What data do we collect?
We will collect personal and special categories of information. We collect this information where it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.
We will collect the following information in each of the situations set out below:
- Practitioners and self-referring practitioners about whom we have been approached for advice (information as reported to us): name; gender; professional registration number; post/grade; specialty; length of time in post; contract type; age group at referral; ethnic group; disability status; place of first professional qualification (UK, European Economic Area (EEA) or Outside EEA); number of years worked in UK; and details of the reported performance concerns and the local management of the case (including investigation reports)
- Employing/contracting organisations: name; work position; work address; contact details; and information about concerns and proposed management of cases
- Practitioners referred for consideration of assessment: (in addition to information referred to in ‘Practitioners and self-referring practitioners about whom we have been approached for advice’ above.) contact details; qualifications; contract/employment status; work experience; scope of practice; information about investigations undertaken; information about occupational health assessments completed; equality and diversity details; and recommendations in relation to consideration of assessment
- Practitioners engaging in assessment or professional support and remediation: (in addition to information in ‘Practitioners referred for assessment’ above)
Contact details; qualifications, contract/employment status; additional posts; work experience; scope of practice; workload; information about health; job plan; timetable; continuing professional activities; and equality and diversity details.
Information generated as part of the assessment process including: information about your health (if consent is given to share this with us); information collected as part of the assessment of behavioural concerns; information collected as part of colleague multi-source feedback; information generated as part of patient feedback; and information collected as part of the observation of clinical practice. As part of the assessment process, information about the practitioner being assessed will be shared with assessors undertaking the assessment on behalf of our service, which will include the information listed above.
- Practitioners participating in Assisted Mediation: practitioner name; specialty; documentation of concerns; personal statements; mediation agreements; and correspondence explaining the outcome of mediation
- Patients: details about care and information about a compliment or complaint made in relation to a practitioner about whom we have been approached for advice. (This information will often be anonymised or pseudonymised, and it is our normal practice to seek prior written consent, or the agreement of a parent/guardian, to use personal data in any assessment activity)
- Colleagues of the practitioner: details about involvement in a case; colleague multi-source feedback about an assessed practitioner (including: name; professional registration number; gender; grade; length of working relationship; and, in the cases of nurses and allied health professionals, length of time since qualification)
- Suspended/excluded practitioners: (in addition to information listed in ‘Practitioners referred for assessment’ above) start and end dates of suspensions or exclusions of individual practitioners from work and, thereby, information as to the duration of episodes and copies of suspension letters
- Healthcare professionals who are subject to Healthcare Professional Alert Notices: the request for the alert notice (including full name and last known address, national insurance number); (where applicable) professional body registration number; the gender and ethnic origin of the individual; a description of the capacity in which the individual was employed or engaged to provide services and in which it is thought possible they may seek work in the NHS. (Note: the reason for the request will include: a summary of all relevant information about the individual which supports the request; an assessment of the relevant risks; any advice taken; and any action already taken in respect of the individual concerned including copies of investigations/reviews (including any referral to the regulatory body)
- Performers List: practitioner name; practitioner role; professional registration number; and practitioner address
- Team reviews: practitioner names; personal details; specialty; any documents detailing concerns; and details of organisation requesting the review (name, work position, work address and contact details)
How we use personal data
We use the information that we collect for the following reasons:
- Advising and supporting healthcare organisations employing/contracting organisations where there is a concern about the performance of a dentist, doctor or pharmacist.
- Monitoring the diversity of individuals referred to us (as required by the Secretary of State).
- Engaging with individual practitioners who are the subject of concerns, including, where applicable, producing an assessment report, and where possible helping to develop a subsequent action plan.
- Facilitating the carrying out of a review of the functioning of a clinical team.
- Monitoring suspensions and exclusions of dentists, doctors and some pharmacists from work.
- Issuing alert notices in relation to healthcare professionals and maintaining the HPAN system.
- Carrying out research, evaluation and educational activities relating to the services provided by us.
How we collect your data
Where we do not collect the data directly from the data subject the data will have been obtained from the employing/contracting organisation or other practitioners.
How long we keep your personal data
In order to determine how long we keep your personal data, we follow the NHS Records Management Code of Practice. You can find information about our retention schedules in our Records Management Policy – this document will outline the duration that we keep specific information for.
We specifically hold information referred to in the above sections for a period of 20 years. We hold information so that we can learn from the cases referred to us, to help us inform service improvements and to support practitioners and organisations to deliver safer care to patients.
Who we share your personal data with
Personal data about practitioners and referring organisations may be shared with third parties who provide services as part of our assessment process (and with other third parties – see below). Where we contract with third parties to provide services as part of our assessment processes; we require those third parties to sign appropriate agreements before access to data is granted.
We share information with third parties such as the Police, NHS Counter Fraud Authority, the Department of Health and Social Care or other government departments, regulatory or other public authorities, to comply with legal obligations or where this is otherwise necessary, including disclosures made to protect patient safety or for the purposes of public protection.
The lawful basis for processing your data
For all of the processing of personal data undertaken by Practitioner Performance Advice, the lawful basis for processing is as follows:
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where we have to process special categories of personal data, there are three justifications depending on the circumstances (please contact the Data Protection Officer for more information):
- Processing is necessary for reasons of substantial public interest.
- Processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, the management health or social care systems on the basis of Union or Member State law.
- Processing is necessary for reasons of public interest in the area of public health such as ensuring high standards of quality and safety of healthcare, on the basis of Union or Member State law which protects the rights and freedoms of the data subject, in particular professional secrecy.
Page last updated on:
