1 Confidentiality and data use in the NHS in Scotland Rod Muir, ISD

2 NHS Scotland data needs Joined up care-of individuals (clinical) and populations (public health) Quality of care (to measure & improve) Audit and research Planning, performance management and administration

3 Legal and ethical framework Common Law Data Protection Act 1998 Human Rights Act 2000 Professional Guidance-GMC Nov 2000

4 CSAGS Confidentiality and Security Advisory Group for Scotland – September 2000 to April 2002 “To provide advice on the confidentiality and security of health related information to the Scottish Executive, the Public and to Health Care Professionals.” Final report 25 th April

5 Informing Staff, Patients & Public Consent Anonymisation Security Legislation Main Themes

6 Informing - conclusions staff awareness of legal, professional & organisational requirements patients' right to know how information may be used practical & integral to care general or specific according to need

7 national advertising campaign for staff, patients & public ‘generic’ information leaflet informing at point of contact –condition specific? Informing - recommendations

8 Consent - conclusions effective information is a pre-requisite explicit consent is ‘best practice’ & should become norm some areas - implied consent currently acceptable right to opt out - implications & operational impediments

9 Consent not required a. Legal Requirement eg notifiable diseases; Abortion Act b. Legal Defence eg to protect life or prevent serious injury; notification to DVLA c. Anonymised eg personal identifiers removed

10 Implied consent acceptable a. NHSS Patient Care b. NHSS Operational Management & Public Health (maintaining quality and probity) e.g. planning; managing; funding and auditing; where identifiable data cannot be anonymised c. Multiple uses (if cannot be anonymised) eg disease registries; epidemiology; national data banks But informing is essential

11 Prior consent required a. Multi-agency care eg sharing data with Social Work; referrals to Nursing Homes b. Research using identifiable data eg clinical trials c. Education and Training eg identifiable patient records used to lecture medical students

12 if anonymised - inform only central anon service feasible national standards local NHS boards should be able to chose to use the central or their own service improve the supply of data legislative issues Anonymisation - conclusions

13 Current confidentiality arrangements Confidentiality Guidelines/ Rules Staff Contracts Restricted staff have access to PID Caldicott Principles/ Guardian Data protection Officer/ ITSO Research Ethics Committees Privacy Advisory Committee

14 Audit programmes - implications Data controllers Data subjects - informing Data processors Data uses

15 CSAGS has issued recommendations Steady improvement in systems in the key Know the rules Inform Respect Conclusions

16 Data protection: CSAGS report: pdf Training package: IT security: More information?