GDPR Data processing modelTuberculosis Screening

Sector: HealthSector: Social careOrganisation: Public

This processing model concerns tuberculosis screening carried out by public health bodies, such as local authority public health teams, NHS bodies and the UK Health Security Agency.

Purposes (2)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Tuberculosis screening in particular for the migrant population

Public interest

Contact tracing, screening and follow-up if necessary for 2 years, in order to prevent contagions

Public interest

Data categories (2)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Health data

Data details

Data directly related to optical defectsrequiredsensitive data

Medical devicesrequiredsensitive data

Products delivered

requiredsensitive data

Adaptation measuresrequiredsensitive data

Prescriptions (pharmacy)requiredsensitive data

Prescriptionsrequiredsensitive data

Data conservation rules

Active base:

5 years from the last dispensing or intervention. No statutory period; the controller should set the period based on continuity of care and the NHS Records Management Code of Practice.

Misuse of Drugs Regulations 2001, reg. 23; Human Medicines Regulations 2012, reg. 253; Companies Act 2006, s.388; NHS Records Management Code of Practice; Limitation Act 1980

Intermediate archiving:

Archived on separate media for the periods required for the relevant registers and records: - Controlled drugs registers and related records: 2 years from the date of the last entry (Misuse of Drugs Regulations 2001, reg. 23). - Prescription-only medicines register (private prescriptions, emergency supplies): 2 years (Human Medicines Regulations 2012, reg. 253). - Other patient and dispensing records: no single statutory period for community pharmacies; the controller should set the period based on the NHS Records Management Code of Practice and the limitation periods for claims (Limitation Act 1980). - Accounting records: 3 years (private company) or 6 years (public company) (Companies Act 2006, s.388).

Destruction

Data required for patient management

Data details

Professional situationrequired

Relationship to tuberculosis caserequired

Telephone numberrequired

Date and place of birthrequired

National Insurance numberrequiredsensitive data

Name and surnamerequired

Data conservation rules

Active base:

Records are kept for no longer than necessary to fulfil the purpose (UK GDPR, Article 5(1)(e)). For organisations within, or under contract to, the NHS in England, and for public health functions of local authorities, the retention schedule of the NHS England Records Management Code of Practice applies: for example, adult health records are generally kept for 8 years after the conclusion of treatment, and children's records until the patient's 25th birthday (26th if aged 17 at the end of treatment). Other organisations should define their retention periods in a written retention schedule based on applicable rules.

UK GDPR, Article 5(1)(e); NHS England Records Management Code of Practice

Destruction

Data subject (2)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Other
Patients

Created at:07/08/2023

Updated on:10/05/2026

Nb using:0