DSfC - NHS Dorset CCG: RS & IV

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

INVOICE VALIDATION Invoice validation is part of a process by which providers of care or services get paid for the work they do. Invoices are submitted to the Clinical Commissioning Group (CCG) so the CCG is are able to ensure that the activity claimed for each patient is their responsibility. This is done by processing and analysing Secondary User Services (SUS+) data, which is received into a secure Controlled Environment for Finance (CEfF). The SUS+ data is identifiable at the level of NHS number. The NHS number is only used to confirm the accuracy of backing-data sets (data from providers) and will not be used further. The CCG are advised by the appointed CEfF whether payment for invoices can be made or not. Invoice Validation will be conducted by Liaison Financial Services Ltd. Liaison Financial Services Ltd conduct an independent ad-hoc review on retrospective payments made. Investing resource, skills and experience into deeper reconciliation, this identifies overcharges already paid and recovers savings for the CCG that would otherwise be lost. RISK STRATIFICATION [3 paragraphs unchanged]

Processing activities

Data must only be used as stipulated within this Data Sharing Agreement. PROCESSING CONDITIONS: Data must only be used for the purposes stipulated within this Data Sharing Agreement. Any additional disclosure / publication will require further approval from NHS Digital. [2 paragraphs unchanged] All access to data is managed under Role-Based Access Controls. Users can only access data authorised by their role and the tasks that they are required to undertake. Patient level data will not be linked other than as specifically detailed within this Data Sharing Agreement. Data released will only be shared with those parties listed and will only be used for the purposes laid out in the application/agreement. NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data) The DSCRO (part of NHS Digital) will apply National Opt-outs before any identifiable data leaves the DSCRO only for the purpose of Risk Stratification. CCGs should work with general practices within their CCG to help them fulfil data controller responsibilities regarding flow of identifiable data into risk stratification tools. The only identifier available in the data set is the NHS numbers. Any further identification of the patients will only be completed by the patient’s clinician on their own systems for the purpose of direct care with a legitimate relationship. ONWARD SHARING: [1 paragraph unchanged] All access to data is managed under Roles-Based Access Controls Aggregated reports only with small number suppression can be shared externally as set out within NHS Digital guidance applicable to each data set. No patient level data will be linked other than as specifically detailed within this agreement. Data will only be shared with those parties listed and will only be used for the purposes laid out in the application/agreement. The data to be released from NHS Digital will not be national data, but only that data relating to the specific locality and that data required by the applicant. SEGREGATION: NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data) The DSCRO (part of NHS Digital) will apply Type 2 objections before any identifiable data leaves the DSCRO only for the purpose of Risk Stratification. CCGs should work with general practices within their CCG to help them fulfil data controller responsibilities regarding flow of identifiable data into risk stratification tools. Segregation [1 paragraph unchanged] Where the Data Processor and/or the Data Controller hold identifiable data with opt outs applied and identifiable data with opt outs not applied, the data will be held separately so data cannot be linked. [1 paragraph unchanged] Data Minimisation Data for the purpose of Invoice Validation is kept within the CEfF, and only used by staff properly trained and authorised for the activity. Only CEfF staff are able to access data in the CEfF and only CEfF staff operate the invoice validation process within the CEfF. Data flows directly in to the CEfF from the DSCRO and from the providers – it does not flow through any other processors. Data Minimisation in relation to the data sets listed within section 3 are listed below. This also includes the purpose on which they would be applied - DATA MINIMISATION: • Patients who are normally registered and/or resident within the commissioner (including historical activity where the patient was previously registered or resident in another commissioner Data Minimisation in relation to the data sets listed within the application are listed below. This also includes the purpose on which they would be applied - For clarity, any access by The Bunker Secure Hosting Ltd to data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data. For the purpose of Risk Stratification: The Data Controller should ensure appropriate data processing agreements with all data processors contracted to undertaking work referenced within this agreement. • Patients who are normally registered and/or resident within the NHS Dorset CCG region (including historical activity where the patient was previously registered or resident in another commissioner Identifiable data will only be disclosed: For the purpose of Invoice Validation: 1) where the requesting Data Controller’s Caldicott Guardian/Senior Approving Officer has approved the disclosure • Patients who are resident and/or registered within the CCG region. 2) where the DSCRO Information Risk Owner has approved the disclosure The Bunker Secure Hosting Ltd do not access data held under this agreement as they only supply the building. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data. 3) to requestor/recipients specified by the Data Controller INVOICE VALIDATION - Liaison Financial Services Ltd 4) to recipients that have a legitimate relationship with the individuals identified by the data, e.g. clinician 1. Identifiable SUS+ Data is obtained from the SUS+ Repository to the Data Services for 5) using mechanisms and routes that are secure and have an appropriate legal basis for holding identifiable data Commissioners Regional Office (DSCRO). 6) where there is a legal basis and it is covered by a Data Sharing Agreement that justifies its use or the data subject has consented or where there is a separate legal basis for making the dataset identifiable enabling the re-identification to take place 2. The DSCRO pushes a one-way data flow of SUS+ data into the Controlled Environment for 7) whilst continuing to respect the data subject’s preferences for data sharing Finance (CEfF) in the Liaison Financial Services Ltd. In order for identifiable data to be disclosed, all seven requirements must be met. 3. The CEfF also receive backing data from the provider. Where identifiable data for the same dataset to the same organisation is released by NHS Digital (via a DSCRO), relevant controls must be in place locally by the recipient organisation to ensure that identifiable data is stored separately, under strict access control provisions, from its original anonymised in accordance with the ICOACoP form and used only for the specific purpose stipulated in this agreement. There must be no efforts made by the recipient organisation to link these datasets . 4. Liaison Financial Services Ltd carry out the following processing activities within the CEfF for invoice validation purposes: a. Validating that the Clinical Commissioning Group are responsible for payment for the care of the individual by using SUS+ and/or provider backing flow data. b. Once the provider backing information is received, this will be checked against national NHS and local commissioning policies as well as being checked against system access and reports provided by NHS Digital to confirm the payments are: i. In line with Payment by Results tariffs ii. are in relation to a patient registered with a CCG GP or resident within the CCG area. iii. The health care provided should be paid by the CCG in line with CCG guidance. 5. The CCG are notified that the invoice has been validated and can be paid. Any discrepancies or non-validated invoices are investigated and resolved between Liaison Financial Services Ltd CEfF team and the provider, meaning that no identifiable data needs to be sent to the CCG. The CCG only receives notification to pay and management reporting detailing the total quantum of invoices received pending, processed etc. [8 paragraphs unchanged]

Expected output

INVOICE VALIDATION - Liaison Financial Services Ltd 1. Validation of Continuing Healthcare related invoices and payments 2. Independent Identification of potential overpayments made by the CCG through invoice validation 3. Liaising with providers with a view to recouping these monies 4. Review is completed for the retrospective period from date of contract with Liaison Financial Services back to 01/04/2013. 5. Reviews take 3-9 months depending on number of claims to investigate and resolve 6. Liaison Financial Services will repeat the exercise 2-3 years later 7. CCGs are able to request reviews to be done more frequently 8. SUS+ will only be requested each time a review was completed, and maybe requested at different times as independent reviews RISK STRATIFICATION [18 paragraphs unchanged]

Expected measurable benefits

INVOICE VALIDATION - Liaison Financial Services Ltd 1. Financial validation of activity 2. CCG Budget control 3. Assurances over the robustness of internal control mechanisms relating to the payment of invoices and/or suggested improvements 4. Identification and recovery of monies which would otherwise be lost 5. Meeting commissioning objectives without compromising patient confidentiality 6. The avoidance of misappropriation of public funds to ensure the ongoing delivery of patient care 7. Benefit delivered 3-9 months from receiving data, depending on number of claims to investigate and resolve RISK STRATIFICATION [13 paragraphs unchanged]

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Expected output

[1 paragraph unchanged] 2. Output from the risk stratification tool will provide aggregate reporting of number and percentage of population found to be at risk. 2. GP Practices will be able to view the risk scores for individual patients with the ability to display the underlying SUS+ data for the individual patients when it is required for direct care purposes by someone who has a legitimate relationship with the patient. 3. Record level output will be available for commissioners (of the CCG), pseudonymised at patient level. CCGs will be able to: 4. GP Practices will be able to view the risk scores for individual patients with the ability to display the underlying SUS+ data for the individual patients when it is required for direct care purposes by someone who has a legitimate relationship with the patient. 3. Target specific vulnerable patient groups and enable clinicians with the duty of care for the patient to offer appropriate interventions. 5. The CCG will be able to target specific patient groups and enable clinicians with the duty of care for the patient to offer appropriate interventions. The CCG will also be able to: 4. Reduce hospital readmissions and targeting clinical interventions to high risk patients. o Stratify populations based on: disease profiles; conditions currently being treated; current service use; pharmacy use and risk of future overall cost 5. Identify patients at risk of deterioration and providing effective care. o Plan work for commissioning services and contracts 6. Reduce in the difference in the quality of care between those with the best and worst outcomes. o Set up capitated budgets 7. Re-design care to reduce admissions. o Identify health determinants of risk of admission to hospital, or other adverse care outcomes. 8. Set up capitated budgets – budgets based on care provided to the specific population. 9. Identify health determinants of risk of admission to hospital, or other adverse care outcomes. 10. Monitor vulnerable groups of patients including but not limited to frailty, COPD, Diabetes, elderly. 11. Health needs assessments – identifying numbers of patients with specific health conditions or combination of conditions. 12. Classify vulnerable groups based on: disease profiles; conditions currently being treated; current service use; pharmacy use and risk of future overall cost. 13. Production of Theographs – a visual timeline of a patients encounters with hospital providers. 14. Analyse based on specific diseases In addition: - The risk stratification tool will provide aggregate reporting of number and percentage of population found to be at risk. - Record level output (pseudonymised) will be available for commissioners (of the CCG), pseudonymised at patient level. Onward sharing of this data is not permitted.

Benefits reported

Stated in the previous version and removed here.

Yielded Benefits is not a requirement for new applications.

Unchanged: Objective for processing, Processing activities, Expected measurable benefits.