NHS Number – privacy notice

Your NHS Number is a number made of 10 digits that is unique to you and is used to correctly match you to your health care records. This number will appear on the majority of the official documents you receive from the NHS, including letters from your doctor, hospital appointments, results and prescriptions.

Why we need your NHS number

If you are receiving support from social care then the NHS may share your NHS number with us. This is so that the NHS and social care can use the same number to identify you whilst providing your care. By using the same number the NHS and Lancashire County Council Social Care can work together more closely to improve your care and support.

The information shared

Your NHS number is accessed through an NHS service called the Personal Demographic Service (PDS). Social Care sends basic personal information such as your name, address and date of birth to the PDS so they can find your NHS number. Once retrieved from the PDS the NHS number is stored on the Council’s Social Care system which is called Liquid Logic.

Personal information

Lancashire County Council will share data with the PDS in order to retrieve your NHS number that is classed as personal under the Data Protection Act 1998. Only relevant data will be shared. The Data Protection Act 1998 defines personal information as.

Personal information is:

  • Information/Data which relates to a living, individual who can be identified from the data or other data/information that Lancashire County Council holds
  • This could be single elements or a combination e.g. names, addresses, occupation, date of birth etc.it could also include opinions about them and intentions towards them.

Legal gateway for sharing information

Health and Social Care Act 2015 – places a duty on health and social care providers to share information about a person’s care with other health and care professionals. Relevant health and adult social care bodies will also be required to use a consistent identifier - the NHS Number - when processing and/or sharing information about an individual for their direct care. This will enable better connection of health and care records as people move between services, so relevant information is shared, meaning safer and better aligned care.

Care Act 2014

Sections 2 and 3: Local Authorities must exercise their functions with a view to ensuring the integration of care and support where it would promote the wellbeing of adults, contribute to prevention or delay of care or support for carers and adults. The NHS Number is used to match information across health and care. It terms of this application this would only be for people receiving direct care from both health and social care.

Section 6: Local Authority must cooperate with each of its relevant partners in the exercise of functions relating to adults and carers. The NHS Number is used to share information to support the effective care coordination of individuals.

Section 25: Local Authority must give a copy of the support plan to the carer, adult needing care and any other person to whom the carer asks the authority to give a copy. The NHS Number is used to share information to support the effective care coordination of individuals. The NHS Number is used to ensure records are not duplicated and that the information shared is accurate.

Section 27:  Local Authority must keep under review care and support plans and review the plan.  The NHS Number is used to ensure that the information used when reviewing care is accurate

Section 37 and 38: Local Authorities must cooperate where they receive notification that someone intends to move between Local Authority area. The NHS Number is used to ensure that information shared can be matched to existing records or provide continuity of records across care settings.

Section 74: Local Authorities must comply with regard to the discharge of hospital patients likely to need care or support. The NHS Number is used to ensure that information shared can be matched to existing records or provide continuity of records across care settings.

Disabled Persons Act 1986 – Section 7: Places a duty on Local Authorities to assess an individual when discharge notifications are received after a person has received treatment for a mental disorder. The NHS Number is used to ensure that information shared can be matched to existing records or provide continuity of records across care settings.

Data Protection Act 1998 – As Lancashire County Council are just sharing your name, address and date of birth then we only need to meet one condition under the Data Protection Act 1998 for processing personal data, this being:

Schedule 2

5   The processing is necessary –

     (b) for the exercise of any other functions of a public nature exercised in the public interest by any person."

General Data Protection Regulation – On 25 May 2018 the Data Protection Act 1998 will be replaced by the General Data Protection Regulation (GDPR). The condition for processing under the GDPR will be:

Article 6

  1. Processing shall be lawful only if and to the extent that at least one of the following applies:

(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller."

How long your information is stored

Lancashire County Council will add your NHS to your social care record. The type of support and care you receive from us will determine the length of time we keep your information for. We will only retain your information for as long as is legally required or in situations where there is no legal retention period we will follow established best practice. At the end of the retention period electronic data will be deleted and any physical files will be confidentially disposed of.

File Type Retention Period
Children's Social Care
Adoption Agency, Non Agency and inter-Country, Adoption Welfare Supervision 100 years from date of Adoption Order
Children Looked  After Files of children who are looked after, or who cease to be looked after, before the age of 18 years, should be retained completely intact until the 18 Birthday is reached. 75 years from date of birth or if the child has died before reaching 18 years, for the period of 15 years from the date of death or when the  age of 18 would have been achieved, whichever is the later.   Any historic family records previously created on children who are look after for 75 years from the date of birth of the youngest child will be stored by records management team.
Child Protection Records Records of children where child protection enquiries took place under Section 47 of the Children Act 1989, but did not lead to registration, will have a retention period of 20 years following closure of the case.  If the child dies within the retention period the records remain archived for the full retention period. Records of children who have been on the Child Protection Register will have a retention period of 75 years from the date of birth of the child. .  If the child dies within the retention period the records remain archived for the full retention period.
Records of children not currently looked after but subject to a legal order to the authority requiring supervision   (Supervision Order or Family Assistance Order the Children Act 1989)  75 years from date of birth or if the child has died before reaching 18 years, for the period of 15 years from the date of death or when the  age of 18 would have been achieved, whichever is the later.
Children’s records other  than those referred to above, - cases closed after initial assessment; - children receiving Family Centre support; - other Children In Need and Family Support cases;    10 years after the case is closed
Records in respect of children in Children’s Homes as described in Schedule 4 of the Children’s Homes Regulations 2001  Amendment 2011 50 years after the child is discharged from the home The legislative retention period for these records is 15 years but Lancashire policy is to keep some of them for 50 years.  
Records on persons cautioned or convicted of an offence under Schedule 1 of the Children and Young Persons Act 1933 or persons posing a risk to children. 100 years from the creation of the record.
Records of those Children who have been detained under Section 2 or 3 of the Mental Health Act 1983 20 years after no further treatment considered necessary or 8 years after the patient’s death if the patient died while still receiving treatment
Adult Social Care
Anyone who has been subject to detention under the Mental Health Act 1983 and Mental Health Act 2007 amendments 20 years after no further treatment considered necessary, or 8 years after the patient's death if patient died while still receiving treatment.
Other records of adults with a service user category of Mental Health 5 years from the date the service ceases for service users with a category of Mental Health. 
Social care records relating to service users with a section 117 under the Mental Health Act 1983 Service users with a section 117 classification need to stay open indefinitely as an annual reviewable record to ensure the section 117 is still current.  This will continue until a discharge notice has been actioned and approved.   If S117 legal status start date + end date applied then the retention period should be 5 years from ended date.   
Safeguarding - Where a safeguarding alert has been created and progressed to a safeguarding case. 10 years from date of closure.
Organisational Safeguarding Alerts (OSA) - Where there is a Safeguarding alert for an organisation such as a provider or care home, the retention period applied is 10 years from the date the case is closed. 10 years from date of closure.
4.4.2      Deprivation of Liberty (DOLs) - Deprivation of liberty safeguards form part of the Mental Capacity Act 2005 and relate to where an individual has been admitted to a hospital or residential/nursing home against their will following a best interests decision. The retention applied is 10 years from the date of closure.      10 years from date of closure.
All other service user records including, elderly, physically disabled, learning disabilities 3 years after the death of the service user; or after the case has been closed
Blind and Partially Sighted register Indefinitely until death The local authority has a statutory duty  to maintain a register of severely sight impaired (Blind) and sight impaired (partially sighted people). Records to be held 3 years after death
Deaf and Hard of Hearing register Indefinitely until death The local authority has a statutory duty to maintain a register of citizens that are deaf or hard of hearing. Records to be held 3 years after death

How your information is protected

Your information will only be accessible by staff involved with the administration and provision of your care and service and on some occasions ICT support staff. Your data will not be stored outside the European Economic area and it will be stored and used in accordance with the Data Protection Act 1998. Your details will sent to the PDS using a dedicated N3 line and the NHS number will be sent back using the same line. An N3 line is a direct, secure link into the NHS network. All the staff who handle your information will complete annual information governance training.

Further information

If you object to the use of your NHS number or would like further information then please contact us on 0300 123 6701 or email enquiries@lancashire.gov.uk

Your rights

If you would like to request a copy of the information Lancashire County Council holds on you then please make your request in writing to the Information Governance team. Contact and process details can be found here.

If at any point you believe the information we process on you is incorrect you can request to see this information and even have it corrected or deleted. Where possible we will seek to comply with your request but we may need to hold or process information in connection with one or more of the Council’s legal functions.

You have the right to opt out of Lancashire County Council receiving or holding your personal identifiable information. There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues. The process for opting out will depend on the specific data is and what programme it relates to.

If you wish to raise a complaint on how we have handled your personal data, you can contact the Information Governance team who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).