Purpose

To use pseudonymised (Not identifiable) Datasets: -

• Commissioning Datasets (Hospital and Community data),
• GP datasets and
• Other provider datasets,

to provide intelligence to support the commissioning of health services.  Data sets - NHS England Digital

The data (containing both clinical and financial information) is analysed so that health care provision can be planned to

support the needs of the population within the ICB area.

The data is used to:

• Performance management and monitoring of services;
• Ensure patients are receiving quality and cost-effective care;
• Prepare statistics on NHS performance for NHS England, and to support service redesign, modernisation and improvement;
• design future services;
• Validate activity/costs and service delivery to ensure the service commissioned is the one you experience. This could include challenging other NHS organisation about care being delivered and the associated costs.
• Thoroughly investigating the needs of the population, to inform the commissioning or appropriate services for that Population’s health needs.
• Stratify patients and activity based on risk and conditions.
• Gain evidence on how we can improve local health services
• Audit NHS accounts.

Legal Basis

Section 251 NHS Act 2006, Health and Social Care Act 2012

Processing Activities

Purpose

The national CHC Strategic Improvement Programme extract data from our patient administration system, Broadcare to understand the variation in content and value of care packages. The ICB are required, under the NHS Continuing Healthcare Directions 2022, enforced by NHS England, to submit a monthly CHC Patient Level Data Set to NHS England.

The data will be used by NHS England to:

• Analyse the cost of CHC packages
• Where patients are being placed out of area
• Where care packages are changing frequently
• Other evidence which may indicate poor outcomes for patients, so that they can be identified and addressed

The data will be used to support better outcomes, better patient experience and better use of resources.

Legal Basis

NHS England’s Statutory Functions – NHS Act 2006 and Health and Social Care Act 2012 (specifically Section 254(1) and 254(6))

Processing Activities

The CHC Team will extract data currently held in Broadcare, which is collected, stored and processed by the ICBs for the purposes of assessment and administering CHC packages of care. The data extraction process is conducted between the CHC SIP Team and Broadcare.  The extraction will involve pseudonymised data fields to protect the confidentiality of individual service users.

The extraction will include an end-to-end data set (from referral to end of service provision) for each patient who has been assessed for CHC funded care.  This data set will include patient who are eligible, as well as those who have been assessed and are not eligible.

Explicit consent to flow data to NHS England under Directions issued by NHS England is not required.  As a result, individuals may not opt out or object to use of their data used in this way.

Data is pseudonymised and shared into the Data Hub, for operational purposes such as commissioning and reporting as with other datasets.

Purpose

To combine data relating to the commissioning of nursing care across:

• Norfolk County Council
• ICB
• Suffolk County Council

to support the development of a sustainable care market that provides high quality care to people across Norfolk and Waveney, increasing cost efficiencies by delivering closer alignment across the commissioning functions.

There is the need to share data containing NHS numbers so that we can generate accurate joint costings

Legal Basis

Exercising its functions effectively, efficiently and economically Section 14Z33 of the NHS Act 2006

Processing Activities

Linking the data from the two systems that are used to support the funding of Continuing Healthcare (CHC) /Funded Nursing Care (FNC) including people who use Personal Health Budgets (PHB) and use Personal assistants (PAs) (over 18 years of age and includes LD&A).

The data will be analysed to deliver efficiencies.

Purpose

To ensure that the ICB is paying appropriately for the care given to its residence/population.

As we are responsible for paying for care, we may need to ask for evidence of the care provided, to ensure that it was appropriate, provided by the right organisation and to ensure it was the best use of public funding. 

Legal Basis

Section 251 NHS Act 2006, Health and Social Care Act 2012

Processing Activities

The use of limited information about individual patients is required when validating invoices received for healthcare provided, in most cases limited data such as the practice code is used to make such payments.

In some instances, information to confirm that you are registered at a GP Practice within our area is needed to make such payments to ensure the invoice is accurate and genuine.

This will be performed in a secure environment and will be carried out by a limited number of authorised staff

The Norfolk and Waveney ICB is an accredited Controlled Environment for Finance (CEfF) under a Section 251 exemption, which enables us to process patient identifiable information without consent for the purposes of invoice validation – CAG 7-07(a)(b)(c)/2013

Liaison Financial Services LTD CHC Invoice Validation Reviews - Liaison Group are also an accredited CEfF, and processes invoiced on behalf of the ICB for Continuing health care.

The process involves a limited number of authorised staff using your NHS number, postcode and/or date of birth to establish whether we are responsible for paying for your care. The minimum information necessary is always used for this purpose.

Purpose

If you are in receipt of CHC, we will still need to make sure that the care you receive is in accordance with your care plan, and that it is chargeable to our ICB. To do this we will use the records already available to us in our CHC administration system, Broadcare.

Legal Basis

NHS Act 2006, Health and Social Care Act 2012, National Framework for NHS continuing Healthcare and NHS funded Nursing Care July 2022

Processing Activities

When we receive an invoice for your care, we will check that it meets the needs of your care plan. This will be done using a unique identifier. Wherever possible we will not use your person identifiable information to validate invoices.

However, if there is a discrepancy, i.e., we have received an invoice for care not mentioned in your care plan, we may review our records and your personal information to assess whether you care needs have changed and your package needs to be  reviewed.                                                   

We will of course contact you if there any changes are required to your care plan.

Purpose

NHS England encourages ICBs and GPs to use risk stratification tools to develop strategies to support patients with long term conditions and to help prevent avoidable admissions, by predicting when a deterioration in health is likely to occur. Risk stratification is part of overall Population Health Management activities which bring together health related data for identifying and managing patients who should be classified as:

• “at risk of an emergency hospital admission or deterioration in health” or
• identify a specific population that health services may then prioritise.

The Purpose is to:

• Reduce health inequalities and improve overall outcomes.
• Help decide if a patient is at greater risk of suffering a particular condition
• Prevent an emergency admission to hospital
• Identify if a patient needs medical help to prevent a health condition from getting worse.
• Help the ICB to commission appropriate preventative services and promote quality improvements in existing services.

Legal Basis

GDPR Article 6(1)(e) - processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller.

GDPR Article 9(2)(h) - processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

Section 251 (NHS Act 2006) approval (CAG 7-04(a)/2013) from the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority, sets aside the Common Law Duty of Confidentiality. This enables pseudonymised information to be sent to the ICB via NHS England (https://digital.nhs.uk/services/data- services-for-commissioners/data-services-for-commissioners- regional-offices) in order to help us plan the most appropriate health services for our population.

Processing Activities

Risk stratification tools use various combinations of data about patients such as age, gender, diagnoses, hospital attendance, admission and primary care data collected by your GP in practice systems. This data could be pseudonymised, anonymised or aggregated.

Risk Stratification is a process which applies algorithms, or calculations to identify those patients who are most at risk from certain medical conditions and who will benefit from clinical care to help prevent or better treat their condition.

The ICB has commissioned the services of two authorised Risk Stratification Providers to provide risks stratification tools that have been approved by NHS England:

• Prescribing Services Limited (PSL); and
• Arden & GEM Commissioning Support Unit (AGEM CSU)
• Data processing takes place under a contract to ensure that contractual obligations on the providers are enforceable.
• The ICB has a data sharing contract in place with NHS England which enables PSL to have access to secondary care data (Inpatient, Outpatient, Accident and Emergency, Out of Hours, Urgent Care, Community Nursing, Community Mental Health) at an identifiable level (via the NHS Number) which it can link to primary care data. Subsequent use of data is then
• AGEM CSU uses a process that converts identifiable data at source and then removes NHS This is then handled by the ICB as a commissioning data set. This enables linkage to other data sets provided to the ICB where permitted. (This processing does not require Section 251 approval).
• Our GP Practices also have a data sharing contract in place with PSL and AGEM CSU to flow primary care data into their risk stratification They act as data processor under very specific instructions from the GP practice.

The ICB complies with national opt out processes.

Your details will only be processed if there is a legal basis to do so such as direct health or social care need. This means the data is not identifiable and remains that way until a request is made by a clinician or support team (who already has a direct relationship with you) to re-identify with the intention of offering direct care and support.

If you do not wish for your personal data to be used for Risk Stratification, you can choose to exercise a local opt out by contacting the ICB using the contact details within this Notice. See Contacting Us section at the end of this Notice.

In order for us to comply with your opt-out request, a level of identifiable data will need to be retained by us as a record of your request and our subsequent processing of this. The data retained will be the minimum required for the processing undertaken.

Purpose

Population Health Management (PHM) is aimed at improving the health of an entire population. PHM is about improving the physical and mental health outcomes and wellbeing of people and making sure that access to services is fair, timely and equal. It helps to reduce the occurrence of ill-health and looks at all the wider factors that affect health and care.

The PHM approach requires health care organisations to work together with communities and partner agencies, for example, GP practices, community service providers, hospitals and other health and social care providers. These organisations will share and combine information with each other in order to get a view of health and services for the population in a particular area. 

Examples of how data could be used for a number of healthcare related activities include:

• improving the quality and standards of care provide
• research into the development of new treatments
• preventing illness and diseases
• monitoring safety
• planning services

Legal Basis

GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller
 
GDPR Article 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

In the majority of cases, anonymised data is used so that you cannot be identified. Where identifiable data is used, this is done under contract with the relevant healthcare providers.

Processing Activities

The ICB has commissioned the services of two providers who conduct Risk Stratification to support PHM:

• Prescribing Services Limited (PSL); and
• Arden & GEM Commissioning Support Unit (AGEM CSU)

For information on this processing activity, please refer to the Risk Stratification section above.

As part of the ICB’s PHM work, local health and social care providers may direct the ICB’s Protect NoW Team, to contact patients in relation to population heath initiatives.

The Protect NoW team uses patient demographic data, consisting of name, address, contact details, and NHS number. This information is sourced from the NHS personal demographics service  (PDS) system through our patient engagement platform which is provided by PSL.

The Protect NoW call handlers signpost patients to additional services commissioned by the ICB, if requested by the patient. They will not have access to medical records. The provider will extract the relevant cohort of patients from their treatment list with the minimum information required for the Protect NoW call handlers to contact the patient.  All calls are recorded for quality and audit purposes.

Further information regarding the work of Protect NoW can be found on the ICB’s website -  Protect Now and Health Improvement Support Teams - Norfolk and Waveney ICS (improvinglivesnw.org.uk) and Population Health Management Projects - Norfolk & Waveney ICS (improvinglivesnw.org.uk)

Purpose

To bring together care organisations across N&W to collectively plan health and care services to meet the needs of the Population. To allow ICB to share data received from NHS England via our commissioning agreement, with members of N&W ICS. This will be limited to pseudonymised commissioning data. The data will only be shared for the purpose of commissioning.

Legal Basis

Health and Social Care Act 2012 - s261(5)(d)

Processing Activities

The Sublicensee will be required to meet certain criteria and then sign up to the standards of use in the data sharing agreement before they will be granted access.

Sub licensee requests will be vetted by an ICB hosted approvals group and will require senior sign off by ICB Senior Information Risk Officers.

The pseudonymised data sets provided by NHS Digital are maintained in a data warehouse and will populate and Business Intelligence dashboards and routine reports which sublicensees will be granted access to. The ICB can also share this data direct to a sub licensee upon request, all data shared under these terms is logged by the ICB.

They Sub-licensee will become a data controller and are not able to share the data outside their organisation.

The list of sub-licensees will be updated quarterly and can be found here. - List of Sub-licensees

Purpose

Norfolk & Waveney ICB is a statutory NHS organisation responsible for developing a plan for meeting the health needs of the population, managing the NHS budget and arranging for the provision of health services in a geographical area.

As part of its function, the ICB works with partners to design, deliver and evaluate cross-sector, multi-agency projects and services to drive the integration agenda. This includes working alongside system partners to develop and transform pathways and services.

Legal Basis

NHS ACT 2006 and Health and Social Care Act 2012

Processing Activities

Service redesign and evaluation may involve ICB staff shadowing and working with colleagues from system partners to understand pathways, patient flows and patient experiences. As a result, access to or sight of personal identifiable data, where this is relevant to the patient journey and to help improve processes and services/pathways, may occur.

Where complex pathways or services are evaluated, it may be necessary to bring providers together to find a solution. The ICB may act as facilitators in multi-disciplinary meetings to ensure a coordinated approach in ensuring the best possible outcomes for patients. As part of this work, an element of personal identifiable data may need to be shared.

In all cases, only the minimum amount of personal identifiable information will be shared, necessary for the purpose and only where anonymised themes and trends are insufficient to allow accurate evaluation.

Purpose

Centralised workforce data is critical for planning for the ICS and wider NHS.  Processing it centrally will save providers time in collating their reports and will enable comparisons. 

Centralising this data allows the ICB to provide sufficiently detailed workforce  data to boards and workstreams such as the Nursing & Midwifery board or in support of preparation for winter pressures. 

This will support an evidenced based approach to decision making it is important to ensure that we leverage all the data available to us. By making use of aggregated workforce data, we would be able to present information which helps decision makers to understand all the issues and the root cause, for example, accident and emergency reporting should include not just information about patient demand and throughput, but should show more wholistic data sets such as the vacancy rate, sickness rate and relative knowledge of the work force which may have a very significant impact on performance.

Legal Basis

14Z34Duty as to improvement in quality of services

Processing Activities

The data is collected via the electronic staff record (ESR) as part of the organisation’s public task in managing its staff data.  On receipt of the data it will by pseudonymised (de-identified) and segregated from any health information held on the system.

The data to be shared with the ICB will be used for planning, commissioning and wider PHM purposes. The data shared is already accessible to NHSE who use it for the same purposes. As such

there is no substantial change to the way that data is being used which would impact data subjects.

The data will be held in a segregated section within the data hub

Data Hub - Norfolk & Waveney Integrated Care System (ICS (improvinglivesnw.org.uk)