Sharing information relating to Infected Blood Compensation Authority claims

Making a claim

The IBCA website includes the following information to support you making a claim for compensation:

• how to claim, and how to calculate the compensation you might get, if you are someone who is infected (including where you were infected by your partner or by living with an infected person)
• how to claim compensation on behalf of someone who has died, if you are representing their estate
• how to claim if you are an ‘affected person’ – this is for a person claiming compensation who is a family member, partner, or unpaid carer of someone who was infected. This claims process has not started yet, so further information will follow

Information you will provide

The IBCA website provides details of the documents you may need to support your claim. This includes documents to prove who you are.

Information NHS organisations will provide

Information from your medical records may be needed to support your claim. If you are claiming compensation on behalf of someone who has died, information from that person’s medical records may be needed. IBCA knows that you may not have this information yourself. When you start your claim, your dedicated claim manager will guide you through what's needed.

If you already have the medical records, you can choose to share them with IBCA. If not, you don't have to find the information yourself. IBCA will contact the organisations that hold the records to ask for the medical information they need.

Types of health information needed

Organisations will only share information that is relevant to your claim with IBCA. This could include:

• information about when you (and, where relevant, the person who infected you if you were not infected through receiving treatment) were infected - for example, evidence of the date of a blood transfusion
• information about when you (and, where relevant, the person who infected you) were diagnosed - for example, evidence of your blood test results, scans or letters to you confirming the diagnosis
• information about if and how your diagnosis changed over time - for example, your initial diagnosis may have led to further complications
• information to support an accelerated claim - for example, medical information to show you are nearing the end of your life

Where you are claiming on behalf of someone who has died, it will be their information requested rather than your own.

No action required by you

You do not need to do anything to ensure that the NHS provides this medical information to IBCA. IBCA will contact the NHS organisations that have provided you (or, where relevant the person who infected you) with care and ask them for the information.

NHS organisations are legally required to provide the information to IBCA. They do not need to ask for your consent before sending the information, even if the information is confidential. If you were infected by someone else, rather than through NHS treatment, the NHS also does not need that person’s consent if it is relevant to your claim. This ensures that your claim is dealt with as quickly as possible.

How your information is used

IBCA will only use information to support your claim. If it wishes to use it for something else, they will have to ask you first. You can read more about how IBCA uses information in their privacy notice.

Information provided to the confidential support service

The Inquiry is funding a confidential support service for anyone affected by treatment with infected blood or blood products. Information that you share with the support service is not made available to IBCA.

Concerns about your information being shared

The NHS is required by law to share information with IBCA to support claims, so you cannot object to this. Your claims manager at IBCA will discuss what information may be needed to support your claim, and you should raise any concerns with them. You can object to IBCA holding and using the information. To do this, you can contact ibca.datagov@ibca.org.uk. IBCA will consider your request, but this may make it more difficult for you to claim compensation.

Further information

You can read more about how the scheme will work on the IBCA website.

NHS England does not hold any information about your claim so will not be able to answer any questions related to this. You can direct any questions to IBCA by emailing ibcaenquiries@ibca.org.uk.

Your organisation will nominate a single point of contact who will coordinate and manage requests for information from IBCA.

To process the claims of those impacted by contaminated blood, blood products or tissue, you may be asked to provide evidence for a specific person claiming compensation. This could be someone you have cared for but could also relate to someone who was cared for by a clinical colleague who previously worked at your organisation.

Common types of information requested

IBCA will have a body of evidence required for each claim, some of which will be provided by the person claiming compensation. Where gaps in evidence are identified, IBCA will need to obtain copies of any evidence required.

You will be provided with the necessary details of the person claiming compensation and the information required. Whilst this will vary for each claim, common types of information requested include:

If the exact evidence cannot be sent, a written statement with a timeline of events can be accepted if it has been signed off by an appropriate clinician.

Patients who are nearing the end of their life may also ask IBCA to consider their claim more urgently. Read the information published by IBCA. IBCA may therefore also ask you to provide information to confirm that this is the case for a patient.

Patient consent not required

Patient consent is not required before sharing information with IBCA for the administration of claims (see Legal basis for sharing in the IG Professionals section below for further information). This includes when providing information to support the claim of someone who has been indirectly infected. For example you do not need consent to share information from a patient’s records to support a claim from that patient’s infected partner.

Timeline to respond

Your organisation’s single point of contact should respond to IBCA within 7 working days, providing:

• the requested data, where this can be obtained within this timeframe
• failing that, an acknowledgement of the request with details of what information is held and where this is currently located, and the estimated time it will take to retrieve and supply this, factoring in your own local processes

Where a person claiming compensation is nearing the end of their life, IBCA will confirm this in their request, and such requests should be dealt with as a priority.

Further support

If you require any further support, contact your IG team or Data Protection Officer (DPO). Your Caldicott Guardian can also provide advice if you have questions.

Single point of contact - action

You should nominate a single point of contact for IBCA to contact in relation to any requests for information relating to compensation claims and send this to ibca.datagov@ibca.org.uk. The single point of contact should be someone who can respond to IBCA within 7 working days, providing:

• the requested data, where this can be obtained within this timeframe
• failing that, an acknowledgement of the request with an estimated timeline for providing the information

You will need to consider within your organisation who is best placed to be the single point of contact, and this is likely to vary from one organisation to another. For example, for some trusts the subject access request (SAR) team may be best placed to manage the request (although requests from IBCA should not be processed as SAR requests, see Legal basis for sharing section below), whereas for others the DPO may wish to coordinate.

For DPOs that support GP practices, you will need to consider who the single point of contact is for the GP practices you support. This could be a single point of contact for each practice or one individual who coordinates for multiple practices.

Once the single point of contact is confirmed, they will need to work through the processes within your organisation for gathering the requested information.

Legal basis for sharing

Victims and Prisoners Act

IBCA has been created through the Victims and Prisoners Act 2024 (VAP), which sets out its duties and obligations.

Section 53 of the VAP provides IBCA with the legal power to require information from NHS organisations when needed to process an infected blood compensation claim.

It also provides NHS providers with a legal power to provide information to IBCA for the purposes of any matter connected with the administration of the compensation scheme, which includes personal data such as medical records or information. The Act imposes a duty upon NHS providers to comply with requests for information from IBCA. Section 53 also allows IBCA to seek a court order in the event a notice to provide information is not complied with.

The requirement to send information to IBCA is not therefore a subject access request on behalf of the patient, or a request under the Access to Health Records Act where the patient is deceased, but a request for information using the statutory powers of the VAP.

Common law duty of confidentiality

Section 53 of the VAP sets aside the common law duty of confidentiality and gives you the legal power to provide the information to IBCA upon request. This includes information relating to deceased individuals where someone is making a claim on their behalf. This means that you do not need the consent of the patient to share information with IBCA. You also do not need a patient’s consent to share information from their records to support the claim of someone who has been indirectly infected, such as a current or former partner.

UK GDPR

Under UK GDPR the legal bases which are most likely to apply are:

Subject access requests

Correspondence from IBCA should not be treated as a subject access request, or a request under the Access to Health Records Act where the patient is deceased (see Legal basis for sharing section).

Patients will be asked to provide medical information to their claim managers where they hold it. They will not be asked by IBCA to contact you directly to request their information, although this does not prevent an individual, or a legal representative on their behalf, submitting a subject access request.

Transparency

You should add information about these sharing requirements with IBCA in your privacy notice and signpost to IBCA’s privacy notice so that patients can find out more about this sharing.

NHS England has developed a privacy notice template that you can use to develop your wider privacy notices, and some recommended wording below that you can include:

You can also refer individuals to the patient section of this guidance.

Nature of the information required by IBCA

IBCA will have a body of information required for each claim, some of which will be provided by the person claiming compensation.

Where gaps in evidence are identified, IBCA will contact your single point of contact to obtain copies of any evidence required. They will be provided with the necessary details of the person claiming compensation and the information required.

The single point of contact will consider how best to source the information requested (see the common types of information requested paragraph of the Guidance for healthcare workers section above for further information).

Verifying validity

At this time, IBCA is processing the claims of individuals who have chosen to register with the 4 national Infected Blood Support Schemes (IBSS). You do not require any further evidence that IBCA is acting on behalf of the person claiming compensation given that individuals have decided to apply for these schemes and IBCA would not be processing a claim without their authorisation.

IBCA has processes in place to verify the identity of the individual. This includes checking identity documents from the person claiming compensation. You should not therefore repeat this process with the patient.

All correspondence from IBCA will come from an email address ending in ibca.org.uk. IBCA has been assigned an Organisation Data Service (ODS) code of Y2Y5B – INFECTED BLOOD COMPENSATION AUTHORITY.

Correspondence from IBCA will set out clearly their powers for requiring their information.

If you have any questions about the request itself, for example if your records had slightly different details to the information requested you should contact the claim manager for clarification. You should also speak to your Caldicott Guardian if you have any concerns.

Timeline to respond

It is important to provide information to IBCA as soon as possible to avoid any delay to a claim for compensation. Where a person claiming compensation is nearing the end of their life, IBCA will confirm this in their request, and such requests should be dealt with as a priority. The single point of contact should respond to IBCA within 7 working days, providing:

• the requested data, where this can be obtained within this timeframe
• failing that, an acknowledgement of the request with details of what information is held and where this is currently located, and the estimated time it will take to retrieve and supply this. For example, if records are held off site, then you will need to factor in the time to retrieve them into your estimated timeline

Whilst recognising that organisations are managing multiple requests for information simultaneously which can create a significant burden, your support in responding to correspondence from IBCA promptly would be valued.

IBCA’s own compliance with data protection laws

IBCA will ensure that their processes and sharing are compliant by:

• ensuring that correspondence includes details of:
  • the information required
  • the lawful basis for requiring the information and
  • why the information is necessary, proportionate and relevant
• only requiring information on behalf of a person claiming compensation where the information is needed to support a claim, and after its necessity has been discussed with the person claiming compensation
• ensuring that all claims managers and IBCA staff processing personal data have been adequately trained on their role and responsibilities in relation to data protection
• ensuring that personal data is only processed for the purpose of administrating the compensation scheme. Further details about the specific purposes of processing can be found in their privacy notice
• providing access to transparency information on how IBCA processes personal data, through their privacy notice, including details of how data subject access rights requests and complaints are managed

Security of the information

IBCA has put in place security measures to ensure the security of the information they receive. These include:

• data encryption: to ensure that data is protected both in transit and at rest. Files are currently shared between organisations via the Egress system. IBCA has recently been assigned an Organisation Data Service (ODS) code of Y2Y5B – INFECTED BLOOD COMPENSATION AUTHORITY and is also applying for the DCB1596 NHS Secure Email Standard to improve efficiency and security of information sharing
• firewalls and intrusion detection systems: to ensure the prevention of unauthorised access to systems and data
• access controls: restricting access to data based on need-to-know principles with managed and approved authorised access
• data backups: to ensure that data can be recovered in case of system failures
• pseudonymisation: where appropriate removing or masking personal data identifiers
• antivirus and anti-malware software: protecting against malicious software
• audits: IBCA also has its own quality team that carries out audits for the infected blood compensation claim process, to ensure all legislation and compliance requirements (including data protection) are adhered to

For most cases, IBCA will retain the information they receive for 8 years. There may be exceptions to this for example where there was a late diagnosis. IBCA will delete the copies of information it holds at the end of the retention period.

Documenting the sharing

It is good practice to document this data sharing on your organisation’s information asset and data flow register.

Further information

NHS England guidance on the importance of retaining information that might be required in connection with the Infected Blood Compensation Scheme and support schemes.