interviews

Data security at heart of HSCIC's new strategy

Andy Williams, chief executive of the Health and Social Care Information Centre, talks to NHE about how the organisation is aiming to tackle the data security challenge in its new five-year strategy.

Last year Sir Nick Partridge completed a review of information released by the Health and Social Care Information Centre’s (HSCIC’s) predecessor organisation, the NHS Information Centre, which concluded there were “significant” administrative lapses in recording the release of data.

Although relating to the predecessor organisation, Sir Nick recommended that the HSCIC ensures there is “clear, transparent and timely decision making”, via the appropriate governance for all data releases.

He also called for the HSCIC to come up with a technical solution to allow external parties to access the data without the need for the HSCIC to actually release it to them.

Fast forward 12 months and HSCIC has published a five-year strategy with five key pillars at its heart:

• Ensuring that every citizen’s data is protected;
• Establishing shared architecture and standards so everyone benefits;
• Implementing services that meet national and local needs;
• Supporting health and care organisations to get the best from technology, data and information; and
• Making better use of health and care information.

Speaking to NHE about the strategy, HSCIC’s chief executive, Andy Williams, said the first pillar in the strategy is all about protecting citizens’ data, because “we felt this was the most important one”.
Williams said a lot of the recommendations made in the Partridge Review related to the “security associated with the data we pass to other organisations”.

He added that as the amount of data HSCIC manages continues to grow, the organisation has, in parallel, been increasing the associated security measures.

“The cyber security threat certainly isn’t going down. So we have to be absolutely certain that we’re doing everything we possibly can to ensure the security against any cyber threat to the data we hold,” said Williams.

Data Lab

Over the next five years, HSCIC will become the main organisation that extracts data from health and social care organisations and will become the major ‘safe haven’ for data. The strategy outlines how the HSCIC will do this.

Talking specifically about the pursuit of a new technical solution to allow access to data as recommended by Sir Nick, Williams discussed the development of the so-called ‘Data Lab’. This is a secure facility in Leeds that people can come on-site to use, rather than being sent the data.

“The joke is that they are frisked as they come in and frisked as they go out,” he said. “But we prepare an environment for them where they can explore the data – where they have an agreement to explore – in a very secure environment. They can bring data in that they can link with, but they are not allowed to take the results out – other than in an anonymised form.”

He said that HSCIC has built the first Data Lab specifically for the care.data programme and will be piloting the use of that in parallel with the pilot phase of the care.data towards the end of the year. “We want to be fairly careful about exploring the way that it [Data Lab] is used, but we do see that as being one of the important pillars going forward – in terms of using and accessing data.”

Williams added that HSCIC will be looking to move more people in the direction of secure data facilities in the future. “We are progressing down this route and are taking the first steps,” he said.

“In order to do all of that, we are working on building our ‘Data Services Platform’. We are looking to re-design and re-engineer the whole basis – from a technology point of view – on which our data is held. This will include much better pseudonymisation, but also include the capabilities around virtual access and virtual machine access.”

Applications

Following the Partridge review, Williams said HSCIC has been much more rigorous with regards to the applications for data, but has also been trying to streamline the process.

“We are conscious that on the one hand we do want to make sure we are doing a proper job, but we are also offering a responsive service that are entitled to access data,” he said, adding: “We’re running a whole series of workshops with research institutions where we bring a group of their researchers together and explain what the changes are and what the new process is.”

The National Information Board, which brings together lots of people from the different parts of the health and care system, is currently laying out a roadmap for technology and data across health and care for the next five years.

“The most important part in our strategy is to play a full and proper role in making sure that happens,” said Williams. “With regards to the HSCIC’s role, we are at a point where we can make some really important and long-reaching decisions about far better use of data and technology not just for citizens but for professionals working in the service.

“Our role in all of this is to ensure the standards are in place, that the overall architecture of the system from a technology point of view fits together and that we build a data platform and ensure data is available for a multitude of purposes in a secure way.”

Asked how HSCIC will monitor its progress against the strategy, Williams joked: “It’s a really good question and one the secretary of state is asking.”
He said that in the next couple of months the National Information Board is expected to have a definable set of coherent programmes. “There is a range of measures being developed for the system as a whole, ranging from what is the usage of online services, looking at how digitally mature a local health economy is,” he said.

“Another key in this is linking up health and social care, and how do we get information about patients flowing effectively across different care settings. There will be measures around these as well. But none of these have been set yet.”

In the last edition of NHE, we spoke to Andrew MacLaren, the HSCIC’s new director of information and analytics, who discussed how he wanted to take big data forward to deliver benefits to patients and healthcare providers.

However, when we spoke to Williams we learned that MacLaren had resigned from his post. NHE was told that he “is going to be a hard act to follow, but we are putting some interim measures in place”.

Williams added that Professor Martin Severs, HSCIC’s Professional Lead and Caldicott Guardian, will be taking on his role on an interim basis. He said it is a “shame” that MacLaren has left, but added: “We’ve got to move on.”