Privacy Notice – Use of Artificial Intelligence by Radiology external reporting companies
Introduction
In order for Northern Health & Social Care Trust (The Trust) to help provide a service for you we need to share some information about you. Personal information that we process about you is governed by the UK Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR.)
How is my information being used?
To provide a safe and efficient service for you we need to share some of the information we hold about you with an external reporting company who support the Radiology Service. This company is contracted by the Trust to review your Radiology images and provide a report to the Trust to ensure your results can be reviewed in a timely manner. The reporting company uses Artificial Intelligence (AI) software as a workflow aid through the automatic detection of acute pathologies on CT exams. The software improves the accuracy of Radiology Reporting and therefore improves patient outcomes.
The software makes suggestions to Radiologists, it does not make decisions. In keeping with the current IR(ME)R legislation, a Radiologist or reporting Radiographer will review the suggestions and report their own findings.
What information is being processed?
We only share the information we need to with the external reporting company. The images obtained during your CT scan may be analysed by the AI software. The images contain your date of birth and a unique ID called an accession number that identifies you within the system.
Your date of birth is required only to confirm patient age as scans for patients under 18 years old are not reviewed by the AI software.
Retention of the data
The external company acts as a data processor on the instructions of the Trust and will only retain data in line with the terms of the contract
The Trust retains your information in line with specific guidance issued by the Department of Health in Northern Ireland. The length of time we keep your information for will depend on the types of records created for your care. If you want to find out more about how long your records are retained, you can view the “Good Management, Good Records” section under “Disposal Schedule” on Department of Health’s website.
The security of your information
The Trust takes your privacy seriously. Staff will only access your information on a strict ‘need to know’ basis and when they are involved in the delivery of Radiology Services. All staff have a legal duty to keep your information safe and confidential and are aware of their responsibilities in regards to your privacy. Any organisation we share information with is also bound by legislation to ensure information is handled correctly. No data is stored by the AI system used by the external reporting company, it is transient in nature. The images are encrypted by the AI supplier on receipt into their system and then removed from the system once the AI software has returned its suggestions
Lawful basis for processing
Radiology Services process your information in line with Article 6 and Article 9 of UK GDPR:
- Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
Access to my information
If you want to see the information we hold about you or ask about how we use it, you can speak to the staff currently involved with you/your family or you can request a copy of your information. See the Trust’s website for further details on how you can apply for a copy of your health and social care information.
Who to contact if you have any queries or concerns regarding the use of your information
If you want to know more about how we use your information or if you are unhappy with any aspect about how we use your information you can contact:
Information Governance Department, Causeway House, 8e Coleraine Road, Ballymoney, BT53 6BP.
E-mail: info.governance@northerntrust.hscni.net, Tel 028 2766 1293
Date of issue: February 2025
