Information: To Share or not to Share - GOV.UK

1 information : To Share or not to Share Government Response to the Caldicott Review September 2013. You may re-use the text of this document (not including logos) free of charge in any format or medium, under the terms of the Open Government Licence. To view this licence, visit Crown copyright 2013. Published to , in PDF format only. Contents 1. Contents Ministerial Foreword 3. The revised Caldicott principles 5. Chapter 1. Introduction 6. Chapter 2. People's right to access information about themselves 13. Chapter 3. Direct care of individuals 14. Chapter 4. Personal data breaches 19. Chapter 5. information governance and the law 22.

2 Chapter 6. Research 25. Chapter 7. Commissioning 28. Chapter 8. Public health 32. Chapter 9. Education and training 33. Chapter 10. Children and families 35. Chapter 11. New and emerging technologies 37. Chapter 12. Data management 38. Chapter 13. System regulation and leadership 40. Chapter 14. Conclusion and recommendations 42. Table of commitments who's doing what 44. Ministerial Foreword 3. Ministerial Foreword Better information confidence that anyone else who shares sharing will mean more information will do so responsibly and effective health and properly. And people will know how their care care services and an information is used and shared and how to improved experience object if they want to.

3 For people using those services. So I am Our response sets out how individuals and extremely grateful to organisations should improve the way that Dame Fiona Caldicott information is used for research, and her team for their comprehensive review. commissioning and above all good care. In this document we set out the Giving people a say in how their information Government's response. is used is an essential component of a good system. Where someone is concerned about Dame Fiona's review has given us a their information being shared, they have the tremendous opportunity to get information right to make their objection heard.

4 Sharing right - to improve safety, to prevent the need for patients to have to repeat information must be held securely. Several themselves to different health professionals, safeguards will be put in place. They include: to make care more efficient, and to find new making sure that health and care staff are cures and therapies for killer diseases. At the appropriately trained in information same time, it is vital that we respect people's governance, responding to a data breach privacy and put them more in control of how honestly and immediately, and having a their information is used. This is a fine designated leader on information governance.

5 Balance to strike, but an achievable one. The Health and Social Care information In the past, information governance rules Centre's Code of Practice on Confidentiality have prioritised systems over people. Too will provide much needed clarity to often they have been seen as an organisations on how the rules work and insurmountable obstacle and an excuse to how they can be applied consistently. avoid sharing information . We outline a new approach here. I have been encouraged by the willingness of organisations across health and care to work This new approach will mean that frontline with the Department of Health to effect the staff will be confident about when to Share cultural change we are seeking.

6 Dame Fiona information with other members of a will monitor the progress made following her person's care team and how to do so safely. review, and will publish a report a year from Frontline staff will also have much greater now. 4 Government Response to the Caldicott Review information is compiled, stored and shared because doing so improves people's health, but at the same time their data must be treated with propriety and respect. The prize for achieving this is very great indeed. Rt. Hon. Jeremy Hunt MP. Secretary of State for Health The revised Caldicott principles 1. Justify the purpose(s) access to the data items that they need to see.

7 This may mean introducing access Every proposed use or transfer of personal controls or splitting data flows where one confidential data within or from an organisation data flow is used for several purposes. should be clearly defined, scrutinised and documented, with continuing uses regularly 5. Everyone with access to reviewed, by an appropriate guardian. personal confidential data 2. Don't use personal confidential should be aware of their data unless it is absolutely responsibilities necessary Action should be taken to ensure that those handling personal confidential data both Personal confidential data should not be clinical and non-clinical staff are made fully included unless it is essential for the specified aware of their responsibilities and obligations purpose(s) of that flow.

8 The need for patients to respect patient confidentiality. to be identified should be considered at each stage of satisfying the purpose(s). 6. Comply with the law 3. Use the minimum necessary Every use of personal confidential data must personal confidential data be lawful. Someone in each organisation handling personal confidential data should be Where use of personal confidential data is responsible for ensuring that the organisation considered to be essential, the inclusion of complies with legal requirements. each individual item of data should be considered and justified so that the minimum 7. The duty to Share information amount of personal confidential data transferred or accessible as is necessary can be as important as the for a given function to be carried out.

9 Duty to protect patient confidentiality 4. Access to personal Health and social care professionals should confidential data should be on have the confidence to Share information in a strict need-to-know basis the best interests of their patients within the framework set out by these principles. They Only those individuals who need access should be supported by the policies of their to personal confidential data should have employers, regulators and professional access to it, and they should only have bodies. 6 Government Response to the Caldicott Review Chapter 1. Introduction The Government is committed to a a new right for patients to request that health and care system which puts their confidential information is not those who use it at the heart of the used beyond their own care and system.

10 The Department of Health (the treatment and to have their objections Department) wants equality of considered, and where their wishes opportunity for everyone so that cannot be followed, to be told the everybody who uses both health and reasons, including the legal basis. social care services receives integrated care from services that work together The way that information is used, kept to address health inequalities and give secure and overseen is known as the best care based on a person's information governance'. information personal circumstances. governance is the term used to describe the principles, processes and To do this, service users need access legal and ethical responsibilities for to information , and service providers managing and handling information .