Information Sharing for Integrated Care A 5 Step Blueprint

Five Steps 1.Leadership 2.Governance 3.Stakeholder engagement & robust IG 4.Technical Solution 5.Implementation Key to Success Visionary leadership supported by effective IG expertise

Step 1: Leadership Two to five leaders from organisations seeking to deliver integrated care need to establish the project and drive it forward, setting out a clear vision for what they want to achieve and the role of information in accomplishing this. Step 1 deliverables: The scope of the project and its specific objectives A vision for how information sharing will enable the achievement of those objectives Broad understanding of what will be required to achieve the stated objectives Between two and five ’sponsors’ – who may come from commissioners, providers, CSU, patient groups or elsewhere – enthusiastic leaders who are well-respected within the locality and who are committed to dedicating the necessary time (at least a few hours each week) and fully supporting the programme to achieve buy-in If not included amongst the initial sponsors, identify clinical/service leaders who support and are willing to champion the project Initial meetings of the information governance experts who will support the work – it is essential to involve these staff early and to focus them on supporting delivery Broad understanding of the steps ahead and an achievable high-level timeline by which to accomplish them by

Step 2: Governance & Principles The Leaders oversee the formation of a wider governance group across providers and other interested parties. It sets out clear and immediate objectives and a governance structure. Step 2 deliverables: The established governance structure for the effort (either part of an existing governance structure or a newly created one) The formal decision-making group (e.g. a board) with all major representatives across commissioners (both NHS and local authority) and providers An information sharing and IG work stream with IG representatives from all participating organisations Privacy impact assessment to ensure appropriate information governance controls A clear legal basis for processing personal data and/or confidential personal data Agreed terms of reference and principles – Tier 1 Information Sharing Agreement or Data Controller agreement signed by participating organisations Necessary resources secured Assigned roles and responsibilities The established schedule of regular interactions An agreed high-level roadmap/information sharing strategy with implementation milestones An updated vision statement.

Step 3: Stakeholder Engagement & robust IG The team establishes all applicable information governance requirements, including identifying appropriate legal bases for sharing data and implementing the necessary steps to ensure the requirements are met (e.g. putting in place data sharing agreements). It also secures the clinical buy-in required from all (or most) of the providers and ensures proposals are supported by groups representing the interests of citizens etc. Simultaneously, the specifications of the data to be shared should also be determined. Step 3 deliverables: Getting at least 80% of GP practices on board with signed Tier 2 data-sharing agreements (if GP data is needed for the project) A defined data specification for each relevant provider Data-sharing agreements signed with all major providers Communications strategy drafted and tested with patient groups and professional representatives Consent process agreed

Step 4: Designing the Technical Solution The leadership team decides on and commissions a technical solution that is best suited to the immediate requirements of the dataset. Step 4 deliverables: A clear view of the limitations of the proposed solution and the trade-off analysis of the benefits of additional features versus additional investment required Clarity on how requirements stemming from the Privacy Impact Assessment will be met An approved business case for investment (if necessary) An implementation roadmap to put the solution (tools, data warehouse etc) in place Clarity about the respective roles and responsibilities of the HSCIC DSCROs, CSUs and others involved in the data processing pathway A choice of a third-party provider/vendor to deliver the tools and/or data warehouse solution (if needed) or a procurement process in place to choose a solution Agreement on auditing requirements to identify weaknesses and areas needing support and improvement

Step 5: Implementation The project team ensure all actions are taking prior to implementation Step 5 deliverables: Satisfactory information governance toolkit assessments against the appropriate requirement views from all participating bodies Confirmation that all risks identified in the Privacy Impact Assessment have been addressed A system security policy signed off an adopted by participating organisations Staff informed and trained appropriately Consent process implemented Communications strategy – fair processing and informing for consent - implemented Access to information governance support for the team Agreement on business as usual arrangements covering new organisations joining, changes to the data shared, periodic review of IG products (e.g. Information sharing agreements, information security policy etc)

Step 1 Leadership Step 2 Governance Step 3 Stakeholder Engagement Step 4 Technical Solution Step 5 Implement Information Sharing Strategy Business case (if needed) Governance Board Terms of Reference Hosting procurement (if needed) Implementation Roadmap Shared Vision High level plan Communications Strategy Implemented Staff Training Required Products: System Leader Responsibilities Business as usual arrangements Specific Objectives Stakeholder map and engagement plan Communications strategy in draft Data Specification for each provider

Step 1 Leadership Step 2 Governance Step 3 Stakeholder Engagement Step 4 Technical Solution Step 5 Implement Information Sharing Strategy Tier 2 Information Sharing Agreements Satisfactory IG Toolkits IG work stream Terms of Reference Tier 1 Information Sharing Framework Agreement Consent process implemented Consent process agreed Required Products: IG Experts Privacy Impact Assessment Audit Plan Business as usual arrangements System Security Policy Data Flow map & legal basis agreed