NHS Health Check programme: Advice note on information governance
A few commissioners of the NHS Health Check have asked for advice on information governance requirements for the programme, specifically in relation to the exclusion criteria and the sharing of clinical data for individuals for this purpose outside of GP practices.
Arrangements locally are extremely varied in terms of commissioning models, and the arrangements in place to identify and invite individuals for their NHS Health Check, that national guidance to cover every eventuality is not possible and would not be legally sound. Local areas should however already be very familiar with the legal requirements for handling sensitive personal data. Any organisation doing so must be clear about the legal basis on which they are accessing and using those data and ensure they have the appropriate information governance protocols in place for the particular type of data access they require. This is a local responsibility and local information governance and legal advice should be sought to support this.
Where areas continue to have concerns due to their particular arrangements or circumstances, and/or where transitional arrangements present temporary issues over governance, we have suggested below some general approaches which commissioners may wish to consider. These are legally acceptable and consideration of other possible options will be given by Public Health England.
Information governance options
1. GPs send out the invitations and conduct the NHS Health Checks
2. Invitations for a NHS Health Check could be issued by GPs, but the checks carried out by:
a. a third party provider on behalf of the PCT or LA if they wished.
b. GP's and a third party provider, with individuals given the option to choose.
3. An opportunistic element of the programme is offered - where eligible people are not systematically identified and invited but individuals are offered a NHS Health Check, for example in a community setting as part of outreach work - in conjunction with GP delivery.
4. PCT's (LAs in future) or third party providers secure GP practice data from the National Health Application and Infrastructure Services (NHAIS) system. This system contains the most up to date patient demographic data and is used to call women for breast or cervical cancer screening for example, but it holds no clinical data. It could be used to invite a given age range of people for a Health Check. Individuals already under the care of GPs for a related condition could be excluded by the content of the letter and also when they make an appointment (no clinical data is transferred, meeting information governance rules). Individuals effectively "self-exclude" from the NHS Health Check, and this does not represent any departure from the principle that the Check is offered to those not already under GP care for a relevant condition. Those interested in this option should contact the Exeter Helpdesk 01392 251289. NHAIS users only 0845 3713671 or email the helpdesk email@example.com
It is important again to underline in this advice the need for local practice to respect data sharing rules and these options are identified purely as examples of what can be done. This is not an exhaustive list and local areas will need to make decisions that take account of their own circumstances and arrangements.