NIGB #NIGB #HSCIG Leeds – Birmingham - London NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE #NIGB #HSCIG Leeds – Birmingham - London

Information Governance Building an Effective Partnership NIGB Regional Workshops June 2012

Positioning IG Patient and Public information Professional record keeping Information Governance Business services ; tariff, workforce Finance relating to payments Datasets and terminology Technical Standards; messaging, interoperability Information Standards Portfolio Business Reports Care Records NHSCB | Presentation to NIGB Workshops| June 2012

The ‘Act Effect’ NHSCB will publish information standards NHS in England SoS for Public Health and Adult Social Care NHSCB will provide IG direction and guidance system-wide Public Health, Social Care, Department of Health, Health Research Information Centre to publish Code of Practice Collection, analysis and publication and dissemination of confidential information IG Review (underway) NHSCB | Presentation to NIGB Workshops| June 2012

The Power of Information Access to GP individual care records Information to drive integrated care Across the entire health and social care sector Both within and between organisations Information recorded once, by the professional carer Shared securely between those providing care Information standards that enable data to flow Keep confidential information safe and secure Records become source for information to improve care, services and inform research NHSCB | Presentation to NIGB Workshops| June 2012

The ‘Deal’ with the Public “You have a right to access your data and a right to withhold consent to its being shared. You have a corresponding responsibility to let us use your data in the interests of your own care and of improving services for others” “We have a right to use your data, and a corresponding responsibility to tell you exactly what we plan to do with it and, when sharing it, to take all reasonable steps to protect your confidentiality” The Power of Information Para 5.39 May 2012 NHSCB | Presentation to NIGB Workshops| June 2012

NHSCB IG Vision Common language – remove complexity IG to be a true enabler; balance between protecting and sharing Right data, right people, right place, right time Digital first Personal responsibility Deal with the public Use of system and professional levers; national contract Clear accountability and responsibility across the system NHSCB | Presentation to NIGB Workshops| June 2012

Monthly meeting of all IG leads; chaired by NHS CB Partnership In Action Function Single ‘up front’ governance model Business not technically led Whole system oversight Thematic sub-groups Approval criteria; Business cases Funding Implementation plans Levers and incentives Exploitation and reusability Partnership Membership NHS Commissioning Public Health Adult Social Care Department of Health System Regulation Collaborative Membership Professional Regulation Local Authorities (Social Care) Providers of Care Burden of collection IT system suppliers Information Commissioner’s Office Monthly meeting of all IG leads; chaired by NHS CB NHSCB | Presentation to NIGB Workshops| June 2012

Information Governance Governance Model Information Governance Requirements Single point of contact Consistent direction and advice Clinical and Business Ownership Supported by IG Advisory Group and thematic groups Approvals Governance Specification Technical Specification if required Commission SME Delivery Nominated IG Leader (from one of the partner organisations) NHSCB | Presentation to NIGB Workshops| June 2012

IG Thematic Groups Information Management, Data Flows and Linkages NHS Transition Issues and Communication IT Systems, Applications and Services Strategy, Regulations and Levers Includes ICO Liaison Professional and Personal IG External reference groups providing input into the IG Advisory Group - the opportunity for local IG leads to get involved NHSCB | Presentation to NIGB Workshops| June 2012

IGT or Not? Self Assessment What value does this deliver value; Without teeth National Contract Use of system and professional levers No System Management in new system What is an IG Standards – help us shape? Needs to be reviewed and justified Value – Cost – Risk Impact NHSCB | Presentation to NIGB Workshops| June 2012

IG is a key enabler – let’s make it one. Thank you NHS | Presentation to [XXXX Company] | [Type Date]

NIGB #NIGB #HSCIG Leeds – Birmingham - London NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE #NIGB #HSCIG Leeds – Birmingham - London

NIGB #NIGB #HSCIG Leeds – Birmingham - London NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE #NIGB #HSCIG Leeds – Birmingham - London

Getting Started with IG NIGB Collaborative Workshops 2012 "The Reality of Delivering the Information Revolution“ Getting Started with IG H Thomas, NHS IG Lead, NIGB D Stone, Managing Consultant, Apira

Introductions Hayden Thomas NHS IG Lead NIGB hayden.thomas@nhs.net David Stone Managing Consultant Apira Limited david.stone@apira.co.uk

The NIGB definition of IG Information governance describes the structures, policies and practices which are used to ensure the confidentiality and security of records of patients and service users. Correctly developed and implemented it Correctly developed and implemented it enables the appropriate and ethical and lawful use of information for the benefit of individuals and the public good’. This is the definition of information governance that the Board have developed.

Compliance

Compliance Legal framework around personal data and its use Law is in terms of responsibilities (not ownership) Interactions of statute, guidance, concepts (public interest, vital interest) key areas challenge understanding

Legalese Data Protection Act 1998 Data Controller Joint Data Controllers Data Controllers in Common Data Processors Human Rights Act 1998 Common Law Duty of Confidentiality

Building Blocks Two building blocks for understanding Primary Use (another perspective on secondary use) Consent

Primary Use Healthcare data – information about an individuals health provided to a healthcare professional for the provision of healthcare (and relevant administration - appointments). Clear expectation of confidentiality Also consider Wider medical purposes Implications for medical research

Consent Consent – contested term Concept used in several ways by different groups Implied Consent (NHS) – The patient turned up for treatment Explicit Consent (Social Care) – Signed piece of paper or addition to record – issue explained to the service user Informed Consent – that the person given consent has capacity and understands what they are consenting to

Legal Basis Key legislation, schedule 3 of the Data Protection Act 1998 Explicit Consent Mental and Physical Health Sexual Life Definition Health Professional and Health Record

Information Rights Advocacy

Information Rights Right of Access to Information with a growing expectation of routine access Patients access to data about themselves Includes right access information about who has seen their record (implication should be able to understand why) Freedom of Information Disclosure (and eDisclosure) – concepts around court cases expectation all relevant information is provided to legal representatives of all parties (Don’t forget EIRs)

Information Security

8 passwords and a retinal scan Information Security Technical Physical Policy, Procedure and Governance Business Process Training

Information Risk

Information Risk What’s is your organisation’s Risk Appetite? Where’s IG on the spectrum? How do they set (or moderate) priorities in dealing with risk? Where would it be after a data loss? How engaged is your SIRO? How often do you get to discuss the issues? Key Issue – understand your organisational culture

Health Informatics

Clever things with information Analysis Service Management Service Performance Clinical Risk Management Targeted Services Inter-agency co-operation to deliver better health care (Paying the bills)

Managing risk in the gap } {

ICO Incident Investigation Reality Check Satisfactory Not Satisfactory ICO Incident Investigation Undertaking or Fine

Measures of Success? The IGT “a map not a straight-jacket” CQC Outcomes NHS Litigation Authority Audit

Mandated and typical roles SIRO IAO IAA ISM Caldicott RA Records Manager FoIA SAR/DPA IG Manager Privacy Officer

Rule of 3s Security Confidentiality, Integrity and Availability Controls People, Technological, Organisational Strategy Governance, Risk and Compliance Change Leadership, Vision and Culture

When things go wrong... Clear process for investigation and escalation Organisation understands that there is a problem Organisation understands that it must learn lessons Review process, training and support systems Iterative process – shows that the organisation learns and improves continually

Single Points of Truth Department of Health National Information Governance Board Information Commissioner’s Office Legislation.gov.uk National Archives CESG

Geek & Peers

Getting Help Other Disciplines Records Management Clinical Governance External Support ICO, NIGB Other IG managers in other organisations Regional Forums (Health & Social Care)

Not matter how bad it is.. Telephone call on the weekend, system about to go live on Monday . Personal Identifiable Data – accessible to all users, can the IG manager sort out the IG over the weekend? Managers drops in on a Friday afternoon, Trust building closed that day, they found 200 boxes – looks like patient records – could they be removed – new tenant moves in on Monday We bought some new laptops and they “seem” to have gone missing. No we didn’t buy them through ICT, we had some spare money at the end of the financial year and ... oh are they encrypted? How would I know, I’m not from ICT.

NIGB #NIGB #HSCIG Leeds – Birmingham - London Tea and Coffee NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE #NIGB #HSCIG Tea and Coffee Leeds – Birmingham - London

The power of information Putting all of us in control of the health and care information we need

the vision: people first Joined up systems and shared data standards will facilitate and drive integration within and between organisations and care settings to ensure that care is focused around the person and their health and care needs. This is why the strategy spans the NHS, public health and social care. Getting the right information to the right people at the right time – in a form they can understand, engage with and contribute to – will help individuals take control of their own care, improving self-management, shared decision making, and more informed choices. Needs support and advocacy to help people in all sectors of society to make meaningful use of it, harnessing modern technology where that is helpful. 45

the information strategy: main ambitions • Information used to drive integrated care across the entire health and social care sector • Information regarded as a health and care service in its own right – with appropriate support in using information available for those who need it, so that information benefits everyone and helps reduce inequalities • A change in culture and mindset, in which our health and care professionals, organisations and systems recognise that information in our own care records is fundamentally about us - so it becomes normal for us to access our own records • Information recorded once, at our first contact with professional staff, and shared securely between those providing our care – supported by consistent use of information standards that enable data to flow between systems whilst keeping our confidential information safe and secure

the information strategy: main ambitions • Our electronic care records become the source for core information used to improve our care, improve services and to inform research, etc. – reducing bureaucratic data collections and enabling us to measure quality • A culture of transparency where access to high-quality, evidence-based information about services and the quality of care held by Government and health and care services is openly and easily available to us all • An information-led culture where all health and care professionals take responsibility for recording, sharing and using information to improve care • The widespread use of modern technology to make health and care services more convenient, accessible and efficient • An information system built on innovative and integrated solutions and local decision-making, within a framework of national standards that ensure information can move freely, safely, and securely around the system

the vision: modern convenient information 2. Booking appointments will be quicker when you can do it online 3. You’ll need fewer phone calls when you can communicate with professional teams electronically 1. Accessing your GP record online will give you more control over your care 4. You’ll have less paperwork in your life when your healthcare letters are available online 5. You’ll know where to go for health and care information when there is one trusted website 6. Services will do more to offer you support you use and understand information if and when you need it. 9. You will have more information to help you choose the best services and treatments for you 7. You won’t have to repeat yourself when your information is shared between health and care professionals 8. You’ll be confident that your feedback is being listened to and helping to improve services

what we heard: information governance Consultation responses recognised: the importance of providing safeguards to accessing data barriers to sharing data get in the way of high quality care The NHS Future Forum received a clear message: not sharing information has the potential to do more harm than sharing it 49

what we heard: information governance The NHS Future Forum also proposed a ‘deal’ along the lines: “You have a right to access your data and a right to withhold consent to its being shared. You have a corresponding responsibility to let us use your data in the interests of your own care and of improving the service for others. We have a right to use your data, and a corresponding responsibility to tell you exactly what we plan to do with it and, when sharing it, to take all reasonable steps to protect your confidentiality.” 50

the vision: information governance Government has commissioned an independent review of information governance rules and their application, led by Dame Fiona Caldicott to ensure an appropriate balance between: the protection of confidential and identifiable information within our health and care records and the use and sharing of information to improve the quality and safety of our own care and for the benefit of wider society Government has also committed to consulting on an amendment to the NHS Constitution to make more explicit proposals for the ‘consent deal’ 51

the vision: care records - a core source of data Better care 52

the strategy online: aimed at real people online version includes sections on “what the strategy means for me” using a wide range of case studies easy-read developed in partnership with CHANGE, a learning disability organisation equality impact assessment co-produced by the Department of Health with 13 other organisations extensive partnership working with Intellect, Royal College of GPs and many others www.informationstrategy.dh.gov.uk

NIGB #NIGB #HSCIG Leeds – Birmingham - London NIGB IG Collaborative Workshops The Reality of Delivering the Information Revolution NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE #NIGB #HSCIG Leeds – Birmingham - London