Background

Standards for sharing

We are already required to register with the information commissioner and ensure that our patients understand what happens with their data and can make informed decisions.  We have sent letters to our services users, patients and their career/ parents as part of the go live process of OnEPR to let them know of the changes. 

Our health partners have to operate with the same level of legal obligation around data sharing.  TPP have done in-depth testing and review work around data sharing with primary care (who act as the data controllers for SystmOne) and, as SystmOne is a nationally approved EPR that has undergone moderation and review by NHSD and NHSE, we can be assured that it provides and maintains robust protection of confidential patient data. TPP carry out regular safety checks and tests to ensure the system is maintained and meets the highest levels of safety and reliability.

Communicating about the share

We have transferred the data from Paris onto SystmOne and opened the share to our health partners through a  process of implied consent.  This is a temporary permission that requires our clinical colleagues to confirm that patients or their representatives can agree to the data share at the first appointment post go live.  This needs to be a clinical conversation as there needs to be a transparent discussion about the benefits as well as the concerns that accompany data sharing. When considering the risks around data sharing, there is a need to give equal consideration to the risks of NOT sharing clinical information and the impact that this can have on clinical care and patient safety. 

Auditing access

We can see who has accessed a patient record if necessary and specific clinical records can be marked as confidential.  This facility needs to be used carefully as marking all case notes as confidential can increase clinical risk.  It is better to make a case note that summarises the intervention and record the activity and then follow this up with a more details case note that is marked confidential that contains the more sensitive information about the intervention.

Our health partners who use SystmOne can also see when we have accessed their version of the patient record.

Visibility of the record

As the share is enabled for the majority of our health partners, we need to think about how the record will present when viewed.  We need to be mindful that clinicians viewing the record need to be assured of the quality of the information on view.  For example, documents should be authorised and closed as per policy to avoid late or inappropriate editing.  This will signpost the clinician to make use of the most up to date version of a document with the most relevant information.

Key points to remember

• Where data is for direct health or social care, the Trust has a legal obligation to share.  
• Where the data is for safeguarding purposes the Trust has a legal obligation to share.
• The Trust  is under a common law duty to ensure that confidential information is protected from inappropriate disclosure. For SystmOne this is addressed through the data sharing agreements and our local policies around data usage and sharing.
• We have information sharing agreements with partner agencies (which include primary care, DCHS, UHDB and Social care) which have been agreed to support our lawful practise around data sharing. All of our individual Information Sharing Agreements sit under the overarching Derbyshire Partnership ISP.
• We have an area on our external Trust website that gives guidance around data sharing.

• Information governance covers the sharing of patient information with other services and organisations.

• Clinical governance covers the consent to treatment and needs to be considered for each clinical intervention.  Where capacity is an issue it is important to understand the person’s ability  to give consent to treatment and whether the decision to treat needs to be made in their person’s best interest based on a formal assessment of their mental capacity.