Comment: Information governance in a new-look NHS
Legal expert warns of the pitfalls of tranferring patient data
The NHS is in transition and organisations are in the process of transferring services and functions to new NHS bodies. Here, CHRIS ALDERSON, a partner at healthcare legal experts, Hempsons, speaks about the importance of preparing information governance plans and keeping asset registers up to date
The Department of Health has published guidance for organisations transferring services and functions to new bodies. NHS Information Governance: Effective Management of Records during a period of Transition or Organisational Change is essential reading for those responsible for managing NHS organisations through the current period of transition.
The guidance suggests that transferring organisations should:
- Ensure their information asset register is up to date – it is important to know what you hold before decisions are made as to where it should go. This should be used to produce an information inventory, identifying how the records are used and what will be happening to them in the future.
- Make decisions relating to records early in the process, with sufficient resources and senior management support being provided.
- Prepare agreements outlining the terms of the transfer, giving clarity as to which organisation is responsible for what. The general rule is that where functions transfer to a new organisation, the related records should too.
- Ensure that the receiving organisation has appropriate information governance structures in place.
- Bear in mind that the transfer of records is only one option. Organisations should also consider whether the particular records should be destroyed or archived instead. The NHS has a long history, and strategic health authorities may hold a large number of records inherited from previous organisations that do not have any clear successor. Organisations are directed to consider whether there is a duty to transfer the records to a ‘Place of Deposit’ under the Public Records Act 1958.
Where the records to be transferred include personal data, it is important to ensure that the necessary Data Protection Act registrations with the Information Commissioner are up to date and reflect the change in functions. It will be necessary to ensure that any successor organisation receiving patient data complies with the requirements of the Information Governance Toolkit , and there must be an adequate plan for informing patients about the change.
It will be necessary to ensure that any successor organisation receiving patient data complies with the requirements of the Information Governance Toolkit , and there must be an adequate plan for informing patients about the change
The steps suggested range from information notices in appointment letters where the responsibility remains within the NHS, through to writing to each patient in advance if the service is transferring to a private sector supplier.
Where both active and inactive patient records are to be transferred, the guidance suggests that the inactive records should not be shared with the new organisation if at all possible, as there would be no need for the receiving body to hold inactive patient records. In such circumstances, the guidance stresses that the inactive records should be archived so as to allow the easy tracing and re-activation if required.
The guidance recognises that in some instances it will simply not be practicable to separate inactive patient records from active files, in which case it advises that the transfer of all records to the new body would be justified in the public interest – provided that steps are taken to ensure that the records are only accessible on a ‘need to know’ basis.
An organisation may hold some patient records in its own right, with another organisation’s archived patient records. This often causes confusion as to which organisation is the data controller. It is important to understand that it may be that both organisations are data controllers of such information, irrespective of what labels have been applied in any transfer agreement.
