Skip to main content

Public Health privacy notice

Types of information we use
Details of Data we receive from NHS Digital
Who uses this information?
What do we do with this information?
How is your data kept safe and secure?
How can you opt out of the Public Health datasets?
Access to your personal information
Contacting the Public Health Intelligence and Insight Team
For independent advice about the use of your data

As a local authority we have a duty to improve the health of the population we serve in Surrey. To help us do this, we use data and information from a range of sources including the Office for National Statistics (ONS), Public Health England, NHS-England, NHS Digital, local Clinical Commissioning Groups (CCGs), GPs and hospitals to understand more about the nature and causes of disease and ill health in Surrey and to support our public health functions. This data includes data provided to Surrey County Council from NHS Digital / ONS that comes from birth and death registrations as well as data on health care within English hospitals.

Types of information we use

We work with many types of data to be able to promote health and support improvements in the delivery of health and care services in Surrey.  We can describe the data as follows:
1. Identifiable data – this is personal data that can identify individuals, such as name, date of birth, gender, address, postcode and NHS number.
2. Pseudonymised data – this contains information about individuals but with the identifiable details replaced with a unique code.
3. Anonymised data – All identifying details are anonymised so individuals can not be identified.
4. Aggregated data – This is data that has been grouped together so that it doesn’t provide information on individuals, only groups of people.

Details of Data we receive from NHS Digital

We receive the following data from NHS Digital (previously the Health and Social Care Information Centre) which is supplied to us under a Data Sharing Agreement (DSA) and in accordance with section 42(4) of the Statistics and Registration Service Act 2007 as amended by section 287 of the Health and Social Care Act 2012, and Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002. This data is only supplied to us by NHS Digital under strict license and data disclosure controls:

1. Hospital Episode Statistics (HES) –  Pseudonymised records about health care and treatment of patients within any English hospital. This contains data collected when someone is admitted to a hospital bed, treated as a day patient, attends as an outpatient, or attends an urgent care centre (such as an Accident & Emergency department). This data includes the patient’s age, method of admission, source of admission, diagnosis codes, procedure and investigation codes, area of residence, hospital attended, date of attendance, and GP practice of patient.
2. Primary Care Mortality Database (PCMD) – The PCMD provides us with access to identifiable mortality data which is based on death registrations.  The data includes the address, postcode of residence of the deceased, postcode of the place of death, NHS number, date of birth, date of death, name of certifier, and cause of death but not names. Our access is limited to those deaths which occurred within Surrey’s borders, deaths to Surrey residents and deaths in the registered population of GP Practices within Surrey’s Clinical Commissioning Groups.  The access to this database is via a secure internet connection (referred to as the NHS N3 Connection).
3. Births data tables – This dataset provides us with access to identifiable data about the number of births that occur within Surrey (Surrey County Council and Surrey’s Clinical Commissioning Groups boundaries). It includes the address of usual residence of the mother, place of birth, postcode of usual residence of the mother, postcode of place of birth of the child, NHS number of the child and the date of birth of the child but no names.
4. Vital statistics tables – This dataset is aggregated together so that it does not identify individuals. It contains data on live and still births, fertility rates, maternity statistics, death registrations and cause of death analysis within Surrey (Surrey County Council and Surrey’s Clinical Commissioning Groups boundaries).

Who uses this information?

Access to the NHS Digital data is restricted to the Public Health Intelligence and Insight Team (PHIIT) in Surrey County Council’s Public Health Team. Staff members are trained to be aware of data protection standards and to observe the guidelines relating to this data (e.g. Hospital Episode Statistics Guidelines HES Guidelines or Office of National Statistics Disclosure Guidance).

What do we do with this information?

The PHIIT use this information for statistical analyses to measure the health, mortality or care needs of the population; to identify risks to the public's health and opportunities to improve the public’s health, and to inform the planning, evaluation and targeting of health, care and public health services.

These analyses allow the Public Health Team to produce needs assessments which provide expert advice and intelligence for local commissioners to make effective decisions on how they spend funding for local services. These assessments can focus on a specific topic like falls or more general assessments of local health like the CCG Health Profiles. We contribute, alongside colleagues from within the council and other local partners, to the Joint Strategic Needs Assessment, which identifies the current and future health and social care needs of Surrey's population and analyses whether needs are being met locally. Analyses produced are also used within the Director of Public Health’s Annual Public Health Report, and the pharmaceutical needs assessment – see Surrey’s local information portal for more information on these publications (Surrey-i).

The Office for National Statistics (ONS) Birth data is used specifically to identify trends and variations in birth rates, low birth weight and still births, to inform the planning and targeting of health, care and public health services. Mortality data is used to monitor trends in the number of deaths, estimating death rates, providing input around place of death for end of Life Care analyses, monitoring child deaths, monitoring seasonal patterns of death and calculating excess winter deaths, reviewing life expectancy and premature deaths and variations by geographic areas, age, sex and other characteristics.
The HES data is used for monitoring population health in the county, and to inform the planning and commissioning of health services. This includes providing public health advice and support to local NHS commissioners, to monitor demand and variation in access to health care services along with health outcomes.
No person-identifiable information is published, and numbers and rates in published reports based on counts fewer than five are removed to further protect confidentiality and anonymity.

How is my data kept safe and secure?

All the data we process and hold is kept safely and securely within our IT systems.  When not in use, our Primary Care Mortality Database PCMD data is encrypted (to AES standard 256 level). We do not disclose any data to a third party who is not identified on our license agreement with NHS Digital.  Any data requests received from a third party will only receive anonymised and/or aggregated data to a level that complies with the Office of National Statistics Disclosure Guidance or with the HES Guidelines and meets legal requirements.

How can I opt out of the Public Health datasets?

You have the right to opt-out of the Surrey County Council Public Health Intelligence Team receiving or processing your personal identifiable information. There are occasions where service providers will have a legal duty to share information, for example for safeguarding or criminal issues. The process for opting out will depend on what the specific data is and what programme it relates to.
If you have any questions about our use of these data, wish to request a copy of the information we hold about you, or if you wish to discuss your rights in relation to opting-out from these processes, please contact the Public Health Intelligence and Insight Team.

For independent advice about the use of your data


If you have concerns about the use of your personal data, the Information Commissioners Office is an independent body set up to uphold information rights in the UK.  They can be contacted through their website: www.ico.org.uk, through their helpline (0303 123 1113) and in writing at their head office: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Access to your personal information

To make a request for personal information, fill in the access form. If you want to know more about how we handle data at Surrey County Council please read our Access to Information pages.

Contacting the Public Health Intelligence and Insight Team

By Telephone on 0208 213 2634
By email
By post to: Public Health Intelligence & Insight Team, Surrey County Council, County Hall, Penrhyn Road, Kingston Upon Thames, KT1 2DN

Top