Home Blogs & News

What will NHS Scotland’s New Public Benefit and Privacy Panel for Health and Social Care Mean for IG and Research?

At the beginning of May this year, the Scottish Government took an important step towards simplifying NHS Scotland’s information governance procedures as it relates to the reuse of NHS patient data. Kim Kingan, Aridhia’s Chief Privacy Officer, looks at the changes and what this might mean for medical research and collaboration in Scotland.

Facilitating research – the Public Benefit and Privacy Panel for Health and Social Care

Scotland is a data-rich country with a strong history and reputation for having some of the best national data sets globally. But we also know that we have significant health gaps that we need to address.

The challenge is how to be pragmatic and balance the interests of those who seek access to NHS data for research purposes with data protection, and the privacy of the patients who entrust their data to the NHS. To date this is something that Scotland has been reasonably good at; however, I think that it’s fair to say that that some of the arrangements which are in place to approve applications to NHS originated data don’t work quite as well as we’d all like.

So on the 1st May 2015, Scotland took the first steps to simplifying the national governance structure by merging three distinct advisory groups – the NHS NSS Privacy Advisory Committee (PAC), National Caldicott Guardian Scrutiny panel and CHI Advisory Group (CHIAG) – and introducing a single information governance process with the creation of a Public Benefits and Privacy Panel for Health and Social Care. This panel has the support of NHS Board Chief Executives and Caldicott Guardians. The Panel isn’t intended to replace the existing local approval or scrutiny process for access to data owned by individual NHS Board’s.

One of the panel’s key jobs is to undertake information governance scrutiny of requests to access NHSScotland-originated data from more than one NHSScotland Board for a range of purposes which might include research, direct care, health planning or audit.

The Public Benefit and Privacy Panel for Health and Social Care has very broad membership which includes not only IG professionals, but also lay and research representatives. This shows a real commitment to striking a balance between safeguarding an individual’s privacy and making best possible use of the NHS data available, with public interest in mind.

At first glance, the Panel’s application form might appear quite daunting, but I don’t feel people should be put off by this. While the document is quite lengthy, it provides a great opportunity for researchers to not only showcase their study and how it will benefit Scotland’s residents, but how they have embedded privacy and security practices within their study or operations to uphold the Caldicott Principles.

From 15^th June 2015 onwards, only the new format application forms will be accepted for submission so now is the time for those seeking to access NHS originated data for research, audit or healthcare planning purposes to get acquainted with the changes.

What’s Aridhia’s view on this?

Aridhia welcomes these developments. I think we are starting to a see real moves towards much more clarity from data custodians about their expectations and hopefully greater consistency in decision making. As with anything, time will tell as to how effective these changes will be. If you look at this very simplistically, all the panel is saying is ‘if we entrust our data to you, do you know what the risks are and how you’re going to keep that data safe and secure?’ You can’t argue with that.

Since 2008, Aridhia has collaborated on a range of projects which has enabled us to gain a deep appreciation and understanding of some of the challenges faced by data custodians and applicants; for example, the ability to meet the stringent NHS IG standards, and the subtle but important differences in the documentation and the details to be included in responses across the different data custodians and approval committees, and the length of time to gain approval. The introduction of a two tier process, with additional support via the eDRIS application coordinators and the comprehensive form will go a long way to improving matters for everyone.

We’ve used those experiences in developing AnalytiXagility, our data science platform, which provides users with the technical environment to manage data safely and securely through the data lifecycle from de-identification, uploading, analysis and safe destruction.

AnalytiXagility’s integral data innovation platform, audit and collaborative features have been designed specifically for use in healthcare, precision medicine, collaborative research, and academic environments. Its use can take applicants a long way to successfully answering the questions in the application form/raised by the panel.

AnalytiXagility shares the best practice principles of the Scottish Health Informatics Programme (SHIP), best practice guidance from the NHS Caldicott Principles and the best attributes of other international safe havens and relevant privacy legislation – all of which are a must if you want to work with NHS data.

As Aridhia’s in-house information governance expert, it is my role to act as a key member of our development team to ensure that our platform adheres to client compliance requirements and provides adequate protection and security for multidisciplinary and multi-institutional research teams to safely integrate and analyse data from multiple systems and data sources.

Some of AnalytiXagility’s key privacy and security features offer a direct solution to the questions posed within section five of the Public Benefit and Privacy Panel’s application. Use of the platform and its in-built features will also simplify the application completion process for the applicant, and make the scrutiny of the data protection provisions that applicants intend to put in place easier for the Panel.

Secure Environment: AnalytiXagility is built to the international information security management standard and is hosted within secure data centres which have all the best practice security controls you would expect from companies providing co-location services for thousands of large enterprises. In Scotland, access to AnalytiXagility is obtained directly from Aridhia within these data centres, or via the Stratified Medicine Scotland-Innovation Centre, which is specifically designed for -omics and imaging.

De-identification: Aridhia’s De-Identification Service provides functionality which allows data controllers, custodians and owners to anonymise healthcare data sets within their own environment, thereby allowing the data to be safely linked and analysed for research purposes while minimising the risk of identifying an individual.

Data Storage and Access: All data is stored in access-controlled databases and users retain control of who they invite to access their private workspace. All users have unique login credentials to provide them with access to specific databases.

Deletion: At the end of the study or project the data will be deleted from the workspace unless an agreement is in place for continued data retention (e.g. users may wish to archive it in a secure environment with limited access), ensuring that personal data is kept no longer than is necessary for the agreed purpose.

Audit: AnalytiXagility has user activity tracking and monitoring which can be used to look at who is doing what, when and where.

The introduction of the Public Benefits and Privacy Panel for Health and Social Care has again highlighted the immense benefits that can be gained from research and wider use of data, but that such efforts should only be undertaken while ensuring that relevant governance and legislation is followed.

AnalytiXagility’s strength is that it offers both a practical and operational solution, which can help clients to minimise both the risks associated with the use and storage of data and aid their compliance with the law and best practice. In offering AnalytiXagility to healthcare and research users, we hope that we can help to simplify requests to reuse NHS originated data for research purposes, and ultimately allow the people of Scotland – and beyond – to gain the benefits of better health and social care.