NHS Westminster and
@@@@@@@ Pharmacy for the provision of NHS Health Checks
Data Handling Agreement
April 2010
Author Donal Markey Community Pharmacies
Data Handling agreement V2
1. Introduction
1.1. This Data Handling Agreement (DHA) supplements the Inner North West London Inter Organisational General Protocol for Sharing Information (the Protocol or ISP). Any Party agreeing to and signing the Protocol also confirms agreement to this DHA.
1.2. The purpose of the DHA is to outline the particular personal information sharing requirements of the NHS Health Checks as it applies to patients receiving an NHS Health Checks in a community pharmacy within NHS Westminster.
2. Local Context
2.1. From 2009/10, the NHS is being asked to implement a uniform and universal vascular risk assessment and management programme called “NHS Health Check’” for people in England aged between 40 and 74, the proposals for which were set out in Putting Prevention First DH April 2008.
2.2. The NHS Health Check is for adults in England between the ages of 40 and 74, and was introduced in April 2009. Itwill give patients and their GP a clearer picture of an individuals health, and help them take action to reduce their risk of heart disease, stroke, type 2 diabetes and kidney disease
2.3. The Pharmacy shall offer NHS Health Checks to eligible patients only. An eligible patient is one who is;
2.3.1. registered with a NHS Westminster GP (a registered patient) and
2.3.2. who are 40 years and over and,
2.3.3. who are aged 74 and under and
2.3.4. who have not received a NHS Health Check within the past 5 years and
2.3.5. who are not diagnosed as having vascular disease or are not taking medication for vascular disease.
2.4. NHS Westminster (NHSW) will commission Health Checks in 3 settings, GP Practice, Pharmacies and community settings.
2.5. NHSW has commissioned MyAction as the provider of support servicers to persons with a CVD risk score is ≥ 20%.
2.6. Information from the NHS Health Check will be shared with the person’s GP and with MyAction is the CVD risk score is ≥20%
2.7. The current position is that interfaces exist between MyAction, GP Practices, and this agreement relates to an interface developed between Pharmacies, MyAction and GP Practices provided by Telehealth Solutions Ltd (THSL) and using N3 & NHSmail
2.8. THSL have
2.8.1. signed the ISP
2.8.2. a separate Subject Specific Information Sharing Protocol (SSISP)
2.8.3. a separate contractual agreement with NHSW
3. Monitoring and Review Procedures
3.1. This DHA will be monitored and reviewed in line with the procedures outline in Section 5.2 of the Protocol.
4. Information Sharing
4.1. Security
4.1.1. In order to fully realise the benefits of the system it is necessary to ensure that all providers of services to patients receiving an NHS Health Check are able to access clinical information in a secure and appropriately managed and organised environment.
4.1.2. Cardio Pod by Telehealth Solutions is a stand device which is connected to the N3 portal in the pharmacy. It does not interface with the pharmacies Patient Medication Records (PMR)
4.1.3. Information Flow Map: NHS Health Checks in Pharmacies
4.1.4. The technology used by Cardio Pod conforms to current Data Protection Act 1998 and other data protection legislation, Caldicott recommendations and the NHS Code of Connection messaging requirements. Secure Socket Layer (SSL) encryption is used to ensure that any data transmitted is secure. Additionally the data is sent from the pharmacy to the THSL directly via N3. Software security within the solution is multi-layered and extremely rigorous, ensuring that patient confidentiality is preserved at all times.
4.2. Operation
4.2.1. Cardio Pod, calculate the person’s CVD risk score, using QRISK2 CVD Calculator i.e. the risk of a cardiovascular (CVD) effect within the next 10 years from the day of the test
4.2.2. Cardio Pod produces bespoke advice based on the person’s assessment and percentage CVD risk on how the patient should manage and reduce their risk of developing vascular disease
4.2.3. Cardio Pod produces an action plan with appropriate advice, referral or signposting to other service providers in accordance with NHS Westminster’s care pathway for CVD
4.2.4. Cardio Pod sends a summary report to the patient’s GP for every consultation
4.2.5. Cardio Pod sends a summary report to MyAction if the CVD risk score is ≥ 20% and the patient has agreed to attend the MyAction programme or has agreed to be contacted by MyAction for further information
4.2.6. 12 community pharmacies have been commissioned to provide the service.
4.2.7. Data entered into the system at the pharmacy is by default only visible at the pharmacy where the data was entered
4.3. Access to Data
4.3.1. Only named pharmacy employees will have access to the Cardio Pod and the device is password protected.
4.3.2. Pharmacy employees must be bound by the appropriate data handling and security procedure to protect the integrity of any patient identifiable data
4.3.3. No third party contractor or self employees individual may have access to the data unless that have agreed to comply in writing with the pharmacies data protection standards
4.3.4. No third party contractor or self employees individual may have access to patient identifiable data.
4.3.5. Any information shared between the Parties to this DHA must comply with the Information Sharing Principles and Protocols, Section 6 of the main Protocol.
4.3.6. The full requirements are outlined in the ISP Section 6. However the key principles are:
4.3.6.1. Consent should normally be sought at the first contact with the service user;
4.3.6.2. The patient consent form agreeing to collection of the data (refer 5.1) to perform an NHS Health Check generated by Cardio Pod must be printed and signed by the individual receiving the Health Check. or his/her legally authorized representative;
4.3.6.3. A copy of the signed consent form should be retained in the pharmacy and a copy given to the service user.
5. Data
5.1. Suitable individuals will be asked to give written consent to the assessment, following an explanation of the process. The following will be performed.
5.1.1. Blood pressure
5.1.2. Random Blood glucose
5.1.3. Blood cholesterol (HDL/LDL)
5.1.4. Pulse Check
5.1.5. Body Mass Index and waist circumference
5.1.6. Lifestyle questionnaire (including alcohol use)
5.1.7. CVD Risk Score
5.2. The following data field will be collected
Data fields to be collectedIn the pharmacy / Data sharing requirements
NHSW / MyAction / GP Practice
Full Name
(Surname and First name) / No / Yes / Yes
House/flat number / No / Yes / Yes
Street / No / Yes / Yes
City/County / No / Yes / Yes
Postcode / Yes / Yes / Yes
Date of Birth / Yes / Yes / Yes
Gender / Yes / Yes / Yes
GP Practice Code / Yes / Yes / Yes
Total Cholesterol / Yes / Yes / Yes
HDL/LDL / Yes / Yes / Yes
Blood Pressure / Yes / Yes / Yes
Pulse Check / Yes / Yes / Yes
Alcohol Audit / Yes / Yes / Yes
Lifestyle Questionnaire / Yes / Yes / Yes
Smoking Status / Yes / Yes / Yes
Height / Yes / Yes / Yes
Weight / Yes / Yes / Yes
BMI / Yes / Yes / Yes
Waist circumference / Yes / Yes / Yes
Random Blood Glucose / Yes / Yes / Yes
CVD Risk Score / Yes / Yes / Yes
5.3. This data to be hosted on a server managed by THSL regardless of the number of users.
5.4. THSL will work with IT pharmacy system providers to ensure that the data can be passed from the point of collection to the server, covering off the possibilities of the collection point being behind N3 or in the clear.
5.5. NHSW to be able to run reports that indicate results for any of the data fields defined in 5.2 including a confirmation of any actions and/or referrals agreed with the individual including a time/date – stamp.
5.6. Data sent to GPs and MyAction will meet minimum dataset requirements agreed between THSL and NHS Westminster.
5.7. No patient identifiable data will be transferred outside of an N3 connection
6. Reporting Requirements
6.1. The pharmacy agrees to provide the following reports
6.1.1. Monthly invoicing of activity which is auditable against the number of Health Checks recorded on the Cardio Pod.
6.1.2. Customer/Client report showing the results on their “My Health Check Report”
6.1.3. GP report with results of the individual put into an agreed format that is then e-mailed to the GP Practice using the Cardio Pod & NHSmail.
6.1.4. Anonymous data analysis reports of all the data field defined in section 5.2 and all actions and referrals recorded by Cardio Pod, if required for audit purposes.
7. Information Governance & NHS Standards
7.1. The pharmacy agrees to comply with the prevailing NHS requirements of Information Governance and NHS Data security standards
See link http://www.psnc.org.uk/data/files/IG/psnc_ig_workbook_2010web.pdf
7.2. The pharmacy will identify a Caldicott Guardian to the standards set by the Caldicott Report 1997 and by any new requirements on Caldicott Guardians determined by the Department of Health
7.3. Each Party agrees that
7.3.1. It is responsible for maintaining the personal information that it has collected on its own account, or jointly with another Party, in accordance with the DPA 1998;
7.3.2. It will retain legal responsibility for correcting personal information where it is factually incorrect; and
7.3.3. It will not amend the record of an opinion or judgement recorded by a health or social care professional, whether accurate or not, because the recorded opinion or judgement is essential for understanding the clinical decisions that were made and to audit the quality of care.
7.4. It is the responsibility of all Parties to maintain an audit trail of personal information disclosed and received in the course of information sharing to which this DHA relates. The procedures which apply to the maintenance of an audit trail are described in the Protocol, Section 6.9.
7.5. Encryption Guidance for Information Governance
7.5.1. Department of Health : Information Security NHS Code of Practice standards (see link: http://www.dh.gov.uk/prod_consum_dh/idcplg?IdcService=GET_FILE&dID=138909&Rendition=Web )
7.5.2. Department of Health : Confidentiality, NHS Code of Practice (see link: http://www.dh.gov.uk/en/Policyandguidance/Informationpolicy/Patientconfidentialityandcaldicottguardians/DH_4100550 )
7.5.3. Department of Health: Records Management NHS Code of Practice (see link: http://www.dh.gov.uk/PublicationsAndStatistics/Publications/PublicationsPolicyAndGuidance/PublicationsPolicyAndGuidanceArticle/fs/en?CONTENT_ID=4131747&chk=tMmN39 )
8. Data Protection
8.1. The pharmacy agrees to fully comply with the Data Protection Act, and any relevant changes in the Data Protection Legislation in respect of Personal Data held by it on behalf of NHS Westminster
8.2. The pharmacy will agree to and sign the NHS Westminster Information Sharing Protocol.
8.3. All patient data remains the property of NHS Westminster at all times and will be returned to NHS Westminster at the end of the agreement in accordance with the contractual termination agreements. The data cannot be used by any other party nor can it be used for any other purpose other NHS Health Checks.
9. Freedom of Information Act
9.1. The pharmacy agrees fully to comply with the Freedom of Information Act as if they were Public Authorities [or a Publically-owned company] in the meaning of the Act.
10. The Agreement
10.1. This DHA comprises three sub-agreements relating to:
10.1.1. Data Supply;
10.1.2. Data Sharing;
10.1.3. Data Use.
11. The Data Supply Agreement
11.1. This Agreement confirms the patient data that may be hosted within the Carelink Server at Telehealth Solutions Ltd. It is an agreement by each pharmacy to allow patient data from the Cardio Pod installed in the pharmacy to be downloaded to and hosted on the Carelink Platform. in accordance with data listed in Section 5.2
11.2. The information to be downloaded to and hosted on the Carelink Platform within the patient Data Sets is detailed in Section 5.2.
11.3. Any extension(s) to the Data Sets to be uploaded in the future must be agreed by the participating practices.
12. The Data Sharing Agreement
12.1. This Agreement confirms the data that may be accessed by named NHS Westminster employees and named THSL employees. It is an agreement by the pharmacy to allow patient data from the Cardio Pod to be shared with other NHS Parties to the Protocol, in accordance section 5.2.
12.2. Any changes to the Data Sharing arrangements must be agreed by the Parties to the ISP.
12.3. The levels of access supported are:
12.3.1. Patient Identifiable Data;
12.3.2. Aggregate/Summary Data (Reporting of numbers and percentages only)
13. The Data Use Agreement
13.1. This Agreement confirms the purposes for which information may be used and the care settings to which the solution applies. It is not permitted to use the data uploaded for any purpose other than the provision of information to participating GP Practices, Community pharmacies, MyAction and NHS Westminster,
13.2. No Party is permitted to use the data for commercial purposes.
13.3. Each Party uploading the information from the Cardio Pod and Carelink Platform warrants that the information shall:
13.3.1. Be for the Party’s sole use and not provided to any other Party, other than another Party to the Protocol and solely for the purposes of providing services to patients receiving an NHS Health Check.
13.3.2. Only be disclosed to, and used by, users and employers who plan, govern and/or deliver healthcare services under the directives of the Party for the Party’s patients/clients;
13.3.3. Only be used for the benefit of the individual patients who are the Data Subjects of the information and are also within the care of the Party;
13.3.4. Not be copied or communicated to Parties/individuals who are not signatories to the Protocol, except in the case of an emergency or in the interests of the public good where the organisation’s Caldicott Guardian has given an explicit temporary right of access.
13.4. Each Party agrees to use the Cardio Pod and Carelink Platform only in the way(s) and for the purpose(s) set out in this DHA.
13.5. Each Party agrees to assign to employees, contractors, link workers and other users those Business Functions, Field Sets and Record Set Restrictions (if any) outlined in this DHA.