COVID-19 Data Protection Statement

During these unprecedented times, BMI Healthcare’s main priority is the health and safety of our patients, colleagues and the wider community as well as supporting the NHS in responding to the COVID-19 pandemic. We are supporting the NHS in responding to the COVID-19 pandemic and this will remain our focus for the foreseeable future.

Our role in responding to the pandemic may vary in relation to demand.  As a result of these unique circumstances, we may need to share personal data with the NHS and other regulatory and government bodies. Each of our hospitals is working in collaboration with their local NHS trusts to ensure we can provide the right help, exactly where and when it is needed, and this may involve personal data being shared with us by the local Trust. This will be done in accordance with data protection legislation and any amendments to applicable legislation made by the Secretary of State. We will also consider any guidance provided by the Information Commissioner’s Office.

Where the NHS and its healthcare professionals provide your healthcare services at a BMI healthcare hospital, the privacy notice of the relevant NHS Trust may also apply.

The basis on which we will process your data is set out below.

Using your personal data and the legal basis for processing

We will rely on Article 6 (1) (b) and Article 9 (2) (h) for the processing of your data.  In addition, we will rely on one or more of the following bases when sharing your personal data as part of our support work with the NHS during the COVID-19 pandemic:

  • Legal obligation: the processing is necessary for compliance with a legal obligation Article 6 (1)(c) *
  • Vital interests: the processing is necessary to protect someone’s life. Article 6 (1)(d)
  • Public interest: the processing is necessary to perform a task in the public interest. Article 6 (1)(e)
  • Legitimate interests: the processing is necessary for an organisation’s legitimate interests or the legitimate interests of a third-party Article 6 (1)(f)

When processing special category data for the purposes of;

  • Employment, social security and social protection Article 9 (2)(b)
  • Vital interests of the Data Subject Article 9 (2)(c)
  • Substantial public interest Article 9 (2)(g)
  • Provision of health or social care Article 9 (2)(h)
  • Public interest in the area of public health such as protecting against serious cross border threats to health Article 9 (2)(i)

* This includes the Notice by Secretary of State under Reg 3(4) of Health Service Control of Patient Information Regulations issued 1st April 2020 allowing healthcare providers to share personal data and any other such notice that may be issued to support efforts against COVID-19.

Sharing personal information

During the COVID-19 pandemic your personal data may also be shared for the following purposes:

  • Understanding COVID-19 trends and risks to public health and controlling and preventing the spread of COVID-19
  • Identifying and understanding information about patients or potential patients with or at risk of COVID-19 including patient exposure to COVID-19
  • Management of patients with or at risk of COVID-19 including locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19
  • Understanding capacity and availability information about patient access to health services and adult social care services
  • Monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information (including workforce details) to the public about COVID-19
  • Delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19
  • Research and planning in relation to COVID-19.

Data Security

We assure you that all necessary steps will continue to be taken to maintain the security of your personal information and our focus will be to prioritise information flows, to ensure ongoing safe and effective care during these unprecedented times.

Changes to this Privacy Statement

We will regularly review this privacy statement and its applicability throughout the COVID-19 outbreak. We reserve the right to update this privacy statement at any time, and we will provide you with a new privacy statement when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

Contact Us

If you have any concerns or questions about the use of your personal data, you can contact our Data Protection Officer via email at [email protected].

April 2020