The Manchester Self-Harm Project / Data security and privacy

Data security and privacy

We make every effort to ensure our standards are high in handling personal data in our work. This privacy notice explains how we use the personal information we collect, and the rights that you have if you think that we hold information about you as a data subject.

 National data opt-out

The national data opt-out is a service that allows patients to stop their confidential patient information being used for any reason other than direct care. However, there are some cases where confidential patient information is needed to help develop new treatments and make recommendations that will improve the care and safety of patients overall. In these cases the work undertaken is considered to be in the public interest, and as long as the data is held securely and no individual data is ever shared, the collection of confidential patient information is allowed to continue.

The Manchester Self-Harm Project collects information on people who self-harm and go to hospital Accident and Emergency departments in Manchester. This information is used to improve care and safety for people who self-harm and people who may be at risk of suicide. Our project has been fully reviewed by the Confidentiality Advisory Group of the Health Research Authority, and they have recommended that our project be exempt from applying national data opt-outs. This means that even when someone has requested that their data not be used for anything other than their own care their data will still be included in our work on self-harm.
We take the security of your data very seriously and follow strict security protocols. Only trained staff working directly on the Manchester Self-Harm Project can access your data, and we never share individual information. All our publications, reports, and recommendations will only ever present completely anonymous grouped data, and we always ensure than no individual can be identified.

Please click on the tab below to read the full lay summary produced in collaboration with service users and carers from the MS4MH-R group:

National data opt-out - Lay Summary

Please note: Only staff working directly on the Manchester Self-Harm Project will have access to your data. Your identifiable patient information will be held securely and will NEVER be shared with anyone for any reason. The inclusion of your data in this work will help us to make accurate recommendations and improve care and safety for people who self-harm. Service users were involved in the creation of this summary.

The Manchester Self-Harm Project has been recommended an exemption from applying national data opt-outs to the data we collect. This is because our work is important for improving the care and safety of people who self-harm and people who may be at risk of suicide. For example, from our data we can advise health services and policy makers on who might be at highest risk of self-harm, whether self-harm has increased or decreased over time, and what treatments and care options are the most effective for people who self-harm.

To continue helping to improving care and safety for people who self-harm it is vital that we collect accurate information on all people who attend Manchester A&E departments after self-harm. Losing information on people who have chosen to opt-out of sharing their data could have a large impact on the conclusions we draw from analysing the information and have a negative impact on patient care. NHS research has suggested that some groups of people are more likely to choose to opt-out of sharing their data, such as homeless people, those from ethnic minority groups, or people from the LGBT community. If they were excluded from our data collection, it may incorrectly look like self-harm is not common among these groups when, in fact, they might be at high risk.

Because of the importance of our work, and the need to collect accurate information, we have been recommended an exemption from the national data opt-out by the Confidentiality Advisory Group at the Health Research Authority. This is an independent body who provide expert advice on the use of confidential patient information. The Confidentiality Advisory Group conducted a review of the project and decided it is in the interest of patients and the public for the Manchester Self-Harm Project to continue to collect patient data even when someone has opted out of sharing their health records.

The Manchester Self-Harm Project takes the security and confidentiality of your data very seriously. We only collect the information we need to carry out our work successfully and try to limit the amount of identifiable information we collect (you can see further details on what information we collect under the section titled ‘Information we collect’ on the main data security and privacy page). We follow very strict security protocols, and all staff are trained on data security and management. All electronic records are secured on an encrypted server that is not connected to the internet. Any movement of identifiable information takes place only on the encrypted NHS email system, or locally via encrypted and password protected USB memory sticks. We would like to reassure you that we would never share your health information with anyone outside of the Project, for any reason. We only ever use completely anonymous grouped data in our papers and reports to ensure that no individual can be identified. The will be no record of your data being collected by the Project team on your health records, and there will be no impact on your direct care or treatment from your information being included in our work.

Although we have been recommended an exemption from national data opt-out, if you think we might hold data on you, you can still request that we remove your individual information from our project by contacting us directly. Please see the information in the ‘How to request removal of your data’ tab below.

Information we collect

The Manchester Self-Harm Project collects data on everyone who presents to an emergency department in the City of Manchester following self-harm. We collect basic information on time, date, method of self-harm, as well as age and gender. For some people who are assessed by psychiatric liaison staff we also collect details on what might have led to the self-harm, past or current psychiatric care, as well as where people were referred to from the emergency department for follow-up care. These data make it possible for us to monitor self-harm rates in Manchester over time, and to investigate different aspects of self-harm behaviour and outcomes, such as repetition of self-harm, which help to improve patient care.

As part of our work we look at mortality in people who self-harm and present to hospital in Manchester. To do this we securely submit some of the identifiable personal data we collect to information services at NHS Digital, such as name and/or postcode. This makes it possible for our data to be linked to Civil Registration data, which can tell us whether people are still alive, if and/or how they have died, or if they have lost contact with the NHS – for example by leaving the country. With this information we can look at risk of suicide after a presentation to hospital for self-harm, and look at any changes in risk over time.

The Manchester Self-Harm project is also one of three self-harm monitoring projects that make up the collaborative Multicentre Study of Self-harm in England (along with studies based at the University of Oxford and Derbyshire Healthcare NHS Foundation), a limited amount of data is sent to the Multicentre Study Coordinator who is based in Oxford. The Study Coordinator merges the site-specific data into a single database that includes information on self-harm and mortality follow-up, and then securely sends a copy of the full database back to us. We do share date of death and cause of death if we have received this information from NHS Digital, but we do not share any names, addresses, date of birth, NHS number, or any other identifiable personal data of anyone we collect data on in Manchester. Instead we use local study codes in the combined Multicentre Study database to link together data on each person so we know if someone has presented to hospital for self-harm on multiple occasions. Once a copy of the Multicentre Study database has been received, that copy belongs to The Manchester Self-Harm Project, and the data controller is therefore the University of Manchester.

How we use collected information

The Manchester Self-Harm Project produces a number of outputs based on analysis of the information we collect. We publish local reports on self-harm in Manchester which includes detailed analysis of who attends hospital for self-harm, self-harm methods, timings, and how common self-harm is in different groups (e.g. age groups, gender, people with a history of psychiatric care), as well as trends over time. We also produce infographics that provide clear and concise messages about self-harm in Manchester, including infographics relating to specific subgroups (e.g. children and young people). We also publish papers in peer reviewed scientific journals using Manchester-only data as well as leading on various collaborative papers as part of the Multicentre Study of Self-harm in England. We only publish aggregate figures, and we follow ONS guidance about small numbers (i.e. we do not publish low counts), and we do not share information about any individuals in our outputs. There are various retention periods for the information we collect, based on the specific requirements of the data providers and our overall Section 251 approval. Once a data destruction date is reached personal data are securely destroyed.

 

Data security information

Data controller and security measures

Processing of data held by The Manchester Self-Harm Project is lawful under Article 6(1)(e) of the General Data Protection Regulation (2016) for ‘task in the public interest,’ and Article 9(2)(i) for ‘processing special category personal data, concerning health.’ We also comply with the Data Protection Act (2018), and NHS information governance procedures to ensure that any personal information we hold remains confidential and safe at all times. In order to carry out our work we have the following approvals in place:

Section 251 approval; this allows us to hold identifiable and patient sensitive data.

Data Sharing Agreements; these are agreements of principals for the release of sensitive data.

A 100% assessment on the Information Governance Toolkit; this is an online assessment against NHS information governance policies and standards.

The Manchester Self-Harm Project and its data are based at The University of Manchester, which was established by Royal Charter. As host organisation The University of Manchester is the data controller for the Manchester Self-Harm Project. If you have any questions about how your personal information is used you can contact the data protection officer by email at dataprotection@manchester.ac.uk, or by writing to:

The Data Protection Officer
Information Governance Office
Christie Building
University of Manchester
Oxford Road
Manchester M13 9P

Accessing your individual data

If you believe that The Manchester Self-Harm Project holds personal information about you, you have a right to ask for a copy of that information. This is commonly known as a Subject Access Request. A request for information from health records has to be made with the organisation that holds your health records. For hospital health records, please contact the records manager or patient services manager at the relevant NHS hospital or mental health trust. You can find a list of NHS trusts on the NHS Choices website. If you would like to receive a copy of other information we hold about you, your request should be made in writing (or email) to The Manchester Self-Harm Project.

Email: MASH@manchester.ac.uk

Address: The Manchester Self-Harm Project, Room 2.316 Jean McFarlane Building, The University of Manchester, Oxford Road, Manchester, M13 9PL.

Please include the words ‘Subject Access Request’ at the beginning of your letter or in the subject line of your email. When making your request, please include the following details: your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

Correction request

You have the right to request that any personal information about you that is inaccurate be corrected. If you would like to request that personal data that we hold about you be corrected, your request should be made in writing (or email) to The Manchester Self-Harm Project (addresses provided above).

Please include the words ‘Correction of information’ at the beginning of your letter or in the subject line of your email. When making your request, please include the following details: your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

How to request removal of your data

You have the right to opt out of having your personal data processed by The Manchester Self-Harm Project for tasks in the public interest. If you would like to request having your data removed from the project, your request should be made in writing (or email) to The Manchester Self-Harm Project.

By email to: MASH@manchester.ac.uk

In writing to: The Manchester Self-Harm Project, Room 2.316 Jean McFarlane Building, The University of Manchester, Oxford Road, Manchester, M13 9PL.

Please include the words ‘Opt Out of Processing’ at the beginning of your letter or in the subject line of your email. When making your request, please include the following details: your name, address and postcode. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

Restriction of processing request

You may also request the right to restrict processing of your data. This is not an absolute right and applies only in specific circumstances:

Where you contest the accuracy of your personal data and we need to verify the accuracy of the data.

The personal data were unlawfully processed (i.e. in breach of the Data Protection Act 2018 and General Data Protection Regulation), and you request restriction rather than erasure of the data.

Where the personal data are no longer necessary in relation to the purpose for which it were originally collected/processed, but you need us to keep the data in relation to a legal claim.

When you object to the processing and we are considering whether our legitimate interest for continuing the processing would override this objection.

If you would like to raise an objection to the processing of your data, your objection should be made in writing (or email) to The Manchester Self-Harm Project (addresses provided above).

Please include the words ‘Restriction of Processing’ at the beginning of your letter or in the subject line of your email. When making your request, please include the following details: your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

The University of Manchester