interviews

07.07.16

Dame Fiona Caldicott: We’re not quite ready for sharing back-office function on data security

Source: NHE Jul/Aug 16

NHE’s David Stevenson talks to Dame Fiona Caldicott following her much-awaited Review of Data Security, Consent and Opt-Outs.

In the foreword to the National Data Guardian’s (NDG’s) Review of Data Security, Consent and Opt-Outs, Dame Fiona Caldicott said she agreed to undertake her third review into this area for two reasons. Firstly, there had been “little positive change” in the use of data across health and social care since her 2013 report, and secondly, because she believes “we have a very significant opportunity now to improve the use of data in people’s interests, and ensure transparency”. 

New standards

The latest report certainly packs a punch. The NDG has proposed 10 new data security standards for the NHS and social care, with a requirement for trusts and CCGs to identify and address risks such as default passwords, dormant accounts and unsupported operating systems. 

She also set out a method for testing compliance against the standards, and a new opt-out model to make clear how people’s health and care information will be used and in what circumstances they can opt out. Dame Fiona added that during the review she heard that, more often than not, data breaches are caused by people, processes and technology, which is what she based the recommendations and standards on. 

The NDG also said that data security should be reviewed and strengthened by organisation leaders and put on a similar level to those assuring financial integrity and accountability. There is also a call for NHS England to change its standard financial contracts to require organisations to take account of the data security standards. 

The review, which was conducted in parallel to the CQC reviewing data security in the NHS, recommends that the CQC should integrate measures for compliance with the data security standards into their ‘Well-Led Inspections’ regime. 

Dame Fiona added that her report has focused on trust, and that the case for data sharing still needs to be made to the public. 

Immediate impact 

Within 24 hours of the report’s release it had major ramifications, with NHS England closing down the controversial care.data programme . Although Dame Fiona was not asked to look at the care.data programme, she said the consent and opt-out models proposed by the review go further than the approach that was planned for the pathfinder areas, “and should replace the approach that had been developed for those areas”. In light of the work, she said the government should consider the future of the care.data programme. 

The NDG also said that there needed to be a consultation on her proposals. Only hours after the report’s release George Freeman, the life sciences minister, who commissioned the Caldicott and CQC reviews, launched the consultation which is open until September – a link to it is provided at the bottom of the article. 

Consolidations and the new standards 

Before the launch of Dame Fiona’s review, NHS Improvement boss Jim Mackey wrote to CEOs at trusts and FTs saying that in order to reduce the provider deficit from £550m to £250m this year, efforts would be made to reduce paybill growth in selected providers, and savings could delivered through back-office, pathology and elective service consolidations. 

His letter said that “there is still a significant potential saving if back-office services and pathology services are consolidated on a regional basis”. 

NHE asked Dame Fiona how the data standards would fit in with this work: “I could talk for rather a long time about that. Essentially, trusts have to have people who are responsible for data security. So, whether that is something that can be shared between organisations that are currently independent of each other, I think, would have to be looked at carefully. 

“In the end, if a board is going to be accountable for patient data security, they have to know that the people to whom they delegate the actual operation of that are trustworthy and fulfilling their contracts. 

“I think it is something for consideration, but, at the moment, I would think that is a step where sharing so-called back-office function on data security – we are probably not quite ready for that. Let’s get data security standards in place across the whole of the health and social care system, seeing if we can do it as economically and efficiently as possible.” 

Not marking your own homework 

Another key thing Dame Fiona wants to see is annual role-appropriate training being mandatory for all who work in health and social care, with extra bespoke training for people in leadership roles, such as Caldicott Guardians, Senior Information Risk Owners and board members. 

She said that the review heard that the self-assessment nature of existing compliance mechanisms such as the Information Governance (IG) Toolkit “was a concern”, whilst audit and inspections were largely welcomed as an enforcement mechanism to provide some ‘teeth’. 

Therefore, she said there is a need for a redesigned IG Toolkit to embed the new standards, identify exemplar organisations to enable peer support and cascade lessons learned. 

“I would like to see it being much more user-friendly, not to be a self-assessment toolkit,” Dame Fiona told NHE. “We’ve already had some conversations in HSCIC about this, so that it is quite clear about what an organisation is achieving through that training of its staff which fits with the greater security across that organisation. 

“It is about making it more friendly to the staff working in the organisation, easier to do, but actually can be tested by audit processes, rather than the organisation testing themselves. You can’t mark you own homework in our view.” 

Consent and opt-out model 

The review heard that trust is essential and should underpin any opt-out model. Dame Fiona said that building public trust for the use of health and care data means giving people confidence that their private information is kept secure and is used in their interests. 

“Citizens have a right to know how their data is safeguarded,” she added. “They should be included in conversations about the potential benefits that responsible use of their information can bring.” 

The report has recommended that there should be a new consent/opt-out model to allow people to opt out of their personal confidential data being used for purposes beyond their direct care. This would apply unless there is a mandatory legal requirement or an overriding public interest. Alongside the consultation into the new model, Dame Fiona said there should be further testing of both a two-question and a single question model with patients and professionals to see if people would prefer to have more than one choice. 

“We were asked to come up with a simple model that could be explained to the public, and indeed the professionals who often advise the public in terms of what their choices are,” said Dame Fiona. “We have come up with a model that is simple. It gives people the option to have any of their information being used for purposes beyond care to opt out of that, as a simple choice. 

“However, we’ve made it slightly more complicated by saying it was worth putting to the public the choice of having two separate groups of information to opt out of: research on the one hand, or that which was used for running the health service. We think that if you put all the possible uses of data currently in the system together and ask people to opt in or opt out, that it is actually asking them to make a choice about a very big collection of information. They may want to have the possibility of their data being used for research, but not for running the health service.” 

The review’s remit did not cover the existing opt outs people have in relation to their data, but Dame Fiona said that if the proposed model was accepted there would then have to be a piece of work that addresses the existing opt outs in the system, like the Summary Care Record. 

“This would be to see how they fit in with the new model, and whether they can be replaced or not. It is not something we’ve recommended, but it is an implication of the acceptance of our model,” she explained. 

“What I hope is that this [opt-out] model can be seen, if it is agreed in the consultation, as something that can be put in place. I would encourage everyone to get involved in the consultation about the proposals that I am putting to government.”

The National Data Guardian’s data security standards

Leaders of all health and social care organisations should commit to the following data security standards. They should demonstrate this through audit or objective assurance, and ensure that audit enables inspection by the relevant regulator.

Leadership Obligation 1: People: Ensure staff are equipped to handle information respectfully and safely, according to the Caldicott Principles. 

Data Security Standard 1. All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared for lawful and appropriate purposes. 

Data Security Standard 2. All staff understand their responsibilities under the National Data Guardian’s Data Security Standards, including their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches. 

Data Security Standard 3. All staff complete appropriate annual data security training and pass a mandatory test, provided through the revised Information Governance Toolkit. 

Leadership Obligation 2: Process: Ensure the organisation proactively prevents data security breaches and responds appropriately to incidents or near misses. 

Data Security Standard 4. Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access to personal confidential data on IT systems can be attributed to individuals. 

Data Security Standard 5. Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security. 

Data Security Standard 6. Cyber-attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near miss, with a report made to senior management within 12 hours of detection. 

Data Security Standard 7. A continuity plan is in place to respond to threats to data security, including significant  data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management. 

Leadership Obligation 3: Technology: Ensure technology is secure and up-to-date. 

Data Security Standard 8. No unsupported operating systems, software or internet browsers are used within the IT estate. 

Data Security Standard 9. A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least annually. 

Data Security Standard 10. IT suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian’s Data Security Standards.

Tell us what you think – have your say below or email opinion@nationalhealthexecutive.com

Comments

There are no comments. Why not be the first?

Add your comment

 

national health executive tv

more videos >

latest healthcare news

Half of STPs at an advanced stage, but rankings are ‘mixed blessing’

21/07/2017Half of STPs at an advanced stage, but rankings are ‘mixed blessing’

The 44 sustainability and transformation partnership (STP) footprints in England have been rated and ranked by overall performance for the first ... more >
Mackey calls on trusts to cull ‘unsustainable’ spending on agency staff

21/07/2017Mackey calls on trusts to cull ‘unsustainable’ spending on agency staff

Providers have this week been urged to up their efforts to reduce agency spending which has reportedly reached an “unsustainable” lev... more >
Mental health providers urged to adopt quality improvement initiatives

21/07/2017Mental health providers urged to adopt quality improvement initiatives

Mental health providers have been called upon to adopt quality improvement more in order to make care for patients better. The call comes fr... more >
681 149x260 NHE Subscribe button

the scalpel's daily blog

Why diversity and inclusion are critical to leading much-needed change in the NHS

12/07/2017Why diversity and inclusion are critical to leading much-needed change in the NHS

Despite 30 years of investment, the equality and diversity agenda hasn’t moved forward at anywhere near the pace we would have liked. Indeed, many colleagues have lost sight of the value this work brings. Tracie Jolliff, head of inclusion and systems leadership at the NHS Leadership Academy, explores the need to go back to basics. T... more >
read more blog posts from 'the scalpel' >

comment

Hoping for cross-organisational change

21/07/2017Hoping for cross-organisational change

Mark Orchard, president of the Healthcare Financial Management Association (HFMA) and director of finance at Poole Hospital NHS FT, discusse... more >
Making community pharmacy integral to STP solutions

21/07/2017Making community pharmacy integral to STP solutions

James Roach discusses his work with the National Pharmacy Association (NPA) to develop a new community pharmacy service offering for sustainabili... more >
Time to heed the winter warning from the frontline

19/07/2017Time to heed the winter warning from the frontline

As we head into the peak of summer most people will be thinking sunbeds rather than hospital beds. But as a new report by NHS Providers indicates... more >
Designing services properly

19/07/2017Designing services properly

Terry Young, professor of healthcare systems at Brunel University London and a founder of the Cumberland Initiative, argues that we should drop s... more >

last word

A clear strategy for change is needed for health and social care

A clear strategy for change is needed for health and social care

Nigel Edwards, CEO at the Nuffield Trust, argues that it would be a lost opportunity if the next government does not seek to put both health and ... more > more last word articles >

editor's comment

13/06/2017Tackling the major challenges facing the NHS

As you will have gathered from the front cover, a theme that runs throughout this edition of NHE is about empowering and involving the workforce in order to deliver innovative change across the system.  Professor Jane Dacre, president of the Royal College of Physicians, highlights on page 16 the importance of sustainability and trans... read more >

health service focus

Breaking down silos at the commissioning show

21/07/2017Breaking down silos at the commissioning show

NHE’s Luana Salles and Josh Mines repor... more >
Financing options explained: How to control capital expenditure on healthcare equipment

17/07/2017Financing options explained: How to control capital expenditure on healthcare equipment

It is no secret that budgetary constraints in... more >