NHS Scotland Caldicott Guardian Workshop

Document Sample
NHS Scotland Caldicott Guardian Workshop Powered By Docstoc
					22nd October 2009 - NHS Scotland Caldicott Guardian Workshop

PAPER 2                               ISD
                                      Gyle Square
                                      1 South Gyle Crescent
                                      EH12 9EB
                                      0131 275 6000

minutes                               http://www.isdscotland.org

NHS Scotland Caldicott Guardian Workshop
22nd October 2009
Board Room, Gyle Square, Edinburgh

 Harry Burns (CMO, SGHD)                     Eddie Coyle (NHS Fife)
 Malcolm McWhirter (SCMO, SGHD)              Marthunus Roos (NHS Orkney)
 Alan Hyslop (eHealth Strategy Lead,         Andrew Russell (NHS Tayside)
 Kim Kingan (IG Lead, SGHD)                  Alison McCallum (NHS Lothian)
 Fiona Dagge-Bell (NHS QIS)                  Andrew Marsden (National
                                             Procurement, NHS NSS)
 Angus Cameron (NHS Dumfries &               David Knowles (Practitioner
 Galloway)                                   Services, NHS NSS)
 Eric Baijal (NHS Borders)                   Lorna Ramsay (Clinical Lead,
                                             NHSS IG Programme)
 Craig White (NHS Ayrshire & Arran)          Deborah Dillon (IG Project
                                             Manager, NHSS IG Programme)

1. Welcome and introductions
LR welcomed attendees to the workshop. A number of apologies were

2. Importance of the NHS Board Caldicott Guardian role and introduction
to opt out and CHI Governance
HB gave a presentation highlighting the value of the Caldicott Guardian role,
emphasising the importance of well managed information in the context of
delivering high quality care. Ensuring personal data is appropriately available
and of high quality is as important as ensuring confidentiality and security –
the Caldicott Guardian has a crucial role in using their judgement to achieve
this balance.

In relation to requests from individuals to opt-out from having their records
held electronically, HB stated that SGHD is developing guidance to help
Boards deal with these consistently. In summary, opt-out will only be for a
very small number, e.g. witness protection – running of parallel recording
systems is not sustainable for a complex organisation.

3. Consensus approach to opt-out of electronic records

22nd October 2009 - NHS Scotland Caldicott Guardian Workshop

KK updated attendees with regards to a consensus approach to opt out of
electronic records. She clarified that the guidance has been approved by the
CLO and Information Commissioner and should be circulated by the end of
the year. Opt-out from electronic means of recording is separate from opt-out
from data sharing.
Some discussion on data sharing followed. KK explained that central
guidance would not be appropriate as it is difficult to reflect all the possible
scenarios. It was acknowledged that most patients expect a certain amount of
data to be shared as part of both their own care and the running of the health
service and that being more explicit about what the NHS would expect to
share within the organisation through implied consent would be helpful in
ensuring fair processing. DK explained that PSD is currently working on a
revised GP registration form. The group agreed that this would be a good
opportunity to explore including wording around uses of data within the NHS.

Action: PSD to consider how wording on data use within NHSS could be
incorporated into revised GP Registration Form (DK).

The Patient Rights Bill is expected to be enacted during 2010. The
consultation document focussed mainly on patient rights to confidentiality but
also included reference to responsibilities re data. The timing may be too late,
but it was proposed that KK could explore whether some form of wording
could be added on service users being expected to allow use of their data to
support delivery of direct care and the running of the service, the latter with
anonymised or aggregated data where possible.

Action: Explore whether wording on data use within NHSS could be
incorporated into forthcoming Patient Rights legislation (KK).

4. CHI Governance
KK gave a presentation concerning the governance of CHI. KK advised that
there is a central mechanism for co-ordinating research applications for
national level use of CHI through the CHI Advisory Group chaired by EB
however there is no route for consideration at a national level for non-
research issues relating to CHI. At the moment applications need to go to
each DPH for their approval which can result in inconsistency and be
cumbersome for applicants.

EB and AMcC agreed that this gap could be problematic. They also
mentioned the importance of maintaining alignment between CHIAG and the
NSS Privacy Advisory Committee (PAC) since some applications need to go
to both groups. The standard of some applications could be poor, reflecting
that little consideration of IG had been given at the outset of planning projects
or was an after-thought, with approval sought when projects were about to go

DK highlighted that it was important that Atos Origin Alliance as the IT
supplier for CHI system were not left to be a gatekeeper to accessing CHI
data and that governance of the CHI systems/ tool was also a gap at the
moment. There is a similar gap in governance for other national systems so

22nd October 2009 - NHS Scotland Caldicott Guardian Workshop

any principles developed for governing national CHI matters should also be
applied in these cases.

There was a general consensus that there needed to be awareness raising
about what CHI is for, the need to consider IG issues early in any project and
the processes to be followed such as what should be referred to CHIAG and
what to local DPH. KK mentioned that SGHD will be undertaking work to
revise HDL (2003) 37 to specifically focus on the purpose and use of the CHI
including addressing issues such the allocation of a CHI number to a stillborn
baby. She is also working on rationalising and if necessary updating the
existing myriad of circulars, etc which relate either wholly or partly to IG. In the
interim she would be happy to share a list of all the relevant circulars.

Action: Circulate list of IG related SGHD circulars (KK)

5. Overview of SGHD IG plan
KK provided an overview of the SGHD Information Governance Programme
Plan. The plan links directly into the NHSS IG Programme Plan. The plan
focuses on a number of areas, including:
      Role based access protocol for Clinical Portal
      Incident reporting – guidance on what to inform SGHD of
      Protective marking/ information classification scheme
      Opt out of electronic recording guidance
      NHS Code of Confidentiality update
      Information Governance basic training and awareness for NHSS
On the horizon:
      Criminal Justice Bill will have a provision concerning data sharing
      Ministry of Justice will be circulating a consultations paper regarding
        enhanced penalties and monetary fines
      Patients Bill of Rights
      Identity Management and Privacy Principles are currently out for
        consultation – advocates the use of Privacy Impact Assessments.

KK also mentioned that the Health Management Library holds core texts
relating to Information Governance.

6. Caldicott Guardian perspectives
FDB gave attendees an overview of her experience of being a relatively new
Caldicott Guardian and being in a special Board, including feeling somewhat
lonely in the role. Understanding of what the role entails can be unclear on
first assuming the remit but comes into sharp focus when faced with an
incident. She suggested improvements for future Caldicotts coming into the
       Profiling the role to help those taking up post understand the remit
       Induction training for new Caldicott Guardians covering core
         information of what you actually need to fulfil this role & directing
         them to background information and tools available
       Contact details of other Caldicott Guardians – being accessible to
         each other for support

22nd October 2009 - NHS Scotland Caldicott Guardian Workshop

 AC briefed attendees on his experience of providing the Caldicott Guardian
 service in a territorial Board.
     Training is a big issue both for employees and Caldicotts – an IG
        training module with assessment should be mandatory with
        successful completion being linked to and recorded on the HR
     About 90% of the role is fairly straight-forward and can be managed
        by following available guidance and processes. However the
        remaining 10% is more complicated and can be very challenging,
        with no clear precedent. In these cases the role can feel quite
     There can be particular challenges around trying to integrate services
        such as with the voluntary sector where they do not have adequate
        IG practice in place to be able to agree to information sharing
     Child protection and child custody issues arise on a regular basis
     Multi-agency data sharing in cases such as domestic violence can be
        challenging where information on a third party who has not been
        formally accused is requested
     Information relating to the deceased is often sought – Access to
        Health Records Act
     Psychology – disclosure relating to the aforementioned. AC
        mentioned that much more personal information may be disclosed to
        a metal health practitioner than to a GP. A person receiving
        psychological treatment may become inhibited if they feel that their
        information may be disclosed in the future.
     A means of sharing approaches to complicated scenarios would be
        helpful to improve consistency and share good practice

EB spoke with regards to his experiences of being a Caldicott Guardian
involved in national level activity:
      There is a complexity of communications when those who need to be
        involved belong to many different groups
      An overarching national umbrella group would be helpful
      There is a risk of inconsistency in outcome and practice,
      The fact that DsPH have responsibility for access to CHI, whilst the
        Caldicott Guardian is responsible for access to any other data means
        there is disparity in approach even within organisations
      Consistency in Caldicott Guardian application forms would be useful
      Now that the discipline of Caldicott Guardian is becoming more
        formalised, it would be useful to promote prioritisation of the role and
        its recognition at senior levels within organisations, including the time
        needed to undertake the role
      Issues around the lack of consistency in training/ pressure about
        taking time out to learn – ongoing training would be helpful
      It would be useful if Caldicott Guardians could meet to discuss issues
        that arise and share best practice.

LR thanked FDB, AC and EB for sharing their experiences and mentioned
that it had been very interesting to hear three different perspectives, though

22nd October 2009 - NHS Scotland Caldicott Guardian Workshop

with common themes. Others felt that these reflected their own experiences
fairly well.

MR suggested that there could be a National application form for Caldicott
issues. It was agreed this should be considered as part of any collaborative
work undertaken by the forum.

Action: Add national Caldicott application form to list of potential areas for
collaborative work by a national Caldicott forum (DD)

7. Discussion sessions

7.1 Support tools for Caldicott Guardians
LR mentioned the survey undertaken by colleagues in the IG team Caldicott
Guardians were asked if they find the current tools useful, i.e. the Caldicott
Guardian manual and the eLibrary – these were found to be fairly helpful but
in need of enhancement.

The Online tool that is currently used in NHS Wales was discussed at length.
DD circulated the NHS Wales “Principles into Practice “manual. The general
consensus was that Guardians would welcome a more interactive and
regularly updated tool along these lines. The time constraints upon Guardians
meant that undertaking the work required to substantially update the current
Scottish manual may not be feasible. A subgroup (EC, FDB, CW, AR) agreed
to evaluate the Welsh tools and report back on their suitability for adapting for
use in Scotland as a replacement to the existing manual.

    Forward link to NHS Wales Caldicott Guardian site to attendees (DD)
    Subgroup to provide feedback to DD within 2 weeks (EC, FDB, CW,

7.2 Caldicott Guardian network/forum
LR provided an overview with regards to other groups of IG professionals who
currently have regular forums, these include Data Protection Officers,
Records Managers and IT Security Officers. These groups currently meet
three times a year in addition to the IG Annual Conference.

Feedback from the survey and the opinion of attendees was that such a forum
for Caldicott Guardians would be useful. FDB suggested twice yearly full day
meetings would be easier to attend than quarterly half day meetings. The
group agreed that this would be a good approach, and if an issue arose out-
with a biannual meeting then an additional meeting could be arranged as
required. It was agreed to alternate the venue between Glasgow and
Edinburgh with the first meeting in April 2010. The purpose of meetings would
include: networking, sharing of best practice, progressing collaborative work,
etc with ongoing CPD an integral component. Formal Terms of Reference
should be agreed. In advance of the forum being established it was agreed
that it would be useful to circulate a list of current Caldicotts and contact

22nd October 2009 - NHS Scotland Caldicott Guardian Workshop

details. Also arranging for a national Caldicotts email group would help
support communications.
Topics for consideration for CPD include:
 The broader legal framework, including IG aspects relating to vulnerable
 Scenario based discussion – thinking through scenarios from beginning to
   end and agreeing a best practice approach. Ideally based on actual
   experiences if people are willing to share in a ‘safe’ setting.
Topics should be circulated in advance of the six monthly meetings.

    Draft a formal terms of reference for Caldicott Guardians forum and
      arrange first meeting in April (DD)
    Set up a Caldicott Guardian Group e-mail address (DD)
    Circulate current list of Guardians (NHSS IG Team)

7.3 IG training for the wider NHSS workforce
LR discussed the NHSS IG training paper and explained to attendees the
differing levels of training provisions that are needed to address IG training
needs of different staff groups.

With respect to IG practitioners, expert level training can be commissioned
from external providers. The MSc in Information Governance is currently
being undertaken by around 30 IG practitioners through the Royal College of
Surgeons in Edinburgh and University of Bath/University of Edinburgh through
national funding. This can be supported at local level, e.g. by supporting staff
through ISEB qualifications or online courses in Information Governance for
example as run by thee University of Edinburgh.

The Intermediate Level concerns mainly Health Care Professionals. NHS
NES is currently working on a number of modules which are integral to wider
national training packages: DOTS (Doctors Online Training) will incorporate
an IG training module into the studies of junior doctors, with Flying Start
providing an equivalent module for newly qualified nurses, midwives and
AHPs. LR mentioned that there is a need to target other health care
professional groups and further work with NHS NES will need to identify these
groups and develop tailored effective IG training and awareness.

At foundation level, some Boards have already developed or procured IG
training packages to comply with ICO undertakings, though with variable
comprehensiveness. Attendees agreed that a national IG training and
awareness package should be developed which all NHS staff should
complete. This would improve consistency across NHSS and allow
‘transferability’ of foundation skills fo staff who work across or move between
organisations. A 2 phased approach is proposed, with the first phase being
described by KK as a ‘rules of engagement’ package, with 10-15 core high
level statements in plain English, signposting standard terms in employment
contract, etc. DK suggested that IG training and awareness should be built
into job profiles, like the Equality and Diversity requirements. Local IG
professionals are to be consulted with regards to content. The second phase

22nd October 2009 - NHS Scotland Caldicott Guardian Workshop

of foundation level IG training and awareness would be more detailed
coverage of all aspects of IG probably through a CBT package and include an
on-line assessment. This could be used as a regular refresher to the basic

Attendees were very supportive of the suggested approach. LR explained that
this would need to go through various steps before it would be agreed and
that the additional funding required would need to be secured. There will be
workshops to discuss content for the foundation tools involving IG
practitioners and relevant others across NHSS. Caldicott Guardians will be
asked for their input in due course and to support the local delivery of tools

Summary of Actions:

                                ACTION                             OWNER
1   Consider how wording on data use within NHSS could be           DK
    incorporated into revised GP Registration Form.
2   Explore whether wording on data use within NHSS could             KK
    be incorporated into forthcoming Patient Rights legislation.
3   Circulate list of IG related SGHD circulars                      KK
4   Add national Caldicott application form to list of potential     DD
    areas for collaborative work by a national Caldicott forum
5   Forward link to NHS Wales Caldicott Guardian site to             DD
6   Subgroup to provide feedback on NHS Wales Caldicott            EC, FDB,
    Guardian manual and website to DD within 2 weeks.              CW, AR
7   Draft a formal terms of reference for Caldicott Guardians        DD
    forum and arrange first meeting in April
8   Set up a Caldicott Guardian Group e-mail address                 DD
9   Circulate current list of Guardians                            IG team