Evidence submitted by the British Medical
Association (EPR 40)
EXECUTIVE SUMMARY
— The BMA supports the creation of
a summary record. Patients should play a central role in deciding
what information, if any, is shared and checking for accuracy.
It is the BMA's view that explicit consent should be obtained
and patients must have the right to prevent their information
being uploaded or shared. It is important that an incremental
approach is adopted and that experience of sharing summary care
information should be accumulated before detailed care records
are shared. Patients must have the right to prevent the sharing
of their detailed care records beyond organisational boundaries.
— Information governance presents a
significant challenge. There needs to be clarity about how the
number of alerts will be managed by Caldicott Guardians, what
training and resources will be in place to support Caldicott Guardians,
the penalties which will be in place if the system is abused,
and about how smart cards can be better managed in busy environments.
— The BMA welcomes the Secondary Uses
Service, in principle, and believes that this could bring major
benefits to health and healthcare. There are, however, a number
of areas which remain unclear as indicated in the response.
— Many of the problems encountered
by the programme have been caused by stakeholders, clinicians
and patients not being consulted on developments. Following the
National Audit Office report, this has started to be addressed
but there is still a sense, at times, of proposals being signed
off without adequate consultation and an element of secrecy around
developments. There needs to be greater transparency and openness
with both clinicians and patients about developments and engagement,
at every stage, of healthcare professionals who will use the systems.
— Connecting for Health needs to be
clearer about its strategy. Many areas remain vague or unanswered
including UK integration, who beyond the NHS will have access
and how the detailed care record will be implemented. In addition,
the workload implications of implementation have not been identified
and could be a major rate limiting step for further roll out if
not resourced. Connecting for Health needs to work with stakeholders,
clinicians and patients to address these unanswered questions.
— The main purpose of an electronic
patient care record is to improve patient care. The needs of patients
must remain central to these discussions and we hope that the
early adopter phase will provide the opportunity to test out some
of the theory around the National Care Records Service (NCRS)
and find out what patients really require. Further roll out must
not go ahead until lessons have been learnt from the evaluation
of the early adopters.
What patient information will be held on the new
local and national electronic record systems, including whether
patients may prevent their personal data being placed on new systems
1. The BMA supports the creation of a summary
care record on the national electronic record system. The current
hybrid system of paper and electronic records is far from perfect
and we can see the benefits that greater sharing of healthcare
information could bring to everyday working practices to improve
patient care.
2. It is the BMA's view that it is for patients
to decide, in discussion with a healthcare professional where
appropriate, the extent to which their clinical information is
placed on electronic systems. It is vital that patients are properly
informed about any changes and understand the implications of
both sharing and withholding information. The BMA's policy is
for explicit consent to be obtained before any healthcare information
is uploaded onto the system. This will ensure that patients are
properly informed and have the opportunity to check their record
for potential sensitivities and accuracy prior to any upload.
This should not be a one off event; following each consultation,
patients should have the opportunity to consider the information
which could be shared with others involved in their care. Consideration
needs to given to supporting vulnerable groups such as the frail
elderly in this process.
3. The systems should support this process
by highlighting the clinical information, which could be added
to the summary care record. The BMA welcomes the involvement of
clinicians in developing standards to support this process. It
seems sensible that the summary record should be comprised of
basic information such as medications, adverse reactions, allergies,
major diagnoses and test results, provided that the patient is
in agreement. The early adopters will play a key role in testing
this with clinicians and patients. We hope that the independent
evaluation will provide essential feedback on patients' decisions
to influence future developments and that the deployment timetable
allows for appropriate evaluation.
4. If information is to be shared more widely
it will become increasingly important that information in patient
records is meaningful to the viewer. A prerequisite is that all
records, local and shared are accurate. GP practices are being
accredited before any information is uploaded and patients will
play an important role in checking their summary record before
the initial upload. There needs to be an ongoing commitment to
ensure that records remain accurate. There must be investment
in training clinicians and staff to ensure that data is entered
appropriately. Electronic records are dynamic and introduce a
new responsibility of data husbandry that needs to be resourced.
Potential viewers of the NHS Care Records Service may need to
be trained to understand and interpret the context of such records.
5. Patients must have the right to prevent
their healthcare information being uploaded onto shared systems.
Some patients will want reassurance that their healthcare record
will not be shared beyond their GP practice or the organisation
in which it was created. We would not want patients' access to
health care services unreasonably compromised by making this decision.
Failure to provide this option could result in patients withholding
healthcare information adversely affecting clinicians' ability
to provide proper treatment and increasing patient safety risks.
Trust is critical to the success of the NHS Care Records Service.
6. With regard to detailed care records,
patients should have the option to prevent their information being
shared beyond organisational boundaries. If clinical data is entered
onto the GP system, patients must be able to prevent this information
being shared beyond the practice team. The BMA also believes that
patients must have the option of sharing their summary care information
on a national level without sharing their detailed care information
at a regional level. Many patients will be happy to share basic
information so that it is available in an emergency but may be
uncomfortable about sharing their detailed care record outside
organisations, which may include embarrassing and/or sensitive
information that would not have any impact during an emergency
health episode. The BMA also believes that there must be an incremental
approach and experience should be accumulated in sharing summary
care information before detailed care records are shared with
other databases.
7. The BMA accepts that it is necessary
for patients' demographic details to be held on a centralised
system in order to deliver care, in the same way that NHS patients
could not opt out of being recorded on the Exeter system. There
may be situations, for example if a patient is in a witness protection
programme, or otherwise hiding from violence, when a patient's
demographics may be hidden or "flagged sensitive". There
needs to be greater clarity about how these patients, who are
often vulnerable, will be informed that this option exists, how
their health information held on the spine can be accessed and
how being flagged sensitive will impact on their use of the health
service. For example, will they be able to use GP2GP transfer,
Choose and Book and the Electronic Transfer of Prescriptions (ETP)
services? It needs to be clear that personal sensitive information
will never be held on the Personal Demographic System (PDS). We
would also like to see clearer guidance about the consequences
of trawling through PDS without reason.
Who will have access to locally and nationally
held information and under what circumstances
8. The BMA supports the concepts of legitimate
relationships and role based access to control who has access
to what information. It is the BMA view that it is important that
the system is workable. Access controls must not be so stringent
that they delay clinicians providing treatment to patients.
9. Patients should have control over who
has access to their records. Patients should have the choice of:
(a) Having no clinical information uploaded
onto the national system provided that they understand that limiting
the information that will be immediately available via the spine,
even in an emergency, may be to their detriment;
(b) Having a hidden summary care record so
that it can only be accessed with a patient's explicit consent
or in an emergency situation;
(c) Having a summary care record so that
it can be accessed by those directly involved in a patient's care
but restrict the sharing of their detailed care record to the
organisation it was created in;
(d) Sharing their summary and detailed care
record nationally and regionally, respectively;
(e) Placing sensitive information in sealed
or "sealed and locked" envelopes to restrict sharing.
The BMA supports the concept of sealed envelopes but is concerned
about delays in their delivery and the practicalities of their
implementation.
10. The BMA supports developments such as
Healthspace, which enable patients to have greater access to their
own records. We support developments which enable patients to
be more involved and potentially add to their own records at any
time. The BMA hopes that this will allow patients to include advanced
directives and views on organ donation on their record. Urgent
consideration needs to be given to children and arrangements for
accessing Healthspace by "Gillick competent" children.
11. The BMA recognises that in some circumstances
it may be beneficial for some groups outside the NHS who provide
care, to access the summary care record, including dentists, opticians,
community pharmacists and social care workers. In such circumstances
access must only be possible if a patient has chosen to have a
summary record and has provided explicit consent for each of such
groups to have access to the summary record. Patients and clinicians
may feel concerned about this and there needs to be consultation
with stakeholders about the extent to which records are shared
beyond the immediate NHS.
12. As part of NHS system reform, private
providers will increasingly provide care to NHS patients. Private
providers should be subject to the same access controls and should
be responsible for their own local detailed records. There needs
to be clarification about what happens to the record when a private
provider ceases to deliver NHS services. Arrangements should be
in place for the local detailed record to remain part of the of
the patient's record.
13. The primary function of the NHS Care
Records Service is to provide care for patients and the BMA would
strongly oppose any plans to allow other government agencies access
to the NHS Care Records Service, for example, social services,
the police and the Home Office. There are other more appropriate
routes for information sharing, when necessary, with these agencies.
The purpose of the NHS Care Records Service is to provide care
to patients and allowing other agencies access would undermine
trust in the system and the doctor/patient relationship. There
must be strict penalties for anyone who attempts to inappropriately
access the NHS Care Records Service.
14. The BMA is concerned that there appears
to be little progress in supporting patients who live close to
the UK home country borders. The need to ensure that systems are
integrated across the UK was raised by the BMA at the outset of
the programme. Thousands of patients live close to the borders
and there needs to be a mechanism in place to ensure that if a
patient receives care across the border, clinicians can have access
to necessary information and share healthcare information so that
they do not receive sub-standard care. There are also an estimated
quarter of a million people who migrate between the 4 nations
and many patients who receive treatment as temporary residents.
Having a nationally available summary care record with local detailed
records supports by interoperable clinical messaging with support
this need.
Whether patient confidentiality can be adequately
protected
15. The protection of patient data falls
into two categories: (i) the technical security and (ii) information
governance. The BMA believes that the technical security arrangements
provide a sound basis requiring only modest changes to provide
the technical support required to meet all of the confidentiality
issues we have identified. The security framework does not provide
mechanisms that allow the particular issues that relate to the
protection of the records of NHS staff to be addressed. It is
the information governance and "people" side of security,
which in many ways, presents the greater challenge.
16. However secure the system, there is
always a risk to confidentiality when increasing the number of
people who have access to the system. Some actions which put the
data at risk may be accidental such as leaving smart cards in
the system. Other actions may be to speed up processes; there
have already been cases of smart card sharing due to the time
it takes to log into systems, for example at an acute hospital
in South Warwickshire, or giving receptionists a clinician role
in Choose and Book. There will also be occasions when staff access
records for inappropriate reasons.
17. These issues are not new but become
a greater challenge with a centralised system. Whilst an alert
system may detect inappropriate access, it will only become apparent
after the event. The BMA is yet to receive clarification about
how the number of alerts will be managed by Caldicott Guardians
and is concerned that illegitimate access may go undetected or
uninvestigated.
18. The BMA has already raised concerns
with Connecting for Health over the funding and resourcing of
Caldicott Guardians and privacy officers. The BMA welcomes the
establishment of the Caldicott Guardian Council, and the recent
publication of The Caldicott Guardian Manual 2006, but
is concerned that despite these efforts, training and resources
will not be available to ensure that Caldicott Guardians and privacy
officers will be able to fulfil their new extended responsibilities
under the NHS Care Records Service. Given that the government
is placing emphasis on safeguards that these individuals will
police, as a means of reassuring the public and the profession
that they can have trust in the system, it is vital that these
resources are planned and made available.
19. Preventing access in the first place
is crucial. It must be made very clear that inappropriate access
will result in penalties. There also need to be very clear information
governance guidelines in place to support the culture change,
which is necessary to implement Electronic Patient Records.
20. The security of any system can never
be guaranteed. It is therefore for patients to weigh up the benefits
and the disadvantages of the new system and consider to what extent
they wish to be involved. For this reason, a well balanced and
unbiased public information campaign is extremely important.
How data held on the new systems can and should
be used for purposes other than delivery of care eg clinical research
21. The BMA welcome the Secondary Uses Services
(SUS), in principle, as one of the key ways in which the NHS Care
Records Service could bring major benefits to health and healthcare.
The existence of accurate, well coded and linked non-identifiable
data could revolutionise activities such as population needs assessment,
public health surveillance, drug monitoring and epidemiological
research. This could impact in a positive way on all clinicians
and patients in the future. There are, however, a number of unanswered
questions surrounding SUS.
22. Data must be kept secure and confidential.
It must be clear where, how and at what point the data is anonymised
or pseudo-anonymised and if the data is held at any point in an
identifiable form what security will exist to protect that data
and ensure that only those with a legitimate relationship have
access to the data. Secondary uses should use anonymised or pseudo-anonymised
data and other privacy enhancing techniques (PETs) wherever possible.
23. It must be made clear to patients that
their data will be used for secondary uses. The Department of
Health must be open and transparent about the use of the data.
There needs to be clarity about who will be allowed access including
non-NHS organisations and commercial companies. Will any organisations
be charged to access information and if so, what will happen to
this payment? Will it include data from private providers and
ISTCs? Will patients be able to request that their data not be
used for these purposes, or put limits on the types of secondary
uses that their data are used for? Other areas which need clarification
are the legal status of the SUS and the relationship of the Secondary
Uses to the European directive, which excludes research.
Current progress on the development of the NHS
Care Records Service and the National Data Spine and why delivery
of the new systems is up to two years behind schedule
24. The original timescales were extremely
optimistic. Delays were inevitable with a programme of this size.
Lessons should have been learnt from previous NHS IT programmes,
as detailed in the Audit Commission's report of August 2000. More
achievable targets should have been set from the start. Providing
clinical data to clinicians in out of hours settings, as has been
achieved in Scotland, could have been a sensible first step. This
would have engaged and gained the confidence of local clinicians
before progressing in a more incremental way.
25. At the outset, there was no clarity
about what the summary care record would look like and what it
would deliver. There have been changes in specification and it
has been difficult to keep track of the latest plans. A clearer
strategy and understanding of what was required from the start
was required.
26. The delays are partly due to wholesale
replacement of systems rather than working with and integrating
existing systems. Systems, particularly in primary care, were
and are highly developed and have evolved over a number of decades
and this enthusiasm and knowledge and expertise should have been
drawn upon by the programme, rather than largely starting from
scratch. Following pressure from clinicians the GP Systems of
Choice agreement with accredited interoperability will hopefully
help address this in primary care. Recent announcements regarding
a changed emphasis towards an approved catalogue of suppliers
committed to interoperability is also welcomed by the BMA.
27. Not all systems have been delayed. Some
systems including QMAS, EPS and GP2GP in primary care and PACS
systems in secondary care have been delivered successfully. The
reasons for these successes should be understood and disseminated.
28. The BMA is concerned about delays in
delivering new systems in secondary care. Planning blight and
delays in delivery are forcing Trusts to make do with systems
which are in urgent need of replacing or implementing interim
solutions at extra cost and disruption. Staff need training on
interim solutions, which takes time away from caring for patients.
We suspect that timescales were put in place to meet political
targets, which leave Trusts unsure of whether to wait for the
promised systems or go ahead with their original deployment plans.
29. Some of the delays could have been avoided
if there had been greater engagement of patients and healthcare
professionals at the outset of the programme. Developments have
been dictated from the centre and representative and accountable
clinicians have felt disengaged. Representatives from all grades
of doctors need to be engaged including junior doctors and medical
students. A greater involvement of clinicians and stakeholders
could have highlighted potential problems, at an earlier stage
and helped ensure that systems are fit for purpose. Instead clinicians
are concerned that systems will offer less functionality than
those they are currently using. If clinicians and patients were
engaged they could have put pressure on getting systems implemented
and worked with Connecting for Health. For many clinicians their
first encounter of change was Choose and Book or coding to deliver
payment by results, which only served to disengage them. Changes
are now happening as a result of greater engagement for example
ensuring that patients can refuse to have a summary care record
and bringing forward the implementation of Healthspace so that
patients can check their records.
30. Messages from Connecting for Health
have not always been aligned with what has been happening at a
local level. The National Local Ownership Programme has recently
been launched and may begin to address this. Organisational changes
are required to ensure that systems are used as they are intended
and this has not happened. This was particularly highlighted by
the implementation of the Choose and Book system. Lessons must
also be learnt from when things have not gone smoothly and this
will help move the focus from central policy to clinical integration.
31. The financial difficulties within the
NHS will have also contributed to the delays. Spending on Information
Technology will not be a priority for Trusts and PCTS. Ring-fenced
funding could have ensured that money was spent on implementation.
Dr Vivienne Nathanson
British Medical Association
16 March 2007
| 
