This document discusses information governance considerations for developing healthcare applications. It outlines requirements from the Data Protection Act (1998) to ensure personal data is accurate, secure, and not kept longer than necessary. It also discusses Caldicott Guidelines around justifying the purpose of collecting patient data and only collecting minimum necessary data. The document provides guidance on developing accurate, secure applications that collect only necessary data and don't retain data longer than required, in compliance with relevant regulations and standards.

1. Information Governance
considerations in developing
Healthcare Applications
Andrew Glover
Head of Information (Governance & Services)
Leeds Teaching Hospitals

2. Data Protection Act (1998)
• Personal Data relating to living individuals
– Accurate
– Secure
– Not excessive (only collect data that is
required)
– Not kept longer than necessary
– Should not be transferred/held outside the EEA
Deceased Patients are covered by the Common Law
of Confidentiality

3. Caldicott Guidelines
• Justify the purpose(s)
• Don't use patient identifiable information unless it
is absolutely necessary
• Use the minimum necessary patient-identifiable
information
• Access to patient identifiable information should
be on a strict need-to-know basis
• Everyone with access to patient identifiable
information should be aware of their
responsibilities
• Understand and comply with the law

4. Developing Applications
• Accurate
– Data Entry Accuracy (Master File driven, linked field
selection)
– Missing / Invalid Data Reports
– Consider feeding demographic data from primary
patient system
• Secure
– Username & Password or Smartcard (consider role based
access)
– Transaction Log (Access, Add & Update)
– Session Timeout
– De-Identification
– Patient identifiable information should cache to secure
devices / servers

5. Developing Applications
• Not Excessive
– Only collect the data that is required for the purpose of
the application
• Not kept longer than required
– Retention Schedule of the Records Management: NHS
Code of Practice
– Consider building retention date into application
• Should not be transferred outside the EEA
– Cloud computing (where is data held)

6. Other considerations
• Subject Access Request / ATHR
• Ensure Application can interface with other
Healthcare systems
• From 2015 NHS Number is mandated for primary
patient identifier
• Equality & Diversity Information
• Be adaptable to changes in legislation
– Changes to European Directive
– Caldicott review

7. Reference
Data Protection Act (1998)
http://www.legislation.gov.uk/ukpga/1998/29/contents
Caldicott Guidelines
http://www.connectingforhealth.nhs.uk/systemsandservices/info
gov/caldicott
Records Management: NHS Code of Practice
http://www.dh.gov.uk/en/Publicationsandstatistics/Publications/P
ublications
PolicyAndGuidance/DH_4131747
Connecting for Health
http://www.connectingforhealth.nhs.uk/