Personal Data Processing Privacy Notice
This notice describes how UPMC Hillman Cancer Centre collects and processes your personal data, including sensitive health data.
What is UPMC Hillman Cancer Centre and Why Will My Data Be Transferred Abroad?
UPMC Hillman Cancer Centre (“Centre”) is a highly specialized radiation therapy centre which provides innovative and advanced treatments to patients suffering from oncologic diseases. The Centre’s excellence is a result of a multidisciplinary approach to the treatment of cancer and its relationship with UPMC (University of Pittsburgh Medical Center) and the UPMC Hillman Cancer Center (hereinafter “UPMC Group”). In its daily operations, the Centre collects and maintains personal data, and shares it with personnel, data networks and information technology systems of the UPMC Group, and other Data Processors. The patients of the Centre must consent to this processing of their personal data, including sensitive data, and its transfer to the UPMC Group in the United States. The UPMC Group have contractually committed to adopting security measures to protect patients’ data in accordance with European legislation.
What Data Will Be Collected and How?
The Centre will ask you or third parties (e.g., your family doctor) to provide personal information (name, address, etc.) on your health status (diseases, lab results, diagnostic tests, ongoing therapies) and, if required, also on your sex life, social sphere, and psychological state. Before the treatment, it may become necessary to collect some images of you for purposes of safe identification.
Why is My Data Processed?
1. In order for you to receive clinical services and for administrative purposes (INFORMED CONSENT #1)
Your personal data is collected and processed so that you can receive the necessary clinical services, and also to fulfill the related administrative and accounting requirements which includes transfer of data to the UPMC Group in the United States. To this extent your medical record is maintained, and data may be shared (including via telemedicine) with the following:
- family doctors, specialty physicians and radiologists;
- UPMC accounting and management staff;
- social security institutions, insurance companies covering the Centre’s third-party liability, and legal consultants to the Centre and to its staff;
- the National Health Service for reimbursement of medical services, and other medical or governmental institutions monitoring and auditing the provision of clinical services;
In order for the Centre to provide all these services it is necessary that you give your consent. If you do not wish to sign the informed consent #1, the Centre will only be able to perform emergency clinical treatments necessary to immediately protect your life or your physical safety, or those of a third party.
2. To conduct scientific studies and research in the medical field (CONSENT #2)
The Centre is involved in research projects (both nationally and in collaboration with other EU and non-EU institutions) with the purpose of improving its clinical services and contributing to general medical knowledge. In particular, the Centre conducts research on innovative radiotherapy techniques. Many of these studies can be performed using information already collected during regular patient care activity or previous clinical studies. Participating in these research projects does not influence in any way the normal patient care, and does not require additional tests or treatments for the patients. In order to protect privacy, the patient’s ID is removed from the clinical data, and replaced with an alphanumerical code that does not allow any external party to trace the patient’s identity. Contact the Centre for more information on research studies.
In particular, encoded data is used during information processing and storage, and when forwarding data to the others involved in the study. Patients’ ID data can only be accessed during the phase of extracting the information from the original clinical documentation, and during monitoring activity (i.e., when checking that the data used for research match with the data contained in the medical record), and when the research data requires an update. Research results will be disseminated in aggregate form only, according to modalities that prevent the identification of the interested subjects.
In order to use a patient’s clinic information for research purposes, the patient must express his/her consent. Therefore, if you wish to allow the Centre (also in collaboration with centres located in the EU or in non-EU countries where an adequate level of personal data protection may not be guaranteed as per EU regulations) to use your clinical information already collected or that will be collected in the scope of patient care (or during other research projects you were involved in), you may express your consent on the Consent for Personal Data Processing form. Please note that you can withdraw your consent to Data Processing at any time, and that this will not affect your treatment.
The Centre will also participate in research projects regulated by laws in the above-mentioned areas. In order to use data in the scope of these studies, however, it is not necessary to obtain the patients’ consent as this is provided for by law.
3. To verify the quality of care and medical treatment received, and for planning care (CONSENT #3)
If you sign the consent, the Centre will use your data to monitor and assess the effectiveness of the patient care delivered, its appropriateness and quality, as well as clinical risk factors beyond those provided for by law. In particular, the goal of the Centre is to assess and compare the appropriateness, efficacy, effectiveness and efficiency of care delivered to different population groups or in different facilities, also with reference to specific diseases or health issues. These assessments will be carried out using data with no direct identification elements (name, surname, tax code, etc.), therefore not allowing a tracing of the identity of the patient. This data will be processed and compared using computer tools with information managed by other clinical facilities.
4. To receive information and marketing material (CONSENT #4)
If you sign the consent you may receive information on the Centre’s projects and services, information campaigns and fund raising initiatives.
5. To receive scheduling and instructional information (CONSENT #5)
If you sign the consent you may be contacted about the dates of upcoming appointments, and to receive information and instructions on how to prepare for your exams or treatments at the Centre.
How Will My Data be Processed?
Data Processing is performed using both paper and electronic tools, adopting appropriate safety measures to guarantee data confidentiality and security.
Who Will Access My Personal Data?
Your personal data will be processed by the clinical and administrative staff of the Centre, and by duly appointed Data Processors, bound by professional secrecy and confidentiality. For training purposes, clinical treatments may be performed in the presence of medical students. In this case, all necessary precautions will be taken to limit any potential inconvenience, and your will not to abide by this procedure will be respected.
Your data may also be shared with third parties, who as independent Data Controllers or appointed Data Processors, provide ancillary services to activities of the Centre, such as:
- external consultants,
- volunteer associations for patient care activities,
- maintenance firms, and
- other subjects providing services instrumental to the Centre’s activities.
The updated list of entities of the UPMC group to which data could be transferred, of the Data Processors, and third parties to which data could be communicated, can be requested by telephone at +353 (0)51 337 444.
Who Will be Informed of My Health Status?
Information regarding your health status will only be provided to your relatives and friends that you indicated, without prejudice to the provisions of law.
What are My Rights According to the Law?
Your rights are identified by the Data Protection Commissioner. You have the right to:
- have your data used in line with the data protection regulations;
- receive confirmation that the Centre holds your personal data and why;
- access your personal details;
- know if personal details are being held;
- change or remove your details
- prevent use of your personal details
- remove your details from a direct marketing list
- object to use of your details (under certain circumstances)
- freedom from automated decision making
- refuse direct marketing calls or mail
How can I Exercise My Rights?
The rights defined in this document can be exercised by contacting the Data Controller (Waterford Oncology Associates) at +353 (0)51 337 444 or by mail to: UPMC Hillman Cancer Centre, Cork Rd, Butlerstown North Co. Waterford, Ireland.