1. NIGB NIGB IG Collaborative Workshops
The Reality of Delivering the Information Revolution
NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE
Leeds – Birmingham - London Neil Serougi

2. NIGB Today’s workshop – setting the scene Strategic themes
Preparing for the ‘new world’
How to do ‘more for less’
Moving towards solutions
Challenging current thinking
Q&A –Expert Panel
NATIONAL INFORMATION GOVERNANCE BOARD

3. Today’s workshop - housekeeping NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Today’s workshop - housekeeping
Q&A Panel – place your question at registration
Break out sessions
Speed dating – time limited
NATIONAL INFORMATION GOVERNANCE BOARD

4. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Context: Changing health & social care landscape
Health & Social Care Act 2012
Move from central to local
Integration
New organisational structures
Patient / citizen centred e.g. access to records
No decision about me without me
Increased competition
NATIONAL INFORMATION GOVERNANCE BOARD

5. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Health and Social Care Act Key considerations
Changes to the legal bases for information processing
IG roles and responsibilities of organisations in the new landscape
Provision for the NHS Information Centre to request confidential patient information from health and social care bodies
NATIONAL INFORMATION GOVERNANCE BOARD

6. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Health and Social Care Act 2012 Key considerations
Balance between Confidentiality and Information Sharing
- risks and issues
Impact of Organisational Change
Regulation in the ‘new world’
National bodies need to consider whether identifiable information is really needed - Privacy Impact Assessments
Concerns have been raised over interim IG arrangements – NIGB transition guidance
(November 2011)
NATIONAL INFORMATION GOVERNANCE BOARD

7. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Context: Changing Information Governance landscape
Future model development – IG Operating Model
IG Review on behalf of the Secretary of State
Organisational changes – need to ensure system wide consistency
IG Levers
NATIONAL INFORMATION GOVERNANCE BOARD

8. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Moving forward: IG levers
Contract Terms with providers and the oversight management and enforcement of contractual provisions
Information Standards to the extent they are applicable to information governance but they have the benefit of being health and social care system wide
CQC registration criteria – currently limited scope in relation to enforcement - future role for NIGC?
Legal enforcement through the Information Commissioner’s Office in relation to the Data Protection Act 1998
NATIONAL INFORMATION GOVERNANCE BOARD

9. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Future model - practicalities (1)
Culture & context – paper records will continue; technology needs to be user friendly – otherwise people will find way to circumvent controls!
Storage and retention issues become different in electronic environment – both paper and electronic health records need to be effectively managed
Understanding the importance of IG
Shared electronic records – will become the norm, with challenges in relation to data controllership, maintaining data quality and the integrity of the record (Royal College of General Practitioners Guidance)
NATIONAL INFORMATION GOVERNANCE BOARD

10. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Future model - practicalities (2)
Managing and sharing patient and service user identifiable information for secondary uses – challenges of implementing individual’s wishes
Pressure to make efficiencies through increased use of electronic communication – how to ensure IG adequate and difficulties of doing so in a resource constrained environment
Online patient access can reduce patient demands and increase satisfaction
Telemedicine – useful for some groups / locations
Increased risk from more people with access but also harm from not sharing
NATIONAL INFORMATION GOVERNANCE BOARD

11. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Future model – assurance and controls
Managing robust access controls where multiple agencies staff need access understanding that “sharing” is “disclosure”
Sharing across health & social care – consent and appropriate controls in place to ensure patient / citizen interests are protected
Collaboration & engagement
Strong IG standards - need to be embedded
Use of the Care Record Guarantee – uptake of organisations in health & social care has been varied – future of the CRG?
NATIONAL INFORMATION GOVERNANCE BOARD

12. NATIONAL INFORMATION GOVERNANCE BOARD
NIGB
Future model – enabling patient access to their records
Clinician willingness
Information about other individuals or provided by other individuals in the record
Handling seriously harmful information and when to consider that the potential for serious harm has passed
What patients value most is the transactional aspects – booking appointments, requesting repeat prescriptions, getting test results, messaging the GP.
Important to do this in a stepped way, perhaps starting with the transactional aspects
NATIONAL INFORMATION GOVERNANCE BOARD

13. NIGB #NIGB #HSCIG Leeds – Birmingham - London
NIGB IG Collaborative Workshops
The Reality of Delivering the Information Revolution
NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE
#NIGB
#HSCIG
Leeds – Birmingham - London

14. Information Governance Review
Karen Thomson

15. IG Review - Scope Terms of Reference on website
Full scope still to be finalised – focus has been on evidence gathering
Key issue to address concerns Consent and ensuring that all activities have a secure basis in law
IG in the new landscape – how to have effective internal and system wide IG
Specific cross-sector IG issues affecting individuals and organisations

16. IG Review - Membership
Panel – 15 members in total
Process of selection – key areas were identified and then relevant organisations were approached for suggestions
Members appointed in their own right not as representatives
Monthly meetings
Additional evidence gathering sessions

17. Consent and lawful processing
when is explicit consent needed?
what is needed for valid implied consent?
are there activities that need a secure legal basis but for which consent is not appropriate or feasible?
how should they be supported in law?
the consent process – how to seek consent and
what to record
implementation through technical architecture

18. IG Review Process
Timetable: intention to feed into NHS Constitution consultation for October
Autumn 2012: interim report and then final report
Earl y 2013: final report

19. Evidence gathering themes
Linkage and identifiability
Patient and Public rights in law – EU Regulation and what services need to tell people
Workforce education, training and regulation
Issues related to genetic and genome information
Issues related to new and emerging technologies
direct care, including sharing across H & SC and with independent sector
Commissioning
Public Health
LA / Adult, Children and Family Social care uses including safeguarding
Research
Consent

20. Risks and Issues
System wide information governance - responsibilities and accountability in multiple sectors – ensuring consistency
These organisations all have an interest in obtaining and using information – where is the independent scrutiny and management of conflicts of interest?
Are the available levers adequate or effective – can they become so?
What needs to be done to assure the public and maintain trust?

21. Next steps Careful thought to working out the practicalities of change
Collaboration & partnership
Future approach to IG needs to promote excellence in health and social care
Consistency of approach across health and social care, research and public health

22. How you can be involved
Happy to receive written submissions by (or post)
Website in development:
Contact:
Office

23. NIGB #NIGB #HSCIG Leeds – Birmingham - London
NIGB IG Collaborative Workshops
The Reality of Delivering the Information Revolution
NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE
#NIGB
#HSCIG
Leeds – Birmingham - London

24. The role of the Information Commissioner’s Office
David Evans, Senior Policy Officer

25. The Information Commissioner’s Office is the UK’s independent authority set up to uphold information rights in the public interest, promoting openness by public bodies and data privacy for individuals

26. What the Information Commissioner responsible for
Data Protection Act
Freedom of Information Act
Privacy and Electronic Communications Regulations
Environmental Information Regulations
INSPIRE (Infrastructure for Spatial Information in the European Community) Regulations

27. The role of the Information Commissioner
“It shall be the duty of the Commissioner to promote the following of good practice by data controllers and, in particular, so to perform his functions under this Act to promote the observance of the requirements of this Act by data controllers.” S 51 (1) DPA
“It shall be the duty of the Commissioner to promote the following of good practice by public authorities and, in particular, so to perform his functions under this Act as to promote observance of
the requirements of this Act, and
the provisions of the codes of practice under sections 45 and 46.”
S 47 (1) FOIA

28. What do we do
Educate
Decide
Enforce
Prosecute

29. Prosecutions
Former health worker guilty of unlawfully obtaining patient information by accessing the medical records of 5 members of her ex-husband’s family in order to obtain their new telephone numbers - £500 fine & £1,000 costs
Receptionist who unlawfully obtained her sister-in-law’s medical records in order to find out about her medication found guilty – 2 yr conditional discharge & over £600 costs

30. Is it enough?
Former gambling industry worker who unlawfully obtained and sold personal data relating to over 65,000 online bingo players guilty of committing three offences – 3yr conditional discharge, £1,700 compensation & over £800 costs.
Bank cashier illegally accessed the personal details of a sex attack victim. The cashier’s husband had been convicted of carrying out the attack and was jailed - £800 fine & £400 costs.
A personal injury claims company employee guilty of illegally obtaining NHS patients’ information over a four month period - £1,050 fine & £1,160 costs.

31. One that didn’t get away
June two former employees of UK mobile operator T-Mobile who illegally stole and sold select customer data from the company in 2008 ordered to pay a total of £73,700 in fines and confiscation costs or serve prison sentences by default. By January 2012 – paid up in full!
Carried out under the Proceeds of Crime Act and the ICO gets a proportion of this to use for the prevention and detection of crime

32. Enforcement
Feb 2012 – Staffordshire County Council – “failed subject access”.
Dec 2011 – Powys County Council – Enforcement and Civil Monetary Penalty. - CMP – data breach - Enforcement – to compel training to ensure no repeat of the data breach
Undertakings – committing an organisation to a particular course of action in order to improve its compliance

33. Decisions Freedom of Information
Dept of Health’s transition risk registers
Cost of the swine flu vaccination programme
Copies of papers from the “closed” sessions of the meetings of a Foundation Trust board
Compelling the CQC to provide “advice and assistance” to an FOI requestor
MP’s expenses

34. Educate Codes of Practice Guidance Audits Work with stakeholders
Advice - telephone helpline - respond to written enquiries - suggest how to deal with issues that are identified through case work

35. Codes of Practice CCTV Code of Practice (2008)
Assessment Notices Code of Practice (2010)
Data Sharing Code of Practice (2011)
Employment Code of Practice (revised 2011)
Personal Information Code of Practice (2010)
Privacy Notices Code of Practice (2010)
Anonymisation Code of Practice – currently under consultation

36. Guidance - DP The Guide to Data Protection
Guide to ICO data protection audits
Identifying data controllers and data processors
Training checklist for small and medium size organisations
Monetary penalties – statutory guidance
Privacy be design - Privacy impact assessments - Privacy enhancing technologies
Subject access to health records by members of the public

37. Guidance - FOI The Guide to Freedom of Information
When is information caught by the FOI Act
Access to information about public authority employees
Access to information about the deceased
Destruction of requested information
Detailed guidance on individual exemptions
Freedom of information and research
The prejudice test
The public interest test
Publication schemes
Request handling
Vexatious requests

38. Contact us Helpline - 0303 123 1113 or 01625 545745
Textphone and translation service
Website - and
Advice about the law -
Notification queries -

39. Subscribe to our e-newsletter at www.ico.gov.uk
Keep in touch
Subscribe to our e-newsletter at
or find us on…

40. NIGB Tea and Coffee #NIGB #HSCIG Leeds – Birmingham - London
NIGB IG Collaborative Workshops
The Reality of Delivering the Information Revolution
Tea and Coffee
NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE
#NIGB
#HSCIG
Leeds – Birmingham - London