NIGB

1. NIGB NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE Leeds – Birmingham - London Neil Serougi

2. NIGB Today’s workshop – setting the scene • Strategic themes • Preparing for the ‘new world’ • How to do ‘more for less’ • Moving towards solutions • Challenging current thinking • Q&A –Expert Panel NATIONAL INFORMATION GOVERNANCE BOARD

3. NIGB Today’s workshop - housekeeping • Q&A Panel – place your question at registration • Break out sessions • Speed dating – time limited NATIONAL INFORMATION GOVERNANCE BOARD

4. NIGB Context: Changing health & social care landscape NATIONAL INFORMATION GOVERNANCE BOARD Health & Social Care Act 2012 Move from central to local Integration New organisational structures Patient / citizen centred e.g. access to records No decision about me without me Increased competition

5. NIGB Health and Social Care Act 2012 Key considerations NATIONAL INFORMATION GOVERNANCE BOARD Changes to the legal bases for information processing IG roles and responsibilities of organisations in the new landscape Provision for the NHS Information Centre to request confidential patient information from health and social care bodies

6. NIGB Health and Social Care Act 2012Key considerations NATIONAL INFORMATION GOVERNANCE BOARD • Balance between Confidentiality and Information Sharing - risks and issues • Impact of Organisational Change - risks and issues • Regulation in the ‘new world’ • National bodies need to consider whether identifiable information is really needed - Privacy Impact Assessments • Concerns have been raised over interim IG arrangements – NIGB transition guidance (November 2011)

7. NIGB Context: Changing Information Governance landscape NATIONAL INFORMATION GOVERNANCE BOARD Future model development – IG Operating Model IG Review on behalf of the Secretary of State Organisational changes – need to ensure system wide consistency IG Levers

8. NIGB Moving forward: IG levers NATIONAL INFORMATION GOVERNANCE BOARD Contract Terms with providers and the oversight management and enforcement of contractual provisions Information Standards to the extent they are applicable to information governance but they have the benefit of being health and social care system wide CQC registration criteria – currently limited scope in relation to enforcement - future role for NIGC? Legal enforcement through the Information Commissioner’s Office in relation to the Data Protection Act 1998

9. NIGB Future model - practicalities (1) NATIONAL INFORMATION GOVERNANCE BOARD Culture & context – paper records will continue; technology needs to be user friendly – otherwise people will find way to circumvent controls! Storage and retention issues become different in electronic environment – both paper and electronic health records need to be effectively managed Understanding the importance of IG Shared electronic records – will become the norm, with challenges in relation to data controllership, maintaining data quality and the integrity of the record (Royal College of General Practitioners Guidance)

10. NIGB Future model - practicalities (2) • Managing and sharing patient and service user identifiable information for secondary uses – challenges of implementing individual’s wishes • Pressure to make efficiencies through increased use of electronic communication – how to ensure IG adequate and difficulties of doing so in a resource constrained environment • Online patient access can reduce patient demands and increase satisfaction • Telemedicine – useful for some groups / locations • Increased risk from more people with access but also harm from not sharing NATIONAL INFORMATION GOVERNANCE BOARD

11. NIGB Future model – assurance and controls NATIONAL INFORMATION GOVERNANCE BOARD Managing robust access controls where multiple agencies staff need access understanding that “sharing” is “disclosure” Sharing across health & social care – consent and appropriate controls in place to ensure patient / citizen interests are protected Collaboration & engagement Strong IG standards - need to be embedded Use of the Care Record Guarantee – uptake of organisations in health & social care has been varied – future of the CRG?

12. NIGB Future model –enabling patient access to their records NATIONAL INFORMATION GOVERNANCE BOARD Clinician willingness Information about other individuals or provided by other individuals in the record Handling seriously harmful information and when to consider that the potential for serious harm has passed What patients value most is the transactional aspects – booking appointments, requesting repeat prescriptions, getting test results, messaging the GP. Important to do this in a stepped way, perhaps starting with the transactional aspects

13. NIGB NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE #NIGB #HSCIG Leeds – Birmingham - London

14. Information Governance Review Karen Thomson

15. IG Review - Scope Terms of Reference on website Full scope still to be finalised – focus has been on evidence gathering Key issue to address concerns Consent and ensuring that all activities have a secure basis in law IG in the new landscape – how to have effective internal and system wide IG Specific cross-sector IG issues affecting individuals and organisations

16. IG Review - Membership Panel – 15 members in total Process of selection – key areas were identified and then relevant organisations were approached for suggestions Members appointed in their own right not as representatives Monthly meetings Additional evidence gathering sessions

17. Consent and lawful processing • when is explicit consent needed? • what is needed for valid implied consent? • are there activities that need a secure legal basis but for which consent is not appropriate or feasible? • how should they be supported in law? • the consent process – how to seek consent and • what to record • implementation through technical architecture

18. IG Review Process Timetable: intention to feed into NHS Constitution consultation for October Autumn 2012: interim report and then final report Earl y 2013: final report

19. Evidence gathering themes • Linkage and identifiability • Patient and Public rights in law – EU Regulation and what services need to tell people • Workforce education, training and regulation • Issues related to genetic and genome information • Issues related to new and emerging technologies • direct care, including sharing across H & SC and with independent sector • Commissioning • Public Health • LA / Adult, Children and Family Social care uses including safeguarding • Research • Consent

20. Risks and Issues System wide information governance - responsibilities and accountability in multiple sectors – ensuring consistency These organisations all have an interest in obtaining and using information – where is the independent scrutiny and management of conflicts of interest? Are the available levers adequate or effective – can they become so? What needs to be done to assure the public and maintain trust?

21. Next steps Careful thought to working out the practicalities of change Collaboration & partnership Future approach to IG needs to promote excellence in health and social care Consistency of approach across health and social care, research and public health

22. How you can be involved • Happy to receive written submissions by email (or post) • Website in development: • www.Caldicott2.dh.gov.uk • Contact: Fiona.Caldicott@dh.gsi.gov.uk • Office - 020 7972 3734

23. NIGB NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE #NIGB #HSCIG Leeds – Birmingham - London

24. The role of the Information Commissioner’s Office David Evans, Senior Policy Officer

25. The Information Commissioner’s Office is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals

26. What the Information Commissionerresponsible for • Data Protection Act • Freedom of Information Act • Privacy and Electronic Communications Regulations • Environmental Information Regulations • INSPIRE (Infrastructure for Spatial Information in the European Community) Regulations

27. The role of the Information Commissioner • “It shall be the duty of the Commissioner to promote the following of good practice by data controllers and, in particular, so to perform his functions under this Act to promote the observance of the requirements of this Act by data controllers.” S 51 (1) DPA • “It shall be the duty of the Commissioner to promote the following of good practice by public authorities and, in particular, so to perform his functions under this Act as to promote observance of • the requirements of this Act, and • the provisions of the codes of practice under sections 45 and 46.” • S 47 (1) FOIA

28. What do we do • Educate • Decide • Enforce • Prosecute

29. Prosecutions • Former health worker guilty of unlawfully obtaining patient information by accessing the medical records of 5 members of her ex-husband’s family in order to obtain their new telephone numbers - £500 fine & £1,000 costs • Receptionist who unlawfully obtained her sister-in-law’s medical records in order to find out about her medication found guilty – 2 yr conditional discharge & over £600 costs

30. Is it enough? • Former gambling industry worker who unlawfully obtained and sold personal data relating to over 65,000 online bingo players guilty of committing three offences – 3yr conditional discharge, £1,700 compensation & over £800 costs. • Bank cashier illegally accessed the personal details of a sex attack victim. The cashier’s husband had been convicted of carrying out the attack and was jailed - £800 fine & £400 costs. • A personal injury claims company employee guilty of illegally obtaining NHS patients’ information over a four month period - £1,050 fine & £1,160 costs.

31. One that didn’t get away • June 2011 - two former employees of UK mobile operator T-Mobile who illegally stole and sold select customer data from the company in 2008 ordered to pay a total of £73,700 in fines and confiscation costs or serve prison sentences by default.By January 2012 – paid up in full! • Carried out under the Proceeds of Crime Act and the ICO gets a proportion of this to use for the prevention and detection of crime

32. Enforcement • Feb 2012 – Staffordshire County Council – “failed subject access”. • Dec 2011 – Powys County Council – Enforcement and Civil Monetary Penalty. - CMP – data breach - Enforcement – to compel training to ensure no repeat of the data breach • Undertakings – committing an organisation to a particular course of action in order to improve its compliance

33. Decisions • Freedom of Information • Dept of Health’s transition risk registers • Cost of the swine flu vaccination programme • Copies of papers from the “closed” sessions of the meetings of a Foundation Trust board • Compelling the CQC to provide “advice and assistance” to an FOI requestor • MP’s expenses

34. Educate • Codes of Practice • Guidance • Audits • Work with stakeholders • Advice - telephone helpline - respond to written enquiries - suggest how to deal with issues that are identified through case work

35. Codes of Practice • CCTV Code of Practice (2008) • Assessment Notices Code of Practice (2010) • Data Sharing Code of Practice (2011) • Employment Code of Practice (revised 2011) • Personal Information Code of Practice (2010) • Privacy Notices Code of Practice (2010) • Anonymisation Code of Practice – currently under consultation

36. Guidance - DP • The Guide to Data Protection • Guide to ICO data protection audits • Identifying data controllers and data processors • Training checklist for small and medium size organisations • Monetary penalties – statutory guidance • Privacy be design - Privacy impact assessments - Privacy enhancing technologies • Subject access to health records by members of the public

37. Guidance - FOI • The Guide to Freedom of Information • When is information caught by the FOI Act • Access to information about public authority employees • Access to information about the deceased • Destruction of requested information • Detailed guidance on individual exemptions • Freedom of information and research • The prejudice test • The public interest test • Publication schemes • Request handling • Vexatious requests

38. Contact us • Helpline - 0303 123 1113 or 01625 545745 • Textphone and translation service - 01625 545860 • Website - http://www.ico.gov.uk/ andwebsitefeedback@ico.gsi.gov.uk • Advice about the law - casework@ico.gsi.gov.uk • Notification queries - notification@ico.gsi.gov.uk

39. Keep in touch Subscribe to our e-newsletter atwww.ico.gov.uk or find us on… • www.twitter.com/iconews

40. NIGB NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution Tea and Coffee NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE #NIGB #HSCIG Leeds – Birmingham - London