Information Governance

1. Information Governance Peter McKenzie Information Governance Manager NHS Tayside informationgovernance.tayside@nhs.net

2. Caldicott Approval • The Caldicott Guardian has a responsibility to review and monitor all flows of information in NHS Tayside and all transfers of data outside of the organisation. • Approval must be sought when • creating an information sharing protocol to share patient identifiable information (PII) with another organisation • proposals for research projects that will use PII • collecting PII for the purposes of creating a new database

3. Inpatient Out Patients GP/practice nurse A&E Pharmacy Dentist Lab.Services Boards Online Services Visited at home Walk-in centre Health Care Guides Out of Hours and Direct Calls Caldicott Coverage

4. Caldicott Approval – to cover… • research where data is used for any living patient (this also includes images, videos, charts etc). • all use of NHS patient data even if you consider the data being held to be non-identifiable data. • it is the responsibility of the Caldicott Guardian to review the use of all data and determine if it is appropriately anonymised to ensure that this it non-identifiable. • if identifiable data is to be used then you must be able to justify the requirement for use of this data. • all databases created for the purposes of research to hold patient identifiable data must also be registered for data protection purposes

5. Justify the purpose for using person identifiable information (PII) Only use PII when absolutely necessary Use only the minimum PII required Access is on a strict “need to know” basis Everyone must be aware of their responsibilities You must comply with the law Caldicott Principles

6. Caldicott Principles and Data Protection

7. Caldicott Requirements • The Caldicott Guardian has to ensure that proposals comply with Caldicott Principles and that the technical and operational arrangements that are proposed will safeguard the information to be provided: • the justification for using PII? – linkage, other data sets • what that data is? – data items physical or electronic • where you will get the data from? – collected, manually or electronically extracted • is data to be collected from more than one source?

8. Caldicott Requirements • how you will get that data? – encrypted transfer, email • who will provide you with the data? – an authorised administrator, self, colleague, service • who will have access to the data? – co-users, data entry, processors • how you intend to protect the data given to you? – anonymisation, encryption, retention • if individuals are to be contacted who will do that and how will that be done? – GP, responsible medical officer, researcher

9. NHS Tayside Systems Central Vision TOPAS MiDiS Health Informatics Centre Researcher Researcher Caldicott Approval NHS Generic Caldicott Approval Caldicott Arrangements - HIC If the study is limited to: a) using electronic data already held within, or accessed via HIC and will be undertaken using anonymised data or b) also includes data collected directly from a patient who has explicitly consented to its use for this research and it is anonymously linked to other electronic data held within, or accessed via, HIC …the study will not require explicit Caldicott Guardian approval. The researcher will have no access to any identifiable data. Any request for identifiable data will require specific Caldicott approval. Request for Anonymous Data Request for Identifiable Data

10. Live NHS Tayside System e.g. Central Vision System Administrator Researcher Caldicott Approval Where a study relies on electronic data already held in an NHS Tayside clinical information system then Caldicott Guardian approval is required. Access to systems requires the identification of the person accessing data to be recorded by means of a transaction log. Such logs are essential evidence of legitimate (in this case approved) access and form part of the person’s personal data. These records will be disclosed as part of any subject access request and any investigation of activity around patient’s records. The researcher will normally have no access to any identifiable data unless specific approval has been given. Caldicott Arrangements - Clinical Systems Request for Identifiable or Anonymous Data

11. Caldicott Approval is concerned with: controlling access to patient identifiable information ensuring that adequate operational data handling arrangements are in place that clearly establish responsibilities ensuring that adequate technical data handling arrangements are in place to safeguard the data maintaining the trust and reassurance of patients in our handling of their personal data Caldicott Approval

12. Information Governance Peter McKenzie Information Governance Manager NHS Tayside informationgovernance.tayside@nhs.net