Strict procedures have been established to ensure that: -

· the requirements of the Data Protection Act are met.
· the confidentiality of patient information is respected.
· the use of customer data can be audited.

· When data is required, customers will be requested to send their Data Protection Form for releasing data to the SCI team for signature. This form may be e-mailed or faxed.
· The member of the SCI team requesting the data will sign and return the form by FAX. Only when this has been received, should the data be sent to SCI.
· Customers should print and complete the Submission Note.
· If the data is to be destroyed the Authorising Manager must sign the Submission note. If there is no signature, the data will be returned after the investigation.
· The Submission note and the data should be placed in an appropriate protective envelope labelled
MEDICAL–IN-CONFIDENCE, F.A.O. SCI Data Investigation Administrator,
Seaforth House, Seaforth Road, Hillington, Glasgow G52 4SQ.
· This envelope should then be placed inside another one addressed to GPASS/SCI Admin. Office, Seaforth House, Seaforth Road, Hillington, Glasgow G52 4SQ
· A message stating “If undelivered please return unopened to…..” should be added to both envelopes.
· The data must be sent by registered mail or by an alternative secure method.
· Once the data has been received, the Product Support Analyst will notify the customer.
· When the investigation has been completed, the data will be removed from the server used for the investigation and the original media returned by registered mail or destroyed according to the instructions.

A full description of the these procedures can be viewed in the Procedures for Handling Live Data document.

Further information regarding the Data Protection Act and how it applies within the NHS in Scotland can be found at www.show.scot.nhs.uk.

For general information on on the Data Protection Act please visit the Government web site at https://www.gov.uk/data-protection