1. An update from the Department of Health Lorraine Jackson Deputy Director for Data sharing and Cyber security Department of Health
22 November 2016

2. The National Data Guardian’s Review on Data Security, Consent and Opt-Outs
The National Data Guardian Review was published in July 2016, and the consultation started immediately after.
The National Data Guardian’s recommendations focussed on two key areas:
Strengthening data security: 10 new data standards
Data sharing: a new opt-out model which is intended to replace all existing opt-outs in order to give patients a simpler set of choices.
It accompanied the CQC Review which addressed:
Current approaches to data security in the NHS.

3. Consultation
The consultation ran from 6 July 2016 to 7 September 2016.
Approx. 500 professional and public stakeholders were engaged and signposted to the consultation exercise.
There were 638 responses to the consultation in total.
Events were held, with sessions for professionals and for the public.
The consultation engagement events had 178 attendees in total:
111 professionals (including those working in direct care, and IG and IT practitioners)
67 members of the public

4. What we heard: The Data Security Standards
Support:
Support from all key stakeholders for the Data Security Standards.
Many helpful examples provided about data security best practice.
Consensus that data security is about good leadership, from board level, through to all members of staff.
More to think about:
How best to support organisations of various sizes and across health and care through implementing the new standards.
Making the standards as clear and understandable as possible.
The IG Toolkit needs to be adapted.

5. Information Governance and Data Security
People
Process
Technology

6. What we heard: The proposed Opt-Out Model
Support:
Broad support for the proposed Opt-Out model.
Clear appetite for improving public understanding, and for good communications.
Overwhelming support for the proposal to impose criminal sanctions for deliberate / negligent re-identification of data.
Agreement that the Opt-Out should not apply to anonymised information.
More to think about:
The Consultation also gave us lots to think about, such as:
How / whether to include patient surveys and the cancer registry in the new opt-out
How best to manage Type 1 opt-outs

7. Next Steps Taking the time to get it right
Setting up the supporting framework:
Putting the role of National Data Guardian on a Statutory footing
Regulations to support implementation
Immediate focus on prioritising data security standards and support
Further engagement and dialogue:
Assess and manage the impact of implementation
Support practitioners through implementation
Helping patients to understand how their information is used and what choices they have
Preparing for implementation:
Working with professionals to communicate any future change
Learning from others
Next Steps
Taking the time to get it right

8. Supported by Independent Oversight
The National Data Guardian
Confidentiality Access Group
Data Access Advisory Group

9. The Role of the Information Governance Alliance:
Information Governance is a difficult and complex landscape.
The IGA continues to be the single authoritative source of guidance for the health and social care see system and the Department of Health remains a full and committed partner to this.
The development of the IGA Guidance on anonymisation will be a vital cornerstone for the implementation of the National Data Guardian recommendations.
We will need to work with the IGA, along with the NIB and others, in order to map out the best path to implementation.