Common use of Basis for sharing Clause in Contracts

Basis for sharing. 3.1 Legal basis for sharing the personal information Article 6 of the General Data Protection Regulation 2016/679 For the creation of a CMC care plan Article 6(1)(a) is the legal basis (consent, as defined in data protection legislation).  An indication of consent provision by the person who has mental capacity to agree to having the support of a CMC care plan is required on the CMC care plan. (Where mental capacity to agree to having a plan is not available, the consent of the Lasting Power of Attorney for Health and Welfare where one exists or where not, the clinician’s decision in the best interests of the patient may be used.  Any process by which consent is obtained, how the discussion and decision are undertaken, gained and otherwise noted is the responsibility of the individual controller organisations to design and manage. For viewing (processing) the record by services including urgent care services Article 6(1)(e) is the legal basis (performance of a public task). 3.2 Legal basis for sharing the information special categories of personal information i.e. health information For the creation of a CMC care plan Article 9(2)(a) is the legal basis (consent, as defined in data protection legislation). Article 9 of the General Data Protection Regulation 2016/679  An indication of consent provision by the person who has mental capacity to agree to having the support of a CMC care plan is required on the CMC care plan. (Where mental capacity to agree to having a plan is not available, the consent of the Lasting Power of Attorney for Health and Welfare where one exists or where not, the clinician’s decision in the best interests of the patient may be used.  Any process by which consent is obtained, how the discussion and decision are undertaken, gained and otherwise noted is the responsibility of the individual controller organisations to design and manage For viewing (processing) the record by services including urgent care services Article 9(2)(h) is the legal basis (performance of a public task). 3.3 Legal Basis for sharing under the Common Law Duty of Confidence (see appendix) Implied consent. Health and Social Care Act requires health care providers to share information to enable direct care to take place. 3.4 If aggregated data for secondary uses, not direct care, consider whether any individuals may be identifiable from the information (and in conjunction with any other information available) If personal data, consider whether the information can be provided in an anonymised way. Data may be used for auditing and service evaluation purposes whereby information is accessed by legitimate organisations and services which the patient had previously utilised or is utilising currently. The end product of any audit (report or similar) and service evaluation (report or similar) will not contain patient identifiable data. Controller organisations wanting to access historical information that no longer is available on their view of the care plan due to update changes made on the care plan over time, can be provided with that information by the Coordinate My Care service on request. The controller identifies the persons of interest to them and will communicate this to the Coordinate My Care service so that they can retrieve and transfer the relevant items to the requesting Controller organisation via a secure email transfer. 3.5 Data Privacy Impact Assessment – please embed DPIA in box opposite for high risk processing. Does a residual risk remain? Describe DPIA’s are require to be published Acrobat Document No. Published on the CMC website. ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇.▇▇/joining-cmc/

Basis for sharing. 3.1 Legal basis for sharing the personal information Article 6 of the General Data Protection Regulation 2016/679 For the creation of a CMC care plan Article 6(1)(a) is the legal basis (consent, as defined in data protection legislation).  • An indication of consent provision by the person who has mental capacity to agree to having the support of a CMC care plan is required on the CMC care plan. (Where mental capacity to agree to having a plan is not available, the consent of the Lasting Power of Attorney for Health and Welfare where one exists or where not, the clinician’s decision in the best interests of the patient may be used.  • Any process by which consent is obtained, how the discussion and decision are undertaken, gained and otherwise noted is the responsibility of the individual controller organisations to design and manage. For viewing (processing) the record by services including urgent care services Article 6(1)(e) is the legal basis (performance of a public task). 3.2 Legal basis for sharing the information special categories of personal information i.e. health information For the creation of a CMC care plan Article 9(2)(a) is the legal basis (consent, as defined in data protection legislation). Article 9 of the General Data Protection Regulation 2016/679  • An indication of consent provision by the person who has mental capacity to agree to having the support of a CMC care plan is required on the CMC care plan. (Where mental capacity to agree to having a plan is not available, the consent of the Lasting Power of Attorney for Health and Welfare where one exists or where not, the clinician’s decision in the best interests of the patient may be used.  • Any process by which consent is obtained, how the discussion and decision are undertaken, gained and otherwise noted is the responsibility of the individual controller organisations to design and manage For viewing (processing) the record by services including urgent care services Article 9(2)(h) is the legal basis (performance of a public taskmedical purposes). 3.3 Legal Basis for sharing under the Common Law Duty of Confidence (see appendix) Implied consent. Health and Social Care Act requires health care providers to share information to enable direct care to take place. 3.4 If aggregated data for secondary uses, not direct care, consider whether any individuals may be identifiable from the information (and in conjunction with any other information available) If personal data, consider whether the information can be provided in an anonymised way. Data may be used for auditing and service evaluation purposes whereby information is accessed by legitimate organisations and services which the patient had previously utilised or is utilising currently. The end product of any audit (report or similar) and service evaluation (report or similar) will not contain patient identifiable data. Controller organisations wanting to access historical information that no longer is available on their view of the care plan due to update changes made on the care plan over time, can be provided with that information by the Coordinate My Care service on request. The controller identifies the persons of interest to them and will communicate this to the Coordinate My Care service so that they can retrieve and transfer the relevant items to the requesting Controller organisation via a secure email transfer. 3.5 Data Privacy Impact Assessment – please embed DPIA in box opposite for high risk processing. Does a residual risk remain? Describe DPIA’s are require to be published Acrobat Document CMC DPIS.pdf No. Published on the CMC website. ▇▇▇▇▇://▇▇▇.▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇▇.▇▇.▇▇/joining-cmc/