An update from the Department of Health Lorraine Jackson Deputy Director for Data sharing and Cyber security Department of Health 22 November 2016

The National Data Guardian’s Review on Data Security, Consent and Opt-Outs The National Data Guardian Review was published in July 2016, and the consultation started immediately after. The National Data Guardian’s recommendations focussed on two key areas: Strengthening data security: 10 new data standards Data sharing: a new opt-out model which is intended to replace all existing opt-outs in order to give patients a simpler set of choices. It accompanied the CQC Review which addressed: Current approaches to data security in the NHS.

Consultation The consultation ran from 6 July 2016 to 7 September 2016. Approx. 500 professional and public stakeholders were engaged and signposted to the consultation exercise. There were 638 responses to the consultation in total. Events were held, with sessions for professionals and for the public. The consultation engagement events had 178 attendees in total: 111 professionals (including those working in direct care, and IG and IT practitioners) 67 members of the public

What we heard: The Data Security Standards Support: Support from all key stakeholders for the Data Security Standards. Many helpful examples provided about data security best practice. Consensus that data security is about good leadership, from board level, through to all members of staff. More to think about: How best to support organisations of various sizes and across health and care through implementing the new standards. Making the standards as clear and understandable as possible. The IG Toolkit needs to be adapted.

Information Governance and Data Security People Process Technology

What we heard: The proposed Opt-Out Model Support: Broad support for the proposed Opt-Out model. Clear appetite for improving public understanding, and for good communications. Overwhelming support for the proposal to impose criminal sanctions for deliberate / negligent re-identification of data. Agreement that the Opt-Out should not apply to anonymised information. More to think about: The Consultation also gave us lots to think about, such as: How / whether to include patient surveys and the cancer registry in the new opt-out How best to manage Type 1 opt-outs

Next Steps Taking the time to get it right Setting up the supporting framework: Putting the role of National Data Guardian on a Statutory footing Regulations to support implementation Immediate focus on prioritising data security standards and support Further engagement and dialogue: Assess and manage the impact of implementation Support practitioners through implementation Helping patients to understand how their information is used and what choices they have Preparing for implementation: Working with professionals to communicate any future change Learning from others Next Steps Taking the time to get it right

Supported by Independent Oversight The National Data Guardian Confidentiality Access Group Data Access Advisory Group

The Role of the Information Governance Alliance: Information Governance is a difficult and complex landscape. The IGA continues to be the single authoritative source of guidance for the health and social care see system and the Department of Health remains a full and committed partner to this. The development of the IGA Guidance on anonymisation will be a vital cornerstone for the implementation of the National Data Guardian recommendations. We will need to work with the IGA, along with the NIB and others, in order to map out the best path to implementation.