Commissioners get new PCD powers

Commissioners have been given new powers to process ‘necessary’ patient confidential data for invoice validation, following a decision by health secretary Jeremy Hunt.

Clinical commissioning groups have been unable to do monthly invoice reconciliation since April because of rules regarding access to PCD.

New guidance issued by NHS England says that the result of these changes has been that CCGs and NHS England are “finding it difficult to satisfy their statutory duties for fiscal probity and to demonstrate scrutiny for public expenditure."

Hunt has now approved NHS England’s application for Section 251 support to allow CCGs and commissioning support units to process PCD for invoice validation, though this is subject to a range of conditions. The exemption lasts for a year, until 31 October 2014.

“Therefore, as well as implementing our advice for the short term, CCGs, CSUs and providers should also be working on their medium-term plans to minimise the use of PCD for invoice validation and to find a secure legal basis where it is necessary to use such data,” a letter to commissioners says.

The validation process confirms that providers receive the correct amounts by checking that the correct patient received the correct treatment and that the correct commissioner has been identified.

Primary care trusts previously used a S251 exemption to access PCD to do this work. However, these powers were not transferred to commissioners when PCTs were disbanded in April this year.

A review of information governance chaired by Dame Fiona Caldicott also found that the majority of commissioning functions could be achieved using anonymous or pseudonymous data.

However, ‘Who Pays – Information Advice for Invoice Validation’ says work to develop new data processing systems for commissioners “has not progressed as quickly as had been expected” and it is “not feasible to prolong the delay any further”.

NHS England therefore applied for section 251 support to establish a temporary lawful basis for ‘necessary’ PCD to be used to validate invoices.

In order to process ‘necessary’ PCD, CSUs or CCGs that are already a stage one Accredited Safe Haven must apply to create a ‘controlled environment for finance’.

The Health and Social Care Information Centre’s regional processing centres will be able to flow weakly pseudonymised data into these controlled environments for invoice validation purposes.

The weakly pseudonymised cannot be on the invoice itself, but in an accompanying ‘PCD backing-data set’, which can only be submitted to a nominated CEfF. This backing data set can include both the NHS Number and local identifiers.

The invoice number will be on both documents in order to link the information.

The guidance says that submission of PCD backing data to the wrong CCG or CSU is a personal data breach and CCGs and CSUs “must design systems to capture, report, investigate and manage personal data breaches”.

Also, that CEfF staff should be separated from other staff. The new approval does not cover specialist services commissioned by NHS England or payment for services provided to private patients.

It cannot be used to determine: which is the responsible commissioner where care is provided over the border with a devolved administration; where one provider commissions the services of another provider; or any invoice validation by local authorities or for services jointly commissioned by the NHS and a local authority.

“Other NHS organisations – and independent sector service providers acting as a data processor under contract with a CCG to validate invoices on their behalf – are within neither the scope of this document nor the Section 251 approvals obtained to date,” it adds.

A CCG member who asked to remain anonymous told EHI that the new system “seems the most complicated way of doing things that anyone might invent."

He said it has been drilled into the wider NHS over recent years that the NHS Number is the identifier that should be used and many practices do not record any local identifiers at all, meaning that linking data using things such as local hospital numbers would be highly difficult and complex.