DSfC - NHS Tameside and Glossop CCG - IV

Invoice Validation

Invoice validation is part of a process by which providers of care or services get paid for the work they do.

Invoices are submitted to the Clinical Commissioning Group (CCG) so they are able to ensure that the activity claimed for each patient is their responsibility. This is done by processing and analysing Secondary User Services (SUS+) data, which is received into a secure Controlled Environment for Finance (CEfF). The SUS+ data is identifiable at the level of NHS number. The NHS number is only used to confirm the accuracy of backing-data sets and will not be used further.

Invoice Validation with be conducted by NHS Tameside and Glossop CCG

The CCG are advised by their inhouse team whether payment for invoices can be made or not

Data must only be used as stipulated within this Data Sharing Agreement.

Data Processors must only act upon specific instructions from the Data Controller.

Data can only be stored at the addresses listed under storage addresses.

The Data Controller and any Data Processor will only have access to records of patients of residence and registration within the CCG.

Patient level data will not be shared outside of the CCG unless it is for the purpose of Direct Care, where it may be shared only with those health professionals who have a legitimate relationship with the patient and a legitimate reason to access the data.

All access to data is managed under Roles-Based Access Controls

No patient level data will be linked other than as specifically detailed within this agreement. Data will only be shared with those parties listed and will only be used for the purposes laid out in the application/agreement. The data to be released from NHS Digital will not be national data, but only that data relating to the specific locality and that data required by the applicant.

NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data)

Segregation

Where the Data Processor and/or the Data Controller hold both identifiable and pseudonymised data, the data will be held separately so data cannot be linked.

All access to data is auditable by NHS Digital.

Data for the purpose of Invoice Validation is kept within the CEfF, and only used by staff properly trained and authorised for the activity. Only CEfF staff are able to access data in the CEfF and only CEfF staff operate the invoice validation process within the CEfF. Data flows directly in to the CEfF from the CCG and from the providers – it does not flow through any other processors.

Data Minimisation

Data Minimisation in relation to the data sets listed within section 3 are listed below. This also includes the purpose on which they would be applied -

For the purpose of Invoice Validation:

• CCG of residence and/or registration.

Identifiable data will only be disclosed:

1) where the requesting Data Controller’s Caldicott Guardian/Senior Approving Officer has approved the disclosure

2) where the DSCRO Information Risk Owner has approved the disclosure

3) to requestor/recipients specified by the Data Controller

4) to recipients that have a legitimate relationship with the individuals identified by the data, e.g. clinician

5) using mechanisms and routes that are secure and have an appropriate legal basis for holding identifiable data

6) where there is a legal basis and it is covered by a Data Sharing Agreement that justifies its use or the data subject has consented or where there is a separate legal basis for making the dataset identifiable enabling the re-identification to take place

7) whilst continuing to respect the data subject’s preferences for data sharing

In order for identifiable data to be disclosed, all seven requirements must be met.

Where identifiable data for the same dataset to the same organisation is released by NHS Digital (via a DSCRO), relevant controls must be in place locally by the recipient organisation to ensure that identifiable data is stored separately, under strict access control provisions, from its original anonymised in accordance with the ICOACoP form and used only for the specific purpose stipulated in this agreement. There must be no efforts made by the recipient organisation to link these datasets.

Local Identifiers:

If a Data Controller organisation (or the Data Processor working on their behalf):

a. only receives a DSCRO disseminated identifiable (NHS Number) flow, then it can receive clear local identifiers.

b. receives and pseudonymised flow, then clear local identifiers can be included and used only for the purpose outlined within the Data Sharing Agreement

c. receives both DSCRO disseminated identifiable and pseudonymised flows, the identifiable flow must have the local identifiers pseudonymised or removed.

Invoice Validation

1. Identifiable SUS+ Data is obtained from the SUS+ Repository by the Data Services for Commissioners Regional Office (DSCRO).

2. The DSCRO pushes a one-way data flow of SUS+ data into the Controlled Environment for Finance (CEfF) located in the CCG.

3. The CEfF conduct the following processing activities for invoice validation purposes:

a. Validating that the Clinical Commissioning Group is responsible for payment for the care of the individual by using SUS+ and/or provider backing flow data.

b. Once the provider backing information is received, this will be checked against national NHS and local commissioning policies as well as being checked against system access and reports provided by NHS Digital to confirm the payments are:

i. In line with Payment by Results tariffs

ii. In relation to a patient registered with the CCG GP or resident within the CCG area.

iii. The health care provided should be paid by the CCG in line with CCG guidance.

4. The CCG are notified by the CEfF that the invoice has been validated and can be paid. Any discrepancies or non-validated invoices are investigated and resolved

Invoice Validation

1. The Controlled Environment for Finance (CEfF) will enable the CCG to challenge invoices and raise discrepancies and disputes.

2. Outputs from the CEfF will enable accurate production of budget reports, which will:

a. Assist in addressing poor quality data issues

b. Assist in business intelligence

3. Validation of invoices for non-contracted events where a service delivered to a patient by a provider that does not have a written contract with the patient’s responsible commissioner, but does have a written contract with another NHS commissioner/s.

4. Budget control of the CCG.

Invoice Validation

The invoice validation process supports the ongoing delivery of patient care across the NHS and the CCG region by:

1. Ensuring that activity is fully financially validated.

2. Ensuring that service providers are accurately paid for the patients treatment.

3. Enabling services to be planned, commissioned, managed, and subjected to financial control.

4. Enabling commissioners to confirm that they are paying appropriately for treatment of patients for whom they are responsible.

5. Fulfilling commissioners duties to fiscal probity and scrutiny.

6. Ensuring full financial accountability for relevant organisations.

7. Ensuring robust commissioning and performance management.

8. Ensuring commissioning objectives do not compromise patient confidentiality.

9. Ensuring the avoidance of misappropriation of public funds.

Not stated in the register.