your legal rights and choices.

We are committed to protecting your rights to confidentiality

We want patients to understand:

  • How the CCGs use and share information
  • How GPs use and share your information
  • Your health record, what it contains and how you can access it
  • When you can choose to opt-out of your personal information being collected or shared and what this will mean to you 

Why we collect information about you

We use information collected by hospitals, GPs, community services and NHS Digital. The type of information we use is called Secondary Uses Services data (SUS data). SUS data gives us information about the services we commission. It does not include your name or home address but may include information such as your NHS number, ethnicity and gender. It also contains coded information about hospital attendances and treatment.

We use the SUS data for a number of purposes:

  • To understand the health needs of the population
  • To plan, redesign and improve services
  • To ensure providers are using resources effectively
  • To pay services for the care they provide
  • To audit NHS accounts and services

We will use anonymised data that cannot be linked back to your identity (de-identified data) wherever possible. In order to ensure that the NHS continues to function lawfully and efficiently, the Secretary of State for Health has given permission for CCGs to use certain personal information from SUS without consent, but only when it is absolutely necessary for certain specified purposes. This approval is given upon the strict advice of the Health Research Authority’s Confidentiality and Advisory Group (CAG) under conditions set out in section 251 of the NHS Act 2006. The specific terms and conditions that we are obliged to follow when using SUS data can be found on the NHS Digital website.

As a commissioning organisation we do not routinely hold medical records or patient confidential data. There are some specific areas, however, because of our assigned responsibilities where we do hold and use personal information. In order to process that information we will have met a legal requirement, in general this is where we have complied with one of the following:

  • The information is necessary for direct healthcare for patients
  • We have received consent from individuals to be able to use their information for a specific purpose
  • There is an overriding public interest in using the information e.g. in order to safeguard an individual, or to prevent a serious crime
  • There is a legal requirement that will allow us to use or provide information (e.g. a formal court order, statutory returns)

The areas where we use personal information are:

  • Individual funding requests – a process where patients and their GPs can request special treatments not routinely funded by the NHS. This is carried out by Greater Manchester Shared Service Effective Use of Resources Team on behalf of the CCG.
  • Assessments for Continuing Healthcare Assessments (a package of care for those with complex medical needs)
  • Responding to your queries, concerns or complaints
  • Assessment and evaluation of safeguarding concerns for individuals
  • Medicines Optimisation Services
  • If you are a member of our patient participation group, or have asked us to keep you up to date about our work and involved in our engagement and public consultations

For information that may identify you (known as personal confidential data) we would only use in accordance with the:

  • Data Protection Act 1998 - This Data Protection Act requires us to have a legal basis if we wish to process any personal information.
  • NHS Care Record Guarantee – sets out high level commitments for protecting and safeguarding your information, particularly in regard to your rights to access your information, how information will be shared, how decisions on sharing information will be made and investigating and managing inappropriate access (audit trails)
  • NHS Constitution for England – this states that you have the right to privacy and confidentiality and to expect the NHS to keep your confidential information safe and secure

We also have to honour any duty of confidence attached to information and apply Common Law Duty of Confidentiality requirements. This will mean where a legal basis does not exist to use your personal or confidential information we will not do so.

We keep your information in written form and / or on a computer securely and confidentially.

The information held within these records depend on what is required in order to complete the process for which it is intended and will include basic personal details about you, such as your name and address. They may also contain more sensitive information about your health and also information such as outcomes of needs assessments.

The CCG will use the services of the additional data processors, who will provide additional expertise to support the work of the CCG by adding value to the analyses of data that does not directly identify patients, as follows:

Data Processors

Data Processor 1

NHS Arden and Greater East Midlands (GEM)

Commissioning Support Unit (CSU)

St John’s House, East Street, Leicester, LE1 1NB

The GEM are processing data on behalf of the CCG under DSCRO. See Who are DSCRO and What do they do?

Data Processor 2

NHS Oldham CCG hosting:

Greater Manchester Shared Services

Ellen House, Waddington Street, Oldham, OL9 6EE

IT Services / Personal data for the purposes of the Effective Use of Resources process.

Data Processor 3

Salford Royal NHS Foundation Trust hosting:

Advancing Quality Alliance (AQuA), 3rd Floor, Gate House, Cross St, Sale, M33 7FT

No personal data is transferred to this Data Processor or received.

Data Processor 4

Salford Royal NHS Foundation Trust hosting:
Academic Health Sciences Network (Utilisation Management Team)

Salford Royal NHS Foundation Trust Data Centre, Stott Lane, Salford, M6 8HD

No personal data is transferred to this data processor or received

Risk Stratification (Pro-Active Care Management)

Risk stratification is a process GPs use to help them to identify and support patients with long-term conditions and to help prevent un-planned hospital admissions or reduce the risk of certain diseases developing such as type 2 diabetes. This is called risk stratification for case-finding.

The CCG also uses risk stratified data to understand the health needs of the local population in order to plan and commission the right services. This is called risk stratification for commissioning.  The CCG does not have access to your personal data.  The information is de-identified / *pseudonymised.

NHS England (the national Commissioning Board) encourages CCGs and GPs to use risk stratification tools as part of their local strategies for supporting patients with long-term conditions and to help and prevent avoidable admissions. Knowledge of the risk profile of our population will help the CCG to commission appropriate preventative services and to promote quality improvement in collaboration with our GP practices.

Risk stratification tools use various combinations of historic information about patients, for example, age, gender, diagnoses and patterns of hospital attendance and admission and primary care data collected in GP practice systems. The CCG will use anonymised information to understand the local population needs, whereas GPs will be able to identify which of their patients are at risk in order to offer a preventative service to them.

We are committed to conducting risk stratification effectively, in ways that are consistent with the laws that protect your confidentiality. The use of personal data by CCGs and GPs for risk stratification has been approved by the Confidentiality Advisory Group of the Health Research Authority (CAG) and it is reviewed by themselves yearly.

The CCG uses a Data Services for Commissioners Regional Offices (DSCRO’s) specifically North West and Greater East Midlands DSCROs to assist in the process of Risk Stratification. 

Who are DSCRO and what do they do?

NHS Digital's responsibilities as set out in the Health and Social Care Act 2012 include the collection, analysis and presentation of national health and social care data. The Act also gave NHS Digital the powers to act as a safe haven and collect, hold and process personal confidential data (PCD) for purposes beyond direct patient care.

Commissioners of healthcare services need to plan and commission healthcare services in their local area through analysis of actual and projected use of services across all parts of the care economy. This modelling requires access to information about care provided to patients, their hospitals stays and patient journeys but without accessing personal confidential patient data. Care commissioners do not provide direct patient care, and therefore they have no legal basis on which to access personal confidential patient information.

Therefore commissioners require an intermediary service that specialises in processing, analysing and packaging patient information into a format they can legally use this is completed by Data Services for Commissioners Regional Offices (DSCROs)

DSCROs work with data from GP Practices and NHS Hospital Trusts in the regional processing centres. Staff follow strict rules on accessing, analysing and processing data.  The powers granted to the organisation by the Health and Social Care Act 2012 which means that staff are operating within the approved legal framework.

The service allows clinical commissioning groups (CCGs), local authority public health teams and specialised commissioners to plan and commission those healthcare services in their local area and nationally using the services provided through the DSCROs.

Technical and organisational measures are in place to ensure the security and protection of personal confidential data.  Robust access controls are in place to ensure only GPs are able to re-identify information about their individual patients with their consent when it is necessary for the provision of their care.

Invoice Validation

CCGs and NHS England, which includes Commissioning Support Units, do not have a legal right to access personal confidential data (PCD) for the purpose of validating invoices. On 22 November 2013, the Secretary of State for Health approved applications from NHS England for section 251 support for PCD to be used to validate invoices lawfully, without the need to obtain explicit consent from the individual patient at a local level via the process outlined below.

Invoice validation is an important process which involves using your pseudonymised NHS number at Salford CCG to establish which CCG is responsible for paying for your treatment. The process also ensures that those who provide you with care are reimbursed correctly for the care and treatment they have provided. At Salford CCG, we use a pseudonymised NHS Number, which means we cannot identify you, using the Secondary Uses Services data we receive. If there is no data in SUS, another data set is used from providers which shows Salford practice / area codes to confirm the patient is from the Salford area in order to pay an invoice.

For further information on invoice validation, please visit the NHS England website and the following document entitled “Who Pays? – Determining responsibility for payments to providers”.

Sharing your information with other organisations

We share anonymised information with other NHS and social care partner agencies (for example, Salford Together) for the purpose of improving local services, research, audit and public health. We would not share information about you unless:

  • You have asked us to and given us permission
  • We are lawfully required to report certain information to the appropriate authorities e.g. to prevent fraud or a serious crime
  • To protect children and vulnerable adults
  • When a formal court order has been served upon us; and/or
  • The health and safety of others, for example to report an infectious disease like meningitis or measles 

Sharing and linking data

NHS patients and social care service users may receive care and treatment from a number of different places. It is necessary to link this information together to provide the full picture needed to support the activities listed above. In effect, sharing information enables the NHS to improve its understanding of the most important health needs and the quality of the treatment and care we provide to you.

We have entered into contracts with other NHS organisations to provide some services to us, which includes processing data on our behalf, including patient information and to provide Human Resources services for our staff. In these instances, we ensure that our partner agencies have contracts which outline that your information is processed under strict conditions and in line with the law. These services are subject to the same legal rules and conditions for keeping personal information confidential and secure and the CCG is responsible for ensuring their staff are appropriately trained and that technical and operational procedures are in place to keep information secure and protect privacy.

Disclosure of Information

We will not disclose your information to organisations/individuals that are not involved in your care, without your permission, unless there are exceptional circumstances or a legal obligation such as;

  • There is a risk of harm to someone or the wider community
  • The prevention or detection of a serious crime
  • Where we are required to do so by law
  • Reporting some infectious diseases.

In the event that we are obligated to release information as described above, this will only be done with the approval of our Caldicott Guardian. 

Keeping information secure and confidential

All staff have contractual obligations of confidentiality, enforceable through disciplinary procedures. All staff will receive appropriate training on confidentiality of information and staff who have regular access to personal confidential data will have received additional specialist training.

We take relevant organisational and technical measures to ensure the information we hold is secure – such as holding information in secure locations, restricting access to information to authorised personnel, protecting personal and confidential information held on equipment such as laptops with encryption.

Unless required to do so by law, we will not share, sell or distribute any of the information you provide to us with any third party organisations/individuals without your explicit consent.

Each NHS organisation has a senior person responsible for protecting the confidentiality of patient information and enabling appropriate information sharing.

This person is called the *Caldicott Guardian, in NHS Salford CCG this is Francine Thorpe.

Data Retention

The CCG hold data in accordance to the retention schedule in the Records Management Code of Practice 2016.

Please see link for the Records Management Code of Practice and associated record retention schedules


All personal data is destroyed securely by the Clinical Commissioning Group.

Opting out of data being shared beyond care purposes

The NHS Constitution states "You have the right to request that your confidential information is not used beyond your own care and treatment and to have your objections considered".

How to opt out

If you do not want your personal information being shared and used for purposes other than your care and treatment, then you should contact the GP Practice you are registered with and ask for further information about how to register your objections. This should not affect the care and treatment you receive.

You may want to prevent confidential information about you from being shared or used for any purpose other than providing your care.

There are two choices available to you:

  • You can object to information about you leaving a GP Practice in an identifiable form for purposes other than your direct care, which means confidential information about you will not be shared with the CCGs, NHS Digital or other organisation for any non-direct care purpose. This is referred to as a 'type 1' objection; in addition
  • You can object to information about you leaving the NHS Digital in identifiable form, which means confidential information about you will not be sent to anyone outside the HSCIC. This is referred to as a 'type 2' objection.

Information from other places where you receive care, such as hospitals and community services is collected nationally NHS Digital.

If you do not want information that identifies you to be shared outside your GP practice, please speak to a member of staff at your GP practice to ask how to “opt-out”.

The Practice will add the appropriate code to your records to prevent your confidential information from being used for non-direct care purposes. Please note that these codes can be overridden in special circumstances required by law, such as a civil emergency or public health emergency.

If you do not want your personal confidential information to be shared outside of the NHS Digital, for purposes other than for your direct care you can register a type 2 opt-out with your GP practice.

Patients are only able to register the opt-out at their GP practice.

For further information and support relating to type 2 opt-outs please contact the HSCIC contact centre at enquiries@nhsdigital.nhs.uk referencing 'Type 2 opt-outs - Data requests' in the subject line; or call the HSCIC on (0300) 303 5678; or visit the website https://digital.nhs.uk/article/7092/Applying-Type-2-Opt-Outs

How can you get access to information held about you at the CCG?

You have certain legal rights, including a right to have your information processed fairly and lawfully and a right to access any personal information we hold about you. You have the right to privacy and to expect the NHS to keep your information confidential and secure. You also have a right to request that your confidential information is not used beyond your own care and treatment and to have your objections considered. These are commitments set out in the NHS Constitution.


The Data Protection Act 1998 gives you the right to request to view or have a copy of your records held by the CCG.  You do not need to give a reason, but you may be charged a fee. This is called a subject access request. To make a request to any personal information we may hold you need to put the request in writing to the address provided below. If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

Additionally, the NHS Care Record Guarantee states that you can be provided audit trail information regarding those staff who have access your record.

As noted above, the CCG holds limited health information about you. This is only when it is held for direct care purposes. If you require access to GP or hospital records you will have to contact the NHS organisation(s) where you are being, or have been treated.

You should also be aware that in certain circumstances, your right to see some details in your health records may be limited in your own interest or for other reasons.

If you know that information which we hold about you is not correct, you may have a right to request that it is corrected, or to have a note added – please contact Salford Clinical Commissioning Group at the address below. 

Data Protection Register / ICO Notification

The CCG is a Data Controller and under the terms of the Data Protection Act 1998 and are legally responsible for ensuring that all personal information we process is in compliance with the law. All data controllers must notify with the Information Commissioners Office (ICO) who is the UKs independent body set up to uphold information rights, of all personal information processing activities.

Salford CCG has dutifully notified and our ICO Notification number is ZA008141 you can access this notification via the ICO website at www.ico.org.uk


When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.

We will only use the personal information we collect to process the complaint and to check on the level of service we provide. We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute. If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.

We will keep personal information contained in complaint files in line with our retention policy. This means that information relating to a complaint will be retained for two years from closure. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.

Questions or concerns

If you have any questions or concerns regarding the information we hold on you or the use of your information, please contact us at:

Senior Corporate Services Officer
NHS Salford Clinical Commissioning Group
St James House
Pendleton Way
M6 5FW

Email: SALCCG.PatientServices@nhs.net

To contact the Caldicott Guardian, please contact us at salccg.involve@nhs.net

(Please note this email account is accessed by a number of personnel therefore consider the information provided when contacting and please state that the email is for the Caldicott Guardian of Salford CCG).


Personal Confidential Data

Personal confidential data is a term used in the Caldicott Information Governance Review and describes personal information about identified or identifiable individuals, which should be kept private or secret and includes dead as well as living people.

The review interpreted 'personal' as including the Data Protection Act definition of personal data, but included data relating to the deceased as well as living people, and 'confidential' includes both information 'given in confidence' and 'that which is owed a duty of confidence' and is adapted to include 'sensitive' as defined in the Data Protection Act.

Pseudonymisation Pseudonymisation is a technical process that replaces identifiable information such as a NHS number, postcode, date of birth with a unique identifier, which obscures the ‘real world’ identity of the individual patient to those working with the data. It allows records for the same patient from different sources to be linked to create a complete longitudinal record of that patient’s condition, history and care
Caldicott Guardian Each NHS organisation has a senior person responsible for protecting the confidentiality of patient information and enabling appropriate information sharing. This person is called the Caldicott Guardian. The Caldicott Guardian is the senior person in the CCG responsible for protecting the confidentiality of patient and service user information and enabling appropriate and lawful information-sharing. There are specific processes which are followed to ensure the continuing security and confidentiality of the information and we are obliged to tell you that we have shared your information in all but very exceptional circumstances.  

Useful resources and information