The Health and Social Care Information Centre has released a code of practice on confidential information, outlining how NHS organisations should securely collect, analyse and publish health and social care data.
The code of practice sets out regulations and principles for “activities in the information-handling life cycle”, from the intent to process confidential information, through establishing and implementing systems to process it, ending in its eventual destruction.
The Health and Social Care Act 2012 gave the HSCIC the responsibility of publishing a code of practice on “the actions to be taken in relation to the collection, analysis, publication or other dissemination of confidential information concerning or connected with the provision of health services or adult social care in England."
In a foreword to the code of practice, HSCIC chief executive Andy Williams says the document “is the first step on a journey to provide recommended practice to organisations” that use confidential information in that fashion.
The document says the code of practice does not relate to the direct provision of care, related record keeping or documentation for handovers of care from one provider to another.
It says organisations must establish and use standards for handling data to minimise the risk of a breach of confidence, while ensuring data quality is still high and all parties handling it understand its origin, structure and meaning.
“Misunderstanding of these qualities of data is likely to lead to incorrect and inconsistent interpretation and consequent harm.”
The code of practice also speaks about recognising individuals’ objections to the handling of confidential information about them.
It says organisations should take “appropriate steps” to inform people of how they can object to their information being used, also ensuring that proper procedures are in place to receive objections and act on them if necessary.
The code says organisations should adopt “sound analysis” of confidential data based on scientific principles, sharing the information where legally allowable and disposing of confidential data once it is no longer required.
Feedback from a consultation process earlier this year raised a number of concerns about the draft code of practice, which the HSCIC says it has addressed in the final version.