The NHS Business Services Authority (NHSBSA) and the Department of Health and Social Care are jointly responsible for this service.
Why we process your information
We’ll use the information you have given us to:
- process and verify your application for the European Health Insurance Card (EHIC)
- help plan and make improvements to NHS services, and/or direct patient care
If you have an NHS pension and we do not have up-to-date details for you, we may use your information to update our records. This is so we can meet our legal obligation to send you information about your NHS pension benefits.
By law, we must process this information to be able to provide this service.
We will ask you for:
- information to identify you, and if appropriate your partner and children
- your address so we can post the EHIC to you
Your information will not be transferred outside the European Economic Area and Switzerland.
Sharing your personal information
To validate EHIC applications and EHIC, we may share your information with:
- The Department for Work and Pensions
- HM Revenue and Customs
To prevent, detect and investigate fraud and errors, we may share your information with:
- NHS Counter Fraud Authority
- Department of Health and Social Care – International Division
- NHS commissioners and service providers
Keeping your personal information
We will delete your personal data from our systems and files no later than 24 months after the expiry of your EHIC. This is to allow for treatment cost claims made near the end of your card expiry to be processed.
The information you provided will be managed as required by Data Protection law.
You have the right to:
- receive a copy of the information the NHSBSA hold about you
- request your information be changed if you believe it was not correct at the time you provided it
From 25 May 2018, you will have the right to:
- request that your information be deleted if you believe the NHSBSA are keeping it for longer than necessary
Find out more about your rights and how we process information.