Fundamental to the success of the project will be the ability of the organisations in each network to share data effectively between all members and associated parties. This will span public sector, private sector and third sector organisations that are expected to make up the networks.
Data sharing has long been recognised as essential for providing direct care within the NHS: the Caldicott review in 2013 made clear that any gaps in patient care should not be as a result of an inability to share data effectively. The Health and Social Care (Safety and Quality) Act 2015 subsequently introduced into law a duty to share certain types of data (personal data and anonymised data) where it concerned facilitating the provision of care to a patient. Whilst it will be possible to anonymise some data that PCNs need to share, it is inevitable that, some information will identify individuals and may be particularly sensitive personal data or 'special category data' under the General Data Protection Regulation (GDPR).
Under the GDPR, there must be a lawful basis for sharing personal data. There is no single catch all lawful basis for sharing personal data, and what is appropriate will depend on the nature of the data, the purpose of the processing, and whether the party is acting in the public or private interest. To allow for effective operations and to fulfil the purpose of the PCNs, data sharing by PCNs will need to go beyond sharing information as required by law relating to direct patient care.
NHS England will be producing a template data sharing agreement for use by PCNs to ensure GDPR compliance.
However, the only data sharing agreement published recently by NHS England (is Primary Medical Care Policy and Guidance Manual: Appendix 4 – Sample Data Sharing Agreement. We do not think this is intended to be used by PCNs given that the sample agreement works on the basis that NHS England will be a party the arrangement, and this will not be the case for PCNs.
Further, the sample agreement relies on NHS England's lawful basis to share personal data for public interest purposes. This would not be appropriate for PCNs operating on a commercial basis. Alternative conditions for processing must be considered, in particular where special category personal data (including health information) is being shared.
Our specialist healthcare and data protection teams work closely to help fledgling PCNs develop their model and their governance arrangements including data sharing arrangements.
We provide a service tailored to the needs of the current progression of your PCN and are offering PCN development workshops to assist practices to develop their model.