New eighth Caldicott Principle

Guidance: The Caldicott Principles
NHS England updated 8 December 2020

• A new eighth Caldicott Principle makes clear that patients and service users should be informed about how their confidential information is used. It has been developed as part of the National Data Guardian for Health and Social Care’s outcomes from the NDG’s public consultation. There will be new guidance in 2021 to define Caldicott Guardians’ roles and responsibilities and how their organisations should support them.

Your Data: Better Security, Better Choice, Better Care

Your Data: Better Security, Better Choice, Better Care
DH 12 July 2017

• This report is the government’s response to the:
• National Data Guardian for Health and Care’s Review of Data Security, Consent and Opt-Outs
• public consultation on that review
• Care Quality Commission’s Review ‘Safe Data, Safe Care’
• Actions include putting the National Data Guardian’s position on a statutory footing, with stronger sanctions to protect anonymised data, including severe penalties for negligent or deliberate re-identification of individuals.
• It also announces plans to:
• give patients and the public more access to, and control over, their personal data
• build confidence in the importance of secure data to provide better individual care and treatment
• support research and planning across the health system
• See also National Data Guardian statement on government response to the NDG Review

Caldicott: Review of data security, consent and opt-outs

Review of data security, consent and opt-outs
National Data Guardian 6 July 2016

• This review by the National Data Guardian for Health and Care (NDG), Dame Fiona Caldicott, makes recommendations aimed at strengthening the safeguards for keeping health and care information secure and ensuring the public can make informed choices about how their data is used.
• The NDG proposes new data security standards for the NHS and social care, a method for testing compliance against the standards, and a new opt-out to make clear how people’s health
  and care information will be used and in what circumstances they can opt out.
• There are a number of videos of Dame Fiona Caldicott speaking about her role and how health and care information can be used to improve health and care services and research new treatments and cures.
• Following publication of this report NHS England has announced that it will close the Care.data programme.

Digital Health and Care Congress 2016

Enabling patient-centred care through information and technology: Digital Health and Care Congress 2016
Kings Fund 5/6 July 2016

• Presentations from the event including:
• Matthew Swindells: The importance of digital health in the implementation of the NHS five year forward view
• Mustafa Suleyman: New ways for technology to enhance patient care
• Dame Fiona Caldicott: Data security in the NHS
• Matt James: A review of progress and uptake of digital health innovations
• Candace Imison: Delivering the benefits of digital healthcare

Jeremy Hunt HSJ Annual lecture 29 October 2015 - the elephant traps and patient power

Jeremy Hunt HSJ Annual lecture 29 October 2015

Full transcript here: http://www.hsj.co.uk/newsletter/news/hsj-annual-lecture-full-transcript/5091559.article
Video: http://www.hsj.co.uk/newsletter/home/video-health-secretary-announces-ofsted-style-ratings-for-ccgs/5091754.article

Highlights:

Progress on Caldicott2

The First Year: The Independent Information Governance Oversight Panel’s report to the Secretary of State for Health

Department of Health 2 January 2015

• This first annual report from the IIGOP looks at the progress made in implementing proposals in the Caldicott2 report and on the state of information governance across the health and care system as a whole.

Caldicott2 leads to new guidance on managing patient information and confidentiality

Information: To share or not to share? Government response to Caldicott Review and new confidentiality guidance
DH 12 September 2013

• The government accepts all the recommendations of the Caldicott2 report and highlights that while information sharing is essential to provide good care for everyone, there are rules that must be followed. See the government's response to the Caldicott Review here. 
• A guide to confidentiality in health and social care - new guidance from the Health and Social Care Information Centre that sets out 5, easy-to-remember rules so that staff can make sure they deal with confidential patient information safely and securely.
• Rule 1: Confidential information about service users or patients should be treated confidentially and respectfully.
• Rule 2: Members of a care team should share confidential information when it is needed for the safe and effective care of individuals.
• Rule 3: Information that is shared for the benefit of the community should be anonymised.
• Rule 4: An individual’s right to object to the sharing of confidential information about them should be respected.
• Rule 5: Organisations should put policies, procedures and systems in place to ensure the confidentiality rules are followed.

Caldicott review: information governance in the health and care system

Information: To Share Or Not To Share? The Information Governance Review
The Caldicott2 Review, 26 April 2013

• An independent review of information sharing to ensure that there is an appropriate balance between the protection of patient information and the use and sharing of information to improve patient care.
• Update of the 1997 report
• Chapter 7 deals with the challenge facing NHS commissioners, and concludes that "commissioners in local authorities and Public Health England must adhere to the same standards, guidance and good practice and be subject to the same penalties for poor practice as the NHS when commissioning services." The Review Panel does not support the proposition that access to personal confidential data for commissioning purposes would be legitimate as suggested by the NHS Commissioning Board.
• The review found widespread support for the original Caldicott principles but has updated them and added an addition principle.
• 1. Justify the purpose(s)
• 2. Don’t use personal confidential data unless it is absolutely necessary
• 3. Use the minimum necessary personal confidential data
• 4. Access to personal confidential data should be on a strict need-to-know basis
• 5. Everyone with access to personal confidential data should be aware of their
• 6. Comply with the law
• 7. The duty to share information can be as important as the duty to protect patient confidentiality.

Read response from the Health Secretary here including the announcement that:

"any patient that does not want personal data held in their GP record to be shared with the Health and Social Care Information Centre will have their objection respected" and "where personal data has already been shared from a GP practice to the Information Centre, a patient will still be able to have the identifiable information removed"

Read the response from the Nuffield Trust here including the implications for CCGs

"As well as emphasising situations in which one might legitimately share personal confidential data, the Review also notes several instances in which it would be inappropriate. The most significant is in the service of commissioning, say by NHS England or a clinical commissioning group (CCG)."

 "Thus, if a CCG , wishes to link personal confidential data from say, primary and secondary care, for the purposes of risk-stratification or predictive risk analysis, it will have to go through an 'accredited safe haven'."