DSfC - NHS Norwich CCG - IV

Invoice validation is part of a process by which providers of care or services get paid for the work they do.

Invoices are submitted to the Clinical Commissioning Group (CCG) so they are able to ensure that the activity claimed for each patient is their responsibility. This is done by processing and analysing Secondary User Services (SUS+) data, which is received into a secure Controlled Environment for Finance (CEfF). The SUS+ data is identifiable at the level of NHS number. The NHS number is only used to confirm the accuracy of backing-data sets and will not be used further.

Invoice Validation with be conducted by Arden and Greater East Midlands Commissioning Support Unit.

The CCG are advised by NHS Arden and Greater East Midlands Commissioning Support Unit whether payment for invoices can be made or not.

Data must only be used as stipulated within this Data Sharing Agreement.

Data Processors must only act upon specific instructions from the Data Controller.

Data can only be stored at the addresses listed under storage addresses.

Patient level data will not be shared outside of the CCG unless it is for the purpose of Direct Care, where it may be shared only with those health professionals who have a legitimate relationship with the patient and a legitimate reason to access the data.

All access to data is managed under Roles-Based Access Controls

No patient level data will be linked other than as specifically detailed within this agreement. Data will only be shared with those parties listed and will only be used for the purposes laid out in the application/agreement. The data to be released from NHS Digital will not be national data, but only that data relating to the specific locality and that data required by the applicant.

NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data)

Segregation

Where the Data Processor and/or the Data Controller hold both identifiable and pseudonymised data, the data will be held separately so data cannot be linked.

All access to data is auditable by NHS Digital.

Data for the purpose of Invoice Validation is kept within the CEfF, and only used by staff properly trained and authorised for the activity. Only CEfF staff are able to access data in the CEfF and only CEfF staff operate the invoice validation process within the CEfF. Data flows directly in to the CEfF from the DSCRO and from the providers – it does not flow through any other processors.

Data Minimisation

Data Minimisation in relation to the data sets listed within section 3 are listed below. This also includes the purpose on which they would be applied -

• CCG of residence and/or registration.

For clarity, any access by NHS Ilkeston Community Hospital to data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Identifiable data will only be disclosed:

1) where the requesting Data Controller’s Caldicott Guardian/Senior Approving Officer has approved the disclosure

2) where the DSCRO Information Risk Owner has approved the disclosure

3) to requestor/recipients specified by the Data Controller

4) to recipients that have a legitimate relationship with the individuals identified by the data, e.g. clinician

5) using mechanisms and routes that are secure and have an appropriate legal basis for holding identifiable data

6) where there is a legal basis and it is covered by a Data Sharing Agreement that justifies its use or the data subject has consented or where there is a separate legal basis for making the dataset identifiable enabling the re-identification to take place

7) whilst continuing to respect the data subject’s preferences for data sharing

In order for identifiable data to be disclosed, all seven requirements must be met.

Where identifiable data for the same dataset to the same organisation is released by NHS Digital (via a DSCRO), relevant controls must be in place locally by the recipient organisation to ensure that identifiable data is stored separately, under strict access control provisions, from its original anonymised in accordance with the ICOACoP form and used only for the specific purpose stipulated in this agreement. There must be no efforts made by the recipient organisation to link these datasets.

Invoice Validation

Arden and Greater East Midlands Commissioning Support Unit

1. Identifiable SUS+ Data is obtained from the SUS+ Repository to the Data Services for Commissioners Regional Office (DSCRO).

2. The DSCRO pushes a one-way data flow of SUS+ data into the Controlled Environment for Finance (CEfF) in the NHS Arden and Greater East Midlands Commissioning Support Unit.

3. NHS Arden and Greater East Midlands Commissioning Support Unit carry out the following processing activities within the CEfF for invoice validation purposes:

a. Validating that the Clinical Commissioning Group is responsible for payment for the care of the individual by using SUS+ and/or backing flow data.

b. Once the backing information is received, this will be checked against national NHS and local commissioning policies as well as being checked against system access and reports provided by NHS Digital to confirm the payments are:

i. In line with Payment by Results tariffs

ii. are in relation to a patient registered with a CCG GP or resident within the CCG area.

iii. The health care provided should be paid by the CCG in line with CCG guidance.

4. The CCG are notified that the invoice has been validated and can be paid. Any discrepancies or non-validated invoices are investigated and resolved between Arden and Greater East Midlands Commissioning Support Unit CEfF team and the provider meaning that no identifiable data needs to be sent to the CCG. The CCG only receives notification to pay and management reporting detailing the total quantum of invoices received pending, processed etc.

Invoice Validation

1. The Controlled Environment for Finance (CEfF) will enable the CCG to challenge invoices and raise discrepancies and disputes.

2. Outputs from the CEfF will enable accurate production of budget reports, which will:

a. Assist in addressing poor quality data issues

b. Assist in business intelligence

3. Validation of invoices for non-contracted events where a service delivered to a patient by a provider that does not have a written contract with the patient’s responsible commissioner, but does have a written contract with another NHS commissioner/s.

4. Budget control of the CCG.

Invoice Validation

The invoice validation process supports the ongoing delivery of patient care across the NHS and the CCG region by:

1. Ensuring that activity is fully financially validated.

2. Ensuring that service providers are accurately paid for the patients treatment.

3. Enabling services to be planned, commissioned, managed, and subjected to financial control.

4. Enabling commissioners to confirm that they are paying appropriately for treatment of patients for whom they are responsible.

5. Fulfilling commissioners duties to fiscal probity and scrutiny.

6. Ensuring full financial accountability for relevant organisations.

7. Ensuring robust commissioning and performance management.

8. Ensuring commissioning objectives do not compromise patient confidentiality.

9. Ensuring the avoidance of misappropriation of public funds.

Not stated in the register.