1. Confidentiality Policy
Jim Shannon
Confidentiality Policy Manager
NHS Connecting for Health

2. AGENDA
Confidentiality Strategy
NCRS Access Controls
IG Review

3. A Confidentiality Strategy for the NHS – DH 2001
Confidentiality Code of Practice
Public Awareness Campaign
Anonymisation Services for Secondary Uses
Implementation of robust access controls for electronic records

4. Strategy - Objectives
achieve informed consent to the use of information that individuals provide in confidence to the NHS
ensure the NHS processes all personal information fairly and lawfully
Communications Strategy
- Care Record Guarantee
- phased rollout will include information sent directly to all households
Section 60
- Patient Information Advisory Group set up under the Health and Social Care Act 2001
- can authorise the use of confidential health information without consent for specific health related purposes such as research
- originally envisaged as a temporary measure until SUS fully operational
- may now be a longer term requirement as research community arguing that there will always be a need for at least some identifiable data to be used in research without consent
Secondary Uses Service (SUS)
- Already received a presentation this morning
Communications Strategy
NCRS
Section 60
Secondary Uses Service

5. Confidentiality Code of Practice
Confidential patient information should only be used for direct care unless:
Express consent has been gained
On balance, the public interest requires disclosure
Disclosure required by statute or the Court

6. Public Awareness Campaign: Information Governance aspects
Builds confidence in the safeguards and controls
Supports local work to inform patients as required by confidentiality obligations & Data Protection Act
May generate local interest in confidentiality and choices available

7. Care Records Guarantee
Adopted by the Care Records Development Board
Guarantee underwritten by the Secretary of State for Health
Partly aspiration but a clear vision of a confidential service facilitated through Information Technology

8. Secondary Uses Service
Increased emphasis on confidentiality
Gradually increasing capacity to meet secondary uses through SUS rather than through local disclosure

9. NCRS Access Controls
Patient
Clinician
Others

10. Patient Controls
Opt Out
Dissent to Sharing
Patient Sealed Envelopes

11. Clinician Controls Authentication & Registration
Role Based Access Controls (RBAC)
Legitimate Relationships (LRs)
Clinician Sealed Envelopes

12. Other Controls
Smart Card & PIN
Audits & Alerts
PDS ‘Stop Notes’

13. NCRS – Implementation Approach
National Application Service Providers (NASP)
Local Service Providers (LSPs)
Working with suppliers to implement new systems and services in planned phases
National Application Service Providers
are responsible for purchasing and integrating IT systems common to all users nationally
Local Service Providers (LSPs) will
deliver IT systems and services on a local level for five regional clusters of strategic health authorities
supply and integrate systems to perform functions in the local setting and to interface with the national system
NHS CFH’s five regional clusters

14. National Application Service Provider
Data services for secondary uses (SUS)
Personal Spine Information Service (PSIS)
Electronic Transmission of Prescriptions (ETP)
Personal Demographic Service (PDS)
Clinical Spine Application (CSA)
Choose and Book
Delivers national services
Transaction Messaging Service
Processes all messages
Authenticates users
Access Control Framework
Local Service Providers
NSTS = PDS (demographic info)
NWCS = Transaction & Messaging
HES = SUS → H & SC Info C
In due course all info in PSIS will be made available to patients through Healthspace available via the web or digital TV
More info in your packs – IT in 21C
Also there is a more up to date document called prog initiation doc though rather more detailed than members need.
Deliver a range of local functionality
Local Instances
Care and services for patients
A cluster

15. NCRS – LSP ‘instance’ strategies
London – 1 for the whole cluster
NW&WM – 1 per current SHA (6)
NE&YH/EM&EE – multiple across different communities and different care settings. Possibly virtual instances created to support wider sharing
SW/SE – 10 over the cluster

16. Harry Cayton IG Review CMO to become Caldicott Guardian
Strengthened governance in NHS
Increased support for Caldicott Function (UK Caldicott Guardian Council)
New National IG Board

17. Questions
? ? ?