Information Sharing Gateway Kevin Whittaker University Hospitals of Morecambe Bay NHS FT On behalf of Lancs & Cumbria IG Group

The challenge The ICO Information Sharing COP

Information Sharing COP The ICO Information Sharing COP – May 2011Information Sharing COP The response - Data Sharing Agreements – Administrative burden – Wheels being reinvented – High level signatures required – Difficult, difficult, difficult The result – Organisations struggle to comply – DSAs often written and signed retrospectively

The plan Let’s build a Mercedes system

The original concept – late 2013

Build trust - but know your risks A system built around IG Assurance Adherence to robust process (as recommended by ICO) i.e. risk assessment of dataflows Deployed at scale Shared approaches – sector agnostic ‘Good enough’ links to Privacy Monitoring (the new audit) & Consent

by IG leads, for IG leads Work electronically, aligned with Project Management Organisations register and provide assurance by organisation Facility to sponsor organisations Sign up to common standards of working (Tier 0/1) Capture, risk assess and approve flows in a system Manage, report and review flows in the system Understand where your risks are Publish the flows so transparency for public ‘Invest time in actions that add value’

Who was involved? thanks to Development Group - health (acute / specialist / MH/CCG), NWAS, LAs, Police reps from L&C IG Group UHMB Project Team and Developer IG Consultant (former ICO) Agile Development started November 2014

The solution The Information Sharing Gateway

Where are we now? 2 websites (sandpit and live) Organisational registration, IG assurance, sponsorship and role based assess live MoU sign up live (the new ‘Tier 1’) Asset register (shop window) live Internal data flows as well as shared (for one stop reporting) live Risk assessments (Privacy Impact, security) live Admin groups ready to go Implementation > 300 orgs iNetwork Innovation Award winners November 2015

Benefits “Normalises” recording of information flows, PIA and information sharing agreements and without sector specific language so all types of organisations can use it Allows IG staff to focus on support for smaller organisations /front line teams /new projects Supports reuse of agreements around ‘often used’ technologies with minimal fuss / amendments Owned by participating organisations so they can use as they wish Supports IG compliance and breach management

Where is it? is our ‘work in progress’ sandpit system (to test new functionality with dummy data) have a look – try it Please get in touch

The future Openness and integration

Patient / service user view Who has access to my records and data (searchable API) For what purpose? What safeguards are in place?

APIs and integration Develop an API to allow integration with sharing platforms Q – Sharing Platform – Does this organisation have a sharing agreement with that organisation to share this data for that purpose? A – Information Sharing Gateway – Yes