Invoice validation is an important process in ensuring that your care is paid for correctly. It involves using your NHS number to check that the Integrated Care Board (ICB) is responsible for paying for your treatment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly. All information with NHS numbers collected to validate invoices is held within a secure, controlled environment for finance (CEfF) (within/on behalf of) the ICB. The use of personal data by ICBs for invoice validation has been approved by the Confidentiality Advisory Group of the Health Research Authority. Further information regarding this can be found here:
Visit the Health Research Authority for more information
Controller contact details
NHS South West London ICB
120 the Broadway
Wimbledon
London SW19 1RH
Data protection officer contact details
Head of Patient Information and Data Protection Officer
Purpose of the processing
To enable the ICB to ensure accurate payment of invoices. To provide accountability and fulfill their legal obligations.
Lawfulness conditions and special categories
The lawful basis for processing, storing and sharing this data are:
- Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”
The ICB does not require access to special category data for the purposes of Invoice Validation and will not process data at this level.
Recipient or categories of recipients of the processed data
The data will be shared with our external provider into a Controlled Environment for Finance (CEfF).
Anonymised data will further be shared with NHS Shared Business Services (SBS) to arrange payment of the invoice.
Rights to object
ICBs process personal data under Article 6(1)(c) on a lawful and legitimate basis where the ICB is obliged to comply with the relevant UK Legislation.
By complying with the laws governing NHS and financial records, the ICB has compelling legitimate grounds for the processing which override the interests, rights and freedoms in the right to object.
Right to access and correct
You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
Retention period
The data will be retained for the period specified in the retention schedule found in the NHS Records Management Code of Practice.
Right to complain
You have the right to complain to the Information Commissioner’s Office https://ico.org.uk/global/contact-us/.
Helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate)