Privacy Notices

This privacy notice explains how we use your personal information in providing occupational health services and your rights regarding that information.

NHS Shetland policies and procedures apply to NHS Shetland Occupational Health Services and this privacy notice should be read  in conjunction with the NHS Shetland Privacy Notices, available on the NHS Shetland website.

The Occupational Health Department is committed to protecting the rights of the individual, acknowledging that any personal data handled will be processed in accordance with the Data Protection Act 2018 (DPA) and the General Data Protection Regulations (GDPR) 2016.

If you have any questions about the processing of your data, please contact
shet.occupationalhealth@nhs.scot or the NHS Shetland Data Protection Officer at
shet.dpo@nhs.scot

What data will be collected?

The following data may be collected during the process of providing occupational health service to you and your Employer:

• Personal information, e.g. name, address, date of birth
• Personal characteristics, e.g. ethnicity, gender
• Past and present job roles
• Health/medical information

Who will the data be collected from?

• You (the data subject)
• Your Manager and Human Resources
• Health Specialists/Services that we may refer you to as part of our assessment process
• With your consent, your GP or other Specialists from whom you have received treatment

How will the Data be collected?

• Verbally, either by telephone or face to face conversations
• In writing, this may be forms you and/or your manager may complete as part of Occupational Health processes, or reports/letters sent to us from other parties, e.g. your GP. These may be sent to us electronically or by post.

Why is the data collected?

The lawful basis for collecting/processing your Occupational Health data is set out in the NHS Shetland Privacy Notices.

How long will your data be held for?

• Pre-employment health assessment records will form part of the individual's Occupational Health record where the individual is successfully appointed to the post. Where an individual is not successfully appointed, the information collected as part of the pre-employment health assessment process will normally be retained for a period of one year from the date of the assessment and then securely destroyed.Information may be retained for longer where there is a legitimate clinical, legal, regulatory, or other statutory reason to do so, in accordance with the organisation's records management and data protection policies.
• Most Occupational Health records are retained until six years after you leave employment or until you reach the age of 75, whichever is sooner. However, some records must be retained for longer where legislation requires this. For example, health surveillance records relating to exposure to certain workplace hazards may be retained for 40 years to comply with Health and Safety Executive (HSE) and Control of Substances Hazardous to Health (COSHH) Regulations 2002 requirements

How will the data be stored?

• Electronic records are stored on a secure server
• Paper records are stored in locked filing cabinets

Occupational Health records are only accessible to Occupational Health personnel.

Who will data be shared with?

Our consent to share procedures are undertaken in line with GMC/NMC and FOM Ethics guidance and information about you will not be shared without your knowledge and consent.

• You have the right to withdraw consent to share at any time, for any reason. Please ensure the department have received this information.
• Disclosure of information without consent may occur when disclosure is required by law or is in the public interest. This type of disclosure would be assessed on a case by case basis, using only information necessary for the specific purpose and circumstance requested with appropriate security measures in place.

What are your rights?

• You have the right to see information held about you in your Occupational Health record. Any request should be made in writing and will be responded to within four weeks, without charge. Charges for this information may apply if the request is excessive or repetitive.
• You can authorise a third party to exercise your right of access to your information, in this instance we may require additional written consent to protect your medical confidentiality under our legal and ethical duty.
• You can also request that an amendment is attached to your record if you believe any of the information held is inaccurate or misleading.
• In the case of a request for erasure, retention may be lawful e.g. if required for legal compliance.
• More information about your rights is available in the main NHS Shetland Privacy Notices.

Should you require any further information please contact the Occupational Health Department Manager via shet.occupationalhealth@nhs.scot