Privacy Notice & Data Flows

Privacy Flow Diagram

Background

The national Perinatal Mortality Review Tool (PMRT) is a bespoke, web-based, tool designed to support local Trusts and Health Boards across the UK, to carry out systematic, standardised, high quality, multidisciplinary reviews of the care provided to mothers and babies when the baby has died during pregnancy, birth or soon after birth (known as a perinatal death).

The aims are to:

• Help local Trusts/Health Boards to provide high quality information to parents whose baby has died about what happened with their care and why their baby died (accepting that even with a full investigation it isn't always possible to identify why every baby dies),
• To understand whether different care may have resulted in a different outcome and if there are any implications for any future pregnancies the parents may be planning
• To support learning by the staff in Trusts/Health Boards, to enable service quality improvements to be put in place to prevent future deaths and improve care for all mothers and babies.

In the course of carrying out a review, the identifiable personal information about the mothers and babies whose care is reviewed is entered into the PMRT. The PMRT system is integrated with the MBRRACE-UK system, which is used to conduct surveillance of perinatal deaths. All this information is held on data systems run by the MBRRACE-UK/PMRT teams at the University of Oxford. (www.npeu.ox.ac.uk/mbrrace-uk)

Data controllers and data processors

Under the UK General Data Protection Regulation the 'data controller' is responsible for what happens to data which is collected. The 'data controller' for the PMRT programme is the Department of Health and Social Care (DHSC) who fund and direct the programme. The PMRT team is the 'data processor' under the direction of the DHSC.

The Department of Health and Social Care (DHSC) commissions the PMRT work for NHS England, NHS Wales, and on behalf of the Health and Social Care Division of the Scottish government, and the Department of Health, Social Services and Public Safety, Northern Ireland (DHSSPS), the States of Jersey, Guernsey, and the Isle of Man.

The PMRT collaboration conducts the PMRT work and is linked to the MBRRACE-UK collaboration. The PMRT collaboration is led from the National Perinatal Epidemiology Unit (NPEU) in the Nuffield Department of Population Health at the University of Oxford and is commissioned by DHSC to development, maintain and run the PMRT.

The data controller for the MBRRACE-UK perinatal mortality surveillance is the Healthcare Quality Improvement Partnership (HQIP) on behalf of NHS England who are the commissioners. (www.npeu.ox.ac.uk/mbrrace-uk/privacy-notice)

Personal data collected about individual mothers and babies during the conduct of a local review of care using the PMRT

The purpose of the Perinatal Mortality Review Tool (PMRT) is to help Trusts and Health Boards to carry out local reviews of the care provided when a perinatal death has occurred. The PMRT is not primarily a data collection tool, but since staff need information to carry out the review process, information about individuals is collected and used within the tool for reviews.

Staff who conduct the reviews need to have the identifying details of the mothers and babies whose care they are reviewing and so this information is included in the PMRT. It is also used in the report of the review which is generated by staff in Trusts/Health Boards to discuss with parents and file in their medical record. Personal identifying information is therefore held on the MBRRACE-UK/PMRT system.

The identifying information includes, for example, name, address, and NHS number of mothers and babies. Within Trusts/Health Boards the information is only available to authorised users of the PMRT system. At the NPEU this information is kept securely and is only available to specified individuals in the MBRRACE-UK/PMRT team on a 'need to know' basis to run the system.

How the PMRT uses the information relating to bereaved mothers and their babies

The PMRT team based in Oxford have access to the PMRT in order to do the following:

• Maintain, develop and improve the PMRT tool for use by clinical staff in Trusts/Health Boards; this involves maintaining the information that is entered into the tool to support the reviews conducted by clinical staff;
• To provide support to clinical staff using the tool in the event they have difficulty opening and closing reviews, and downloading final reports;
• To download and encrypt copies of the information held in the tool when mothers make a data subject access request to access her and her baby's information;
• To download, on an annual basis, an anonymised copy of the information held in the tool for the analysis needed for the national annual report;
• To support the verification process, using anonymised information, for the NHS Resolution Maternity Incentive Scheme (England only).

Permission to process the information about you

We do not seek the specific consent of mothers/parents to enable us to process the information in the PMRT. Conducting a review when there has been a death is a required part of usual clinical care and will be carried out by Trusts and Health Board without specific maternal/parental consent. The PMRT is designed to support that process.

We sought the advice of Third Sector organisations and charities who support bereaved parents who were of the view that seeking specific consent of mothers for the PMRT to be used to conduct the review would be burdensome for parents at a time when they have just experienced a bereavement, which in many cases, will be unexpected. We therefore sought appropriate permissions for the operations of the PMRT without specific maternal/parental consent. In England and Wales, this is l from the Confidentiality Advisory Group (CAG) at the Health Research Authority. In Scotland this is l from the NHS Scotland Public Benefit and Privacy Panel for Health and Social Care (HSC-PBPP). The PMRT in Northern Ireland is used by clinical staff only with maternal consent.

Mothers/parents can choose not to have a review by their Trust/Health Board using the PMRT – so called 'opting out'. It is their right to 'opt-out'. If the review has been started before mothers/parents opt out, then the processing of the information will stop at that stage. This does not affect the lawfulness of the processing carried out before the 'opt out' was initiated.

We will only use the PMRT data for the purposes for which it was collected (see aims and uses above), unless we reasonably consider that we need to use it for another related reason and that reason is compatible with the original purpose. If we need to use the PMRT data for a new unrelated purpose, we will seek the appropriate approvals before doing so.

Who has access to your data?

Only those members of the PMRT team at the University of Oxford who are involved in this work have access to the PMRT information in Oxford. The other organisations who have access to the identifiable information are (i) the Trusts/Health Boards who use the PMRT and they are only able to access information relating to the mothers and babies for whom they have provided care; (ii) the Azure company who provide the cloud-based secure, data encrypted IT system where the PMRT data are stored securely.

Retaining the PMRT data

We will retain the PMRT data for as long as it is needed to meet the PMRT purposes. In practice, this means that we will retain the PMRT data for the duration of the contract with DHSC to provide the PMRT, which at present is until the 31st March 2026. We retain the data to ensure that Trusts/Health Boards are still able to access all the reviews that they have conducted. This enables them to download summary reports and to re-review a death should the need arise. It also enables mothers/parents to make a data subject access request regardless of when their baby died and the review was conducted. Some of these requests are made many months or sometimes years after the deaths and review.

At the end of the current contract one of several things mat happen. First, the PMRT at the University of Oxford may be re-contracted to continue the PMRT work in which case we will continue to retain the data. Second, another organisation may be contracted to carry out the work. In this case, the data controller (DHSC) will arrange for the information to be transferred to the new organisation who will become the new data processors. Third, the PMRT work will cease in which case, under the advice of the data controller, the data will be transferred to the Trusts/Health Boards and then securely deleted from the PMRT systems.

Data security

The PMRT data are held securely in accordance with the University's policies and procedures. We have a specific security policy for PMRT which aligns with the University policies and procedures. Further information is available on the University's Information Security website. [www.infosec.ox.ac.uk/guidance-policy]. Azure data security policies are in line with the University policies and they meet the government standard of Cyber Security Essentials Plus Certification.

In accordance with our policies, we ensure that we protect personal identifiable data against unauthorised access, unlawful use, accidental loss, corruption or destruction. To do this we use 'technical measures' such as encryption, passwords and multi-factor authentication to protect the PMRT system and database. We also use 'operational measures' to protect the data, for example, by limiting the number of people who have access to the database in which the identifiable data is held to only essential staff. We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice.

Where we store and process the PMRT data

We store and process the electronic PMRT information on the UK Microsoft Azure Cloud platform. We do not store information in paper form. The electronic information is stored only within the UK and is not transferred outside the UK.

Complaints

The individuals whose data we hold have the right to complain. If you are one of those individuals and you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer, data.protection@admin.ox.ac.uk who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful, you can complain to the Information Commissioner's Office (ICO).

Contact us

If you have any questions or wish to raise any queries or concerns about our use of your information with us directly, please contact Emeritus Professor Jenny Kurinczuk, PMRT National Programme Lead: jenny.kurinczuk@npeu.ox.ac.uk