Person-identifiable information Sample Clauses

Person-identifiable information. This is information that contains the means to identify a person, e.g. name, address, postcode, date of birth, NHS number, etc.4

Person-identifiable information. The main thread running through the Caldicott Principles is that person-identifiable information is only transferred for justified purposes and that only the minimum necessary information is transferred in each case. A practical action in support of this is to test information flows against the principles and to see whether action to minimise risks of breach of confidentiality is necessary. Key items of information which could be used to establish a person’s identity are: ▪ Name ▪ Address ▪ Postcode ▪ Date of birth ▪ Other Dates (i.e. death, diagnosis) ▪ Sex ▪ Ethnic group ▪ NHS number ▪ Local Identifier (i.e. hospital or GP Practice Number, personal reference number (Social Services) or unique pupil number (Education Department) ▪ Diagnosis/treatment ▪ Occupation ▪ National Insurance Number Other items of information may, in exceptional circumstances, be combined to identify an individual, but for most routine purposes these are the items which needed to be safeguarded. However, items of information fall within a spectrum of identifiability based on the nature of the item and the context. Name and address are very strong identifiers, particularly when both are available, and the presence of either in data set should be thoroughly justified when the business function is not the direct provision or administration of the Supporting People programme. The other items of information are individually not capable of identifying a specific person in all but the most exceptional circumstances, but when combined with other items of information the likelihood may increase significantly. A test of reasonableness should be imposed when considering whether access to particular items of information is likely to result in an individual’s identity becoming apparent. Staff should not without the authorisation of the organisational guardian have access to information which relates to a living individual: - who can be identified from that information ( or from that and any other information in his possession) by any means likely to be available to them: or - whom the staff are likely to identify from information likely to be provided to them by any other person. Appendix 2 Application of key legislation and common law to information covered by this protocol Any disclosure of personal data must have regard to both statute and common law. In addition, guidance such as the Caldicott Principles for the protection of patient- identifiable information must be followed. There is no ...