eHealth Governance, Security and Privacy a UK Perspective Dr Rod Muir Consultant in Public Health Information Services NHS National Services Scotland HINZ Rotorua 31 st October 2007

Dr Rod Muir

Consultant in Public Health

Information Services

NHS National Services Scotland

What I intend to cover NHSScotland NHSScotland ‘eHealth Strategy’: progress Primary and Secondary uses of health information Governance Information Governance: 2002-2007 What we plan to tackle in the next five years

NHSScotland

NHSScotland ‘eHealth Strategy’: progress

Primary and Secondary uses of health information

Governance

Information Governance: 2002-2007

What we plan to tackle in the next five years

My areas of interest Secondary Uses of health information Ethical; legal; practical; and social issues arising from health IT

Secondary Uses of health information

Ethical; legal; practical; and social issues arising from health IT

Information Services: the organisation Part of NHS in Scotland National health information National datasets: collection; analysis; exploitation Information support for policy; management; clinicians operational management, audit and research Information systems; eHealth procurement and commissioning; coding, data definitions; terms etc Information governance

Part of NHS in Scotland

National health information

National datasets: collection; analysis; exploitation

Information support for

policy; management; clinicians

operational management, audit and research

Information systems; eHealth procurement and commissioning; coding, data definitions; terms etc

Information governance

NHS Scotland: demography Pop 5.1 million. 14 Health Boards. Ageing population. Inward migration.. Health and Community Care Budget £10b. 33% of Scottish Government total. http://www.show.scot.nhs.uk/

Pop 5.1 million.

14 Health Boards.

Ageing population.

Inward migration..

Health and Community Care Budget £10b.

33% of Scottish Government total.

NHS Scotland: politics Dismantling health market Focus on life circumstances and prevention Local community based services Move away from acute sector Scottish devolution New Scottish Nationalist Party -led administration UK health policies and models are diverging http://www.show.scot.nhs.uk/

Dismantling health market

Focus on life circumstances and prevention

Local community based services

Move away from acute sector

Scottish devolution

New Scottish Nationalist Party -led administration

UK health policies and models are diverging

NHS Scotland: IT All GP’s computerised and connected to web and NHS net Community pharmacists and dentists now being connected Electronic prescribing being rolled out nationally 40% referrals electronic Most test ordering and results now electronic Well established Secondary Uses service Wide range of IT developments at various stages

All GP’s computerised and connected to web and NHS net

Community pharmacists and dentists now being connected

Electronic prescribing being rolled out nationally

40% referrals electronic

Most test ordering and results now electronic

Well established Secondary Uses service

Wide range of IT developments at various stages

NHSScotland national datasets National datasets: in patient; outpatient; day case Primary care data (6% representative sample) Comprehensive prescribing data warehouse Clinical audits [renal; hip fracture; CHD/ stroke; trauma etc] [linked] General Register Office – vital events; census; Progressively linked [NHS data warehouse]

National datasets: in patient; outpatient; day case

Primary care data (6% representative sample)

Comprehensive prescribing data warehouse

Clinical audits [renal; hip fracture; CHD/ stroke; trauma etc] [linked]

General Register Office – vital events; census;

Progressively linked [NHS data warehouse]

Primary and secondary uses Primary uses Joined up care for individuals Secondary uses All the rest

Primary uses

Joined up care for individuals

Secondary uses

All the rest

Etc etc Epidemiology Surveillance Secondary Uses Screening Planning Research Targets Monitoring performance /progress

% patients treated surgically but documented as unfit for theatre within 24 safe operating hours Fig. 2: Percentage of patients treated surgically but documented as unfit for theatre within 24 safe operating hours of ward admission Percentage of patients treated surgically but documented as unfit for theatre within 24 safe operating hours of ward admission Scottish Hip Fracture Audit Report 2007

NHSScotland eHealth strategy National Approach Convergence Build, fill gaps National Procurements Co-operation, working together Robust information governance Key principles

National Approach

Convergence

Build, fill gaps

National Procurements

Co-operation, working together

Robust information governance

NHS Scotland ‘eHealth’ strategy Currently over 60 national software applications Gaps identified: notably Primary Care PAS Hospital Medicines Administration Decision support

Currently over 60 national software applications

Gaps identified: notably

Primary Care

PAS

Hospital Medicines Administration

Decision support

Big potential procurements IPACC Breadth – community and primary care OBC completed in June Replace current GP system (GPASS) Specification complete January 2008 PMS ( PAS replacement) Breadth – PAS plus clinical systems OBC completed in June Specification work complete January 2008

IPACC

Breadth – community and primary care

OBC completed in June

Replace current GP system (GPASS)

Specification complete January 2008

PMS ( PAS replacement)

Breadth – PAS plus clinical systems

OBC completed in June

Specification work complete January 2008

Other Areas Under Development or Proposed Community Dental Services PAS Theatres Sexual Health (NASH) Cervical Cytology Call/ Recall (SCCRS) Child health Chemotherapy

Community Dental Services PAS

Theatres

Sexual Health (NASH)

Cervical Cytology Call/ Recall (SCCRS)

Child health

Chemotherapy

Other Areas Under Development or Proposed (2) PACS/ RIS Scottish Care Information (SCI) Programme Emergency Care Summary (ECS) Community Health Index (CHI) User Authentication/ ID management/ Electronic HR System (EHRS)/Access Control ePharmacy

PACS/ RIS

Scottish Care Information (SCI) Programme

Emergency Care Summary (ECS)

Community Health Index (CHI)

User Authentication/ ID management/ Electronic HR System (EHRS)/Access Control

ePharmacy

Other Major Developments Emergency Care Summary (ECS) Scottish Health Information Service User Authentication/ ID management/ Electronic HR System (EHRS)/Access Control ePharmacy Hospital Electronic Prescribing Management

Emergency Care Summary (ECS)

Scottish Health Information Service

User Authentication/ ID management/ Electronic HR System (EHRS)/Access Control

ePharmacy

Hospital Electronic Prescribing Management

Emergency Care Summary (ECS) Equivalent of Summary Care Record(SCR) in England Rolled out in short period in Scotland Only a handful of GPs resisted BMA didn’t appear to notice Up and running; well used and well received BMA want a halt on SCR roll out in England pending an evaluation

Equivalent of Summary Care Record(SCR) in England

Rolled out in short period in Scotland

Only a handful of GPs resisted

BMA didn’t appear to notice

Up and running; well used and well received

BMA want a halt on SCR roll out in England pending an evaluation

Scottish Health Information Service (SHIS) Secondary Uses Service

Secondary Uses Service

NHSScotland Data Warehouse QOF ( GP ) DENTAL A&E ( EDIS ) Prescribing ( ACUTE ) SCI Referrals Workforce ( SWISS ) Blood Transfusion Waiting Times SPARRA ( predictive) Others ……… . Common Dimensions – Business Objects GRO ( DEATHS ) SMR 01 ( ACUTE ) SMR 04 ( MENTAL Health) Prescribing ( Primary care) SMR 06 ( CANCER) National Health Targets Benchmarking/ Clinical Governance Navigator

eHealth Programme Executive Team eHealth Programme Director Strategy Design Authority Programmes Change and Benefits

eHealth Programme Executive Team Director eHealth User Skills Development Change and Benefits Communications Service Redesign Benefits Identification & Delivery Strategy Definition of Project Brief Market Intelligence & Evaluation Strategy Maintenance and Delivery Technical Standards & Architecture Design Authority Applications Standards & Architecture Confidentiality & Governance Security & Authentication Programmes Programme Management National Projects Staff Skills , Project Commissioning

Information Governance Low trust environment Climate of suspicion ‘ Surveillance society’ Accountability; transparency; performance management Personal autonomy above all

Low trust environment

Climate of suspicion

‘ Surveillance society’

Accountability; transparency; performance management

Personal autonomy above all

Legal Framework Common Law Data Protection Act 1998 Freedom of Information (Scotland) Act 2002 Adults with Incapacity Act etc etc etc… ..plus loads of professional guidance; Codes of Conduct; Information Sharing protocols…

Common Law

Data Protection Act 1998

Freedom of Information (Scotland) Act 2002

Adults with Incapacity Act

etc etc etc…

..plus loads of professional guidance; Codes of Conduct; Information Sharing protocols…

National awareness campaign Independent body to advise on privacy and the public interest Central ‘anonymisation service’/ for secondary uses Targets for Privacy/ Confidentiality Issues No change in the law (for now) Confidentiality and Security Advisory Group for Scotland (CSAGS) April 2002

National awareness campaign

Independent body to advise on privacy and the public interest

Central ‘anonymisation service’/ for secondary uses

Targets for Privacy/ Confidentiality Issues

No change in the law (for now)

Current Privacy Safeguards Notification with Information Commissioner Data Protection Officers/ Information Governance leads Patient Privacy Guardians; IT security officers Staff training/ contracts

Notification with Information Commissioner

Data Protection Officers/ Information Governance leads

Patient Privacy Guardians;

IT security officers

Staff training/ contracts

Current Privacy safeguards (2) Privacy Advisory Committee MREC/ LREC Advisory Groups Community Health Index (NHS Number) National Health Service Central Register Governance Board Privacy Impact Assessment

Privacy Advisory Committee

MREC/ LREC

Advisory Groups

Community Health Index (NHS Number)

National Health Service Central Register Governance Board

Privacy Impact Assessment

Information Governance Framework SCOPE Data protection Patient confidentiality IT security Freedom of Information Records management Data quality

SCOPE

Data protection

Patient confidentiality

IT security

Freedom of Information

Records management

Data quality

Information Governance Framework National networks National standards Self reporting/ toolkit National ‘inspection’ eLibrary portal on Information Governance Education modules and bursaries Masters; Diploma; Certificate level www. elib . scot . nhs . uk /

National networks

National standards

Self reporting/ toolkit

National ‘inspection’

eLibrary portal on Information Governance

Education modules and bursaries

Masters; Diploma; Certificate level

www. elib . scot . nhs . uk /

But…problems remain Public/ patient awareness/ public debate Definition/ meaning of personal data/ anonymisation Informed consent Consent ‘model’ - opt-out/ opt in Authentication/ staff ID/ access controls Ownership/ leadership/ difficult policy decisions

Public/ patient awareness/ public debate

Definition/ meaning of personal data/ anonymisation

Informed consent

Consent ‘model’ - opt-out/ opt in

Authentication/ staff ID/ access controls

Ownership/ leadership/ difficult policy decisions

Get consent Anonymise Establish a “public interest mandate” for processing personal health data Change the law

Get consent

Anonymise

Establish a “public interest mandate” for processing personal health data

Change the law

The solutions: effecting change in the next five years Engagement Education Engineering Enforcement

Engagement

Education

Engineering

Enforcement

Engagement Public debate Demonstrate benefits Balance: autonomy v societal benefit Leadership Public Interest Mandate Involve Information Commissioner Privacy Impact Assessment Involve the research community

Public debate

Demonstrate benefits

Balance: autonomy v societal benefit

Leadership

Public Interest Mandate

Involve Information Commissioner

Privacy Impact Assessment

Involve the research community

Education Care givers Culture change Core skills Research

Care givers

Culture change

Core skills

Research

Engineering ‘ Need to know’ access Authentication Audit trails

‘ Need to know’ access

Authentication

Audit trails

Enforcement Clear rules Clear guidance Change the law? Effective penalties Visible policing

Clear rules

Clear guidance

Change the law?

Effective penalties

Visible policing

Engagement: taking the patients with us Patient safety Scottish Patient Safety Alliance

Patient safety

Scottish Patient Safety Alliance

Engagement: taking the patients with us Patient safety Scottish Patient safety Alliance Joined up care Most illness is now chronic.. ..multiple providers ..complex pathways of care

Patient safety

Scottish Patient safety Alliance

Joined up care

Most illness is now chronic..

..multiple providers

..complex pathways of care

Engagement: taking the patients with us Patient safety Scottish Patient Safety Alliance Joined up care Most illness is now long term.. Better outcomes Measuring and improving quality Better information for patients

Patient safety

Scottish Patient Safety Alliance

Joined up care

Most illness is now long term..

Better outcomes

Measuring and improving quality

Better information for patients

Engagement: taking the patients with us Patient safety Joined up care Better outcomes Effective Public Health Programmes

Patient safety

Joined up care

Better outcomes

Effective Public Health Programmes

In summary Information governance – can’t ignore it – but so far getting much less attention than it needs IT developments are posing ethical, legal and social dilemmas Lot of progress in last five years.. ..but still playing catch up We understand the problems – time for solutions

Information governance – can’t ignore it – but so far getting much less attention than it needs

IT developments are posing ethical, legal and social dilemmas

Lot of progress in last five years..

..but still playing catch up

We understand the problems – time for solutions

Who needs electronic health records?

Thanks for listening.. We all do