Skip to main content Skip to footer

NHS Prescription Services privacy notice

The NHS Business Services Authority (NHSBSA) is responsible for this service.

Why we process your information

The dispenser of your medical products forwarded your prescription to us, as stated on the prescription form. This is required as part of their contract terms.

By law, we must process this information on behalf of the NHS.

We use the information to:

  • pay the organisation that provided your medical products
  • secure effective and efficient delivery of NHS services
  • analyse with other patients' information to understand patterns and trends that will be used to plan and make improvements to NHS services and direct patient care
  • check for fraud and mistakes
  • monitor the safety of new medicines

We may use your information to check claims you make for help with NHS charges.

If we can’t confirm that you are entitled to help, you may be sent a Penalty Charge Notice.

If you are in the NHS Pension scheme, we may also use the information to ensure your contact details are up to date.

Your information will not be transferred outside the UK or European Economic Area.

Sharing your personal information

To support more effective planning and improvements to NHS services and patient care, we may share our understanding of patterns and trends gained from patient information with:

  • NHS Commissioners and service providers
  • Public Health England (PHE)
  • NHS Digital
  • Department of Health and Social Care (DHSC)
  • NHS Counter Fraud Authority

To prevent, detect and investigate fraud and errors, we may share your information with:

  • NHS Counter Fraud Authority
  • The Department for Work and Pensions (DWP)
  • HM Revenue and Customs
  • Veterans UK
  • NHS Commissioners and service providers

We’ll only share information that can identify you with those:

  • directly involved in your NHS care
  • reviewing you NHS care
  • with a legal right to it
  • who you have given us permission to share with

Strongly coded information is securely shared with the UK Health Security Agency and NHS Digital. This lets them protect and improve the health of the population of England.

You can only be identified from this information where the UK Health Security Agency and NHS Digital have the legal power to do so. UK Health Security Agency legal powers relate to monitoring rare or infectious diseases. NHS Digital’s legal powers relate to maintaining patient registers on cancer and congenital abnormalities.

We share patient identifiable information for new medicines with the Drug Safety Research Unit at Southampton University. They have a legal right to this. They will contact your GP to ask for your permission to take part in the medicine safety study. If you do not want to take part, your information will be deleted.

We share patient identifiable information with NHS Digital to reduce the impact and frequency of avoidable prescribing error, to help improve patient safety and support more effective planning of NHS services, and for research. They have a legal right to this. You can view more information about our medicines data.

If an investigation into errors with state benefit entitlement is needed, we:

  • may receive or share your information with DWP
  • will share pseudonymised information with DHSC so a decision can be made about any errors found

If appropriate, we will then implement the decision made by DHSC.

These investigations may require information over several years. This means we will need to keep your information until we have completed any changes needed.

Keeping your personal information

We will destroy your prescription no later than 18 months after the month we received it.

We will anonymise the information we have used from your prescription no later than 10 years after the month we receive it. This helps the NHS track the benefits and outcomes of prescribed medical products.

Your rights

The information you provided will be managed as required by Data Protection law.

You have the right to:

  • receive a copy of the information the NHSBSA hold about you
  • request your information be changed if you believe it was not correct at the time you provided it

From 25 May 2018, you have the right to request:

  • that your information be deleted if you believe we are keeping it for longer than necessary
  • a review of the automated decision to issue you with a Penalty Charge Notice

Find out more about your rights and how we process information.

View our patient information video:

View or download our patient information poster (PDF 837 KB)