2. National Data Guardian Report on Information Sharing in Health and Care Webinar:- Wednesday 20 July 2016 Chair Stephen Elgar IGA

3. Agenda 1.How to take part in this webinar 2.Information Governance Alliance 3.National Data Guardian Review report on information sharing in health and care 4.Links for more information

4. We are a group of national health and care organisations working together to provide a joined up and consistent approach to information governance. We aim to become the single, authoritative source of advice and guidance on IG across health and social care The Information Governance Alliance Also: - IGA supports local groups of IG leads who are asked to support partnership work Query service – iga@nhs.net;iga@nhs.net

5. 3 August EU General Data Protection Regulations Email: iga@nhs.netwww.hscic.gov.uk/igaiga@nhs.net

6. National Data Guardian Review on information sharing in health and care Suzanne Lea IGA

8. search for National Data Guardian Report or visit the IGA homepage

9. Top messages People should be able to trust that their personal confidential data is protected but trust in the use of personal confidential data has been eroded NDG has seen little positive change in the use of data since the 2013 Review but there is an opportunity for change – To improve the use of data in people’s interests – To ensure transparency for the public A key aspect of this work must be a dialogue with the public. Health and social care data, although unique, cannot be isolated from a wider dialogue that should be conducted on data use across different sectors

10. Data security standards for health and social care

11. Top messages for data security The need for leadership – three obligations See page 22 for the standards New assurance and monitoring proposals People Ensuring staff are equipped to handle information respectfully and safely, according to the Caldicott Principles 3 standards Processes Proactively preventing data security breaches 4 standards Technology Secure and up-to-date technology3 standards

12. Recommendations (see page 9) All organisations - evidence of improvements HSCIC – embed the security standards in a revised IG Toolkit - inform CQC of at risk organisations CQC – amended approach and framework for their inspection of safety standards - use information from HSCIC to prioritise for action DH – harsher sanctions for malicious / intentional breaches

13. The consultation on the standards The Department of Health wants to know Your views on the standards and the barriers and challenges to successful implementation How far does your organisation already meet these standards, is there an appropriate focus on security in your organisation What support would be helpful from DH, NHS England or HSCIC? Your views on the proposed assurance framework

14. Consent/opt-out of information sharing in health and social care

15. Top messages for consent and opt-out There is no easy answer that will please everyone Issues in commissioning, research, public health and monitoring An opt-out model not opt-in The model needs testing and further work on wording The implementation challenge should not be underestimated

16. The model (see page 39) 1. You are protected by the law. 2. Information is essential for high quality care. 3. Information is essential for other beneficial purposes. 4. You have the right to opt out. 5. This opt-out will be respected by all organisations that use health and social care information. 6. Explicit consent will continue to be possible. 7. The opt-out will not apply to anonymised information. 8. Arrangements will continue to cover exceptional circumstances.

17. The opt-out question Opt-out for these purposes to run the NHS and social care system to support research to improve treatment and care for everyone Suggested four different approaches that might be adopted when asking the public whether or not they wish to opt out but not recommending any or limiting consideration to just these approaches.

18. WhatWhere Use of anonymised dataPage 30 Role of HSCICPages 31 and 34 Stronger sanctions for re-identificationPage 32 Research, genomics and national disease registersPages 32-33 Invoice validation for non-contracted activityPage 35 Its not just about the model

19. Recommendations (see page 10) All organisations - make the case for data sharing HSCIC and HRA –provide better information on how peoples data is used Research – explicit consent still possible DH – stronger sanctions to protect anonymised data - clarify legal framework General – recommending the new model

20. The consultation on the consent/opt-out model The Department of Health wants to know Your views on the proposed model and what support you might need to implement it what needs to be done to move from the current opt-out system to a new consent/opt-out model Your views on stronger sanctions for re-identification of anonymised data Speaking as a member of the public, where would you go for advice before making a choice

21. search for NDG consent consultation or visit the IGA homepage Next steps

22. Next steps – what should you do now Consultation runs until 7 September Organisations should respond – every health and social care organisation is affected You should consider responding in your personal capacity You could encourage your friends and family to respond

23. Links for more information

24. Links to reports and useful information WhatURL NDG Review reporthttps://www.gov.uk/government/publications/review-of- data-security-consent-and-opt-outs CQC Review Reporthttp://www.cqc.org.uk/content/safe-data-safe-care NDG Website includes links to videos https://www.gov.uk/government/organisations/national- data-guardian Joint letter from CQC and NDG May 2016 http://www.cqc.org.uk/sites/default/files/20160519%20A n%20update%20from%20the%20Care%20Quality%20Commissi on%20and%20National%20Data%20Guardian.pdf Joint letter from CQC and NDG July 2016 https://www.gov.uk/government/uploads/system/uploads /attachment_data/file/534790/CQC-NDG-data-security- letter.pdf DH Consultationhttps://www.gov.uk/government/consultations/new-data- security-standards-for-health-and-social-care Govt response re role and function of NDG https://www.gov.uk/government/consultations/the-role- of-the-national-data-guardian-for-health-and-social-care

25. Email: iga@nhs.net www.hscic.gov.uk/iga