This seminar covered the new Integrated Support and Assurance Process, a background into the General Data Protection Regulation requirements coming into force on 1 April 2018, and the implications of Brexit on the NHS.

1. East Midlands corporate governance network
February 2017, Nottingham

2. The Integrated Support and
Assurance Process (ISAP)
Rachel Whitaker
21 February 2017

3. Content
• What is the ISAP and what is its purpose?
• To whom and when does the ISAP apply?
• 4 key checkpoints
• Timeframe of the ISAP process
• KLOES
• Example questions and submission content
• Governance arrangements
• Handy tips

4. What is the ISAP?
• ISAP is the new guidance published by NHS England
and NHS Improvement.
• The guidance sets out a streamlined assurance
process to support the procurement of complex
healthcare contracts.

5. The Purpose of the ISAP
• The guidance has been developed in response to
the collapsed contract commissioned by the
Cambridgeshire and Peterborough CCG with Uniting
Care Partnership in 2015.
• Identified 7 key lessons
• Applying the ISAP will help guide local
commissioners, manage risk and provide assurance.

6. To whom does the ISAP apply?
• The ISAP applies to commissioners procuring novel
and complex contracts
– CCGs
– NHS England

7. When will the ISAP apply
All novel and complex procurements and specifically
if:
• contract forms risk sharing arrangements.
• If the calculations of the contract value are taking
a previously unused approach.
• If potential providers are creating new legal
entities involving new organisations.

8. Models that will be caught by the
ISAP
• Multispecialty community providers (MCP)
• Primary and acute care systems (PACS)
• Accountable Networks
• Contracts with population based OR significant
levels of payment conditional on outcomes
• Any contracts aiming to integrate a range of
services

9. The 4 Key Checkpoints
Early
Engagement
• An EE meeting takes place while a commissioner is developing a
strategy which involves the commissioning of a complex contract.
Check point
1
• Checkpoint 1 takes place just before formal procurement or other
commissioning process.
Check point
2
• Checkpoint 2 takes place when the Preferred bidder is identified but
before contract is signed.
Check point
3
• Before service commencement

10. Time frame of the ISAP process
Early
engagement
1week
Check point 1
1 month
Check point 3
1 month
Check point 2
2-3 months

11. Key considerations for
Checkpoints
Checkpoint Questions will be based on
Early engagement Does ISAP apply and what is the anticipated
procurement lifecycle?
Check point 1 Does the proposal represent the correct
strategic solution for the local health
economy and has the necessary preparatory
work been completed?
Check point 2 Has the procurement process been robust?
Are the contracts and preferred bidder(s)
appropriate for the complex contract? Is the
financial envelope appropriate for services
being bought?
Check point 3 Is it safe for the service to go life?

12. Key Lines of Enquiry (KLOES)
• Feedback and outcomes will be provided at the end
of each checkpoint.
• KLOES will be structured questions, which will
establish the risk profile of the complex contract at
each check point. It will form the basis of NHS
England and NHS Improvement’s assessment.
• KLOES will affect commissioners and providers

13. Submission content
Checkpoint Submissions (highlights)
Early engagement • An articulation of the scope and scale of the scale
of the care model
• STP alignment and alignment to any relevant care
model frameworks
• Risks that are known at this stage and how they
have been and will be mitigated
Check point 1 • Why the complex contract is the most appropriate
solution for the local health economy.
• The financial model for the service scope over the
lifetime of the contract
• Details of any risk/gain-sharing arrangements
applicable to the contract
Checkpoint 2 Available later this year
Checkpoint 3 Available later this year

14. Governance arrangements
• At each check point, submissions from
commissioner must first be assured by their
respective governing body or board. This
information needs to be presented in an accessible
way.
• Commissioners will seek from providers assurance
that all submissions have been agreed by their
board.

15. Handy tips
• Speak to NHS England before the Early
Engagement.
• Know who the regional contacts are and who the
central contacts are (especially for contracts).
• Keep an open dialogue with NHS England
throughout the process.

16. Handy tips continued
• NHS regional teams are not yet familiar with the
ISAP process, the process is still evolving
• Get sign off on your project timelines at an early
stage.

17. Any questions?
Rachel Whitaker Associate, Commercial Health
rachel.whitaker@brownejacobson.com
T: 0115 976 6538 M: 07920 257152

18. The General Data Protection
Regulation
“The Highlights”

19. Introduction
• Change in 2018 – despite Brexit
• A significant overhaul to DP legislation
• Substantial and ambitious
• A flavour of the changes
• What action is required
• Where to get further guidance

20. Changed concepts
• Transparency and Consent
• Subject access, rectification and portability
• Regulated Data
• Pseudonymisation
• Personal Data Breach
• Data Governance
• Enhanced Rights

21. Transparency and Consent
• The need to provide extensive information
about the processing of personal data
– Clear concise notices
– General transparency obligation, and
– Specified information to be provided
• Stricter conditions for obtaining consent
– Intelligible
– Informed
– unambiguous

22. Subject access, rectification
and portability
• Information required on demand
• Data portability
• Time-bound
• Legality of processing

23. Regulated Data
• Personal and sensitive data – including
genetic and biometric data

24. Pseudonymisation
• The technique of processing personal data
in such a way that it can no longer be
attributed to a specific data subject without
the use of additional information, which
must be kept separately and be subject to
technical and organisational measures to
ensure non-attribution.

25. Personal Data Breach
• A general personal data breach notification
regime
• Processors must report to controllers –
controllers must report to their supervisory
authority & (in some cases) data subjects
• Fines for non-compliance up to the higher
of 2% of turnover or €10 million

26. Data Governance
• A wide range of measures to reduce the
risk of breaching GDPR
• Accountability measures
• Appointment of a Data Protection Officer

27. Enhanced Rights
• Rights to erasure and restriction of
processing

28. What should you be doing?
• Awareness
• Information you hold
• Privacy Notices
• Individuals’ rights
• Subject Access Requests
• Legal basis for processing

29. What should you be doing (2)?
• Consent
• Children
• Data Breaches
• DP by design
• DP Officers
Who in your organisation is doing this, and
how far have they got…?

30. Further guidance
• Bird & Bird (www.twobirds.com)
• ICO (www.ico.org.uk)
• IGA (digital.nhs.uk/information-governance-
alliance)
…any questions?

31. Brexit for Health
Laura Hughes
21 February 2017

32. Where are we now?
• Referendum – 23 June 2016
• All change at the top
• Miller/Santos – High Court and Supreme Court
• White paper Feb 2017
• European Union (Notification of Withdrawal) Bill
2016-17 – 2nd reading in HL 20 Feb
• Notice under Article 50
• The Grand Repeal Bill

33. Impact on health
• Article 168, section 7, Lisbon Treaty – health is a
member state competence
• But…..
• Reciprocal access to healthcare through European
Health Insurance Card
• Pharmaceuticals
• Working hours of Dr’s, recognition of qualifications
• Cross-border public health….

34. • NHSE has set up/is setting up a “Brexit unit”
• Health Select Committee heard from Jeremy Hunt
on 24 Jan 2017
• Health Select Committee hearing today from panel
of experts about reciprocal healthcare
arrangements, and use of staff drawn from the EU

35. Public health
• European Centre for Disease Control and
Prevention – early warning and response system for
the prevention and control of communicable
diseases
• Jeremy Hunt indicated that do not want to change
position in public health

36. Healthcare professionals
• 130,000 EU nationals working in health and social
care. 55,400 in the NHS – 5% total workforce (9%
hospital doctors and 6% nurses)
• Simon Stevens seeking assurance EU nationals can
remain and continue to work in NHS
• Jeremy Hunt says this presents an opportunity for
“proper strategic workforce planning”. Priority to
ensure agreement that EU nationals can remain
and continue to work in NHS.

37. Recognition of qualifications
• European Directive on the recognition of
qualifications – health and social care professionals
who qualified within the EEA automatically have
their qualifications recognised by relevant
regulatory bodies in EEA
• Language and other requirements increase?
• Capability of regulators to cope? i.e. Nursing and
Midwifery Council

38. EU Working Time Directive
• Limits working week to 48 hours and 11 hours rest
between working periods
• Initially junior doctors excluded because of
concerns re training – phased in by 2009
• Limitations of ECJ case law that on call time at a
place of work even if sleeping counted as working
• Possibly regarded as a good thing – although not by
unions…..

39. • BUT Jeremy Hunt said that it is not the intention of
Government to weaken workers rights. Control
over hours was brought in partly to tackle
excessive hours in Dr training.

40. Reciprocal access to healthcare
• Currently reciprocal access to healthcare in other
EU countries
• Could retain something i.e. Swiss residents
participate in European Health Insurance Card
scheme
• EEA and non-perm residents cost NHS £305m per
annum, around £220m recoverable. Only £50m
recovered in 2012-13
• Jeremy Hunt says NHS has to get better at recovery

41. Medicines regulation
• European Medicines Agency – responsible for
scientific evaluation of human and veterinary
medicines developed by pharmaceutical companies
for use in the EU.
• Pharma companies can apply to EMA for centralised
authorisation, and process is compulsory for some
types of drug. Companies can apply to national
marketing authorities EU simultaneously, or
through mutual-recognition procedure

42. • Simon Stevens indicating a preference to remain a
member of the EMA

43. Questions?
Laura Hughes Partner
laura.hughes@brownejacobson.com
T: 0115 9766582 M: 07824 370102

44. Audit & Governance Workshop
Key updates for CCGs
Annette Tudor (Deputy Director)
21st February 2017

45. • Managing Conflicts of Interest in the NHS
Published 9th February 2017, NHS England
• A Manual for Caldicott Guardians
Published January 2017, UK Caldicott Guardian Council

46. • Procedures for clinical commissioning groups
to apply for constitution change, merger or
dissolution
Published 3rd November 2016
• STP Checklist for Governance &
Engagement
Published 22nd November, NHS Clinical Commissioners in
partnership with NHS Confederation, National Voices and the
Centre for Public Scrutiny,

47. All information correct at time of production.
The information and opinions expressed within this document are
no substitute for full legal advice. It is for guidance only and
illustrates the law as at the published date. If in doubt, please
telephone us on 0370 270 6000.
© Browne Jacobson LLP 2017 – The information contained within
this document is and shall remain the property of Browne
Jacobson. This document may not be reproduced without the prior
consent of Browne Jacobson.