Information governance: barrier or opportunity?

Good morning, Ms CCIO. Your mission, should you choose to accept it, involves establishing secure access to CIPHIS: “Citizen’s personal and highly sensitive” information.

You need three key team members: “Control”, responsible for data protection; “Confidence”, responsible for ensuring there are no surprises when you establish connection, and “Judgement”. She will act in the citizen’s best interests.

As always, should any member of your team be caught improperly sharing CIPHIS, or a rogue element captures it, the secretary of health will disavow all knowledge of your actions. The Information Commissioner’s Office will fine you. The relevant regulator will suspend you. We cannot allow access to CIPHIS to fall into the wrong hands – citizen’s trust is paramount.

And Ms CCIO, the next time you go on holiday, please be good enough to give us explicit consent to access you wherever you are, if at all possible. This message will self-destruct in five seconds.

Information governance

This parody of ‘Mission Impossible’ is filled with the nuances of the information governance principles that you will come to understand as you grow into your chief clinical information officer role.

As an academic discipline, IG encapsulates laws, regulations, policies, as well as personal and organisational fears and expectations, governing the processing of any personal identifiable information. It is ultimately underpinned by societal values relating to how we believe “our secrets” should be used and kept safe and secure.

The Robin Hood Challenge for the modern NHS

Information sharing for direct care is a hot topic headlining the national care agenda. Generally, the health and social care system is very poor at sharing our fabled CIPHIS.

I think of this as the Robin Hood Challenge of information sharing: the need to “take from the information rich and give to the information poor” for better care, whilst staying on the right side of the Sheriff of Nottingham.

As you journey through your CCIO career, almost everywhere you turn, one of the biggest demands your professional colleagues will make of you is: “Give me access to GP, social care, mental health and hospital information to do my job better.”

Meeting this demand while protecting CIPHIS can be challenging. Fortunately, you have three mission team members to help you navigate the waters of information governance.

Your Mission Team is here to help

Control:

The Data Protection Act (DPA) 1998 establishes eight principles that control how “sensitive personal data”, such as physical or mental health information, should be obtained, stored, shared and manipulated. Together, these are termed “processing”

Principle 1 asserts that data must be “processed fairly and lawfully”. The DPA sensibly makes it lawful for health data to be processed, or shared, without the patient’s explicit consent when the processing is “necessary for medical purposes and is undertaken by a health professional”.

Fairness means using information in a way patients would reasonably expect as well as informing patients how you intend to use their information, and what they need to do if they wish to object. Such privacy or fair processing notices consist of leaflets, posters, and information on websites. Being as transparent as possible underpins fairness.

The NHS is good at providing fair processing notices with respect to information sharing.The NHS Care Record guarantee states: “We will share your record with the people providing care. Everyone looking at your record… must keep the information confidential.” The NHS constitution states: “You have the right to request that your confidential information is not used beyond your own care and treatment and to have your objections considered.”

In general, care organisations are recognised as “data controllers” in the DPA, since they exercise overall control over the purpose of the health data collected.

Therefore, they are legally responsible for ensuring all health data processing adheres to these eight principles. A breach of these principles brings them face to face with the ICO.

It is good practice to work with your organisation’s senior information risk officer - or SIRO - and the ICO from the beginning of any major information sharing project. You will be surprised how supportive everyone is when you get them involved from the start.

Confidence

As clinicians we have an ethical and legal obligation to ensure the information with which our patients entrust us, is kept in confidence: this is the common law duty of confidence. Put bluntly, we all expect our secrets to stay secret, unless otherwise stated

It is a truism that health and social care services can only deliver care effectively for patients if patients trust them with their information.

However, patients also have an expectation that within the NHS we share and communicate information appropriately with care teams. This is what they reasonably expect.

If you don’t believe this, spend an evening out-of-hours in your local emergency admission unit. One patient nicely summed up her view on the appropriateness of clinicians accessing her whole health and social care record without explicit consent: “I trust them with my life, why not my information?” I asked 20 other patients about this: all gave the same view.

Obtaining explicit consent to share and access information is good practice, but to do this simply to protect yourself from the possible risk of being accused of breaching a patient’s confidence is misguided. Furthermore, it can delay your patient’s care unnecessarily. This is where your final team member comes into play.

Judgement

This is your secret weapon: all registered and regulated care professionals (including social workers) have codes of conduct set by their regulatory bodies. There is also good practice guidance, such as the Caldicott Principles, that enshrine the values and behaviours of professionals.

From these, we all draw our professional values and judgement, and these are key when it comes to information governance.

These values tell us the patient has a right to expect no surprises in how their information is used once they disclose it. Professionalism means you are not going to share something irrelevant or shout down the corridor that Mr Poorly has cancer.

Similarly, should the patient exercise their right to prevent information from being shared between care settings, professionalism means we try to adhere to this using the tools available. It means we should also inform the patient that such restriction could affect the care they receive.

It is crucial to note that regulators explicitly endorse the importance for information to be shared. For example, the General Medical Council states:

“You must share all relevant information with colleagues involved in your patients’ care within and outside the team”.

Professionalism means that when it makes sense to share or access information in the best interests of your patient, that’s what is expected of you. In the context of direct care, when you have a legitimate relationship with your patient, you can make the judgement to share and access information about them with implied consent . This is valid and legal.

Promoting holistic care – the proportionality dilemma

The terms “relevant”, “adequate”, “not excessive”, “need to know” are key IG concepts, found in Principle 3 of the DPA, and in the fourth of the Caldicott Principles. How should we consider them in the context of the working mechanics of clinical practice?

It is my opinion that a clinician cannot really know what is relevant to share with another colleague until the other colleague has independently assessed the circumstances of the situation the patient finds him or herself in.

We increasingly recognise how new data items can make dramatic changes to care decisions; the same applies to sharing the complete record. Its impact is likely to be even more profound on decision making. I speculate it to be transformative: clinicians practice best when they can access, read, analyse and assimilate for themselves.

A podiatrist may be empowered to deliver more holistic care if they know a patient has erectile dysfunction; a gastroenterologist investigating chronic abdominal pain in a woman may use clinical acumen to consider the relevance of the gynaecologist’s diagnosis of vaginismus, or the psychiatrist’s diagnosis of schizophrenia.

In the clinical world, the complex interplay of illnesses, past and present, do not lend themselves to simple reductionist theory. A patient is a whole. We aspire to provide holistic care. Ergo, I believe, patient information needs to be shared as complete care records, otherwise we perpetuate the existence of information silos that weaken care.

Role-based access – meaning that the data you can and cannot see in a system is dependent on your role - has a place, when sensibly implemented. But just because we can use such controls does not mean their application is always in the patient’s best interest.

Filtering needs to be proportionate too. Ideally, everyone clinician should have the ability to access the same source “code” of health data. Summaries, with the ability to drill down into detail are liked by all.

So professionalism and proportionality align nicely: if we are to truly realise the benefits of sharing complete records, then we must remember that to be too prescriptive on what is and is not shared risks undermining not only professionalism but also our endeavours to deliver the highest quality of care.

We cannot unread what is read, but we can behave with dignity towards our patients. Professionalism is knowing when to act, speak or stay quiet, after we have assimilated the information. Embedding excellent IG information will help here.

Information governance is not a barrier

Nothing is more obvious to you as a professional than that clinical information is the fundamental currency for effective decision making. Having information at your fingertips – or on the end of a computer, smartphone or tablet, or even on paper - enables you to make more informed, efficient and targeted clinical decisions. This means better quality care for patients.

As a CCIO, you need to champion your new understanding that the application of existing IG principles can truly power widespread information sharing, lawfully. Furthermore, when used appropriately, implied consent to share is a necessary clinical tool.

In your armoury, keep the Hampshire Health Record . For more than ten years, care information on 2 million patients in Hampshire has been shared between community, mental health, acute and general practice care professionals.

Since 2014, social workers have also accessed health information, and in 2015 social care data will be shared. Other shared care records include Leeds Care Connect and the national Summary Care Record.

If IG was a true barrier, then how is it that information sharing is occurring at such a scale? IG powers all of this vast sharing and is an opportunity just waiting for you.

As CCIO you will bring sense to a fragmented and siloed care system. You recognise that increasingly professionals need to work in “teams without walls” and it is at such points when your leadership is most needed to give clarity.

As a clinician, dilemmas of IG become less problematic when you think sensibly of what are the best interests of your patient. The clinical judgement you bring to informatics and information governance is gold dust.

Champion change through education and remind everyone of the 7th Caldicott principle (weapons-grade ammunition on your mission): the duty to share information can be as important as the duty to protect patient confidentiality.

Technology empowering patients to drive the information sharing agenda

Increasingly, through evolving online digital services, we will be able to bring privacy notices straight to a patient’s smartphone or portable device. We will be able to empower patients to exercise their preferences as to how their information is shared.

Our first task as clinicians must be to establish what we believe are sensible sharing options and reflect that back to patients, with examples and explanations.

There will be a balance to strike, as some patients will want to exercise the ability to restrict sharing at granular data levels. But I suspect most patients are likely to opt “to share my complete health and social care record information with the care professionals and team members that look after my needs, in the manner deemed best practice by such professionals”.

A complimentary approach is to make visible to patients the audit trail of access to their patient record. Their watchful eyes will act as a powerful deterrent to those minority professionals acting at the fringes of what is acceptable practice for record sharing.

The access audit will also help patients gain more confidence in understanding when, how and why their records were shared. Similarly, professionals will be able to learn who else is working with the patient – helping to establish true multidisciplinary teams.

However, true empowerment is only complete once patients are given full access to their whole records. The journey has begun in earnest through the NHS England Patient Online Programme.

Learning how clinicians think, document and communicate will raise the public’s understanding of the complexities of health. As patients come to learn how clinical decisions and diagnosis are made more quickly and safely because of effective information sharing, they will become the ones shouting “to share is to truly care”.

Mission is possible

I hope you come to value the immense power of your IG allies control, confidence and above all, your own judgement. Our citizens need clinicians to use joined up, comprehensive records to receive holistic quality care.

With the mission team on your side, CIPHIS will be safe from rogue elements, citizen’s trust in us maintained, and clinicians empowered to delivery care like never before.

About the author: Dr Amir Mehrkar is a GP at the Portswood Solent Surgery in Southampton. Until recently, he was the chief clinical information officer for the Hampshire Health Record, run by NHS South Commissioning Support Unit, and is still the unit’s clinical informatics advisor.
He is also the digital clinical champion for the Patient Online programme run by NHS England, and the national clinical lead for the NHS e-Referral Service (the replacement for Choose and Book) at the Health and Social Care Information Centre.