Embed Size (px)
Citation preview
Bone and Joint Infection Registry (BAJIR) Information Governance Pack
This information pack is designed to include all relevant IG documentation and information for organisations to provide to their local IG teams when considering participation in the National Bone and Joint Infection Registry run by Northumbria Healthcare NHS Foundation Trust. If you have further questions, please do not hesitate to contact us using the details within this pack.
This document is for information purposes only and should not be shared outside the receiving organisation without the agreement of Northumbria Healthcare NHS Foundation Trust.
Overview / Purpose of the BAJIR
Bone and Joint infections can cause a great deal of suffering to those patients who have one. Different clinical teams have different ways of treating the infections. The Bone and Joint Infection Registry (BAJIR) is a national project that aims to improve our understanding of these diseases. The aim is to improve care for those who suffer from these conditions. The BAJIR aims to do this by recording how treatment is delivered across the UK. This will then in turn enable us to better understand which treatments work the best and disseminate this information to the healthcare professionals who treat these patients.
The BAJIR database is the UK Bone and Joint Infection Registry. It is designed to collect data on all patients with bone and joint infections in the UK. The information will be used to better understand bone and joint infections and how best to treat them. It will also be used to assess and improve the quality of services across the NHS to achieve better outcomes for patients with these conditions.
Having as many cases of bone and joint infection in the central registry means that clinicians can look at large numbers of cases and compare what treatments have been most successful when treating patients who have had an infection. By knowing this, the best treatment can be given to all patients sooner.
Author: Jonathan Walmsley, IG Manager Northumbria Healthcare NHS Foundation Trust Version 1.0Creation date: 26/05/2021 Review Date: 26/05/2022
Information sharing agreement
The following Information Sharing agreement (ISA/DSA) outlines the data sharing arrangements that form part of the BAJIR. This agreement has been drafted by Northumbria Healthcare NHS Foundation Trust as the host for the BAJIR.
The future aim of the management of this agreement, will be to transfer to an electronic solution following the initial sign off. It is envisaged that at the same period each year (for example every March) all previous / new participating organisations to the BAJIR and this sharing agreement will transfer to an agreement facilitated through the Information Sharing Gateway. This is to allow for ease of reviews moving forward and sign off of the agreement on an annual basis. Paper based agreements will still be available if required.
If you have any queries relating to this agreement please contact the Information Governance Team at Northumbria or the central BAJIR team. Once happy and when signed off by your organisation, please return your completed agreement to the central BAJIR team.
Data Protection Impact Assessment (DPIA)
As host of the BAJIR registry Northumbria Healthcare has completed a Data Protection Impact assessment for the registry. This documentation is intended for information purposes and each organisation may wish to carry out their own assessment accordingly.
Dendrite Clinical Systems
Dendrite Clinical Systems Ltd act as a Data Processor on behalf on Northumbria Healthcare NHS Foundation Trust in providing the system that the Registry operates on. Due diligence in relation to Dendrite can be found within the above DPIA. Additionally, Northumbria Healthcare have a contract in place with the supplier for the provision of the system. Whilst we are unable to share a copy of the contract in place, included below for reference is a copy of the Data Processing agreement between Northumbria Healthcare NHS Foundation Trust and Dendrite Clinical Systems Ltd.
Author: Jonathan Walmsley, IG Manager Northumbria Healthcare NHS Foundation Trust Version 1.0Creation date: 26/05/2021 Review Date: 26/05/2022
Full data Processor details are:
Data Processor: Dendrite Clinical Systems Ltd
Admin office address: 5th Floor, Reading Bridge House, George Street, Reading, RG1 8LS
Registered address: 82 St John Street, London, EC1M 4JN
ICO registration: Z8855307 (Tier 1)
Data Protection Officer:
Neal McCann, [email protected], 0208 329 4060
DSP Toolkit Information:
Organisation Code: 8HJ38Score: Standards exceeded[Previous IG Toolkit: Level 2]
Other Certification: Cyber Essential Plus QGCE 1448GCLOUD 11 Contract ref RM1557.11https://www.digitalmarketplace.service.gov.uk/g-cloud/search?q=clinical%20data%20analysis
Server Host Information:
Piksel CareLink https://carelink.co.uk/Certification ISO27001, ISO9001, ISO20000, FACT Content ProtectionServer location UK (HSCN Connection over https)
Privacy Notice
The following document contains the privacy notice for the BAJIR, this is available on the BAJIR website. It is the responsibility for each participating organisation to ensure that individual privacy notices are updated accordingly.
Caldicott agreement
Each individual participating organisation may have their own requirements to use patient data for secondary purposes. Often these may require Caldicott Approval. If your organisation has such requirements in place as part of governance arrangements, we have included a copy of the Caldicott approval form in place within Northumbria Healthcare NHS Foundation Trust that can be used for reference. It is the responsibility of each participating organisation to ensure such processes are adhered to and the Northumbria Documentation is provided for information purposes only.
Author: Jonathan Walmsley, IG Manager Northumbria Healthcare NHS Foundation Trust Version 1.0Creation date: 26/05/2021 Review Date: 26/05/2022
Section 251 approval
The BAJIR initially operates under Section 251 approval. This is reviewed on an annual basis and current status can be checked on the HRA ‘April 2013 onward approved non-research applications’ register. Our CAG reference is: 18/CAG/0064.
Legal basis
Personal data processed within the BAJIR relies on the following legal basis:
Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
Special Category data is processed under the following condition:
Health or social care (with a basis in law): (preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services);
The above basis & condition covers both the provision of direct care and audit/ service evaluation processing of the data. Under the regulations, processing of personal data for purposes other than those for which the personal data were initially collected should be allowed only where the processing is compatible with the purpose for which the personal data were initially collected. In the case of the BAJIR this is to improve the treatment of patients with bone and joint infections. Furthermore, it is specified that:
In such a case (i.e. processing for a compatible secondary purpose), no legal basis separate from that which allowed the collection of the personal data is required.
If the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, Union or Member State law may determine and specify the tasks and purposes for which the further processing should be regarded as compatible and lawful
Further processing for scientific research purposes are considered to be compatible lawful processing operations. The legal basis provided by Union or Member State law for the processing of personal data may also provide a legal basis for further processing.
In ascertaining whether a purpose of further processing is compatible with the purpose for which the personal data are initially collected the following should be taken into account, inter alia:
Any link between those purposes and the purposes of the intended further processing;
The context in which the personal data have been collected, in particular the reasonable expectations of the data subjects based on their relationship with the controller as to their further use;
The nature of the personal data; The consequence of the intended further processing for data subjects; And the existence of appropriate safeguards in both the original and intended further
processing operations.
Author: Jonathan Walmsley, IG Manager Northumbria Healthcare NHS Foundation Trust Version 1.0Creation date: 26/05/2021 Review Date: 26/05/2022
The presumption of compatibility for research purposes depends on the requirements in Article 89(1) to ensure appropriate technical and organisation safeguards.
In principle personal data collected in a healthcare context may be further used for scientific research purposes by the original or a new controller if appropriate safeguards are in place and therefore we do not need to rely on another lawful basis. The BAJIR has a number of safeguards in place such as strict access controls.
Additional documentation
The following additional documents may also be of assistance as part of your organisation due diligence checks:
Patient FAQ
Patient Letter
Patient Consent Form
Contact details
BAJIR central Team [email protected]
Information Governance Team (Northumbria Healthcare NHS Foundation Trust
Information GovernanceDigital Services3rd FloorCobalt Business Exchange & Conference CentreCobalt Park WayNewcastle upon TyneNE28 9NZ
0191 607 3601 or;[email protected]
Author: Jonathan Walmsley, IG Manager Northumbria Healthcare NHS Foundation Trust Version 1.0Creation date: 26/05/2021 Review Date: 26/05/2022
