1. Caldicott 2, IG and public health Julian Flowers – Director KIT (East) Confidentiality lead CKO directorate

2. Outline Changes in the legal and IG landscape Quick overview of Caldicott and other recent developments in IG and their relevance to PH Issues and challenges What is being done and how you can help 2Presentation title - edit in Header and Footer

3. The bottom line You need a legal basis for processing personal confidential data (data collected for medial purposes) – either: Consent Statute Other legal gateway Overriding public interest You need a justifiable purpose You should only process the minimum data required for the purpose and only process PCD if there is not practicable alternative People whose data is being processed should be informed and be given the right to opt out For most purposes anonymised or aggregate data should be sufficient 3Presentation title - edit in Header and Footer

4. The IG landscape 1.Role of the HSCIC – gains new powers under the HSC Act o National repository of all health and care data o A statutory safe haven o Can legally hold patient identifiable/ confidential data (PCD) o Can be mandated and required to collect data and develop systems (s254, 255 of the HSC Act 2012 o Required by the Act to develop a mandatory code for handling confidential information 2.Informatics services commissioning group (ICSG) A partnership board overseeing the HSCIC work programme and investment A newly re-formed IG subgroup to oversee IG system wide 4Presentation title - edit in Header and Footer

5. The IG landscape (2) 3.PHE Some functions covered by s251, Regulations 2 and 3 and other regs IG office and Caldicott system Represented on ISCG subgroup, code of confidentiality group Own toolkit view Safe haven status SIRO, and Caldicott Guardian appointed 4.LA-PH Regulations do not give LAs same legal basis for processing PCD as PCTs had with some exceptions Data flow from CSUs/ DSCs depends on NHSE 5Presentation title - edit in Header and Footer

6. The IG landscape (3) 3.NIGB Disbanded Health research authority (HRA) takes on some responsibilities Confidentiality advisory group (CAG) s251 approval for research s251 advice for non-research – DH approval No mandate for regulation 3 6Presentation title - edit in Header and Footer

7. Five key documents Code of practice for handling confidential information 10 principles Mandatory on all users of health and social care data Not published yet (some amendments in light of Caldicott 2) Caldicott review Published on April 26 th Govt response awaited Role of the IG subgroup ICO anonymisation code ISB No. 1531 Control of Information Regulations 7Presentation title - edit in Header and Footer

8. Caldicott 2 – to share or not to share Lengthy review process – submissions, evidence gathering,panel meetings PHE submissions Finally published 26 th April For SofS 8Presentation title - edit in Header and Footer

9. Caldicott 2 – key points for PH Mix of Direct care = aspects of PH practice equivalent to direct care = implied consent “Research” “Commissioning” Three classes of data Personal confidential Anonymised De-identified for limited access Regulations Recommendation 13 9Presentation title - edit in Header and Footer

10. Regulation 3 Control of Health Services Information Regulations 2002 Sets aside common law duty of confidence for certain PH activities a)Diagnosis of communicable disease and other risks to public health b)Recognising trends in such diseases and risks c)Controlling and preventing the spread of such disease and risks d)Monitoring and managing- 1.Outbreaks of communicable disease 2.Incidents of exposure to communicable diseases 3.Delivery, efficacy and safety of immunisations programmes 4.Adverse reactions to drugs and medicines 5.Risks of infection to from food or the environment 6.Giving information to persons about the diagnosis of communicable disease and risks of acquiring such disease 10Presentation title - edit in Header and Footer

11. Regulation 5 This regulation specifies the medical purposes covered by the regulations provided they are “approved by the Secretary of State” – these are set out in the Schedules. In summary these purposes are: Further anonymising or deindentifying the data The processing of confidential patient information that relates to the present or past geographical locations of patients (including where necessary information from which patients may be identified) which is required for medical research into the locations at which disease or other medical conditions may occur Processing information to allow identification and contact for the purposes of obtaining consent For research To use the information for medical purposes To allow the use of tissue for a) or b) To process data from more than one source For linkage For validating and quality assuring data For deduplication and data cleaning to avoid inaccurate information For audit, monitoring and analysis of heath care For granting access to PCD for one or more of the above 11Presentation title - edit in Header and Footer

12. Who can process data under this regulation? 12Presentation title - edit in Header and Footer 1.PHLS (read Public Health England) 2.Persons employed or engaged for the purposes of the health service 3.Other persons employed or engaged by a Government department other public authority in communicable disease surveillance The explanatory note accompanying these regulations makes it clear that: “Regulation 3 makes provision for the processing of patient information for the recognition, control and prevention of communicable disease and other risks to public health. Regulation 3(4) provides powers under which the Secretary of State may require certain persons who perform health service or other public functions to process information where, for example, there is a need to assess whether there is a significant risk to public health. Regulation 3(4) makes provision for information on the operation of these Regulations to be passed to the Secretary of State.” Legal advice to the DH confirms that these regulations apply to local authority employees “engaged for the purposes of the health service… other public authority in communicable disease surveillance”. This should enable DsPH and their teams to obtain data in respect of their duties for health protection, and the core offer to CCGs. Who can process data under this regulation?

13. Next steps DH working up response to Caldicott PHE input Do we need regulatory change? If so what for? IG subgroup of ISCG will oversee Internal PH process to define scope of Regulation 3 -what is the scope of “other risks to public health” PHE to develop – sign off by CKO, CMO, DH and CAG 13

14. Wicked issues Data linkage – who, how, what Are health checks and risk profiling identifying other risks to public health? Technology limitations Becoming accredited safe havens What is the legal basis for linking non health data to health data e.g. Stats 19 - HES 14Presentation title - edit in Header and Footer

15. How you can help Identifying examples and scenarios we can test Feeding back on “other risks to public health” Identifying examples of good practice for linkage, local IG etc. Identifying ongoing difficulties Do we need more guidance/ education/ regulatory change? 15Presentation title - edit in Header and Footer