Nicholas Oughtibridge (Principle Author of the Code of Practice for Confidential Information - HSCIC) spoke at the recent "Commissioning in Healthcare show (CiH 2015)". Areas covered include: · The role of the code of practice · What is covered by the Code of Practice on Confidential Information? · The seven steps in the life of a data collection · Sharing confidential information with other people to meet legitimate needs · Plans for revising the Code of Practice on Confidential Information

1. Code of practice on confidential information
An overview
Nicholas Oughtibridge, Principle Author

2. Agenda
• Purpose of session
• History and context
• Scope
• The information-handling life cycle
• The activities and key practices
• Questions after each section
• Getting involved

3. What is the Guide to Confidentiality?
• HSCIC released a Guide to Confidentiality in Health and
Social Care in September 2013
• It provided patients and health and care staff with clear,
accessible guidance on the handling of confidential
information.
• The guide is available at www.hscic.gov.uk/confguide

4. What is the Code of Practice?
• Describes good practice to those responsible for setting
and meeting policy relating to the handling of confidential
health and care information (e.g. board members)
• Applies to any organisation that collects, analyses,
publishes or disseminates confidential information
• The code of practice is available from
www.hscic.gov.uk/cop.

5. What is the Code important?
• Outlines steps in the information-handling life cycle that
organisations must, should and may take to ensure that
confidential information is handled appropriately
• Will help organisations ensure that the right structures
and procedures are in place to help staff follow the
confidentiality rules

6. What does it mean for me?
• Practices described as ‘must’ are a legal
obligation, often with penalties
• Practices described as ‘should’ legally require
organisations to have regard to the practice
• Practices described as ‘may’ are permissions,
often in law

7. What is the scope of the Code of Practice?
may
help identify
a person
which
identifies a
person
held in
confidence
concerning English health or
adult social care provision
Information…

8. What is the scope of the Code of Practice?
Information that:
• identifies any person, or
• allows the identity of anyone to
be discovered, or
• is held under a duty of
confidence
and is concerned with the
provision of health services or
adult social care in England

9. The information handling life-cycle
The Code is structured
around seven key activities

10. Establish the purpose
Key Practices
• State what you are intending to
achieve
• Check whether available information
will help you achieve it
• For research, follow the research
governance framework
1. Establish the purpose of
arrangements to handle confidential
information

11. Use standards
Key Practices
• Use standards
• Define standards if necessary
• Minimise burden / inefficiency
• Avoid transcription
• HSCIC – maintain a register of
collections (local, regional and
national)
• HSCIC – provide a single source of
standards and specifications
2. Establish and use standards for
handling data

12. Recognise objections
Key Practices
• HSCIC – tell people how to record
objections
• All organisations
– Record objections
– Share objections with recipients
if a legal flow remains
– Share the number of records
omitted where there is no legal
flow of confidential information
3. Recognise people’s objections to
the handling of information about
them

13. Implement systems
Key Practices
Implement…
• Efficient systems
• Safe systems
• Good management systems for
example using ISO standards
• Minimise risk of breach for example
by encrypting, anonymising or
pseudonymising as soon as
practical
4. Implement systems for handling
confidential information

14. Sound analysis
Key Practices
• Analysis should
– Be scientific
– Follow best practice
– Be transparently documented
• Quality should be monitored,
assured and reported
• Repeated analysis needs
continuous improvement5. Adopt sound analysis of
confidential data

15. Share information
Key Practices
• Maximum value comes from the use
of information
• Sharing must be lawful
• Publications should enable reuse
• Sharing requires a data sharing
agreement
6. Share information

16. Dispose of information
Key Practices
• Review purposes and retained
information with a planned schedule
• Use industry best practice to
dispose of data once there is no
ongoing purpose for retention
• Maintain a record of information
disposal
7. Dispose of information once it is
no longer required

17. Further support
• HSCIC provides a helpdesk to support your use of the
Code of Practice
• If you are aware of examples of good practice we could
include in future iterations of the code, or would like to
provide feedback on the document, please contact us
tel: 0845 371 3671
email: exeter.helpdesk@hscic.gov.uk