Fit for Work Scotland (FFWS) is delivered by NHSScotland on behalf of the Department of Work and Pensions (DWP).
This policy outlines what data we collect about you when you access the service, how we store this data securely and who we share it with. This policy is compliant with the Data Protection Act 1998 (DPA), and we're committed to compliance procedures that demonstrate this.
FFWS operates an advice and assessment service to support people back to work. The types of data we collect will depend on how you access and interact with the service.
FFWS deals with personal and sensitive data, as classified under the DPA.
The advice service is provided through the FFWS website and a telephone advice line.
If you phone the advice line, or use our contact form, we will record your:
- Telephone number
- Email address
To access the assessment service, an individual must be referred by their employer, or GP. Consent for this referral must be obtained from the individual.
A referral can be made using our online referral form, and we'll record the following to help with the assessment:
- Company name
- Name of the person making the referral
- Email address
- Unique Tax Reference
- Details of occupational health already provided
- Name of the employee
- Date of birth
- Contact telephone number
- Email address
Conditions and requirements
- The employee's reason for being off work as noted on their fit note
- Date of absence
- End date of their current fit note
- Additional support requirements
- Employee's top 5 daily activities
- Employee's normal working hours
- Any specific occupational health questions relating to the employee
This service is managed by Salus Occupational Health / NHS Lanarkshire on behalf of FFWS.
Return to work plan
Following an assessment, a return to work plan (RTWP) will be created. We'll share this plan with the employee and, if the employee gives their consent, their GP and employer.
During the assessment, and in addition to the data already collected through the referral process, we'll collect the following to help create a RTWP:
- Condition causing their absence from work, and the impact this has on their ability to do their job
- The assessor’s assessment, and recommendations for the individual
- The assessor’s recommendations
- How long this assessment applies for
- The individual’s current circumstances in relation to disability provisions of the Equality Act 2010
- Details of any specific queries raised by the referrer, and the assessor’s response to these queries
- Details of the employee’s consent to share the RTWP with their employer
- Details of the employee’s consent for further contact with the service and, if applicable, when this is to take place
- The assessor’s name and date of the assessment.
During the assessment, we use an individual's Community Health Index (CHI) number to identify and track them through the process. This number is recorded internally by NHSScotland prior to the initial assessment.
Any data we collect will be stored securely in an NHSScotland database, which has been formally risk assessed and accredited in accordance with the DPA. No third party will have access to this.
This data will be kept no longer than is necessary and reasonable to do so. After this period, the data will be deleted.
Loss and misuse of data
We take reasonable technical and organisational precautions to prevent the loss, misuse or alteration of your personal data.
Any data we collect will only be shared for the purpose of:
- Sharing an individual's return to work plan
- Auditing and evaluating the service
- Monitoring the performance of the service.
Sharing a RTWP
An individual will be asked if they wish to give their consent for their RTWP to be shared with their employer and GP. Only if consent is explicitly given will the RTWP be shared.
No other personal data will be shared outwith the service without the explicit consent of the individual concerned.
Audit and evaluation
To help us evaluate the service, any contact details you provide – including name, address, telephone number and email address – may be passed to a third party for auditing and evaluation purposes.
To help us monitor the performance of the service, statistical data will be shared with National Services Scotland (NSS), the Scottish Government and DWP for the purposes of performance management.
This data will be completely anonymised to ensure that individuals can't be identified.
Data protection and security
In relation to personal data collected, stored and shared by FFWS, the Scottish Government, DWP, NHS Health Scotland, and NHS 24 are data controllers for the purposes of the DPA.
As FFWS is delivered through NHSScotland, we adhere to all data security standards and protocols that apply within NHSScotland.
In addition, all systems that operate as part of FFWS have had a detailed system security policy assessment in line with national recommended standards. The outcomes of this assessment were accredited in April 2015 by Scottish Government eHealth and this has been endorsed by the security department at the DWP.
The process of collecting data as part of the assessment service meets Information Systems Security Standards (ISSS) preventing unauthorised access and malicious misuse.
Times and dates are recorded and stored at each stage of the process.
All health professionals who handle personal data within FFWS undergo Disclosure Scotland checks prior to employment, and at specified intervals throughout their NHS employment.
Training and registration
All health professionals working within FFWS receive confidentiality and data protection training during induction, and must be fully registered with the relevant professional body for their position:
- Nursing and Midwifery Council (NMC) for nurses
- Health Professions Council (HPC) for allied health professionals
Accessing your data
You've a right to know what data we collect about you, and to access, modify and request that we delete this data at any time.
You can request access to this data, or have it deleted at any time, by contacting the site administrator.
Audit and evaluation of the service
FFWS is routinely audited and evaluated to make sure we're delivering the best service for employees, employers and GPs.
A routine internal clinical audit of all records processed by FFWS will be carried out by designated staff from each of the services involved (NHS 24, NHS Lanarkshire and NHS Health Scotland).
This will involve an agreed standard process and only designated staff who've been briefed, trained and security checked within NHSScotland will carry out these audits.
Following this audit, anonymous reports will be shared with:
- The Scottish Government
Audit of employer and GP satisfaction
In addition, an audit of employer and GP satisfaction will be carried out by an independent auditor contracted by the DWP.
The contact details of employers and GPs who've made referrals and/or received RTWPs will be shared with this contractor for this purpose. The name of the employee referred to the service won't be disclosed.
All contact details will be relayed through a secure email.
FFWS will be evaluated by a third party working on behalf of the DWP. Individuals who've received an assessment may be contacted by this organisation for the purpose of this evaluation.
If selected for evaluation, an individual's name, address, phone number and email address, will be provided by FFWS enrolment and assessment staff to the evaluation team.
Only an individual's name, phone number and email address will be relayed through a secure email.
The DWP evaluation provider will obtain further consent regarding the data required for the evaluation when they make contact with those selected.
What is a cookie?
A cookie is a small amount of data placed on your computer or mobile phone by a website.
Cookies can be:
- persistent — meaning they're stored by your web browser and will remain valid until a set expiry date
- session — meaning they'll expire when your web browser is closed.
We only use persistent cookies on this website.
What information do we collect?
When you visit this site, we'll collect information about:
- your computer
- your visits
- how you use this website.
Our cookies don't collect or store any information that personally identifies you.
Why do we collect this information?
We use this information to understand how you use this site and to make it faster and easier to use each time you visit.
Blocking or deleting cookies
Blocking or deleting cookies may have a negative impact on how you use this website and could prevent some of the features from working.
Find out how to delete cookies on aboutcookies.org
What cookies do we use?
We use the following cookies on this website:
Used to distinguish users
Used to throttle request rate
These are first-party cookies used by Google's Universal Analytics.
How to contact us
This website is maintained by NHS 24 on behalf of the Scottish Government and DWP.
- using our contact form
- by post — Fit for Work Scotland, NHS 24, Golden Jubilee Hospital, Clydebank, G81 4DY