Information: To Share or not to Share - GOV.UK

1 information : To Share or not to Share Government Response to the Caldicott Review September 2013. You may re-use the text of this document (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence. To view this licence, visit Crown copyright 2013. Published to , in PDF format only. Contents 1. Contents Ministerial Foreword 3. The revised Caldicott principles 5. Chapter 1. Introduction 6. Chapter 2. People's right to access information about themselves 13. Chapter 3. Direct care of individuals 14. Chapter 4. Personal data breaches 19. Chapter 5. information governance and the law 22. Chapter 6. Research 25. Chapter 7. Commissioning 28. Chapter 8. Public health 32. Chapter 9. Education and training 33. Chapter 10. Children and families 35. Chapter 11. New and emerging technologies 37. Chapter 12. Data management 38. Chapter 13. System regulation and leadership 40. Chapter 14. Conclusion and recommendations 42.

2 Table of commitments who's doing what 44. Ministerial Foreword 3. Ministerial Foreword Better information confidence that anyone else who shares sharing will mean more information will do so responsibly and effective health and properly. And people will know how their care care services and an information is used and shared and how to improved experience object if they want to. for people using those services. So I am Our response sets out how individuals and extremely grateful to organisations should improve the way that Dame Fiona Caldicott information is used for research, and her team for their comprehensive review. commissioning and above all good care. In this document we set out the Giving people a say in how their information Government's response. is used is an essential component of a good system. Where someone is concerned about Dame Fiona's review has given us a their information being shared, they have the tremendous opportunity to get information right to make their objection heard.

3 Sharing right - to improve safety, to prevent the need for patients to have to repeat information must be held securely. Several themselves to different health professionals, safeguards will be put in place. They include: to make care more efficient, and to find new making sure that health and care staff are cures and therapies for killer diseases. At the appropriately trained in information same time, it is vital that we respect people's governance, responding to a data breach privacy and put them more in control of how honestly and immediately, and having a their information is used. This is a fine designated leader on information governance. balance to strike, but an achievable one. The Health and Social Care information In the past, information governance rules Centre's Code of Practice on Confidentiality have prioritised systems over people. Too will provide much needed clarity to often they have been seen as an organisations on how the rules work and insurmountable obstacle and an excuse to how they can be applied consistently.

4 Avoid sharing information . We outline a new approach here. I have been encouraged by the willingness of organisations across health and care to work This new approach will mean that frontline with the Department of Health to effect the staff will be confident about when to Share cultural change we are seeking. Dame Fiona information with other members of a will monitor the progress made following her person's care team and how to do so safely. review, and will publish a report a year from Frontline staff will also have much greater now. 4 Government Response to the Caldicott Review information is compiled, stored and shared because doing so improves people's health, but at the same time their data must be treated with propriety and respect. The prize for achieving this is very great indeed. Rt. Hon. Jeremy Hunt MP. Secretary of State for Health The revised Caldicott principles 1. Justify the purpose(s) access to the data items that they need to see. This may mean introducing access Every proposed use or transfer of personal controls or splitting data flows where one confidential data within or from an organisation data flow is used for several purposes.

5 Should be clearly defined, scrutinised and documented, with continuing uses regularly 5. Everyone with access to reviewed, by an appropriate guardian. personal confidential data 2. Don't use personal confidential should be aware of their data unless it is absolutely responsibilities necessary Action should be taken to ensure that those handling personal confidential data both Personal confidential data should not be clinical and non-clinical staff are made fully included unless it is essential for the specified aware of their responsibilities and obligations purpose(s) of that flow. The need for patients to respect patient confidentiality. to be identified should be considered at each stage of satisfying the purpose(s). 6. Comply with the law 3. Use the minimum necessary Every use of personal confidential data must personal confidential data be lawful. Someone in each organisation handling personal confidential data should be Where use of personal confidential data is responsible for ensuring that the organisation considered to be essential, the inclusion of complies with legal requirements.

6 Each individual item of data should be considered and justified so that the minimum 7. The duty to Share information amount of personal confidential data transferred or accessible as is necessary can be as important as the for a given function to be carried out. duty to protect patient confidentiality 4. Access to personal Health and social care professionals should confidential data should be on have the confidence to Share information in a strict need-to-know basis the best interests of their patients within the framework set out by these principles. They Only those individuals who need access should be supported by the policies of their to personal confidential data should have employers, regulators and professional access to it, and they should only have bodies. 6 Government Response to the Caldicott Review Chapter 1. Introduction The Government is committed to a a new right for patients to request that health and care system which puts their confidential information is not those who use it at the heart of the used beyond their own care and system.

7 The Department of Health (the treatment and to have their objections Department) wants equality of considered, and where their wishes opportunity for everyone so that cannot be followed, to be told the everybody who uses both health and reasons, including the legal basis. social care services receives integrated care from services that work together The way that information is used, kept to address health inequalities and give secure and overseen is known as the best care based on a person's information governance'. information personal circumstances. governance is the term used to describe the principles, processes and To do this, service users need access legal and ethical responsibilities for to information , and service providers managing and handling information . It need to be able to Share information sets the requirements and standards with other providers and that organisations need to achieve to commissioners. The 2012 Care and ensure that information is handled Support White Paper1 recognised the legally, securely, efficiently and importance of information sharing to effectively.

8 Support the integration of services and clause 3 of the subsequent Care Bill The NHS Future Forum called for a sets out a duty on local authorities to review of the current rules on promote integration of care and information governance, and how they support with health services. are applied. The Government's information Strategy, The Power of The NHS Constitution2 commits to information : Putting all of us in control rights to privacy and confidentiality and of the health and care information we to the NHS keeping patients' need,3 accepted the need to be clearer confidential information safe and about when to Share data between secure. In the 2013 update of the NHS professionals. Most people would Constitution, the Government included expect and want this to happen routinely, but would also want 1 assurance that only those involved in future-reforming-care-and-support 2 3 constitution-for-england control-of-the-health-and-care-informati on-they-need their care should have access to What this will mean for us all confidential information , unless they have given specific consent for other In her foreword to the Report, Dame purposes, such as research aimed at Fiona said that every citizen should feel improving the way in which services confident that information about their are delivered to protect and improve health is securely safeguarded and health and care.

9 This applies across shared appropriately when that is in the age range. The Children and Young their interest. The Government agrees People's Health Outcomes Forum4 also with this view and the intention of all identified the need for improved the actions laid out in this response is information sharing to ensure better to give citizens that confidence. integrated services. Our overarching ambition for people The Department asked for the review within the health and care system is for of information governance to ensure them to no longer feel that information that there is an appropriate balance governance is complex and daunting. between the protection of confidential Everyone should understand how to data and the use and sharing of protect and, where appropriate, Share information to improve people's health information about the people they care and social care and for the benefit of for, either directly or indirectly. wider society. Dame Fiona Caldicott was asked to undertake the review and on 26 April 2013 published the Report5 which includes revisions to the original Caldicott principles to emphasise the need to give greater focus to sharing information .

10 The Government is pleased to accept in principle all of its recommendations. The review contains much helpful content beyond the 26. recommendations, and the Department will be looking to deliver the spirit of the review, rather than confine itself to the recommendations. 4 experts-set-out-recommendations-to-impro ve-children- and-young-people-s-health-results 5 governance-review 8 Government Response to the Caldicott Review What this means for patients, care What this means for everyone service users and their families working in the health and care and carers system People will feel more in control Health and care professionals of their personal confidential will make decisions about how information . information is shared and used in the best interests of people Everyone will feel confident that and patients using the five rules information about their health of confidentiality set out in new and care is secure, protected HSCIC guidance. and shared appropriately when that is in their interest.