INFORMATION AND THE HEALTH PROTECTION AGENCY
This leaflet describes how the Health Protection Agency uses
information to protect your health and protect your identity
1. Why does the Health Protection Agency collect information?
The Health Protection Agency is an independent government-funded
organisation that is dedicated to protecting people’s health. We use
information to help doctors, environmental health officers and other
professionals who monitor the effects of infectious, radiation, chemical,
and environmental hazards to health.
This information helps us to protect the health of individuals, their family
and friends, and the population as a whole. From this data we provide
information and impartial advice to the public, professionals and the
government.
2. How does my information help the Health Protection Agency to
Protect my health and the health of others?
Infectious diseases: we collect and use information to identify,
investigate and control outbreaks of disease, investigate antibiotic
resistance and monitor the safety and effectiveness of vaccination
programmes.
Hazardous chemicals: we assess the health effects of short-term and
long-term exposure to hazardous chemicals in air, water, soil and
waste.
Radiation: we look at the risks to health from ionising and non-ionising
radiation, from natural and man-made sources.
3. Who sends information about patients to the Health Protection
Agency?
Notifiable diseases: doctors are required by law to report all cases of
certain serious infections (known as notifiable diseases) to the Agency.
This is known as notification. Notifiable diseases include measles, food
poisoning and tuberculosis.
Healthcare-associated infections: the Department of Health requires
hospitals to report cases of certain infections to the Agency. These
include bloodstream infections caused by MRSA (meticillin-resistant
Staphylococcus aureus). The Agency collates and analyses the
information for the Department of Health.
Laboratory reports: many microbiological laboratories report the results
of tests for infectious diseases to the Agency.
Cancer registries: these provide records that are used by the Agency
staff to investigate environmental or occupational diseases that may
be caused by exposure to radiation or hazardous chemicals.
Sexually transmitted infections and HIV: clinics for genitourinary
medicine report cases of sexually transmitted infections and human
immunodeficiency virus (HIV) to the Agency. These reports do not
include any names of individuals. They do, however, include enough
information for any duplicate reports to be identified and excluded.
4. What do you do with my information?
In most cases, personal information is not required and it is deleted as
soon as possible so that it is impossible to identify individual patients.
This process is known as anonymisation.
The data is then examined for patterns and trends of disease. Reports
are published regularly on the website www.hpa.org.uk.
5. Why can’t all my information be anonymised before it is sent to
the Health Protection Agency?
As far as possible we avoid collecting or keeping anything that can
identify individuals. Sometimes, however, we need to have details
such as name or postcode. Some examples where we need this
information in order to help us to protect your health include:
Salmonella infections
While close contacts of patients may feel well, they may require
treatment with antibiotics to protect them from becoming ill or from
spreading infection to other people. We also need to find out if people
have been vaccinated against meningitis, so that we can check that
the vaccine works.
Legionnaires’ disease
We contact patients and ask them where they were in the days before
they became ill. This helps us to trace the source of their infection
because Legionnaires’ disease is often spread by air conditioning units
and cooling towers.
Waterborne incidents
Infectious agents or toxic chemicals can contaminate water. Relevant
professionals share information about those people affected to help
trace the source of contamination.
Long-term follow up
Some infectious diseases and some exposures to ionising radiation or
chemicals can have long-term effects on health. We use information
about individual patients to help us track the effectiveness of
treatments.
6. How can I be sure that my information is safe with the Health
Protection Agency?
The Agency staff process all information under medical supervision and
are trained to treat all personal details in the strictest confidence, in
compliance with the Data Protection Act 1998 and NHS Caldicott
Guidelines. Surveillance reports about individual patients are shared
only with the healthcare professionals caring for that patient and those
who are investigating the source of an infection or outbreak.
The Agency staff and other healthcare professionals are required to
maintain confidentiality. Breaches of confidentiality, whether
accidental or deliberate, are disciplinary offences.
7. Will I always be asked for my consent before my information is sent
to the HPA?
You will not be asked for your consent to report notifiable diseases
because this is required by law, or for mandatory reporting of
healthcare-associated infections because the Department of Health
requires hospitals to report cases (see section2). All personal
information is treated in confidence and is removed as soon as
possible.
It is often not practical for healthcare professionals to seek consent for
a positive laboratory test result to be reported to the Agency every
time they take a specimen. If you do not want your personal
information to be used for public health monitoring, please inform your
doctor, who will ensure that your records are anonymised before being
shared with the Agency. Alternatively, you can ask your doctor to
write on the laboratory request form “personal information is not to be
used for public health monitoring”.
You should be aware that this may make it difficult for us to find you if
you require further treatment or if we need to trace the cause of your
disease.
7. The Health Protection Agency’s commitment to protecting your
Information
The Health Protection Agency will:

Retain only the minimum information about named individuals.
Many reports that we receive do not contain names and we
usually remove within two years any information obtained
through routine surveillance that could identify a person.

Work with other organisations in the NHS to reduce the amount
of identifying information that is held, e.g. by using the NHS
number instead of the name.

Continue to use the special arrangements that protect the
confidentiality of patients seen in particularly sensitive situations
such as clinics for sexual health or genitourinary medicine.

Use your information in accordance with the Data Protection Act
1998, the Public Health (Control of Disease) Act 1984 and the
Public Health (Infectious Diseases) Regulations 1988, and the NHS
Act 2006 (section 251).

Comply with the requirements of the National Information
Governance Board and other relevant organisations.
Further information
Information about protecting the confidentiality of patients is available
at:
www.hpa.org.uk/safeguarding_confidentiality
A list of notifiable diseases is available at:
www.hpa.org.uk/hpa/notifable_diseases
If you have any questions, you can either ask your doctor or contact:
Head of Clinical Governance
Health Protection Agency
61 Clindale Avenue
London NW9 5EQ
Tel: +44(0)20 8200 4400
Email: caldicott@hpa.org.uk