Justice For Families

http://www.e-health-insider.com/comment ... ccess_code
15 Oct 2009

Maureen Baker

Dr Maureen Baker CBE

NHS Connecting for Health is issuing guidance on the use of the Personal Demographics Service. Dr Maureen Baker CBE, Caldicott Guardian and clinical director for patient safety at NHS Connecting for Health, explains what is in it and what should happen if the rules are broken.

With the shift to electronic patient information it is essential staff understand their responsibilities under the Data Protection Act, confidentiality laws and the NHS Care Record Guarantee for England.

While the systems provided by NHS Connecting for Health are protected by state of the art security and privacy measures, technology alone can never completely safeguard data. The bottom line is that it is the professional integrity of staff that provides the greatest protection.

The Personal Demographics Service is the national electronic database of patients’ demographic information. It is also a key element of the NHS Care Records Service underpinning the creation of an electronic care record for every registered NHS patient in England.

The PDS enables a patient to be readily identified by healthcare professionals and associated, quickly and accurately, with their correct medical details.

It can be accessed by healthcare staff using Choose and Book, the Summary Care Record application, the Electronic Prescription Service and other systems and services that require patient demographic information. No clinical information is stored on the PDS, only demographic information including NHS Number, address and date of birth.

Everyone working across the NHS has an absolute duty and commitment to ensure that all patient information – demographic as well as clinical - is kept safe, secure and confidential. At the same time, patients have a right to privacy and to expect the NHS to keep their confidential information safe and secure, whether that information is in electronic or paper form.

Guidance on inappropriate access

New guidance published this week by NHS Connecting for Health makes it extremely clear that those who search and view the PDS must be approved to do so and must have an appropriate business reason to do so.

A good example of a justifiable business reason would be a receptionist in an out of hours setting booking a patient into a local system.

The guidance outlines what local health communities should do to prevent, monitor and take action if NHS staff, GPs or GP practice staff use IT systems and services to inappropriately view a patient’s demographic information.

It is important that all care settings undertake to play their part in keeping the NHS infrastructure secure. In primary care, GPs need to ensure that systems are used with care and that their staff do not access patient information inappropriately.

Heads of GP practices, in their role as clinical governance leads, take responsibility for this when signing the Information Governance Statement of Compliance (IGSoC). In other care settings, the IGSoC is usually signed by the trust chief executive and all staff need to comply with this.

The IGSoC is the agreement between NHS CFH and service users that sets out the information governance policy and terms and conditions for use of NHS CFH systems and services.

Flagging sensitive records

Patients in sensitive or vulnerable positions, such as those in the public eye or who have suffered domestic violence, can request that their information on the PDS is flagged as sensitive. A patient's record is only marked as sensitive ('s-flagged') by explicit request, never routinely.

This is typically by a patient asking their GP or by agencies such as police, parole boards or social services asking that s-flags are applied for witness protection and safety concerns with the patient’s permission.

When a record is ‘s-flagged’, the PDS does not return any of the patient’s contact details or other information that could be used to determine their location – for example, their address, telephone numbers and GP details.

Addressing inappropriate access

Anyone working within a local health community can request details as to who has accessed a particular patient’s demographic details on the PDS and which records have been accessed by a particular individual.

Patients can also ask who has accessed their demographic information. Should it transpire that someone has deliberately accessed records without permission, this may result in disciplinary action.

Inappropriate access can only effectively be policed by the user’s own organisation. Local NHS organisations have at their disposal a range of sanctions and actions that can be taken against any individuals who access records without the necessary approval and justifiable business reason. These are:

* Criminal action under the Data Protection Act
* Civil action for breach of confidentiality
* Disciplinary action under terms of contract of employment
* Preventing the user from ongoing access to computer systems – this sanction is available to primary care trusts under the terms of GMS/PMS contract with practices
* Action by General Medical Council for breach of patient confidentiality.

Any of these actions can be taken either by the patient whose records have been accessed or by the Caldicott Guardian for the organisation concerned. The particular circumstances of each case will dictate the course of action taken.

All individuals working within the NHS have a contractual obligation to comply with the NHS Code of Conduct for Confidentiality. Clinicians who access patient records inappropriately are guilty of professional misconduct. As soon as inappropriate action is suspected then disciplinary policies and procedures should be used.

Patients have an unequivocal right to expect their personal information is not misused and the NHS Care Record Guarantee provides patients with a range of commitments around the confidentiality of patient information. It is vital this trust is maintained.

Private medical records for sale: Harley Street clinic patients' files outsourced for computer input - and end up on black market
http://www.dailymail.co.uk/news/article ... z0UEeg1YeQ

By Jo Macfarlane
Last updated at 8:13 AM on 18th October 2009


The confidential medical records of patients treated at one of Britain’s top private hospitals have been illegally sold to undercover investigators.

Hundreds of files containing intimate details of patients’ conditions, home addresses and dates of birth are being offered for as little as £4 each.

The files were sold by two men who claimed to have gained access to the information from IT companies in India, where thousands of British medical records are sent every year to be computerised.
A file image of a woman looking at medical records

Breach: Medical files have been illegally sold to undercover investigators (model posed)

They supplied more than 100 records belonging to UK patients but claimed they would be able to pass on hundreds of thousands more on demand.

The revelation raises serious questions about the security of health records sent abroad. One patient affected by the security breach described it as ‘one step up from grave-robbing’.
Harley Street's London clinic

Victim: Harley Street's London clinic has fallen foul

The Information Commissioner’s Office is now looking into the allegations.

Sally Anne Poole, head of investigations at the ICO, said: ‘We are very concerned that private patients’ medical records are on sale in India. The ICO will establish the full facts and will then decide what action, if any, needs to be taken. Medical records are sensitive personal information and must be held securely.’

An investigation into the security breach, Health Records For Sale, will be screened on ITV1’s Tonight programme tomorrow.

Chris Rogers, the programme’s presenter, made contact with the two salesmen in an internet chat room by posing as a marketing executive keen to buy medical records, which he said he would use to sell health products.

The documentary says there is a market for the records because unscrupulous companies want to sell insurance and prescription drugs to vulnerable patients.

One of the men filmed by undercover ITV investigators, Jayesh Bagchandanai, known as Jay, then sent more than 100 files and said they came from staff at an Indian ‘transcription’ centre where medical records are computerised.

Jay told Mr Rogers: ‘We can do really good business with these leads. These leads will give you diagnose [sic], entire diagnose of all the customers, what the customer is facing.

‘There are 17 teams or you can say team managers. The floor managers, they are working as freelancers for me and I am telling them to pull the data for me. They work for me.’
The HQ of Scanning and Data Solutions

Indian link: The HQ of Scanning and Data Solutions which collected the paper records from the London Clinic

Researchers for the programme then met another man, Kunal Gargatti, who called himself ‘John’, in Mumbai. Kunal told them: ‘You have the doctor’s name, doctor’s address, doctor’s phone number. Each and every thing here.

‘I have 30,000 files to give you today, right now. I’ve around 140 diseases here. You just tell me which disease you’re looking out for – I can give you anything.’

Of 116 files bought by ITV, 100 were confirmed to be authentic and were for patients who had been treated in private hospitals, although their records did contain NHS data including referral letters from GPs.
Kunal Gargatti
Jayesh Bagchandanai

Dealers: Kunal Gargatti (left) and Jayesh Bagchandanai were filmed for the Tonight programme

The majority had been treated by consultants using facilities at the London Clinic. People believed to have been treated at the centre include the singer Amy Winehouse.

In recent years, NHS and private hospitals have increasingly sent paper medical records to private companies to have them converted into electronic files.

However, the ITV investigation found that at least one such company had sub-contracted this work outside the EU to save money and the confidential data had been leaked.

Under the Data Protection Act, it is illegal to transfer such information outside the EU unless appropriate guarantees are provided that the data will be secure.
Nick Dawson

Shocked: Nick Dawson's medical file was sold. He said it was 'one step up from grave-robbing'

The London Clinic said it dealt with its own files internally and did not send them to private companies.

But it admitted advising a group of consultants to use a specialist Buckingham-based IT company, DGL Information Technologies UK, with which the clinic has a contract, to help turn paper records into computerised files.

It is believed that these were the files eventually sold to the ITV investigators.

DGL itself did not handle the records but recommended that the doctors use a document-scanning service provided by a company it has a contract with, Scanning And Data Solutions, which operates from a residential address near Berkhamsted, Hertfordshire.

Scanning And Data Solutions collected the paper records from doctors at the London Clinic and scanned them into computers in the UK.

However, it then sub-contracted further work on the files – which involved putting them in order on a database – to a company in Pune, India.

To do so, it put the scanned documents on to a secure internet website, where workers from the Indian company, who had signed a confidentiality agreement with Scanning And Data Solutions, accessed them using a password.

It is unclear whether any further sub-contracting took place in India. But at some point – it is not clear exactly where – the files were copied and passed to the men who hoped to sell them.

The revelations have implications for the many NHS trusts now outsourcing administrative work to India. A spokesman for the Department of Health said the Government had issued guidance to those who did to make sure all records were secure.

Scanning And Data Solutions admitted it had been sending ‘thousands’ of medical records to India over the past two years and said it ‘had no reason to disbelieve’ that it had scanned the records obtained by ITV in India.
Graphic of case studies

It has now suspended its operations there and requested that its partners delete all the information they hold. It has told both Hertfordshire Police and Indian police of the theft.

Company director Michael Bailey said: ‘Urgent investigations are under way to ascertain how these confidential records were stolen. A serious crime has taken place.’

Fiona Button, a solicitor acting on behalf of DGL, said the company was ‘shocked and saddened’ by the security leak and said Scanning And Data Solutions had breached the terms of its contract.

She said: ‘DGL has robust systems and safeguards in place to ensure that data is held securely over and above the provisions in the Data Protection Act. It has also complied with its contractual and legal obligations.’ She confirmed that DGL had no knowledge of the outsourcing to India.

A spokeswoman for the London Clinic said: ‘The outsourcing of patient data to India was without the knowledge or consent of the clinic or its consultants. All business was ceased with the third party as soon as we were alerted to this issue. We will do all we can to assist the investigations.’

‘Jay’ did not respond to calls for comment. ‘John’ denied supplying records to Jay and told ITV that any samples he provided were not genuine. But Indian police are investigating.

Read more: http://www.dailymail.co.uk/news/article ... z0VAi4KwWv