HSE Privacy Notice – patients and service users

The Health Service Executive (HSE) must comply with the Data Protection Acts 1988-2018 and the General Data Protection Regulations (GDPR).

We respect your right to privacy and to the protection of your personal information. The purpose of this privacy notice is to explain how we collect and use personal information for the provision of our services and the day to day running of the HSE.

To allow us to provide our services to you, we collect and process various categories of personal information.

Information we collect may include:

• Personal details about you, such as name, date of birth, PPS Number, address, next of kin, contact details (mobile phone number) etc.
• Information relating to your treatment and care; notes and reports about your health which assist our staff in providing care and treatment to you; results of investigations, such as x-rays and blood tests
• Relevant information from other health and social care professionals, other healthcare agencies and your carers and relatives
• Financial and health insurance information
• CCTV and security information

We may also process certain special categories of information, which may include racial or ethnic origin, religious or philosophical beliefs, the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person’s sex life or sexual orientation.

The collection and recording of the PPS Number is required to further enhance the safe and accurate verification of your identity and to associate you with your healthcare records.

The HSE’s lawful basis for processing personal data of service users is as follows:

1. The processing is necessary in order to protect the vital interests of the person (referred to as the data subject in data protection language) as per Article 6(1)(d) of the GDPR. This would apply in emergency situations such as in the Emergency Department when unconscious, sharing information with other emergency services for rescue or relocation in storms etc.
2. The processing is necessary for a task carried out in the public interest or in the exercise of official authority vested in the controller as per Article 6(1)(e) of the GDPR; for the HSE this official authority is vested in us through the Health Act 2004 (as amended).

Special categories of data are defined by the GDPR and include things like racial or ethnic origin, religious or philosophical beliefs, genetic data, biometric data, health data, sex life details and sexual orientation. The processing of special categories of personal data is permitted in circumstances as set out in Article 9 of the GDPR.

We will only process special categories of personal data where it is necessary:

• for the purposes of preventative or occupational medicine,
• for medical diagnosis,
• for the provision of healthcare, treatment or social care,
• for the management of health or social care systems and services, or pursuant to a contract with a health professional

Processing is lawful where it is undertaken by or under the responsibility of

• a health practitioner, or
• a person who in the circumstances owes a duty of confidentiality to the data subject that is equivalent to that which would exist if that person were a health practitioner. For example the outpatient clinic secretary, Emergency Department Receptionist, Primary Care Centre staff etc.

If the purpose of the processing is for a reason other than the reasons outlined above, we will seek explicit consent to process your sensitive personal data (referred to as ‘special categories’ of data under the GDPR).

We may obtain your information from a variety of sources, including information you give to us. During your treatment and care within the HSE, health specific data will be collected by the doctors, nurses and other healthcare professionals taking care of you and will be held in your patient/client chart (this can be paper and/or electronic).

We may also receive your personal information from third parties, for example your GP, dentist, social worker, or pharmacist. There may also be times when information is collected from your relatives or next of kin e.g. if you are taken to an Emergency Department (A&E) of one of our hospitals but you are very unwell and unable to communicate.

You have certain legal rights concerning your information and the manner in which we process it. This includes:

• a right to get access to your personal information;
• a right to request us to correct inaccurate information, or update incomplete information;
• a right to request that we restrict the processing of your information in certain circumstances;
• a right to request the deletion of personal information excluding medical records
• a right to receive the personal information you provided to us in a portable format;
• a right to object to us processing your personal information in certain circumstances; and
• a right to lodge a complaint with the Data Protection Commission (DPC). Contact details for the DPC are available at DataProtection.ie

Some of these rights only apply in certain circumstances and so are not guaranteed or absolute rights. Please contact your local Deputy Data Protection Office if you have any queries or concerns about your rights.

You can access your records by making a subject access request (SAR) and forms are available for this purpose on the HSE website.

It is also sufficient to write to the hospital, unit or service in question. It is important that you provide satisfactory evidence of identification and a sufficient description of the information that you are looking for.

The data controller in most instances is the HSE. However, when services are provided directly by private hospitals, voluntary hospitals, agencies or private contractors, the private hospital, voluntary hospital, agency or private contractor may be the data controller.

We use your information to manage and deliver your care and treatment to ensure that the treatment is safe and effective, that the right decisions are made about your care and so that we can co-ordinate with other organisations that may be involved in your care.

Your information may be used to:

• Accurately verify your identity and to associate you with your healthcare records.
• Review the care and treatment provided to ensure it is of the highest standard possible and to evaluate and improve the safety of our services. This can be carried out by multiple quality improvement methods e.g. accreditation, audits, clinical audit, patient experience and satisfaction surveys.
• Investigate complaints, legal claims and adverse incidents.
• Plan the future demand in the health services e.g. analysing peak attendance times, staffing levels and average length of stay; establishing the projected demand by disease/condition.
• Preparing statistics on hospital performance and monitoring how we spend public money
• Protect the wider public interests e.g. Influenza, winter vomiting bug, COVID-19.
• Provide training and development to health professionals.
• Invoicing, billing and account management.
• Remind you of appointments by text.
• To identify patients/service users that might be suitable for clinical trials/research.

Note: Any participation in a trial or research study will require your consent.

The HSE provides statistical information to other organisations such as the Department of Health, universities and other research institutions.

The HSE will make sure that you cannot be identified by anonymising the information. If it is not possible to anonymise the information, you will be contacted for your consent.

The HSE uses camera surveillance systems (commonly referred to as CCTV) throughout its facilities for the purpose of maintaining the safety and security of its staff, service users, patients, visitors and members of the public. The HSE is aware that footage or images containing identifiable individuals captured by CCTV systems are personal data for the purposes of data protection law.

The HSE’s CCTV systems may, but will not always, collect and store personal information.

The HSE will comply with the GDPR and this privacy notice in respect of any personal information collected via its CCTV systems.

Within the HSE, the clinical information collected by a doctor or other healthcare professional or staff member authorised to process your data is not passed on to others within the HSE, unless it is considered necessary for your health or social care needs or for one of the other reasons set out above (where possible, the personal information is anonymised or pseudonymised).

You may also be receiving health or social care from providers outside of the HSE, i.e. private or voluntary hospitals, specialists etc.

In order to assist in this process, we may make referrals on your behalf requiring the need to share your personal information with those providers. We will only do so if there is a genuine need in order to ensure the highest quality of care is provided to you.

We are careful only to share the information that is necessary for this purpose. Anyone who receives this information is also bound by confidentiality and the data protection laws. The current list of those with whom personal data is shared may be found on the HSE website.

In certain situations, we may have to disclose your personal information to other agencies, in accordance with legal requirements, i.e. Dept. of Social Welfare, Department of Health, the Courts etc., or in an emergency situation to prevent injury to you or to other persons.

We may transfer your information to organisations in other countries which is necessary to provide you with health and social care services, on the basis that anyone to whom we pass it protects it in the same way we would and in accordance with applicable laws. For more information about overseas transfers, please contact us using the contact information provided above.

We are committed to ensuring that your information is secure with us and with the third parties who act on our behalf. We have a number of security precautions in place to prevent the loss, misuse or alteration of your information.

All staff working for the HSE have a duty to keep information about you confidential. The HSE has strict information security policies and procedures in place to ensure that information about you is safe, whether it is held in paper or electronic format.

We will only retain information for as long as necessary. Records are maintained in line with the recommendations of the HSE retention policy.

Please contact our Data Protection Office:

• If you have any queries in relation to Data Protection or other issues around the security of your personal information
• For more information about the steps we are taking to protect your information
• For more information about your rights, including the circumstances in which you can exercise them and how to exercise them,
• If you wish to raise a complaint on how we have handled your personal information, you can contact our Data Protection Officer who will investigate the matter. We hope that we can address any concerns you may have.

National Data Protection Officer

Email: dpo@hse.ie

Deputy Data Protection Officer West, (excluding voluntary agencies)

Consumer Affairs,
Merlin Park University Hospital,
Galway.

• CHO 1 – Cavan, Donegal, Leitrim, Monaghan, Sligo
• Community Healthcare West – Galway, Mayo, Roscommon
• Mid-West Community Healthcare – Clare, Limerick, North Tipperary.
• Saolta Hospital Group

Email: ddpo.west@hse.ie

Phone: 091 775 373

Deputy Data Protection Officer Dublin North-East (excluding voluntary hospitals and agencies)

Consumer Affairs, HSE Dublin North East,
Bective St., Kells,
Co Meath.

• Midlands, Louth, Meath Community Health Organisation
• Community Health Organisation Dublin North City and County
• CHO 6 – Dublin South East, Dublin South and Wicklow
• RCSI Hospital Group
• National Children’s Hospital

Email: ddpo.dne@hse.ie
Phone: Kells Office: 046 9251 265
Cavan Office: 049 4377 343

Deputy Data Protection Officer Dublin midLeinster (excluding voluntary hospitals and agencies)

Consumer Affairs, HSE, Third Floor Scott Building, Midland Regional Hospital Campus,
Arden Road,
Tullamore,
Co. Offaly.

• Dublin Midlands Hospital Group
• Ireland East Hospital Group
• Community Healthcare Dublin South, Kildare and West Wicklow

Email: ddpo.dml@hse.ie
Phone: Tullamore Office: 057 935 7876
Naas Office: 045 920 105

Deputy Data Protection Officer South (excluding voluntary hospitals and agencies)

Consumer Affairs, HSE South, Ground Floor East, Model Business Park,
Model Farm Road,
Cork.
T12 HT02

• Cork & Kerry Community Healthcare
• CHO 5 – Carlow, Kilkenny, South Tipperary, Waterford and Wexford
• UL Hospital Group
• South South-West Hospital Group

Email: ddpo.south@hse.ie
Phone: Cork Office: 021 4928 538
Kilkenny Office: 056 778 5598.

Title: HSE Privacy Notice – Patients & Service

Version: 1.5

Author: Mary Deasy

Publication Date: December 2024

Last review Date: December 2026

Version 1.1

Owner: HSE

Author: Joe Ryan

Published: June 2019

Version 1.2

Owner: HSE

Author: Jim O’Sullivan

Published: February 2020

Version 1.3

Owner: HSE

Author: Mary Deasy

Published: June 2023

Version 1.4

Owner: HSE

Author: Mary Deasy

Published: February 2024

Version 1.5

Owner: HSE

Author: Mary Deasy

Published: December 2024