What is the Government going to do with your Health Data now? Consenting to your Health Data, Opting in or Opting out?

NHS Survival has a great article covering the Government's desire for views on the proposed Data Security In Health policy do you want to consent and have an opt-out?

https://consultations.dh.gov.uk/information/ndg-review-of-data-security-consent-and-opt-outs/consultation/subpage.2016-06-22.4165482086

It's a lengthy but important document here are the proposed standards in a nutshell:

Proposed Data Security Standards

1.  All staff ensure that personal confidential data is handled, stored and transmitted securely, whether in electronic or paper form. Personal confidential data is only shared for lawful and appropriate purposes.
2.  All staff understand their responsibilities under the National Data Guardian’s Data Security Standards including their obligation to handle information responsibly and their personal accountability for deliberate or avoidable breaches.
3.  All staff complete appropriate annual data security training and pass a mandatory test, provided through the revised Information Governance Toolkit.
4.  Personal confidential data is only accessible to staff who need it for their current role and access is removed as soon as it is no longer required. All access to personal confidential data on IT systems can be attributed to individuals.
5.  Processes are reviewed at least annually to identify and improve processes which have caused breaches or near misses, or which force staff to use workarounds which compromise data security.
6.  Cyber-attacks against services are identified and resisted and CareCERT security advice is responded to. Action is taken immediately following a data breach or a near miss, with a report made to senior management within 12 hours of detection.
7.   A continuity plan is in place to respond to threats to data security, including significant data breaches or near misses, and it is tested once a year as a minimum, with a report to senior management.
8.   No unsupported operating systems, software or internet browsers are used within the IT estate.
9.   A strategy is in place for protecting IT systems from cyber threats which is based on a proven cyber security framework such as Cyber Essentials. This is reviewed at least annually.
10.  Suppliers are held accountable via contracts for protecting the personal confidential data they process and meeting the National Data Guardian’s Data Security Standard.

So I spent a bit of time on the document, here are my answers:


Q 1-3 are about who you are

Q 4 The Review proposes ten data security standards relating to Leadership, People, Processes and Technology. Please provide your views about these standards.

Comments

Concerned about supplier lock-in with powerful and persuasive IT companies that threaten competition and therefore value for tax-payer money as well counter to developing home grown solutions and smaller startups/companies

Q5 If applicable, how far does your organisation already meet the requirements of the ten standards?

I work for the MOD and what is interesting is that whilst I'm (fairly) certain that protection strategies are in place they are not shared with front line staff - why is this bad? Because if front line staff don't know about it then we can't tell our patients about it and build their confidence in the security of personal data!

Q6 By reference to each of the proposed standards, please can you identify any specific or general barriers to implementation of the proposed standards?

Please provide your views about these standards.

I concur with concept of a well trained work force that understands the importance of data security at both individual patient level and global population level *but* I have concerns about repeating this annually which a) seems unnecessary for from the perspective of skill and knowledge fade b) is known to result in devaluing the training and its completion by perverse intention i.e. "just to get it done". *If* it is felt that assurance requirements are such a high risk then please use initial training followed by a short yearly quick check test with high variability e.g. multiple choice questions from a large pool with a percentage score pass level that can be a recurring part of yearly appraisal and a "fail" then prompts re-training.

Q7 Please describe any particular challenges that organisations which provide social care or other services might face in implementing the ten standards.

Please provide your views about these standards.

Time, buy-in, interest, fatigue

Q8 Is there an appropriate focus on data security, including at senior levels, within your organisation?

Please provide comments to support your answer and/or suggest areas for improvement. Yes

As a senior level civil servant I am involved in some of the focus on data security in both MOD health provision and NHS care - but they could do a much better job of sharing how they meet the standards and really making it a part of the care team's DNA at all levels because at the moment it is seen as a meaningless chore - the real value is not understood.

Q9 What support from the Department of Health, the Health & Social Care Information Centre, or NHS England would you find helpful in implementing the ten standards?

Please provide your views about these standards.

Help at all levels but primarily "selling the vision" helping all staff at all levels involved in delivering care to understand *why* it is important *what* their and the team's part is in delivering and *how* they do it.

Q10 Do you agree with the approaches to objective assurance that we have outlined in paragraphs 2.8 and 2.9 of this document? Yes 

...but, involve the people at the frontline of delivery in support tool redesign *and* the training that CQC will receive. Communicate, communicate, communicate!

 Q11 Do you have any comments or points of clarification about any of the eight elements of the model described above? If so please provide details in the space below, making it clear which of the elements you are referring to.

If you do a *much* better job of selling the visions embodied in 2 & 3 then 4,5,6,7,8 won't be such a problem! 

Q12 Do you support the recommendation that the Government should introduce stronger sanctions, including criminal penalties in the case of deliberate re-identification, to protect an individual's anonymised data? Yes 

Q13 If you are working within health or social care, what support might you or your organisation require to implement this model, if applicable?

Same old story time and money but most of all *leadership* to make sure the job is done properly.

Q14 If you are a patient or service user, where would you look for advice before making a choice?

patient or service user, where would you look for advice

Most patients/clients go to their most accessible and trusted provider such as carer in a Nursing Home or District Nurse in the home or GP during a consultation.

Q15What are your views about what needs to be done to move from the current opt-out system to a new consent/opt-out model?

What are your views about how the transition from the existing objection regime to the new model can be achieved?

1. Do a much better job of engaging public understanding and support than last time.
2. Recognise the damage to public confidence done previously by the condescending and downright dreadful approach used last time.
3. It's all about winning public confidence.
4. Maintaining public confidence.
5. Be honest when things go wrong to maintain public confidence.
6. Keep maintaining public confidence.
7. Public confidence.

Q16 Do you think any of the proposals set out in this consultation document could have equality impacts for affected persons who share a protected characteristic, as described above?

I think the biggest risk here is from "unconscious racism" it is pervasive, insidious and exists at institutional as well as individual level - but it can be tackled through education.

Q17 Do you have any views on the proposals in relation to the Secretary of State for Health’s duty in relation to reducing health inequalities? If so, please tell us about them.

Ever since the Black Report it has become explicitly clear that Health Inequalities are a function of poverty. I am a strong believer that a national health IT strategy implemented with passion and conviction will help lever the health of the nation upwards and go some way towards crystallizing the inequalities - whether anyone is then brave enough to tackle them is a matter for government. 

Your response has been submitted
Thank you for completing the consultation.

Your response ID is ANON-2BBS-3ZW3-Z. Please have this ID available if you need to contact us about your response