MINUTES OF THE INFORMATION GOVERNANCE, MANAGEMENT … · Action: JT, AH and JM to consider including laptops in this year’s refresh ... PG noted that although printers were out

The Information Governance, Management and Technology Committee is managed by Rushcliffe Clinical Commissioning Group (CCG) on behalf of Nottingham West CCG, Nottingham North and East CCG, Mansfield and Ashfield CCG and Newark and Sherwood CCG

MINUTES OF THE INFORMATION GOVERNANCE, MANAGEMENT AND TECHNOLOGY

COMMITTEE

Friday 24th July 2015, 1.30 pm – 4.00 pm, Clumber Meeting Room, Easthorpe House, Ruddington

MEMBERSHIP Andy Hall Alexis Farrow Paul Gardner Petra O’Mahony (A) Sarah Bray (A) Nichola Bramhall Ei-Cheng Chui (A) Dr Mike O’Neil Hazel Buchanan Elaine Moss (A) Paul Morris Dr Sean Ottey (A) Eddie Olla Gary Flint (A) Jacqueline Taylor

Director of Outcomes and Information & SIRO (Chair) Information Governance Lead Information Governance Lead Freedom Of Information Lead Chief Finance Officer and Senior Information Risk Owner Director of Nursing and Quality & Caldicott Guardian General Practitioner & Caldicott Guardian Clinical Representative & SIRO Director of Operations & SIRO Director of Quality and Governance & Caldicott Guardian Lay Member General Practitioner & Clinical Representative Director of Health Informatics Head of Customer Services and Business Support Head of Transformation

Nottingham South CCGs GEM CSU Nottingham City CCG GEM CSU Mansfield & Ashfield CCG and Newark & Sherwood CCG Nottingham South CCGs Newark & Sherwood CCG Nottingham West CCG Nottingham North and East CCG Mansfield & Ashfield CCG Newark and Sherwood CCG Rushcliffe CCG NHIS NHIS NHIS

IN ATTENDANCE Gina Holmes Caroline Stevens Craig Sharples (A) Diane Butcher Sergio Pappalettera (A) Andy Evans Mike Press Maria Principe (A) Jason Mather Debbie Pallant Helen Clerk Helen Ben-Fredj Paul Callahan

Corporate Governance Officer Governance Officer Head of Governance Head of Information & Performance Contract and Information Manager Programme Director Head of Technical Solutions Director of Cluster Development and Performance Primary Care Development and Service Integration Manager Corporate Governance Manager Information Governance Officer Project and Business Change Manager NHIS Project and Business Change Manager

Mansfield & Ashfield CCG and Newark & Sherwood CCG Rushcliffe CCG Nottingham West CCG Mansfield & Ashfield CCG and Newark & Sherwood CCG Nottingham North and East CCG Connected Nottinghamshire NHS NHIS NHS Nottingham City CCG NHS Nottingham City CCG NHIS Nottingham City CCG NHIS NHIS

(A) Depicts Absent/Apologies

RCCG/GB/15/146

The Information Governance, Management and Technology Committee is managed by Rushcliffe Clinical Commissioning Group (CCG) on behalf of Nottingham West CCG, Nottingham North and East CCG, Mansfield and Ashfield CCG and Newark and Sherwood CCG - 2 -

Item No. AGENDA ITEM - KEY POINTS OF DISCUSSION Actions

IGMT/15/079 Welcome and Introductions AH welcomed all to the meeting and a round of introductions took place.

IGMT/15/080 Apologies Apologies were received from Marcus Pratt and Petra O’Mahony.

IGMT/15/081 Declarations of Interest There were no declarations of interest

IGMT/15/082 Minutes of Meeting held on 22nd May 2015 The minutes of the last meeting held on 22nd May 2015 were agreed as an accurate record

IGMT/15/083

Matters Arising from previous meeting (not picked up within agenda): IGMT/15/061 – JT had provided updated job titles for NHIS members and these had been amended for the minutes IGMT/15/062 – CCG leads had ensured that cyber security circular from Debbie Pallant had been disseminated to staff and practices IGMT/15/062 – Categorisation for NHIS incidents had not yet been discussed at the IM&T SRO Programme Board, this action would be rolled over for the IM&T Programme Board meeting on Tuesday 28th July 2015 IGMT/15/064 – MP had not yet circulated user information to SIROs. This action would be rolled over IGMT/15/064 – AH had not yet provided a response regarding cyber security and a list of what was required in addition to the technical response. This action would be rolled-over IGMT/15/068 – Password resets had not been separated in the NHSI performance report for this meeting, this would be included in the next report. MP would also draft text regarding using the customer portal and completing customer satisfaction surveys to be disseminated to CCGs and practices IGMT/15/069 – JT provided the schedule for the GP PC Refresh programme to SIROs. A way forward had been agreed IGMT/15/069 – JT and MP had provided some text regarding the SMS Texting services and this had been disseminated to practices and would be covered on the agenda IGMT/15/073 – The committee discussed the action for the IG leads meeting after PG sought clarification of what was being requested of the group. PG explained that the principles could be agreed by the Record

AH and EO MP AH MP CS



and Information Group (RIG), however, a policy would be difficult to create as dependent on different systems. The RIG would consider what was practical and technically possible and report back to the September meeting on progress IGMT/15/074 – PG and AS reported that they had developed a template report for the IGMT that included incidents. The report template was approved at the IG leads meeting earlier that week and would be presented at the next meeting IGMT/15/077 – PIDs had not been added to the July agenda. This action would be rolled over to the September meeting IGMT/15/078 – JT had enquired with SystmOne regarding user groups. A standard form had been disseminated to members for completion. CS to resend form to PM and JT to email out to practices to ask for interest to arrange a meeting through the form with SystmOne for September IGMT/15/078 – PG and JT had reviewed the de-commissioning of Arboretum SystmOne and this matter was now resolved

PG CS JT

IGMT/15/084

Device Replacement Project Helen Ben-Fredj, NHIS Project and Business Change Manager presented an overview and update of the Device Replacement Project to the Committee. HBF reported that the focus this year had been on the PC replacement programme, the budget had been increased which meant that more models could be replaced this year than last. Last year all 745 models or older than 2007 were replace and this year, all 755, 760 and 780 models or older than 2011 were being replaced. HBJ reported that some monitors and keyboards had also been replaced, however, the following items were out of scope OptiPlex 790, laptops, printers and memory The team asked practices if they wanted to be prioritised in case any had any failing devices. HBJ noted that all NNE practices now have all items scheduled in to ensure they are now able to Map Of Medicine. HBJ explained that the project used contracted staff and this had initially been the most challenging aspects of the project initially. This year all engineers working on the project had been with the team before so understood how the practices worked and practices had supplied software lists so engineers knew what they are doing before visiting. The team had also been contacting practices after each visit to ensure they were happy and new software was used to copy all information from one PC to another had created fewer problems than previous processes. HBJ reported that she expected the project to complete in February 2016 JM noted that the project had received positive feedback in Nottingham City CCG and asked if there was scope to include laptops in this year’s



refresh. JT said that budgets would need to be reviewed. The Committee agreed that this would be considered outside of this meeting. Action: JT, AH and JM to consider including laptops in this year’s refresh AH noted that he received positive feedback about the project from practices and in particular one GP had given specific thanks to the team following the refresh which had greatly increased the speed of the practice computers. PG noted that although printers were out of scope, GP2GP required large records to be printed and asked if this could be considered for the project. JT noted that this depended on the funding available for 2015/16. AE noted that it was still unclear how much money would be available from the Primary Care Infrastructure fund. AH thanked HBJ for the presentation Nigel Callahan, NHIS Project and Business Change Manager presented an overview and update of the Server Replacement Project to the Committee. NC noted that the team were working towards moving practice servers into a cloud using N3 servers, he noted that at the moment practice servers were sometimes in cupboards on site. NC reported. The team had so far migrated five practices to a central server location and had now signed up to the N4 (a local network COIN which extended local network). NG reported that the team had not started actual work but had been holding a lot of working groups within NHIS to agree how to take the project forward and keep aligned with the national project to moving towards a centralised system. NHS England had also developed a framework to help guide providers in their project planning. NC identified several issues with current servers including space, batteries and the need to back-up regularly. Moving servers out of practice into a centralised system resolved these problems and provided many other benefits including file sharing, local intranet, shared applications, virus solutions, central printing updates, single sign on solution anywhere in the community, centralised back-ups, and access from anywhere in the community. MO noted that he had not heard about this project before. He explained that whilst he was in favour of this direction of travel, the committee needed a clear understanding of the advantages, disadvantages and mitigations. In particular there was concern about bandwidth issues for some practices. JT reported that this would be completed on a practice by practice basis with an appraisal for each individual practice. Five practices had already completed as their servers had failed. The project would continue for

JT/ AH /JM



emergency work initially and that the committee should communicate to practices that this is what was happening. There was still some exploratory work to be done regarding programme loading and rights over servers. NC noted that servers would be the same for practices but NHIS would just take on that day to day responsibility of backing up. AH stated that the IGMT and CCGs needed to sign off process before practice could be approached. The Committee agreed that NC should send governance proposal within the next four weeks for sign off and then smaller group would consider what it meant for practices before sign off. PG asked that he and AF were involved to consider information governance implications. Action: NC to send proposal to AH Action: AH, AE, MO, PG and AF to consider proposal Action: CS to add to September agenda The IGM&T Committee NOTED the project updates

NC AH/AE/MO/ PG/ AF CS

IGMT/15/085 Data Quality Policy AH presented the Data Quality Policy to the Committee for approval. The purpose of this document was to set out a clear policy framework for maintaining and increasing high levels of data quality within the CCGs. The way in which data is collected and analysed can influence the results and it was, therefore, important to have a clear and open framework in place which supported this process and accurately reflected the practice of the CCGs in the discharge of its functions. This Data Quality Policy set out how the CCGs will collect, analyse and report data. AH noted that through the process of being audited on data quality, it became apparent that the CCGs did not have a policy around data quality. PG had shared City CCG’s draft policy which has been starting point for this policy. The policy provided a broad framework for how to approve and validate data in organisations and focused on electronic data but did refer to other media. HB asked that references to Chief Officer on page 8, section 6 were changed to accountable officer. AE suggested that the committee approve the policy with a review of 3 months as the CCGs did not currently have a policy at the moment. This would allow all members and CCGs to review thoroughly and feedback comments about the policy. Action: CS to add Data Quality Policy to November agenda The IGM&T Committee APPROVED the paper with the amendment noted

CS



IGMT/15/086

Information Governance, Management and Technology Committee Terms of Reference AH presented the updated terms of reference to the Committee for agreement. The terms of reference described the reporting structures of the five Nottinghamshire County CCGs for Information Governance and Information Management and Technology, the membership of the Committee and the CCGs’ responsibilities and duties. The terms of reference were due for review and amendments to the previously approved version reflected changes to the membership, approval rights of the committee and voting rights for deputies The committee reviewed the terms of reference and agreed the following amendments:

Section 2 – members are expected to attend at least 75% of meetings, should change to members are expected to attend a minimum of four meetings per year

Section 8 – Reference to primary care co-commissioning to reflect the committee’s new responsibilities. PG to provide wording

Appendix 1 – Update Alexis Farrow’s surname, Elaine Moss is no longer SIRO for Newark and Sherwood CCG, Sarah Bray is now SIRO for Newark and Sherwood CCG, include NHIS updated job titles as provided for the minutes, Sean Ottey no longer deputy chair, Ei-Cheng Chui now deputy chair, name both Newark and Sherwood CCG and Mansfield and Ashfield CCGs for representatives rather than Nottingham North CCGs, include Andy Evans in attendance

The IGM&T Committee AGREED the update terms of reference with the amendments noted for approval at Governing Bodies Action: CS to send amended terms of reference to CCGs’ Governing Bodies for approval Action: PG to provide wording regarding primary care co-commissioning responsibilities

CS PG

IGMT/15/087 Cyber Security Overview DP presented the Cyber Security Overview paper to the Committee for information At the March 2015 Committee meeting, NHIS was asked to provide a response to the cyber security essentials for the July IGMT Committee meeting (following v13 of the IG toolkit). Cyber Security Assurance would be given to partner organisations as NHIS worked towards accreditation for ISO 27001, accreditation for the Cyber Essentials Scheme and submission of a compliant IG Toolkit in March 2016. A suite of supporting documentation, policies and procedures (including the Network Security Policy and its associated technical operating procedures) was in place and currently under review to ensure they remain fit for purpose



AH thanked DP for completing this work. DB asked if NHIS had applied. DP responded that they intended to apply towards the end of august 2015 and were currently working through all the questions. PG asked if a risk should be added to the risk register or if there was enough assurance provided. DP suggested that the committee await MP’s update. AH noted that he was more assured about technical elements although not assured about non-technical risk. PG explained that if there were gaps in assurance it should be included on the register. EO suggested that there was board level awareness of cyber security as well as making staff aware as part of the induction process, there were quarterly test scenarios between ICT provider and SIROs/ IG leads and tests of the governance in the organisations. MO suggested that it would be useful to provide a short update at a GP practice education event. The Committee agreed to the add cyber security to the risk register’s issues log, rather than the register although agreed that the name of issues log would be changed. Action: PG, AF and DP to add cyber security to the issues log The Committee agreed that all IAOs should be receiving assurance for assets as part of the asset management process. Action: SIROs to ensure that IAOs are considering all local assets in relation to cyber security and bring back to this committee is necessary. The IGM&T Committee NOTED the paper

PG/ AF/ DP

IGMT/15/088

Capital Bids – Projects Financial Status JT presented the Capital Bids report to the Committee for information. The document outlined the financial status and current spend for each of the projects currently underway from Capital Funding from NHS England. JT noted that a number of bids had been submitted and NHIS had received funds and spend on this was being reported. JT updated on the five capital projects 1st project – GP IT refresh, the majority of funds had been spent on equipment and the report included a breakdown of what had been spent and what would be spent. 2nd project – Interoperability programme and EDSM, a small team has been visiting practices, explaining Subject Access Requests and safeguarding issues. All resources have now been spent 3rd project – GP mobile working, this was an initial pilot. The team are considering equipment and working with practices on benefits and what



is needed. AH noted that the resource to deploy cost of laptops seemed high. JT explained that this was a prediction and still needed further review 4th project – GP repository for clinical care programme, this is about receiving data from practices and making this available for clinical care, there were a number of costs and planned project costs were completed ahead of project with some estimations. AH noted that alongside the assessment of capital costs sat the costs of the Data Management Team which was covered by the CCGs. 5th project – GP servers, JT noted that this capital costs had not been calculated for this project and would share this information when NHIS had an accurate idea. AH thanked JT for paper and asked that the committee received the report regularly Action: CS to add to agenda as a standing item The Committee NOTED the report

CS

IGMT/15/089

HSCIC Dridex Alert Investigation MP presented the HSCIC Dridex Alert Investigation to the Committee for information. On 26th June 2015, HSCIC contacted NHIS to inform them that 5 of its supported practices were identified as having potentially been affected by the Dridex Malware Virus. An investigation was undertaken by NHIS to understand how and why HSCIC would be seeing a possible detection for Dridex from NHIS supported sites and ensure that the NHIS Antivirus/Malware tools were effective.

The results of the investigation showed that the tools currently deployed by NHIS were effective, and were operating as expected, it also explained why HSCIC saw a detection.

The investigation provided a number of technical steps to be investigated in light of increased capabilities of NHIS Antivirus/ Malware and changes to the COIN which could further protect GP Practices were not subject to NHIS web filtering.

The investigation also identified the need to Re-educate users in the use of email and particularly the opening of attachments without verifying the source was trusted. MP provided some further detail about the alerts. The alerts related to Malware that was activated in email and sent back key strokes and information used for ill gain. This was a general threat in the NHS N3 network and the alerts required that NHIS respond and provide an action plan by the following Monday. This was completed and provided within the timescales, however, the fact that an alert had been received was a concern and warranted an investigation. MP referred to the diagram in the report explaining that NHIS had ran the anti-malware tools and did not find any live issues. The software was then used to reconstruct time to investigate further, as HSCIC were only able to provide an IP address



and site and did not provide a date. All emails into the network were routinely scanned to detect malware and attached spam and then filtered filtered out. On one particular day the investigation identified that quite a lot of emails had been filtered and NHIS summarised that on one day emails were not filtered and a number of these were then opened. Whilst these were opened there were anti-virus systems on the devices so information was still protected. HSCIC had seen this because the items were opened and this sent a message back to the source which was seen by HSCIC whereas NHIS had automatically dealt with this and so had not been highlighted. MP summarised that the tools used were effective and that it was important that we have multiple capabilities. Next steps included implementing the new COIN so covered practices that were not covered by all the controls. NHIS were waiting for Sophos who were updating virus protection and malicious traffic detection which stopped call home viruses at source. PG enquired about appendix E in the report which included staff email addresses and information that was out of date and noted that this should be redacted MP confirmed that all practices and individuals had been made aware The Committee NOTED the report

IGMT/15/090

GP SMS Text Messaging AH provided an update regarding GP SMS Text Messaging to the Committee for information AH explained that the CCGs were informed in June that practices needed to transfer from national contract to local arrangements within short timescales and thanked MP and his team for delivering this. All the practices that had been using SMS text had now been transferred to a temporary contract until end of September 2015. He noted that there was still some work to be done for the contract to start on 1st October 2015. NHS England had confirmed that funding would be within the CCG requirement, as the GP IT revenue had increased to cover this funding. Communication to practices had been sent out and only a couple of practices had experienced problems receiving error issues. MP noted that now NHIS were in control of the white list, they were able to act on behalf of the CCGs DB confirmed that AH was developing the contract. AH explained that there was an assumption that the CCG would continue to support the practices using the SMS texting service. He noted that there was no risk other than a contractual risk as no further technical work was required and a letter had been sent to providers. AH also explained that as the CCG is now supporting practices invoices would be sent to practices.



PM enquired about the cost of the service. AH explained that it would not be clear until the CCGs understood the usage but would estimate about £50000 per year across 5 CCGs. AH noted that there was a role for the CCGs to standardise use of costs to ensure they do not massively increase. DB enquired if the gateway referral texts would be covered by the contract. AH confirmed that if they had a practice address then they would. The Committee NOTED the update

IGMT/15/091

National Updates DB presented the national updated briefing to the Committee for information. The briefing updated members of the Committee on recent requirements from NHSE in relation to Risk Stratification Assurance Statements and the national register of Controlled Environment for Finance (CEfF) DB assured members that all Risk Stratification Assurance requirements had been completed in November 2014, this was reviewed and re-submitted in June 2015 after being requested by NHS England. The IGM&T Committee NOTED the content of the briefing relating to Risk Stratification Assurance Statements and CEfF Registers, together with the actions taken by the CCGs.

IGMT/15/092

NHIS Update Performance Report EO presented the NHIS Update Performance Reports. He noted that NHIS were still not meeting KPI. The 1a and 1b KPIs were consistently getting better, however, 2, 3 and 4 KPIs were not being achieved and NHIS needed to make sure that this was progressed. EO welcomed feedback from members. He noted a number of personnel changes in NHIS that would affect future achievements. The report included a list of actions for NHIS. DB asked if the contract review meeting could receive an electronic copy of the monthly report. Action: EO to ensure monthly electronic report is provided to contract review meeting members The IGM&T Committee NOTED the report

EO

IGMT/15/093 NHIS Update Project Status Report JT presented the NHIS Update Project Status Report. The purpose of the status report was to provide a high level overview of the current status of the major ICT projects being conducted by NHIS across Nottinghamshire. The high level project status report supported the detailed status reports produced for each CCG.



EPS Release 2 Electronic Prescription Service Release 2 provided the ability for prescriptions to be sent electronically to a nominated dispenser. The project was now establishing a roll out plan for further practices to deploy this functionality, with an aim of reaching a minimum of 65% across the CCG’s. A few more were scheduled to go live than reported in June report and slots were filled through to end of December 2015 NHIS would be targeting lower percentages first to ensure they achieve 75%, 38 slots available and 39 needed. JT noted that one practice had cancelled at the last minute and if that happened any more, the project could need to go into the next financial year. JT stated that issues would be flagged with CCGs if there were problems Medical Interoperability Gateway The Medical Interoperability Gateway (MIG) was a secure gateway to a set of services for exchanging real time patient record data between third party systems and GP Practices. This project would deliver support to Practices for the final technical enablement for Practices through their clinical system. The Project had a pre-requisite and was dependent upon an Information Sharing Agreement (ISA) being in place for each Practice. Only one practice was not enabled, this practice had a SystmOne migration so agreed could hold Enhanced data sharing model (EDSM) A Service Improvement Programme had been requested by the CCGs to SystmOne Practices. The aim had been to encourage sharing of detailed care records for specific groups of patients; e.g. children, patients with chronic disease and with palliative care needs and those likely to be admitted to hospital etc. Due to the low percentage of shares, and the adverse impact that this had on the availability of records viewable in the Medical Interoperability Gateway (MIG), a project exception had been raised, to offer support to SystmOne Practices to set Implied Sharing for all patients. This sharing of information would link in closely with the MIG project activities, which facilitated interoperability of different clinical systems. Healthcare providers using different clinical systems would then have access to patient records through the data sharing and interoperability which enabled timely and relevant information about the patient so that they could be provided with optimum care. Face to face visits at Mansfield and Ashfield, Newark and Sherwood and Nottingham North & East had virtually been completed. The Project was now focusing on City and Nottingham West CCGs. Only one practice had refused to discuss it but were emailing with questions so were considering it. Otherwise the project was receiving positive feedback, JT noted positive clinical leadership through MO and EC. Summary Care Records Viewer Summary Care Record (SCR) Viewer was available for clinicians to access the SCR for temporary residents or new patients where the full medical record was still not available. There is a pre-requisite governance requirement for practices to have a privacy officer in place to monitor the use of the SCR Viewer and the alerts the system may



generate. The Privacy Officer required governance training, in addition to system functionality training. All practices were contacted for an expression of interest and a significant number of positive responses were received from practices. Provision had been made for NHIS to provide training materials to

support Information Governance training for the nominated Privacy

Officer’s at GP Practices in order to progress the project. JT reported that

NHIS had been creating e-learning material and this should be available

at the end of the month, this would also be needed for toolkits

GP PC Refresh Project Project to replace outdated GP practice PC’s. This project would replace PC models 755, 760 and 780. PC’s. Installations had now commenced. Interviews are being held this week as the last recruitment exercise failed to appoint sufficient engineers to complete the project. The project was to be linked closely with the server replacement project due to interdependencies and therefore practice scheduling had only been done 2-3 weeks in advance at present. Mobile working for GPs The mobile working project was to support the CCG mobile working initiative for GP Practices. A practice from each CCG would be taking part in the pilot. A Project Board had been set up and the practices had been contacted to take part in some baseline activities before the pilot commenced. Pilot sites had now been agreed and all had been visited. Baseline visits were being booked and were looking at benefits rather than just providing devices with no guidance Map Of Medicine NHIS was originally commissioned to:

make available to Training Materials that were only available via the Internet and which were only accessible from sites that were not permitted to be accessed and;

to manage the installation of the Map of Medicine (MOM) software on all PCs identified by individual practices.

Both of these activities had been completed.

All training, configuration and deployment activities were outside of the scope of the NHIS remit and were handled by the CCG Rollout Team.

In addition, NHIS were asked to upgrade any identified PCs at selected Practices to enable a pilot of the new versions of MOM and SystmOne:

The four pilot practices had all been upgraded. At each Practice, every PC identified as needing Map of Medicine was now running on 4GB RAM, the latest version of MOM and the upgraded version of SystmOne

A problem was identified at a single PC at a single practice. The Practice was visited and the issue was identified as there



being 2 SystmOne icons available, one of which had not been upgraded to use the 1Gb memory: this was resolved.

The same PC and User were the only report of a slowdown received by the Project Manager. However, previously the slowdown occurred after 3 – 4 hours, it now occured after 7 – 8 hours. This has been raised back to the CCG Project Team

Awaiting customer plans for further rollout JT noted that this project was on hold in Newark & Sherwood and required further work before progressing The IGM&T Committee NOTED the report

IGMT/15/094 Nottingham City CCG ICT Committee Meeting Minutes 8th June 2015 The IGM&T Committee NOTED the minutes

IGMT/15/095 CfH Exit and Transition JT provided an update to the Committee regarding the Connecting for Health exit and transition JT reported guidance had now been received regarding the exit and transition. All of the practices in County and majority in City on SystmOne would need to be moved from LSP contract to GPSOC, as NHIS now had a process to follow, a full assessment process would need to be completed for each individual practice. Each practice would need to be scored on a number of criteria and they would be assessed against these criteria. JT noted that the CCGs would need to meet EU procurement rules by end of September 2015. Action: JT to contact TPP to ask for statement about interoperability as part of criteria and copy in CCG colleagues JM developing a generic response to the assessment and writing out to individual practices asking them to confirm and sign off by end of September, this should also include the contract for signing The IGM&T NOTED the update

JT

IGMT/15/096 Records and Information Group Update In EC’s absence PG provided an update to the Committee on the Records and Information Group’s activities. The group had approved that members in principle would agree to share minimum information for child exploitation online protection centre. The principles for the consent model had also been approved and were currently being signed off by Caldicott Guardians and SIROs. The IGM&T Committee NOTED the update

IGMT/15/097 Privacy Impact Assessments Overview/ Summary AS and PG presented an overview of the current Privacy Impact Assessments (PIA) to the Committee.



Two PIAs had been signed off, the Skylarks PIA was ongiong and a PIA for the Mid Nottinghamshire CCGs for ECG and NRS were ongoing. PG noted that the MIG PIA had not been signed off and this may need to be revisited if it were to include mental health data in future The IGM&T Committee NOTED the summary

IGMT/15/098 Information Governance Incident Report PG reported that no serious incidents had been reported since the last meeting. As per agreement at the last IGMT Committee meeting, incidents would be reported quarterly. PG noted that this would form part of the new IG report to the Committee The IGM&T Committee NOTED the report

IGMT/15/099 Information Governance Risks and Register PG presented the IG risk register. This had been reviewed by the IG Leads meeting and suggestions made to close some risks and move others to an issues log were included in the update. The committee agreed to closing all the risks proposed and to the implementation of an issues log of things that Committee needs to manage The committee noted that two risks remained, these were the flows of data regarding section 251 as still no regulations so a risk remained in case the section 251 was not extended again and risk relating to establishing a relationship with DSCRO. The committee agreed to add cyber security to the issues log The IGMT Committee APPROVED the register

IGMT/15/100 IG Leads meeting update PG presented the minutes for the IG leads held on 15th May 2015. He noted that all meetings had been set to align with IGMT, managing the IG toolkit and supporting GPs The Committee NOTED the minutes

IGMT/15/077 Forward Programme AH presented the Forward Programme for 2015/16. PM noted that he sat on the primary care co-commissioning commissioning and asked implications for this committee regarding pharmacy and opticians. AH explained that NHIS did provide some services to these services, although only EPS as these services do not use smart cards



DB noted that following the national migration, e-referrals were not running smoothly and that a lot of work was going on across the country. AH asked that this be discussed further outside of the meeting Action: ALL members should forward any other agenda items to CS

ALL

IGMT/15/078

Any Other Business The Privacy Impact Assessment and the Access to Patient Information and Smart Card procedures were due for review at this meeting, however, both required further work. As the procedures were still fit for purpose, the committee was asked for a further extension for both procedures until the September 2015 meeting

Date and Time of Next Meeting 1.30 pm – 4.00 pm on Friday 25th September 2015 Meeting Room 2 and 3, Birch House, Mansfield


Abbreviation Meaning

ADT Admissions Discharges and Transfers

AHP Allied Health Professional

AHR Access To Health Record request

AQP Any Qualified Provider

ASH Accredited Safe Haven

AUP Acceptable Use Policy

BAU Business As Usual

BC Business Continuity

CAB/C&B Choose and Book

CAG Confidentiality Advisory Group

CCG Clinical Commissioning Group

CDS Commissioning Data Set

CfH Connecting for Health (now replaced by NHSE and HSCIC)

CG Caldicott Guardian

CSU Commissioning Support Unit

DH/DoH Department of Health

DMIC Data Management Information Centre (old name for DSCRO)

DPA Data Protection Act

DR Disaster Recovery

DSA Data Sharing Agreement

DSC Data Sharing Contract

DSCN Data Set Change Notice

DSCRO Data Service for Commissioners Regional Office

EPR Electronic Patient Record

EPS Electronic Prescribing Services

FOI(A) Freedom of Information (Act)

GEMCSU Greater East Midlands Commissioning Support Unit

GP General Practice

GPES General Practice Extraction Service

HES Hospital Episode Statistics

HIS Health Information Service/System

HPA Health Protection Authority

HSCIC Health & Social Care Information Centre

IAA Information Asset Administrator

IAO Information Asset Owner

ICO Information Commissioners Office

IG Information Governance

IGSoC Information Governance Statement of Compliance

IGT Information Governance Toolkit

IGTT Information Governance Training Tool

ISA Information Sharing Agreement

ISP Information Sharing Protocol

KPI Key Performance Indicator

LA’s Local Authorities

LES Local Enhanced Service


Abbreviation Meaning

LSP Local Service Provider

NACS (Now ODS) National Administrative Codes Service

NHSCB NHS Commissioning Board (old name for NHSE)

NHSE NHS England

NWW NHS Wide Web

ODS (Previously NACS) Organisation Data Service

PCD Personal Confidential Data

PHE Public Health England

PIA Privacy Impact Assessment

QIPP Quality Innovation Productivity and Prevention

QOF Quality Outcome Framework

RA Registration Authority

SAR Subject Access Request

SBS Shared Business Service

SI/SUI Serious Incident/Serious Untoward Incident

SIRO Senior Information Risk Owner

SUS Secondary Use Service

VSO Voluntary Services Organisation

….. Definitions Primary Use of data – is when information is used for healthcare and medical purposes. This would directly contribute to the treatment, diagnosis or the care of the individual. This also includes relevant supporting administrative processes and audit/assurance of the quality of healthcare service provided Weak pseudonym (such as NHS number or postcode) The classification of a weak pseudonym stems from the fact that unless a user has access to another system that requires authorisation and user authentication etc (eg Exeter or the Spine) then the individual cannot be identified from the NHS number alone.

Documents

MINUTES OF THE INFORMATION GOVERNANCE, MANAGEMENT … · Action: JT, AH and JM to consider including laptops in this year’s refresh ... PG noted that although printers were out