NIGB

1. NIGB NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

2. NIGB NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE Building information governance for personal health information Karen Thomson Information Governance Lead 19 March 2010 BCS ISSG Conference

3. NIGB • Role of the NIGB • Definitions • What are the issues with building Information Governance for personal health information NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

4. NIGB The role of the NIGB • To support improvements in information governance in health and social care • To advise on the use of powers under section 251 of the NHS Act 2006 NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

5. NIGB The NIGB as a Statutory Body • The NIGB is an Advisory Non-departmental • Public body • Reports to the Secretary of State and of • Health • Its Statutory powers support it in delivering • its terms of reference NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

6. NIGB The Care Record Guarantees NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

7. NIGB The NIGB has provided advice and guidance on: • Information governance during the swine flu pandemic • The implications of the Coroners and Justice Bill • Parental controls on information sharing for children • Access to clinical information by social workers • The use of third parties to support collaborative care NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

8. NIGB The NIGB Ethics and Confidentiality Committee • Provides a legal basis for the use of information in medical research and other NHS activities without consent • Administers applications for support from section 251 of the NHS Act 2006 and advises on its use NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

9. NIGB What is information governance? ‘Information governance describes the structures, policies and practices which are used to ensure the confidentiality and security of records of patients and service users. Correctly developed and implemented it enables the appropriate and ethical use of information for the benefit of individuals and the public good’. NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

10. NIGB What is personal health information? DPA definition of “Personal data” “Data which relate to a living individual who can be identified – • From those data, or • From those data and other information, which is in the possession of, or is likely to come into the possession of the data controller…” NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

11. NIGB DPA definition of “Sensitive personal data” “Personal data consisting of information as to – (e) His physical or mental health or condition” Or racial or ethnic origin, political opinions, religious or other beliefs, membership of a trade union, sexual life, the commission of any offence or court proceedings related to any offence. NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

12. NIGB NHS Act 2006 definition of “Patient information” S251(10)(a)“Information (however recorded) which relates to the physical or mental health or condition of an individual, to the diagnosis of his condition or to his care or treatment, and (b) Information (however recorded) which is to any extent derived from, directly or indirectly, from such information, whether or not the identity of the individual in question is ascertainable from the information.” NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

13. NIGB Definition of “Confidential patient information” S251(11) “Patient information where- • The identity of the individual in question is ascertainable – • From that information, or • From that information and other information which is in the possession of, or likely to come into the possession of, the person processing the information, and • That information was obtained or generated by a person who, in the circumstances, owed an obligation of confidence to that individual.” NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

14. NIGB • Personal = Identifiability • Health Information in broadest terms includes derived data & could just be demographic information • Two sets of definitions whilst subtly different do reflect one another. • Information governance – how to use and handle data appropriately to keep it confidential and secure. NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

15. NIGB Information Governance might be divided into a number of areas: • Data Protection & Confidentiality • Information security & risk management • Records management & information quality NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

16. NIGB Confidentiality & Data Protection Policies & procedures to cover: • Consent for use & disclosure • De-identification processes • Information sharing protocols • Fair & lawful processing & DP notification • SARs & other DP requirements • Offshore processing • Confidentiality Code of Conduct & demonstrate compliance with the Confidentiality Code of Practice & NHS Care Record Guarantee NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

17. Legal requirements NIGB Legal requirements for processing confidential personal data Common law duty of Confidentiality Data Protection Act 1998 Human Rights Act 1998 NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

18. Common Law of Confidentiality NIGB • Information must be confidential in nature • Information that is communicated as part of a relationship where there is an expectation of confidentiality • May be limited by the circumstances • Consent • Statute/Court order • Public interest favours disclosure Legal and DH policy requirements are set out in The NHS Confidentiality Code of Practice NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

19. Human Rights Act 1998 NIGB • Right to freedom from interference by the State in one’s privacy (Article 8) • BUT breaches may be justified provided they are “necessary [for]…public safety… [and] the protection of health” • Disclosures must be proportionate based on the particular circumstances of individuals • 3 tests – has there been interference with privacy? is there justification? is the justification proportionate to the breach? NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

20. Data Protection Act - 8 principles NIGB • Fairly and lawfully; • Obtained for specific purposes and only used for compatible purposes; • Adequate, relevant & not excessive; • Accurate NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

21. Data Protection Act - 8 principles NIGB • Only kept for as long as necessary for the agreed purpose; • In accordance with the rights of the subject; • Kept securely; • Only transferred outside EEA with equivalent protections. NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

22. NIGB Information security & risk management Policies & procedures to cover: • Business continuity & disaster recovery • Physical & Network security • Remote working & secure data transfer • Access controls & management • Data & media destruction • Local data warehousing • Cross boundary information sharing To demonstrate compliance with the IS CoP NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

23. NIGB Records Management & Information quality Policies & procedures to cover: • Record management • Data flow mapping • Retention & archiving • Data quality including NHS number implementation • Freedom of Information Act • Environmental Information Regulations • Re-use of public sector information regulations. NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

24. NIGB Building information governance for personal health information • Reliable information available at the point of care is essential to supporting quality care • Information governance is about making it available where and when it is needed to support care whilst also protecting patient and service user’s confidentiality and privacy NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

25. NIGB • Information security is not really the problem • Most of the data losses and breaches due to carelessness, stupidity or wrongdoing of people, not weaknesses in systems • IG is about helping humans to use systems effectively and efficiently • Technology supporting people NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

26. NIGB • Technology becomes a problem when “clunky” or where changes to business processes are necessary but not supported through training, encourages workarounds • Technology supporting people • Staff supported through training • Every level • Specialist capacity to provide advice – IG managers, SIROs, IAO. NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

27. NIGB Technology can support people • Allowing or preventing access & managing where uncertain • Prompts – do you need to access? why do you need to access? • Audit trails – not just where made changes but where viewed • Alerts – direct reports & unusual patterns analysis NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

28. NIGB Supporting secondary uses of data • De-identification tools - Data derivation • Pseudonymisation • Electronic recording of consents & dissents NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

29. NIGB Key Messages • IG - Making personal health information available where it is appropriate & necessary • Preventing inappropriate access • Transforming personal health information into de-identified information for secondary uses or recording consent to allow its use in identifiable form • Technology supporting people NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

30. NIGB Contact details • www.nigb.nhs.uk • Phone us – 0207 633 7052 • Email us – nigb@nhs.net • Write to us: NIGB, Floor 7, New King’s Beam House 22 Upper Ground London SW1 9BW NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE

31. NIGB NATIONAL INFORMATION GOVERNANCE BOARD FOR HEALTH AND SOCIAL CARE Questions?