NHS Central Register (NHSCR) Privacy Notice

Home
Publications
NHS Central Register (NHSCR) Privacy Notice

Share this page

Click here to share this page on Facebook. Click here to share this page on LinkedIn. Click here to share this page on X (formerly known as Twitter).

What is the NHS Central Register?

The National Health Service Central Register (NHSCR) is a confidential population database containing information about people who were born or died in Scotland and persons currently registered or persons who have previously been registered for NHS healthcare purposes with Scottish General Practitioners (GPs). The 1939 National Register was used as the foundation for the NHSCR. For more information about the NHSCR click here.

Who are we?

The NHS Central Register (NHSCR) is part of National Records of Scotland (NRS), a devolved non-ministerial government department headed by the Registrar General of Births, Deaths and Marriages for Scotland. The Registrar General is the controller for the personal information we process. They can be contacted via our Data Protection Officer, whose address is at the end of this notice.

What personal information do we process in the NHS Central Register?

The table below shows the personal information that is processed in the NHSCR. The information that can be contained in the NHSCR is determined by legislation and does not come from publicly accessible sources. The NHSCR may receive the same personal information from different sources across the UK when there is an update to a patient’s record. For example, NHS numbers can be created by NHSCR or received from NHS Digital or Business Services Organisation (BSO) Northern Ireland for patients moving from elsewhere in the UK into Scotland.

Personal Information	Description	Source	What do we use it for?
Community Health Index (CHI) Number	Your Community Health Index number which is unique identifier used by the NHS in Scotland. Each individual has a unique CHI number.	NHS National Services Scotland (NHS NSS) – CHI database	To allow NHSCR to link with CHI records that contain amendments to patient records so that NHSCR records are updated accordingly
NHS Number	For babies born in Scotland, the civil registration number of their birth. A special number given to a patient who was born in the rest of the UK.	NRS – NHSCR NHS England – Patient Demographic System (PDS) Northern Ireland Business Services Organisation (BSO) – Open Exeter	Patient identification and linkage.
Unique Citizen Reference Number (UCRN)	A unique, number associated with one unique individual.	UCRN is generated by NHSCR from the NHS number.	To identify and link to individuals in myaccount.
Surname, forename(s) and any middle name(s)	Your Name as registered with your GP and/or Birth certificate and/or death certificate.	NRS Registration NHS NSS - CHI database NHS England - Patient Demographic System (PDS) Northern Ireland BSO - Open Exeter	Patient identification and linkage.
Any previous names	Previous names	NRS Registration NHS NSS -Practitioner Services Division (PSD) and CHI database NHS England - Patient Demographic System (PDS) Northern Ireland BSO - Open Exeter	Patient identification and linkage.
Mother’s birth surname	Mother’s surname at her birth as registered on her child’s birth certificate.	NRS Registration NHS NSS – Practitioner Services Division (PSD) and CHI database	Patient identification and linkage.
Sex	Sex at birth as registered on your birth certificate. Sex as registered with your GP.	NRS Registration NHS NSS – Practitioner Services Division (PSD) and CHI database	Patient identification and linkage.
Date of birth	Date of birth as on your birth certificate or as registered with GP.	NRS Registration NHS NSS – Practitioner Services Division (PSD) and CHI database	Patient identification and linkage.
Country of birth	Your country of birth relating to place of birth in Scotland as registered on birth certificate.	NRS Registration NHS NSS – Practitioner Services Division (PSD) and CHI database NHS England - PDS Northern Ireland BSO – Open Exeter	Patient identification
Postcode	Postcode of the address you currently have registered with your GP or local authority or death certificate.	NRS Registration NHS NSS – CHI database Improvement Service – myaccount	Patient identification and linkage.
Unique Property Reference Number (UPRN)	A unique number associated with one unique property.	Improvement Service – myaccount	Patient identification.
Date of enlistment for UK Armed Forces Personnel	Date when personnel enlist with UK Armed Forces.	NHS England	To inform PSD that individuals are no longer registered with an NHS GP.
Date of discharge for Armed Forces personnel	Date when ex-armed forces personnel re-register with NHS GP.	NHS NSS – PSD NHS England – PDS Northern Ireland BSO - Open Exeter	Movement of medical records.
Current Health Board and equivalent geographical information for rest of the UK and Armed Forces personnel and their families	Geographical Area of current GP registration.	NHS NSS – PSD NHS England – PDS Northern Ireland BSO – Open Exeter	Patient identification. Movement of medical records.
Any previous Health Board and equivalent information for rest of the UK and Armed Forces personnel and their families	Health Board code for GP practice where patient was registered in the past.	NHS NSS – PSD NHS Digital – PDS Northern Ireland BSO – Open Exeter	Patient identification.
Medical research flags	Medical research flag indicating that record is included in a Health and Social Care Public Benefit and Privacy Panel (HSC-PBPP) approved medical research project	PHS Cancer Registry NRS Vital Events	Medical research
Date of Death or when contact with the patient has ceased	Date of death as on registration certificate. Date when patient ceases to be registered with a GP.	NRS Registration NSS – CHI database NHS Digital – PDS Northern Ireland BSO – Open Exeter Ministry Of Defence Office of National Statistics	To update UK Health databases and myaccount so that patient services cease.

Why do we collect your personal information?

UK legislation allows NRS to keep and maintain the NHSCR for the following reasons:

to record NHS patients that register with GPs in Scotland and record patient moves between Health Boards in Scotland.
to trigger the movement of patient medical records between Health Boards in Scotland and Health Authorities in England and Wales, notified by NHS England, and Health Authorities in Northern Ireland, notified by Business Services Organisation (BSO).
to provide information to medical researchers for studies approved by the Public Benefit and Privacy Panel
to provide to Scottish local authorities a unique reference number which is used to identify people on the database of council customers. Councils are also provided other entries for a customer as allowed under The National Health Service Central Register (Scotland) Regulation 2006. This allows councils to increase its data quality and to facilitate the creation of a ‘myaccount’ for an individual.
In maintaining the NHSCR Database, NRS quality assures the data for all demographic elements (such as Sex, Date of Birth, Postcode) of information provided by GP registration. This includes checking the data against Civil Registration Statutory Registers (Births, Marriages and Deaths), NHS England and Northern Ireland BSO systems.

What do we also use your data for?

Extracts from the NHSCR are also used by NRS for the following purposes:

To create and maintain the NRS Population Spine which is used for matching purposes by the NRS Indexing Team, who provide the trusted third party indexing service for data linkage in Scotland.
To produce official statistics on population and migration; to produce statistical research outputs on Administrative Data Based Population Estimates; and for census estimation and adjustment.
For the Scottish Longitudinal Study (SLS) which is a large-scale linkage study created using data from administrative and statistical sources. The SLS is a joint project between NRS and the University of Edinburgh.

What is our lawful basis for processing your data?

NRS’s lawful basis for processing is UK GDPR Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”

Our conditions for processing sensitive information about you, are as follows:

UK GDPR Article 9(2)(h) the processing is necessary for the purposes of preventive or occupational medicine, the provision of health or social care or treatment or the management of health or social care systems and services, supported by Schedule 1, Part 1, paragraph 2 of The Data Protection Act 2018
UK GDPR Article 9(2)(j) - the processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes, supported by Schedule 1, Part 1, Condition 4 of the Data Protection Act 2018.

Who do we share your information with?

The NHSCR is a confidential database, accessible only to the organisations or individuals listed in legislation. The information which may be provided from the NHSCR to these bodies or individuals is the minimum necessary for them to do their work and is determined by legislation. So, for example, local authorities are not provided with the restricted medical research information on the NHSCR as they do not need it.

These bodies, and the information which they are securely provided with are listed below:

Body	Personal information shared	Why shared
NHS NSS	Any information held on NHSCR	To provide update to patient records on the Community Health Index (CHI) which enables health service provision in Scotland.
Health authorities in the rest of the UK	Any information held on NHSCR, except postcode and UPRN	Patient identification
NHS England and Health and Social Care Northern Ireland (HSCNI)	Any information held on NHSCR, except postcode and UPRN	Movement of patient medical records
The Office of National Statistics	Any information held on NHSCR, except postcode and UPRN	Production of official statistics
A researcher from an academic or health institution conducting a medical research project that has been approved by the Public Benefit and Privacy Panel for Health and Social Care	Any information in research request approved by the Health and Social Care Public Benefit and Privacy Panel	Medical research
The Improvement Service and Scottish local authorities	For people who have agreed to be added to the local authority’s database: NHS number, CHI number and any other information (except postcode and address reference code) which does not match the information provided to the local authority by the person	Identity verification
The Ministry of Defence and the armed forces	The NHS numbers of armed forces personnel and their dependants	Movement of patient medical records
Police forces in Scotland, England and Wales or Northern Ireland, the Scottish Drug Enforcement Agency, the Scottish Crime and Drug Enforcement Agency or the Security Service	Any information requested in relation to the prevention or detection of serious crime, to the apprehension or prosecution of those suspected of having committed such crime or to national security, except medical research information	Prevention or detection of serious crime, to the apprehension or prosecution of those suspected of having committed such crime or to national security
Any practising solicitor or charitable body	The fact that an individual's information is contained on the register, or fact and date of death	Identity verification

Each body listed above will become a data controller upon the receipt of the data and each will have their own lawful basis to process your data. For more information on their lawful basis to process your data please refer to the websites of the respective organisations to view their privacy notices.

Where is your data stored?

Data held on the NHSCR database is stored securely within the UK.

How long is your data stored for?

The data held in the NHSCR database is stored forever for the purposes explained above.

Your data protection rights

Under data protection law, you have rights including:

The right to be informed
The right of access – you have the right to ask us for copies of your personal information.
The right to rectification – you have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
The right to restriction of processing.
The right to object.
The right to lodge a complaint with the Information Commissioner’s Office (The ICO)

Not all of your rights may apply in all circumstances and we will deal with requests on a case by case basis. For example, the right to data portability and right to erasure do not apply as we are processing data under Article 6(1)(e) of the UK GDPR. Neither do rights in relation to automated decision-making apply as there is no automated decision making made by NRS using the NHSCR data.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us dataprotection@nrscotland.gov.uk if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information you can contact our Data Protection Officer at:

Email: dataprotection@nrscotland.gov.uk

Address:

Data Protection Officer,
National Records of Scotland ,
HM General Register House,
2 Princes Street,
Edinburgh,
EH1 3YY

Phone Number: 0131 202 0451

You also have the right to report your concerns or to complain to the Information Commissioner’s Office (ICO).

For more information visit the ICO’s website: https://ico.org.uk/concerns

ICO Address:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

ICO Phone number: 0303 123 1113

Link to the NRS Privacy Notice

The NRS Privacy Notice can be viewed on our website here

Changes to this privacy notice

We keep our privacy notice under regular review to make sure it is up to date and accurate. This Privacy Notice was last updated on 27 September 2024.

Glossary

CHI database

CHI Number

Health and Social Care Public Benefit and Privacy Panel (HSC-PBPP)

Identity Verification

Linkage

myaccount

NHSCR

NHS NSS

NHS Number

NRS Registration

Open Exeter

Patient Identification

Patient Demographic Services (PDS)

Practitioner Services Division (PSD)

UCRN

UPRN

Contact details