Confidentiality Policy Jim Shannon Confidentiality Policy Manager NHS Connecting for Health

AGENDA Confidentiality Strategy NCRS Access Controls IG Review

A Confidentiality Strategy for the NHS – DH 2001 Confidentiality Code of Practice Public Awareness Campaign Anonymisation Services for Secondary Uses Implementation of robust access controls for electronic records

Strategy - Objectives achieve informed consent to the use of information that individuals provide in confidence to the NHS ensure the NHS processes all personal information fairly and lawfully Communications Strategy - Care Record Guarantee - phased rollout will include information sent directly to all households Section 60 - Patient Information Advisory Group set up under the Health and Social Care Act 2001 - can authorise the use of confidential health information without consent for specific health related purposes such as research - originally envisaged as a temporary measure until SUS fully operational - may now be a longer term requirement as research community arguing that there will always be a need for at least some identifiable data to be used in research without consent Secondary Uses Service (SUS) - Already received a presentation this morning Communications Strategy NCRS Section 60 Secondary Uses Service

Confidentiality Code of Practice Confidential patient information should only be used for direct care unless: Express consent has been gained On balance, the public interest requires disclosure Disclosure required by statute or the Court

Public Awareness Campaign: Information Governance aspects Builds confidence in the safeguards and controls Supports local work to inform patients as required by confidentiality obligations & Data Protection Act May generate local interest in confidentiality and choices available

Care Records Guarantee Adopted by the Care Records Development Board Guarantee underwritten by the Secretary of State for Health Partly aspiration but a clear vision of a confidential service facilitated through Information Technology

Secondary Uses Service Increased emphasis on confidentiality Gradually increasing capacity to meet secondary uses through SUS rather than through local disclosure

NCRS Access Controls Patient Clinician Others

Patient Controls Opt Out Dissent to Sharing Patient Sealed Envelopes

Clinician Controls Authentication & Registration Role Based Access Controls (RBAC) Legitimate Relationships (LRs) Clinician Sealed Envelopes

Other Controls Smart Card & PIN Audits & Alerts PDS ‘Stop Notes’

NCRS – Implementation Approach National Application Service Providers (NASP) Local Service Providers (LSPs) Working with suppliers to implement new systems and services in planned phases National Application Service Providers are responsible for purchasing and integrating IT systems common to all users nationally Local Service Providers (LSPs) will deliver IT systems and services on a local level for five regional clusters of strategic health authorities supply and integrate systems to perform functions in the local setting and to interface with the national system NHS CFH’s five regional clusters

National Application Service Provider Data services for secondary uses (SUS) Personal Spine Information Service (PSIS) Electronic Transmission of Prescriptions (ETP) Personal Demographic Service (PDS) Clinical Spine Application (CSA) Choose and Book Delivers national services Transaction Messaging Service Processes all messages Authenticates users Access Control Framework Local Service Providers NSTS = PDS (demographic info) NWCS = Transaction & Messaging HES = SUS → H & SC Info C In due course all info in PSIS will be made available to patients through Healthspace available via the web or digital TV More info in your packs – IT in 21C Also there is a more up to date document called prog initiation doc though rather more detailed than members need. Deliver a range of local functionality Local Instances Care and services for patients A cluster

NCRS – LSP ‘instance’ strategies London – 1 for the whole cluster NW&WM – 1 per current SHA (6) NE&YH/EM&EE – multiple across different communities and different care settings. Possibly virtual instances created to support wider sharing SW/SE – 10 over the cluster

Harry Cayton IG Review CMO to become Caldicott Guardian Strengthened governance in NHS Increased support for Caldicott Function (UK Caldicott Guardian Council) New National IG Board

Questions ? ? ?