Invoice validation is an important process in ensuring that your care is paid for correctly. It involves using your NHS number to check that the Integrated Care Board (ICB) is responsible for paying for your treatment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for.
The process makes sure that the organisations providing your care are paid correctly. All information with NHS numbers collected to validate invoices is held within a secure, controlled environment for finance (CEfF) (within/on behalf of) the ICB. The use of personal data by ICBs for invoice validation has been approved by the Confidentiality Advisory Group of the Health Research Authority and is scheduled for review 30 September 2022.
Visit the Health Research Authority for more information
We are required by Articles in the General Data Protection Regulations to provide you with the information in the following 9 subsections.
Controller contact details
NHS South West London ICB, 120 the Broadway, Wimbledon, London SW19 1RH
Data protection officer contact details
Strategic information governance subject matter expert: [email protected]
Purpose of the processing
To enable the ICB to ensure accurate payment of invoices. To provide accountability and fulfill their legal obligations.
Lawfulness conditions and special categories
The lawful basis for processing, storing and sharing this data are;-
Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”
The ICB does not require access to Special Category data for the purposes of Invoice Validation and will not process data at this level.
Recipient or categories of recipients of the processed data
The data will be shared with our external provider into a Controlled Environment for Finance (CEfF).
Anonymised data will further be shared with NHS Shared Business Services (SBS) to arrange payment of the invoice.
Rights to object
You have the right to object to some or all the information being processed under Article 21 of GDPR. Please contact the Controller for more information.
You should be aware that this is a right to raise an objection, which is not the same as having an absolute right to have your wishes granted in every circumstance.
Under the Confidentiality Advisory Group review 10 October 2017 the requirement to oblige with patient objections from the flow of information to Controlled Environments for Finance (CEfF) which are required to support invoice validation was removed.
Right to access and correct
You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
Retention period
The data will be retained in line with the law and national guidance.
Right to complain
You have the right to complain to the Information Commissioner’s Office (ICO).
Contact the ICO online or call their helpline on 0303 123 1113 (local rate) or 01625 545 745 (national rate).
There are National Offices for Scotland, Northern Ireland and Wales.