Pseudonymisation Implementation Project - NHS Connecting for ...

More documents

Recommendations

Info

PIP Implementation GuidancePseudonymisation Implementation Project ImplementationGuidance1 Introduction1.1 Purpose and scopeThis paper provides an updated set of local implementation guidance for the PseudonymisationImplementation Project (PIP) and links to other PIP documents that provide reference material,guidance and general information.The purpose of this paper is to:■■■■■Provide a pathway through the steps that need to be taken to implement localdata usage and governance from the viewpoint of different organisationsinvolved in running NHS business operations.Provide high-level guidance on governance arrangements to ensure that‘effective anonymisation’ can be achieved to mitigate risk associated with use ofpatient data.Provide high-level guidance on governance arrangements and technicalsolutions for de-identification, which will ensure the security and confidentiality ofperson level data within local systems, referred to within PIP as implementinglocal data usage and governance.Provide links to the separate elements of more specific guidance coveringterminology, safe havens and business processes, de-identification and security.The scope of the document is therefore concerned with the management anduse of patient identifiable in relation to NHS business operations; it is notconcerned with the use of such data for medical research purposes.This paper has been updated to reflect developments in relation to the Information Governancetoolkit, standards etc as well further work in particular areas, such as invoices and social care.1.2 PIP Aims and ImplementationThe overall aims of the PIP are to enable:■■■The legal and secure use of patient data for secondary purposes by the NHS(and other organisations involved in the commissioning and provision of NHScommissionedcare)NHS business to no longer use identifiable data in its non-direct care relatedwork wherever possibleNHS business processes to continue to be effective in supporting the day to dayoperation of the NHS.The target aim of the project is that NHS businesses complete this transition by April 2011.Initial work of the Project included a questionnaire sent to all affected organisations. Thisprovided valuable information on flows of patient data for secondary use purposes andidentified practical issues to be addressed in implementation.NHS organisations were required through the 2009/10 Operating Framework InformaticsPlanning Guidance to submit plans for implementation of pseudonymisation. A planningtemplate and guidance (Ref 6) were provided to support development of high level plans byNHS organisations. The template and associated maturity model identified 14 key steps orFinal v1.1 15 June 2010© Crown Copyright 2010Page 4 of 21
PIP Implementation Guidancerequirements to be met as part of delivering local solutions and required completion and returnto their relevant SHA and to PIP. The documents acted as a mechanism for generating highlevelplans and raising organisational awareness of the need for de-identification of data usedfor secondary purposes.In order to assess the starting point for each organisation and to be able to track progress, aMaturity Model was developed covering the 12 essential implementation steps. The planningtemplate also gathered information on perceived issues and problems, which together with thebaseline scores from the Maturity Model have been taken into account in preparing thisguidance.The aims of PIP are embedded in version 8 of the Information Governance Toolkit (IGT). IGT8has a requirement that ‘the organisation protects the confidentiality of service user informationthrough use of pseudonymisation and anonymisation techniques where appropriate”.There are two consequences of the IGT requirement. These are:■■IGT8 refers to “Safe Haven” rather than “New Safe Haven 7 ” as the de-identification needsfor secondary use should build on the existing safe haven mechanisms already in use inNHS organisations. Therefore the IGT8 expression is used throughout this andassociated papers; in some instances the expression “local Safe Haven” is used toemphasise the local nature of the purpose of the safe haven;The attainment levels for this IGT requirement follow the structure of the IGT and do notuse the PIP Maturity Model. The Maturity Model has similar requirements, such as‘documented plan’, and can be used to measure local progress.The need to de-identify patient data to protect service user confidentiality is reflected in theStandards Framework for De-identification of NHS and Social Care Data, approved in principleat the Information Standards Board meeting of April 2010. The Standards Framework will bepublished in the near future, together with a relevant Information Standards Notice (ISN).This paper provides the guidance referred to in the Planning Guidance on the implementationof data usage and governance for secondary uses. The paper is provided in order thatorganisations can better understand the detailed requirements and for development of theirdetailed plans in order to meet the IGT8 requirement.1.3 Related papersThis guidance builds on the earlier PIP documents■■PIP Implementation Planning GuidancePIP Maturity ModelThe guidance is based upon a set of reference documents:■ Reference Document 1 – PIP Terminology, (Ref 1)■ Reference Document 2 – Business Processes and Safe Havens, (Ref 2)■ Reference Document 3 – De-identification, (Ref 3)■ Reference Document 4 – Techniques, (Ref 4)These reference documents have been written as standalone documents to provide coherentguidance in their own right in order to meet the needs of different audiences. It followstherefore that there is a limited duplication of content across the papers. Please note thatReference Document 2 has been modified for consistency with IGT8.7A term used during early stages of PIP work and in previous versions of this and other related guidanceFinal v1.1 15 June 2010© Crown Copyright 2010Page 5 of 21
Page 1 and 2: Pseudonymisation Implementation Pro
Page 3: Header textContents1 Introduction .
Page 7 and 8: PIP Implementation Guidance■These
Page 9 and 10: PIP Implementation GuidanceDe-ident
Page 11 and 12: PIP Implementation Guidance• buil
Page 13 and 14: PIP Implementation Guidance4 Implem
Page 15 and 16: PIP Implementation Guidance■■
Page 17 and 18: PIP Implementation Guidanceorganisa
Page 19 and 20: PIP Implementation Guidance■■
Page 21: PIP Implementation Guidance■■

Pseudonymisation Implementation Project - NHS Connecting for ...

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?