Skip to main content

Digital

Medical Devices and Outcomes Register: GDPR information

Summary

Why and how we process your Medical Device and Outcomes data and your rights.

Note. This collection replaces the Surgical Devices and Implants data set.
  

Controller NHS England
How we use the information (processing activities)

Medical devices and implants data is collected from NHS and independent sector health and care organisations.

This collection supports the development of a single Outcomes and Registries data platform to enable the national reporting of the use of any medical device or implant. You can read more about the Outcomes and Registries programme and platform on our website.  

The data will help improve patient safety by making it easier and quicker to identify adverse outcomes with particular devices, so that any issues can be investigated promptly. This will include:

•    comparing surgical device and implant outcomes to the outcomes where patients have had alternative procedures that did not involve a surgical device or implant for the same medical conditions
•    supporting the identification of patients and verifying their latest address to enable patients to be contacted by their health care organisation if their implanted device needs to be reviewed or removed if an issue with a particular device has been discovered.

This includes:

•    details of the patient, the procedure undertaken on them and clinicians who performed it
•    details of specific medical devices implanted, revised, or removed for a patient
•    other medical devices used in the treatment of the patient
•    post-operative outcome information collected from you by the clinician.

The data supports improved patient safety through:

•    surveillance of surgical devices and implants
•    patient focused activities such as review or recall of specific devices
•    quicker identification and investigation of poorer patient outcomes which could be related to a specific surgical device or implant and which may warrant investigation by appropriate bodies.
Does this contain sensitive (special category) data such as health information? Yes
Is data transferred outside the UK? This data is not transferred out of the UK
How long the data is kept 20 years minimum from death
Our lawful basis for holding this data Legal obligation
Your rights
  • Tick Be informed
  • Tick Get access to it
  • Tick Rectify or change it
  • Cross Erase or remove it
  • Tick Restrict or stop processing it
  • Cross Move, copy or transfer it
  • Cross Object to it being processed or used
  • Cross Know if a decision was made by a computer rather than a person
How can you withdraw your consent?

Consent is not the basis for processing.
Is the data subject to decisions made solely by computers? (automated decision making) No
Where does this data come from? Clinical team providing patient care
The legal basis for collecting this data

Health and Social Care under section 254
GDPR:
Article 6(1)(c) - Legal Obligation (General Powers),
Article 9(2)(g) - Substantial Public Interest
DPA 2018:
Schedule 1, Part 1, paragraph 2 - Health or social care purpose