Guidance

Hepatitis C National Register privacy information

Updated 22 May 2024

About the Hepatitis C (HCV) National Register

The HCV National Register has been set up to help understand more about HCV. It collects information about patients across the whole of the UK who have been diagnosed with HCV and for whom the date when they were infected is known. The Register also collects information about people who have not been diagnosed with HCV, but who may have been exposed to the virus at some point.

This privacy notice explains what personal information is held in the HCV National Register. It also explains what this information is used for, how it is protected, how long it is kept, who it may be shared with, what your rights are, and how you can find out more.

Data Controller for the HCV National Register

Public Health England (PHE) exists to protect and improve the nation’s health and wellbeing, and to reduce health inequalities. It is an executive agency of the Government, sponsored by the Department of Health and Social Care (DHSC). Further information is available about Public Health England and what it does.

PHE’s responsibilities include collecting and using information on communicable diseases, such as HCV, to try to help prevent the spread of infection and improve the treatment and care of those affected.

PHE is the data controller for the HCV National Register and is responsible for its operation and management. We are listed under the DHSC registration with the Information Commissioner’s Office (ICO).

The information we collect and how it is used

We collect information on patients enrolled in the Register. These patients have been identified in the following ways:

• patients identified during the National HCV Lookback programme who had been exposed to blood that was potentially infected with HCV before the introduction of routine HCV testing of the blood supply in the UK
• patients who donate blood and test positive for HCV and who have a previous negative HCV test within the previous 4-year period
• patients who acquired their HCV infections in childhood or adolescence

We will collect the following information about you:

• surname and initials
• date of birth
• NHS number
• medical information, including details of any treatments, blood tests and investigations you may have had for your HCV management
• other information, including cancer diagnoses and information from death registrations

When you first enrol into the HCV National Register, PHE securely share your NHS number, initials and date of birth with the relevant statutory UK agencies listed below to enable PHE to be notified of your current GP and any cancer or death events. We collect this information from the following places:

• NHS Digital – NHS Digital provides information and technology services to the health and care system. It notifies PHE if a patient living in England and Wales who is enrolled in the HCV National Register has been diagnosed with cancer or has died
• National Cancer Registry for Wales – The Welsh Cancer Registry provides information to PHE if a patient living in Wales, who is enrolled in the HCV National Register, has been diagnosed with cancer
• The General Register Office for Northern Ireland – The General Register Office provides information to PHE if a patient living in Northern Ireland, who is enrolled in the HCV National Register, has died
• NHS Central Register for Scotland – The Central Register provides information to PHE if a patient living in Scotland, who is enrolled in the HCV National Register, has been diagnosed with cancer or has died

If available, we also collect spare blood and liver biopsy samples from the hospital treating you for HCV, and record information from our analyses of these samples in the HCV National Register:

• spare blood samples. Any samples of your blood that have already been taken by your doctor and are left over are used by us to help find out whether different strains of the HCV virus (genotypes) cause different types of disease
• spare liver biopsy sections. Any spare sections from liver biopsies that you may have already had and are left over are used by us to assess damage to the liver caused by HCV

The purposes we use your information for

We can learn more about HCV by looking at medical information about patients with the infection. The more information on patients’ health and medical history we can review over time, the more we can learn about the clinical course and long-term outcome of HCV infection. This information will help us to understand how HCV-related liver disease develops, including the effects and response to treatment.

For example, the Register will enable us to find out which groups of patients with HCV are at greatest risk of developing liver disease and also to compare the death rates among patients who acquired their HCV infection via a blood transfusion with others who received a transfusion but were not infected with HCV. Information on the progression of disease is used to inform mathematical models that help us to predict the current and future burden of HCV-related disease on health care services. These models are used to inform strategies that will help us to meet our World Health Organization goals to eliminate HCV as a major public health threat by 2030.

Being included in the Register will help us to help other people. Results from our analysis will help doctors provide better information to patients about the infections they have and how best to prevent and manage them.

Who your information is shared with

University and other researchers can apply to PHE to access information held in the HCV National Register. All applications are first reviewed by the HCV National Register Steering Group to ensure that the information will only be used to help improve our understanding of how to better prevent and treat HCV.

If an application from a researcher is approved, they will only be provided with information that cannot be used to identify you. For example, we always remove information such as your initials and replace your date of birth with age in years.

We also share information from the HCV National Register with the Infected Blood Inquiry (IBI). The IBI is an independent public statutory inquiry established to examine the circumstances in which men, women and children treated by the UK health service were given infected blood and infected blood products, in particular since 1970. Further information is available on the IBI website.

How your information is protected

Your personal information held in the HCV National Register is protected in several ways. The Register is held on computer systems that have been tested to make sure they are secure, and which are kept up-to-date to protect them from viruses and hacking.

Your information can only be seen by staff working on the HCV National Register who have been specially trained to protect your privacy. All personal information used by the HCV National Register is held in the UK only.

No information that could identify you will ever be published by us, for example, dates of birth are replaced by age in years. This helps protect patient confidentiality.

Some data are minimised, for example, patient names and addresses are not held in the Register, we only hold patient initials and surnames are replaced with a code once they are recorded in the Register.

How long we keep your information

Because the HCV National Register is being used to monitor the long-term outcome of patients with HCV infection, we need to keep all the information recorded in the Register until 2026. This is so we can analyse the data to compare outcomes, including cause of death, between patients with HCV infection and those without the infection.

As we understand more about impact of HCV on people’s health and wellbeing over time, we may need to keep the personal information recorded in the Register for longer. If this is the case, we will update this privacy notice to explain how long we intend to keep the information and the reasons why.

Your rights over your information

Under data protection law, you have a number of rights over your personal information. Not all of these rights are automatic.

You have the right to:

• ask for a copy of any information we hold about you
• ask for any information we hold about you that you think is inaccurate to be changed
• ask us to restrict our use of your information, for example, where you think the information we are using is inaccurate
• object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case
• delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case
• ask us not to use your information to make automated decisions about you without the involvement of one of our staff

You can exercise any of these rights by contacting Public Health England at:

Public Information Access Office
Public Health England
Wellington House
133-155 Waterloo Road
London SE1 8UG

Email: FOI@phe.gov.uk

You will be asked to provide proof of your identity so that we can be sure we only use your personal information to respond to your request.

Our legal basis to use your information

The law on protecting personal information, known as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, allows us to use the personal information collected and held in the HCV National Register.

The sections of the GDPR and the Data Protection Act that apply where we use personal information to are:

• GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of healthcare

Separately, we have special permission from the Secretary of State for Health and Social Care to use confidential patient information without people’s consent for the purposes of diagnosing, recognising trends, controlling and preventing, and monitoring and managing communicable diseases and other risks to public health, such as HCV. The part of the law that applies here is section 251 of the National Health Service Act 2006 and regulation 3 of the associated Health Service (Control of Patient Information) Regulations 2002.

How to find out more or raise a concern

Further information is available about the HCV National Register, including copies of the registration and follow up forms used to collect medical information.

If you have any concerns about how your personal information is used and protected by the HCV National Register, you can contact our Data Protection Officer at dataprotectionofficer@phe.gov.uk.

You also have the right to contact the Information Commissioner’s Office if you have any concerns about how we use and protect your personal information. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website or writing to the ICO at:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

About this privacy notice

The personal information we collect and use in the HCV National Register may change so we may need to make revisions to this notice. If we do, the date and version number provided below will change.

Version: 01.00 Published: March, 2021