Privacy notice – NHS Number

NHS Numbers are an example of the types of personal data (information that identifies living individuals) that Devon County Council handles. All of the personal data collected and used by Devon County Council must be processed in accordance with relevant data protection laws.

NHS Numbers are obtained from the Personal Demographics Service

Legal obligations

The Health and Social Care (Safety and Quality) Act 2015 places an obligation on organisations that commission or provide health or adult social care to use a consistent identifier when processing service user information for the purpose of providing care. Supporting regulations specify that the consistent identifier must be the NHS Number.

Local authorities may also refer to Section 1 of the Localism Act 2011 as the basis for processing the NHS Number.

The Common Law Duty of Confidentiality places an obligation that NHS Numbers should not be disclosed without the consent of the service user. For direct care it is accepted that where it is reasonable to believe that the service user understands that their information may be shared and that they have not objected, then consent is implied.

The Data Protection Act 1998 specifies that handling of personal data such as NHS Numbers requires consent unless a different condition in Schedule 2 such as the processing being necessary for the exercise of a public function is met, or in Schedule 3, that the processing is necessary for medical purposes. The Information Commissioner has confirmed that the definition of medical purposes includes the provision of social care.

How do we use NHS Numbers?

The NHS Number is used for administrative purposes only and does not affect entitlement to care. We may use NHS Numbers for the following purposes:

  • The administration of open adult social care cases.
  • The administration of open children’s social care records – recommended.
  • Public health where direct care is involved.
  • Pre-school where the child has a health condition or disability.
  • Residential and nursing homes.
  • Special educational needs (SEND).
  • Other activities where services communicate with health bodies about direct care.

The NHS Number is used to help identify individuals and is associated with other personally identifiable information such as name, address and date of birth.

What must we not use the NHS Number for?

Our use of the NHS Number must not be excessive. It must not be used outside of the care context or as a general identifier for service records about individuals unless there is a recognised health or care factor.

Who do we share personal data with?

The Health and Social Care (Safety and Quality) Act 2015 places a legal obligation to share the NHS Number where “reasonably able”. We may share the NHS Number with third parties where individuals need to be clearly identified for the purpose of providing care, preventing damage or distress or preventing criminal offences. There is an expectation that where we have commissioned a third party and provided them with NHS Numbers we understand how they will use it.

Information may be shared, for primary or secondary purposes, with the following categories of organisation:

  • Clinical Commissioning Groups.
  • GP surgeries.
  • Health trusts.

How long do we keep NHS Numbers?

NHS Numbers will be kept as long as necessary for the purpose of providing health or social care. We do not keep NHS Numbers longer than necessary.

How do we keep your NHS Numbers secure?

Devon County Council is committed to securing your NHS Numbers from unauthorised access, use or disclosure. Digital storage systems are protected by industry standard tools. Employees sign policies and receive training which ensures they are aware of the importance of handling personal data such as NHS Numbers securely.

How do I obtain a copy of my own personal data that you hold?

The Data Protection Act provides members of the public with a right to request copies of documented information that the council holds about them. This is called the right of Subject Access. Find out how to access your personal data, including details of the information needed by the council to progress your request.

How can you complain about the way we handle your NHS Number?

You can contact our Information Governance Team

You have a right to complain to the Data Protection Regulator, the Information Commissioner if you are dissatisfied with the way Devon County Council has handled or shared your personal information:

Information Commissioner’s Office
Wycliffe House
Water Lane
Cheshire SK9 5AF
Tel: 0303 123 1113 (or 01625 545745 or 44 1625 545745 if calling from overseas)
Fax: 01625 524510