Guidance

Sentinel Surveillance of Blood Borne Virus (SSBBV) testing: privacy notice

Published 13 June 2024

About UKHSA

The UK Health Security Agency (UKHSA) is responsible for planning, preventing and responding to external health threats and providing intellectual, scientific and operational leadership at national and local level, as well as internationally. UKHSA will ensure the nation can respond quickly and at greater scale to deal with pandemics and future threats.

We collect and use personal information to fulfil our remit from the government.

UKHSA’s responsibilities include monitoring testing uptake, positivity, cases and outbreaks of infectious diseases, such as bloodborne viruses (BBVs), to understand more about these diseases and help reduce the risk of infection.

This privacy notice covers UKHSA’s SSBBV testing, which began in 2002 and gathers information on individuals testing for the following BBVs from participating laboratories and community and outreach teams:

• hepatitis A to E
• HIV
• human T-lymphotropic virus type 1 (HTLV)

This supplements our wider routine surveillance of BBV testing, for example all doctors and laboratories in England are required to inform UKHSA of cases of viral hepatitis (A to E). Information on the testing carried out in participating centres is collected irrespective of test result and can therefore be used as a basis for estimating prevalence among those tested. This data has enhanced our knowledge and understanding of hepatitis testing, in terms of who is being tested and from which service types individuals are accessing testing and in interpreting trends in the number of positive individuals identified over time. This data, alongside their routine surveillance, helps inform local and national healthcare planning, gaps in the care pathway for those at risk of a BBV and helps reduce incidence and prevalence.

This privacy notice explains the personal information we collect on individuals as part of SSBBV testing, how we use it and who we may share it with.

UKHSA is an executive agency of the government, sponsored by the Department of Health and Social Care (DHSC). The DHSC is the data controller for the personal information we collect, store and use to fulfil our remit.

Further information about the personal information UKHSA collects and uses can be found in our general privacy notice.

The information we collect

We collect and use personal information as part of SSBBV testing as follows.

For individuals positive for a BBV, this includes:

• demographic information, such as but not limited to name, date of birth, sex, NHS number, ethnic group and postcode
• health information, such as but not limited to, results of diagnostic tests for BBVs, liver function and disease staging test results and related health conditions and risk factors

For individuals negative for a BBV, this includes:

• demographic information, such as soundex code of surname, initial, date of birth, sex, NHS number, ethnic group and postcode
• health information, such as results of diagnostic tests for BBV, liver function, and related health conditions and risk factors

A soundex code is a letter and 3 numbers that represent the surname using a phonetic index. One soundex code can represent multiple surnames and therefore creates a depersonalised code of the surname. You cannot identify a person’s surname from the soundex code.

How we collect the information

We obtain individuals’ personal information from:

• laboratories (both private and NHS laboratories who undertake BBV testing)
• community and outreach teams participating in the SSBBV testing (for example Hepatitis C Trust)
• the Find and Treat service

The purposes we use the information for

Information collected by SSBBV testing is used to enhance our understanding of BBVs. For instance, who is being tested and which service types individuals are accessing testing from.

This information supplements our routine surveillance of BBV testing, which is used by us to:

• identify trends and monitor the epidemiology of BBVs to help understand the risks and sources of infection so that interventions can be targeted to reduce the spread
• monitor testing uptake and positivity to inform resource allocation, evaluation of interventions and identify vulnerable populations who are disproportionately affected to inform control and prevention activities
• identify clusters and outbreaks of viral hepatitis to monitor and manage outbreaks
• monitor trends in disease outcome (such as severe liver disease, mortality, transplant) to inform disease prevention and control measures

The information we collect on BBVs is held by us and linked to data on the treatment and health outcomes of infected individuals. For example, we monitor over the long term for health conditions that are related to viral hepatitis, such as cirrhosis or liver cancer diagnoses, that may occur later in life.

The results of our analyses are used to produce reports that we provide to the NHS and health service commissioners. These reports aim to highlight differences in testing uptake, diagnosed positivity, treatment choices and the longer-term health outcomes of individuals with BBVs. This data is also used to support outbreak investigations. This information is used to help improve or change services to better suit the healthcare needs of individuals at risk of and/or who are infected with a BBV.

Who we share the information with

We may share the personal information we collect on BBVs, via SSBBV and routine surveillance, with clinicians who are providing individual care to affected individuals.

If we do share personal information, we will only do so where the law allows, and we only share the minimum amount of information that is necessary.

We may also share personal information with university and other researchers. We only do so with researchers who have approval from a medical ethics committee and have obtained either patient consent or special permission from the Secretary of State for Health and Social Care or the Health Research Authority’s Confidentiality Advisory Group.

You can opt out of us sharing your information with researchers if you choose. Further information and details on how to register your opt-out choice is available. UKHSA will ensure that no personal information about you will be shared with other researchers if you register a choice to opt out.

How we protect the information

The personal information we collect and use for BBV testing for SSBBV and routine surveillance, is protected by us in a range of ways.

It is stored on computer systems that are kept up-to-date and regularly tested to make sure they are secure and protected from viruses and hacking. Personal information can only be seen by our staff who have been specially trained to protect confidentiality. Strict controls are in place to make sure they can only see the information they need to do their job.

Whenever possible, we only use your information in a form that does not directly identify you. No information that could identify any individual will ever be published by us.

Where we share your personal information with other organisations (see ‘Who we share information with’), we only ever do so using secure computer systems or encrypted email.

Where we store the information

We store personal information on BBV testing in England and only in other countries, where necessary, if they are formally recognised by the UK government as providing legal protections over privacy at least equivalent to those that apply here in the UK, such as the countries of the European Economic Area (EEA).

How long we keep the information

We will only keep personal information for as long as we need it to protect public health or as otherwise required by law.

Hepatitis B, hepatitis D and hepatitis C are long-term conditions that can affect the health of infected people across their lifetime. For example, the average time between infection and some outcomes such as cirrhosis or liver cancer can be up to 30 or 40 years. So that we can monitor these longer-term health impacts and use this information to improve the services provided to prevent and treat hepatitis B and C, we keep the personal information of infected individuals for their lifetime.

Your rights over your information

Under data protection law, you have several rights over your personal information. You can find out more about these rights and how to exercise them in the UKHSA general privacy notice in the ‘Your rights over your information’ section.

Our legal basis to use the information

Our legal basis to use the personal information collected to monitor BBVs is provided by the following sections of the UK General Data Protection Regulation 2016 (UK GDPR) and the Data Protection Act 2018 (DPA):

• UK GDPR Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest’
• UK GDPR Article 9(2)(I) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health’
• DPA 2018 Schedule 1 Part 1(3) ‘public health’

Our duty of confidentiality

To fulfil our remit, we need to use confidential patient information without asking for individuals’ consent.

We have section 251 of the National Service Health Act 2006 approval from the Secretary of State for Health and Social Care to do this for the purposes of:

• diagnosing
• recognising trends
• controlling, preventing, monitoring and managing communicable diseases
• other risks to public health

This includes monitoring of acute and chronic viral hepatitis.

The part of the law that applies here is section 251 of the National Health Service Act 2006 and Regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.

How to find out more or raise a concern

If you would like to find out more about hepatitis surveillance at UKHSA, you can contact us at hepatitis@ukhsa.gov.uk

If you have any concerns about how UKHSA uses and protects your personal information, you can contact the DHSC’s Data Protection Officer at data_protection@dhsc.gov.uk or by writing to:

Office of the Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU

You also have the right to contact the Information Commissioner’s Office (ICO) if you have any concerns about how we use and protect personal information. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website or writing to the ICO at:

Customer Contact
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

About this privacy information

The personal information we collect and use on BBV testing may change so we may need to revise this notice. If we do, the publication date will change.