Data Protection Act 2018
Maintaining privacy and confidentiality of Service User information is a basic principle of the feedback process. It is the role of all HSE staff to ensure that privacy and confidentiality is maintained. The Data Protection Act 2018 and the General Data Protection Regulation place an obligation on the HSE and staff to safeguard the right of individuals in relation to the processing of their personal data.
Processing means performing any operation or set of operations on data, including: obtaining, recording or keeping data, collecting, organising, storing, altering or adapting the data; retrieving, consulting or using the data; disclosing the data by transmitting, disseminating or otherwise making it available; aligning, combining, blocking, erasing or destroying the data.
Personal data is defined as data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or likely to come in to the possession of the data controller.
Under the Data Protection Act, personal information should only be used or disclosed for the purpose for which it was collected for or another directly related purpose.
The Freedom of Information Act 2014
The Freedom of Information Act confers on all persons the right of access to information held by public bodies, to the greatest extent possible, consistent with the public interest and the right to privacy. It is imperative that all staff are cognisant of the right of the Service Users to access any information held by the HSE in relation to the management of their feedback. Therefore, staff must ensure that they adhere to the principles of the Freedom of Information Act, that consent to access patient confidential information is obtained where required and that decisions made during the feedback process are supported by facts and evidence.
The Freedom of Information Act 2014 also contains two further statutory rights which may arise where a complaint investigation report has been provided to the Complainant. These rights are:
- Have personal information amended where such information is incomplete, incorrect or misleading.
- Be given reasons for decisions taken by public bodies that affect them.
Consent and Confidentiality
Service users must be assured that their feedback and their personal details will be treated in confidence to the greatest extent possible consistent with the public interest and the right to privacy. Feedback data required for reporting and statistical purposes will be anonymised and all identifiable data will be removed.
However, where the screening and /or investigation of feedback indicates that there is a requirement to disclose some or all details, e.g. where there is evidence of abuse that must be reported in accordance with the Children First Guidelines, the Service User will be informed immediately and the information will be directed to the appropriate service.
Access to Personal Confidential Information
For the purpose of accessing Service User confidential information as part of the investigation of a complaint, the HSE must ensure that it has the consent of the Complainant to do so. If a person is making a complaint on behalf of another, then that person’s consent must be established. Please see the National Consent Policy for further information
Consent may be obtained in three ways:
- HSE Your Service Your Say Feedback Leaflet - The Service User may give consent on the HSE feedback leaflet. This provides the HSE with permission to access Service User confidential information where needed to investigate a complaint.
- Acknowledgment Letter - The acknowledgement letter must outline the process that will be used to manage the complaint and the Complainant will be asked to contact the relevant Complaints Officer within five working days from the date on the acknowledgement letter if they do not wish their patient confidential information to be accessed during the process of the investigation.
- Verbal Consent Recorded by Staff Member - If a verbal complaint is made to a staff member/Complaints Officer who proceeds to record the complaint for the purposes of a formal investigation, the staff member must ask the Complainant to give consent to access the relevant patient confidential information. The staff member must record this consent and have the Complainant sign the consent where possible.
It is important to note that the above consent only allows access to the information in the record that is relevant to the complaint.
Complainants must be informed that refusing or restricting access to relevant patient confidential information may impede the proper investigation of the complaint.
The feedback process must ensure that the details of the complaint and information gathered or received through the investigation of the complaint are only viewed by relevant personnel and that the dissemination of this information is restricted to a rigorous need to know basis.
For the purpose of gathering and publishing statistics and for educational purposes, all patient identifiable data and personal data must be removed from the complaint and the complaint identified using a designated code. Care must be taken to ensure that specific locations and individuals cannot be identified when using this data for these purposes.
Complaints on behalf of a Third Party and access to Personal Confidential Information
- When a complaint is made on behalf of a third party the HSE must endeavour to ensure that the complaint is being made with the consent of the third party.
- When accepting a complaint on behalf of a third party, the HSE must ensure that it is appropriate for the Complainant to make a complaint as detailed in Section 46, (3) and (4) of the Health Act 2004 and that the identity of the Complainant is validated.
- When a complaint is made on behalf of an incapacitated person, the HSE must ensure that this Complainant, by law or by appointment of a court, has the care of the affairs of that person.
- An objectively reasonable approach to this issue will usually prevail with each situation being considered on an individual basis.
- Where the Complaints/Review Officer has a concern about the consent of the third party the Complaints/Review Officer will make every effort to get the consent of the third party before progressing with the complaint.
Staff Member and Rights to Confidentiality
Particular care, caution and sensitivity must be exercised in certain circumstances, where for example, the good name, reputation and rights under natural justice of a staff member may arise in the context of an initial and as yet unsubstantiated complaint.
In such circumstances the person receiving the complaint and / or the Complaints/Review Officer must consider the right to confidentiality of the staff member against whom the complaint appears to be made in the first instance.
Confidentiality, privacy and similar rights must also be protected, pending the outcome of initial checking and validation. Where a complaint has been made about a named staff member, their Line Manager must be informed of the complaint, once the matter/s are deemed, after careful checking and consideration to have substance as a valid complaint under Part 9 of the 2004 Health Act.
Therefore, where a complaint has yet to be substantiated and the Complaints/Review Officer is of the opinion that the confidentiality of the staff member/service involved should be protected until the complaint has been substantiated, the Complaints/Review Officer must use his/her discretion to this effect.
