Corporate report

Privacy notice for doctor licensing to prescribe diamorphine to treat opioid dependence

Published 22 July 2022

Applies to England

Who we are

We are the Office for Health Improvement and Disparities (OHID), in the Department of Health and Social Care (DHSC). We collect information on alcohol and drug treatment, so we can make sure we are improving the lives of people affected by drug and alcohol misuse.

We are responsible for the information you share with us. We are the data controller, which means that we:

• have a responsibility to protect your privacy
• decide how to use the information you consent to share with us
• are responsible for keeping you informed about changes to how we collect or use your information

The Home Office is also a data controller for the data this privacy notice is about. They have published their own privacy notice at Drugs and firearms licensing: privacy information notices.

Why we collect your data

Doctors who prescribe diamorphine (pharmaceutical heroin) to people who are dependent on opioids, as part of their treatment for dependence must be licensed by the Home Office. This is a requirement of the Misuse of Drugs Act 1971.

OHID provides the Home Office with administrative support and clinical advice for this process, and so we keep a record of doctors’ licence applications, their processing and the outcome.

We need this information to make sure that only competent doctors can prescribe diamorphine for the treatment of opioid dependence, and that there is a record of doctors who are licensed.

Legally, the licence could also cover the prescribing of cocaine and dipipanone but the Home Office no longer issues licences for these.

What data we collect

Personal information

The personal information about you that we collect from your form includes:

• your name
• medical qualifications and grade or status
• number and date of full UK registration with the General Medical Council (GMC)
• telephone number and email
• issues you would like us to take into account to support your application
• if you are not a consultant, the name of the consultant psychiatrist who nominates you for a licence and will supervise your diamorphine prescribing

Information about the premises you will prescribe from

For each of the premises from which you will prescribe diamorphine, information we collect includes:

• the organisation’s name
• the organisation’s address
• the organisation’s telephone number
• whether you already hold an existing licence for that premises
• if you do, whether it has been used in the last year
• how many people you would expect to treat by prescribing diamorphine each week
• whether the premises are an inpatient or outpatient service

Information about the senior nominating officer

For the senior officer nominating your application, information we collect includes:

• their name
• their organisation
• their role or position in their organisation
• the date they signed your application
• their telephone number

General Medical Council information

From the GMC online register, we confirm or record your:

• name
• GMC registration number
• date of registration
• grade or status (for example, trainee or consultant)
• specialism
• responsible body for revalidation

Internal DHSC information

We also record internal information relating to your application for a licence, including:

• our clinical adviser’s advice on your application
• the progress of us considering your application, submitting it to the Home Office and their issuing of a licence

What we do with your data

Licence applicants (or their employers) send us a completed MD36 form. We check and supplement this with published information from the GMC doctor’s register.

We then send a copy of the form to the Home Office licensing unit with our clinical adviser’s advice on whether there is any reason not to issue a licence.

The legal basis for processing your data

Data protection legislation requires us to have a valid legal reason to process and use personal data about you. This is often called a ‘legal basis’.

UK General Data Protection Regulation (UK GDPR) requires us to be clear with you about the legal basis we rely on to process information about you. Under Article 6 of the UK GDPR, the legal bases we rely on for processing your information are that:

• we have a legal obligation as the Misuse of Drugs Act requires that doctors must be licensed to prescribe diamorphine for the treatment of opioid dependence
• it’s a necessary task in the controller’s official authority as we assess doctors’ applications for licences and advise the Home Office of our assessment so that the Home Office can issue a licence
• there are reasons of public interest in the area of public health (for example, to ensure high standards of quality and safety of care)
• it’s for archiving, scientific or historical research or statistical purposes

These legal bases only apply if we take suitable and specific measures to protect your rights, and we only use your information for the purposes we describe in the section above on what we do with your information.

Who we share your data with

We pass your form and our advice to the Home Office so that its licensing unit can issue a licence or, very rarely, so it can understand why we are advising against issuing a licence.

How long we keep your data

We keep your information in line with Home Office retention policies. This means we keep it for 25 years and then permanently delete your application form, unless you are still active as a prescriber and prescribing diamorphine.

How we protect your data and keep it secure

We use a range of technical, administrative, contractual, and physical controls to stop inappropriate access to your information. Access to all your data is strictly controlled.

OHID staff are trained to understand their duty to protect your information and handle it appropriately.

Your data will not be transferred outside of the UK.

Your rights as a data subject

By law, you have a number of rights and processing your data does not take away or reduce these rights, under the UK General Data Protection Regulation and the UK Data Protection Act 2018.

You have the right to:

• ask for and receive copies of information about you
• get information about you corrected if you think it’s inaccurate
• limit how your information is used – you can ask for it to be restricted, for example if you think it’s inaccurate
• object to your information being used
• get information deleted

Some of these rights might not apply when the data is being used for research. We will let you know if this is the case.

There are also some circumstances in which we cannot delete your data. For example, if:

• it has been anonymised and we cannot tell which data relates to you
• research analysis has already started
• we need to keep it for tasks that are in the public interest

We will let you know how we will be able to meet your request. If we cannot meet your request, we will explain why.

Comments or complaints

We will always try to respond to concerns or queries that you have about your data.

If you are unhappy about how your personal data is being used, or if you want to complain about how your data is used as part of this programme, you should email data_protection@dhsc.gov.uk or write to:

Data Protection Officer
1st Floor North
39 Victoria Street
London
SW1H 0EU

If you are still not satisfied, you can complain to the Information Commissioner’s Office (ICO). You can find out how to contact them at the ICO website. Their postal address is:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Changes to this policy

This privacy notice is kept under review and will be updated if necessary. All updated versions will be marked by a change note on this notice’s publication page.