1. Data access for public health, the current position, next steps and implications of Caldicott 1 Presented by Andy Sutherland

2. Health and Social Care Act 2012 –Creates new organisation - ENDPB –Grants HSCIC new powers and responsibilities to collect, analyse and publish information as national repository of all health and care data –A statutory safe haven –Can legally process patient identifiable/ confidential data (PCD) –Can be mandated and required to collect data and develop systems (s254, 255 of the HSC Act 2012) –Required by the Act to develop a mandatory Code of Practice for handling confidential information –Requires those seeking information collections to first consult the HSCIC –Identifies HSCIC role to undertake Data Quality Assurance –Requires HSCIC to undertake assessment of Burden of data collections

3. Establishing Information Systems HSCIC

4. The Changing Landscape Clinical Commissioning Groups (CCGs) – taken on the commissioning duties of PCTs Commissioning Support Units (CSUs) – process data for CCGs and part of NHS England Local Area Teams (LATs) – part of NHS England responsible for Specialist Commissioning Data Services for Commissioning (DSC) – regional offices of HSCIC, therefore able to process identifiable data under the H&SC Act PH in PCTs moved to Local Authorities

5. Code of Practice for Confidential Information Section 263 of the HSC Act states: The Information Centre must prepare and publish a code in respect of the practice to be followed in relation to the collection, analysis, publication and other dissemination of confidential information concerning, or connected with, the provision of health services or of adult social care in England.

6. Code of Practice for Confidential Information A statutory code Applies to all bodies processing confidential health and social care information about patients in England Large stakeholder group assisted in development Must be approved by Secretary of State and NHS Commissioning Board Contains 10 principles for handling confidential information about individuals Takes into account recommendations of Caldicott Review

7. Data Flows

8. Access to personal confidential data (PCD) Need: A legal basis for processing PCD (data collected for medical purposes) – either: –Consent –Statute –Other legal gateway e.g. s251 –Overriding public interest A justifiable purpose To only process the minimum data required for the purpose and only process PCD if no practicable alternative To inform people whose data is being processed and give them the right to opt out In most instances anonymised or aggregate data should be sufficient

9. Public Health access to PCD Some functions covered by: s251, NHS Act 2006 Regulation 2, The Health Service (Control of Patient Information) Regulations 2002 – relating to Cancer Regulation 3, The Health Service (Control of Patient Information) Regulations 2002 – relating to PH

10. Regulation 3 Control of Health Services Information Regulations 2002 Sets aside common law duty of confidence for certain PH activities –Diagnosis of communicable disease and other risks to public health –Recognising trends in such diseases and risks –Controlling and preventing the spread of such disease and risks –Monitoring and managing- Outbreaks of communicable disease Incidents of exposure to communicable diseases Delivery, efficacy and safety of immunisations programmes Adverse reactions to drugs and medicines Risks of infection to from food or the environment Giving information to persons about the diagnosis of communicable disease and risks of acquiring such disease Access issues post NHS reorganisation No legal basis to process PCD other than the 2002 Regulations Regulations do not give Local Authorities same legal basis for processing PCD as PCTs had with some exceptions Access issues – LAs and N3

11. Steps being taken to address access issues PHE working closely with LAPH to understand data requirements PHE working closely with NHS E, HSCIC and DH to understand data available and access Working group looking at defining Reg 3 and legal basis for data processing

12. Caldicott Review 2 Report published 26 th April DH’s response expected this month (July) Chapter 8 - Recommendation 13 – DH commission stakeholder group to consider whether additional regulations required