DSfC - NHS Bath and North East Somerset, Swindon And Wiltshire Integrated Care Board - IV, RS & Comm

The Health and Social Care Act 2022 created 42 Integrated Care Boards (ICB). These are legal entities which have replaced CCGs. The ICB has taken on the NHS commissioning functions of CCGs as well as some of NHS England’s commissioning functions. It is accountable for NHS spend and performance within the system. Within each ICB geographical area, there will also be an Integrated Care Partnership (ICP), a joint committee which brings together the ICB and their partner local authorities, and other locally determined representatives (for example from health, social care, public health; and potentially others, such as social care or housing providers) to set local priorities and develop an integrated health and social care strategy.

ICP constituent members (other than the ICB) do not carry out data controllership activities and do not make decisions on sub-licensing.

INVOICE VALIDATION

Invoice validation is part of a process by which providers of care or services get paid for the work they do.

Invoices are submitted to the Integrated Care Board (ICB) so the ICB is able to ensure that the patient is their responsibility and the activity claimed is correct. This is done by processing and analysing Invoice Validation Datasets, which are received into a secure Controlled Environment for Finance (CEfF). The identifiers included are in line with the CAG approval. The identifiers are only used to link and confirm the accuracy of backing-data sets (data from providers).

The ICB are advised by the appointed CEfF whether payment for invoices can be made or not.

RISK STRATIFICATION

Risk stratification is a tool for identifying and predicting which patients are at high risk (of health deterioration and using multiple services) or are likely to be at high risk and prioritising the management of their care in order to prevent worse outcomes.

In order to conduct, Risk Stratification Datasets, identifiable at the level of NHS number are linked with Primary Care data (from GPs) and an algorithm is applied to produce risk scores. Risk Stratification provides focus for future demands by enabling commissioners to prepare plans for both individual and groups of vulnerable patients. Commissioners can then prepare plans for cohorts of patients who may require high levels of care. Risk Stratification also enables General Practitioners (GPs) to better target intervention in Primary Care.

COMMISSIONING

To use pseudonymised Commissioning Datasets to provide intelligence to support the commissioning of health services. The data (containing both clinical and financial information) is analysed so that health care provision can be planned to support the needs of the population within the ICB area.

The ICBs commission services from a range of providers covering a wide array of services. Each of the data flow categories requested supports the commissioned activity of one or more providers.

The pseudonymised data is required for the following purposes:

 Population health management

 Data Quality and Validation – allowing data quality checks on the submitted data

 Thoroughly investigating the needs of the population, to inform the commissioning or appropriate services for that population’s health needs

 Understanding cohorts of residents who are at risk of becoming users of some of the more expensive services, to better understand and manage those needs

 Monitoring population health and care interactions to understand where people may slip through the net, or where the provision of care may be being duplicated

 Modelling activity across all data sets to understand how services interact with each other, and to understand how changes in one service may affect flows through another

 Service redesign

 Health Needs Assessment – identification of disease prevalence within the local population

 Patient stratification and predictive modelling - to highlight cohorts of patients at risk of requiring hospital admission and other avoidable factors such as risk of falls, computed using algorithms executed against linked de-identified data, and identification of future service delivery models

 Demand Management – ensuring enough capacity to manage the demand by predicting the impact on certain care pathways.

 Support measuring the health and care needs of the total local population.

 Provide intelligence about the safety and effectiveness of medicines.

 Allow analysis of patient pathways across healthcare and social care.

DIRECT CARE

In the development of cohorts of pseudonymised patients considered to be at risk, the data controllers may need the facility to provide identifiable results back to direct health or care professionals for the purpose of direct care. Additionally clinicians, made aware of a number of cases that they believe would need intervention may request re-identification for that direct care purpose. These instances of re-identification will generally be carried out as programmes of work or, separately, on an individual/small group basis as a result of coincidental findings. The ICB does not have a statutory function to provide direct care and as such, does not see the identifiable data.

NHS England provides a re-identification service for this process. All re-id requests will be processed and authorised by NHS England on a case by case basis, including requests under a sub-licence. National data opt outs are not applied in these cases as they are for the purposes of direct care which follows the legal basis of implied consent. It is anticipated that this re-id ability in the future will allow risk stratification to be conducted under a single flow of pseudonymised data.

The following is a typical example of an instance where an ICB might want to use the re-identification process:

A&E High Attendance usage

The ICB can filter data to show for example the number of A&E attendances in a given period for each patient. The ICB can then flag to the relevant GP of the patient any patients that require intervention. An outcome of this is earlier intervention in the patient(s) care thus potentially reducing future costs and minimising future risk.

PROCESSING CONDITIONS

Data must only be used for the purposes stipulated within this Data Sharing Agreement. Any additional disclosure / publication will require further approval from NHS England. All access to data is auditable by NHS England.

The Data Controller must keep a record of locations the data is processed and stored. These addresses must be within the UK. The Data Controller should minimise the number of processing and storage locations to prevent excessive processing. NHS England may request a record of processing and storage locations at any time.

All access to data is managed under Role-Based Access Controls. Users can only access data authorised by their role and the tasks that they are required to undertake.

Data may only be processed and held as long as is required to carry out the purposes listed within this agreement.

Patient level data will not be linked other than as specifically detailed within this Data Sharing Agreement. Data released will only be used for the purposes laid out in the application/agreement.

DATA PROCESSORS

Data Processors must be listed in section 5b of this Data Sharing Agreement. These include Cloud and IT infrastructure providers.

The Data Controller should ensure appropriate data processing agreements with all data processors contracted to undertaking work referenced within this agreement.

Palantir Technologies UK Ltd support the Local FDP instance for the ICB and so are therefore listed as a data processor. Palantir Technologies UK Ltd support the system and so will have access to personal data for support purposes.

Amazon Web Services supply Cloud Services for Palantir Technologies UK Ltd so are therefore listed as a data processor, the supply support to the system but do not access data. Therefore, any access to data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database(s) containing the data.

Microsoft Limited supply Cloud Services for Liaison Financial Services Ltd, NHS Bath and North East Somerset, Swindon and Wiltshire ICB, Graphnet Health Limited and NHS South Central and West Commissioning Support Unit and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

ANS Group Limited will be assisting in the set up and management of the South Central and West Commissioning Support Unit Microsoft Azure Cloud and are therefore listed as a data processor. They will not have any additional processing / storage addresses (as these will be the Microsoft Azure addresses). Using the data for any other purpose would be considered a breach of this agreement.

Microsoft Limited and Amazon Web Services provide cloud services for Optum Health Solutions (UK) Limited and are therefore listed as processors. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

ONWARD SHARING:

Patient level data can only be shared outside the Data Controller / Processor in the following circumstances:

• For the purpose of Direct Care, where it may be re-identified and shared only with those health or care. professionals who have a legitimate relationship with the patient and a legitimate reason to access the data.

• Back to a provider to challenge data submissions. The data transferred to the provider is only that which relates directly to the data previously submitted by that particular provider and is limited to that being necessary to challenge the data submission.

• With members of the ICB’s Integrated Care System under the terms of a sub-licensing agreement as detailed in this Data Sharing Agreement.

Aggregated reports with small numbers suppressed (as set out within NHS England guidance applicable to each data set) may be shared externally as anonymous derived data and not subject to a sublicence.

SEGREGATION:

Where the Data Processor and/or the Data Controller hold both identifiable and pseudonymised data, the data will be held separately so data cannot be linked.

Where the Data Processor and/or the Data Controller hold identifiable data with opt outs applied and identifiable data with opt outs not applied, the data will be held separately so data cannot be linked.

INVOICE VALIDATION

Dataset:

Identifiable Invoice Validation Datasets

Data Minimisation:

• Activity for patients that are or have previously been registered to a GP practice within the responsibility of the ICB or the ICB's predecessor organisation(s).

and/or

• Activity for patients that are or have previously been resident within the ICB or the ICB's predecessor organisation(s).

and

• Data is limited to the period of time the patient was registered and/or resident and to the period of invoice validation being undertaken.

Processing:

1. The DSCRO pushes a one-way data flow of the data directly into the Controlled Environment for Finance (CEfF). Data is kept within the CEfF, and only used by staff properly trained and authorised for the activity.

2. The CEfF also receive backing data from the provider.

3. The following processing activities within the CEfF for invoice validation purposes:

a. Validating that the ICB are responsible for payment for the care of the individual by using Invoice Validation data and/or provider backing flow data.

b. Once the provider backing information is received, this will be checked against national NHS and local commissioning policies as well as being checked against system access and reports provided by NHS England to confirm the payments are:

i. In line with Payment by Results tariffs.

ii. are in relation to a patient registered with a ICB GP or resident within the ICB area.

iii. The health care provided should be paid by the ICB in line with ICB guidance.

iv. The ICB are notified that the invoice has been validated and can be paid. Any discrepancies or non-validated invoices are investigated and resolved between the CEfF team and the provider. The ICB only receives notification to pay and management reporting detailing the total quantum of invoices received pending, processed etc.

Linkage will be limited to:

• Backing data as described in the NHS England “Who Pays” Guidance.

Processors:

• NHS South, Central and West Commissioning Support Unit

• NHS Bath and North East Somerset, Swindon And Wiltshire Integrated Care Board

• Liaison Financial Services Ltd

RISK STRATIFICATION

Dataset:

Identifiable Risk Stratification Datasets

Data Minimisation:

• Activity for patients registered to GP practices within the responsibility of the ICB (Including historic activity where the patient may have been registered to another commissioner).

Processing:

1. Data quality management and standardisation of data is completed by the DSCRO and the data identifiable at the level of NHS number is transferred securely to the Data Controller / Processor, who securely hold the data.

2. Identifiable GP Data is securely sent from the GP system to the Data Controller / Processor.

3. Risk Stratification data is linked to GP data in the risk stratification tool by the Data Controller / Processor. Further linkage of data is not permitted.

4. As part of the risk stratification processing activity, GPs have access to the risk stratification tool within the data processor, which highlights patients with whom the GP has a legitimate relationship and have been classed as at risk. The only identifier available to GPs is the NHS numbers of their own patients. Any further identification of the patients will be completed by the GP on their own systems.

5. Once the Controller / Processor has completed the processing, the ICB can access the online system via a secure connection to access the data pseudonymised at patient level. The pseudonymised data is only permitted to be used to support Risk Stratification.

Linkage will be limited to:

• GP data

Processors:

• NHS South, Central and West Commissioning Support Unit

• Prescribing Services Ltd

• Graphnet Health Ltd

COMMISSIONING

Dataset:

Pseudonymised Commissioning Datasets

Data Minimisation:

• Activity for patients registered to GP practices within the responsibility of the ICB (Including historic activity where the patient may have been registered to another commissioner); and historical activity for patients previously registered to GP practices within the responsibility of the ICB or its predecessor organisations.

and/or

• Activity for patients resident in Output Areas located in the geographic boundary of the ICB (Including historic activity where the patient may have been resident in a different Output Area); and historical activity for patients previously resident in Output Areas located in the geographic boundary of the ICB or its predecessor organisations.

and/or

• Patients under the care of a provider where ICB is the host/co-ordinating commissioner and/or has the primary responsibility for the provider services in the local health economy – this is only for commissioning and relates to both national and local flows.

and/or

• Activity identified by the provider and recorded as such within national systems (such as SUS+) as for the attention of ICB - this is only for commissioning and relates to both national and local flows.

and/or

• Patients under the care of a provider where ICB has joint responsibility for the provider services in the local health economy – this is only for Ambulance Trust data.

Processing:

1. Commissioning Datasets are pseudonymised by the DSCRO using a non disclosed SALT key.

2. Local patient identifiers are permitted to be included for the purpose of challenging data submissions with providers.

3. Pseudonymised Commissioning Datasets are securely transferred from the DSCRO to the Data Controller / Processor.

4. Data is processed for the purpose of commissioning as stipulated within this agreement.

5. Row level Pseudonymised Commissioning Data is also available in the National Federated Data Platform (FDP) ICBs are able to access national commissioning datasets that are currently received as extracts via steps 1 - 4 above within FDP to enable the testing of the platform for Population Health Management (PHM) across incubator sites for future use of the Strategic Commissioning Tool (SCT) within FDP, and the backing data for the Strategic Commissioning Tool to non-incubator ICBs for analytics on their FDP tenant. Palantir Technologies UK Ltd is a data processor for the ICB for data the ICB holds in its local FDP tenant. This will eventually replace the need for data extracts to flow outside of NHSE tenant for commissioning purposes.

Relevant data that is already shared under this agreement can be shared with the ICB in its FDP tenant at row level without leaving the FDP secure boundary or aggregated on the national tenant and flowed in aggregate format to the ICB tenant. This data will then be processed on the ICB tenant and service the strategic commissioning product in Population Health Management (PHM) use case on FDP.

The ICB is permitted to link NHS England commissioning datasets with locally sourced datasets from within the ICB footprint area.

A list of the datasets approved for linkage is available on the NHS England website: https://digital.nhs.uk/services/data-services-for-commissioners/commissioning-datasets'

Additionally, the following datasets can be linked to:

• GP Data

• Adult Social Care Data

• Social Prescribing Data

• Continuing Healthcare Data

Linkage Method:

i. Identifiable data is submitted to the processor and lands in a segregated area.

ii. The processor pseudonymises the data using a DSCRO provided key specific to the individual request and is then passed outside the segregated area.

iii. To enable linkage, the DSCRO sends an encrypted mapping table to the data processor. The ICB has a contract in place with the data processor to enable the use of a black box process.

iv. The black box process uses the encrypted mapping table to overwrite the organisation specific pseudonym with the DSCRO pseudonym to enable linkage to NHS England released products.

Where the data has already been pseudonymised by the provider using a separate DSCRO allocated key then a black box solution isn’t required.

Linkage may also be permitted within NHS England where NHS England acts as a data processor on behalf of a provider. There must be a valid and NHS England approved data processing contract in place.

Processors:

• NHS South, Central and West Commissioning Support Unit

• Optum Health Solutions UK Limited

• Palantir Technologies UK Ltd

• Amazon Web Services

National Cancer Waiting Times:

In addition to the dissemination of Cancer Waiting Times Data via the DSCRO, the ICB is able to access reports held within the CWT system in NHS England directly. Access within the ICB is limited to those with a need to process the data for the purposes described in this agreement. A ICB user will be able to access the provider extracts from the portal for any provider where at least 1 patient for whom they are the registered ICB for that individuals GP practice appears in that setting. Although a ICB user may have access to pseudonymised patient information not related to that ICB, users should only process and analyse data for which they have a legitimate relationship (as described within Data Minimisation).

DIRECT CARE

The Re-identification process for direct care is as follows:

1. The ICB identifies a patient cohort to be re-identified for the purpose of direct care.

2. The ICB sends a re-id request to the DSCRO. This may be done through the ICB or CSU’s Business Intelligence (BI) Tool, or through a manual form.

3. The DSCRO assesses as to whether the request passes the specified re-identification process checks. Checks include if the requester is authorised to access identifiable data, if the number of patients in the cohort is appropriate, and that the request does not seem inappropriate or outside of expected parameters, including for example around timings and the requestor’s relationship with patients in the data. These checks are carried out either by DSCRO staff using pre-approved information (timing’s, requester’s identity etc) or via an automated system.

4. For automated systems, steps 1 - 3 wouldn’t apply in most cases as it would be the direct care professional who identifies the cohort and as long as they are an approved re-id user and have gone through security checks initially, they will be able to re-id without further checks.

5. If successful/approved, the DSCRO re-identifies the relevant data item(s) for the appropriate patients and returns the identifiable fields to Health or Care professional(s) with a legitimate relationship to the patient. The ICB does not see the identifiable record.

6. DSCROs retain an audit trail of all re-id requests.

INVOICE VALIDATION

1. Accurate budget reports.

2. Enable a system of communication that will enable the ICB to challenge invoices and raise discrepancies and disputes.

3. Reports on the accuracy of invoices.

4. Validation of invoices for non-contracted events where a service delivered to a patient by a provider that does not have a written contract with the patient’s responsible commissioner, but does have a written contract with another NHS commissioner/s.

5. Budget control of the ICB.

RISK STRATIFICATION

1. As part of the risk stratification processing activity detailed above, GPs have access to the risk stratification tool which highlights patients for whom the GP is responsible and have been classed as at risk. The only identifier available to GPs is the NHS numbers of their own patients. Any further identification of the patients will be completed by the GP on their own systems.

2. GP Practices will be able to view the risk scores for individual patients with the ability to display the underlying SUS+ data for the individual patients when it is required for direct care purposes by someone who has a legitimate relationship with the patient.

The ICB will be provided with the pseudonymised outputs of the risk stratification tool for which they are able to:

1. Identify patient groups at risk of deterioration and providing effective care.

2. Set up capitated budgets – budgets based on care provided to the specific population.

3. Identify health determinants of risk of admission to hospital, or other adverse care outcomes.

4. Monitor vulnerable groups of patients including but not limited to frailty, COPD, Diabetes, elderly.

5. Health needs assessments – identifying numbers of patients with specific health conditions or combination of conditions.

6. Classify vulnerable groups based on: disease profiles; conditions currently being treated; current service use; pharmacy use and risk of future overall cost.

7. Production of Theographs – a visual timeline of a patients encounters with hospital providers.

8. Analyse based on specific diseases.

9. Aggregate reporting of number and percentage of population found to be at risk.

COMMISSIONING

1. Commissioner reporting on providers, finances, readmission analysis etc…

2. Production of aggregate reports for ICB Business Intelligence.

3. Production of project / programme level dashboards.

4. Monitoring of acute / community / mental health quality matrix.

5. Clinical coding reviews / audits.

6. Budget reporting down to individual GP Practice level.

7. GP Practice level dashboard reports.

8. Comparators of ICB performance with similar ICBs as set out by a specific range of care quality and performance measures detailed activity and cost reports.

9. Data Quality and Validation measures allowing data quality checks on the submitted data.

10. Contract Management and Modelling.

11. Patient Stratification dashboards to highlight cohorts of patients with similar conditions at risk.

12. Manage demand, by understanding the quantity of assessments required ICBs are able to improve the care service for patients by predicting the impact on certain care pathways and ensure the secondary care system has enough capacity to manage the demand.

13. Identify low priority procedures which could be directed to community-based alternatives and as such commission these services and deflect referrals for low priority procedures resulting in a reduction in hospital referrals.

14. Compare providers (trusts) mortality outcomes to the national baseline.

15. Identify medication prescribing trends and their effectiveness.

16. Linking prescribing habits to entry points into the health and social care system.

17. Identify, quantify and understand cohorts of patient’s high numbers of different medications (polypharmacy).

18. Feedback to NHS service providers on data quality at an aggregate and individual record level – only on data initially provided by the service providers.

DIRECT CARE

1. Reports and dashboards that highlight cohorts of patients that can be targeted for clinical intervention by direct health and care professionals.

2. Lists of at risk patients made available to direct health and care professionals that require direct care intervention.

3. Reports and dashboards to show the outcome of clinical intervention including patient outcomes and modelled transactional cost savings.

INVOICE VALIDATION

The invoice validation process supports the ongoing delivery of patient care across the NHS and the ICB region by:

1. Ensuring that activity is fully financially validated.

2. Ensuring that service providers are accurately paid for the patient’s treatment.

3. Enabling services to be planned, commissioned, managed, and subjected to financial control.

4. Enabling commissioners to confirm that they are paying appropriately for treatment of patients for whom they are responsible.

5. Fulfilling commissioners duties to fiscal probity and scrutiny.

6. Ensuring full financial accountability for relevant organisations.

7. Ensuring robust commissioning and performance management.

8. Ensuring commissioning objectives do not compromise patient confidentiality.

9. Ensuring the avoidance of misappropriation of public funds.

RISK STRATIFICATION

Risk stratification promotes improved case management in primary care and may lead to the following benefits being realised:

1. Improved planning by better understanding patient flows through the healthcare system, thus allowing commissioners to design appropriate pathways to improve patient flow and allowing commissioners to identify priorities and identify plans to address these.

2. Reduce emergency readmissions, especially avoidable emergency admissions by improving quality of services. This is achieved through mapping of frequent users of emergency services thus allowing early intervention.

3. Improved access to services by identifying which services may be in demand but have poor access, and from this identify areas where improvement is required.

4. Supports the commissioner to meets its requirement to reduce premature mortality in line with the ICB Outcome Framework by allowing for more targeted intervention in primary care.

5. Better understanding of local population characteristics through analysis of their health and healthcare outcomes.

All of the above lead to improved patient experience and health outcomes through more effective commissioning of services.

COMMISSIONING

1. Supporting Quality Innovation Productivity and Prevention (QIPP) to review demand management, integrated care and pathways.

2. Supporting Joint Strategic Needs Assessment (JSNA) for specific disease types.

3. Health economic modelling to analyse provider performance and patient pathways.

4. Commissioning cycle support for grouping and re-costing previous activity.

5. Enables monitoring of commissioned services to ensure they are performing as expected.

6. Improved planning by better understanding patient flows through the healthcare system, thus allowing commissioners to identify priorities and identify commissioning plans to address these (pathways would be designed by service providers within the ICS with input from appropriate stakeholders including patient and public representation).

7. Reduced emergency readmissions, especially avoidable emergency admissions leading to improved quality of services. This is achieved through mapping of frequent users of emergency services and early intervention of appropriate care.

8. Improved access to services by identifying which services may be in demand but have poor access, and from this identify areas where improvement is required.

9. Potentially reduced premature mortality by more targeted intervention in primary care, which supports the commissioner to meets its requirement to reduce premature mortality in line with the ICB Outcome Framework.

10. Better understanding of the health of and the variations in health outcomes within the population to help understand local population characteristics.

11. Better understanding of contract requirements, contract execution, and required services for management of existing contracts, and to assist with identification and planning of future contracts.

12. Insights into patient outcomes, and identification of the possible efficacy of outcomes-based contracting opportunities.

13. Providing greater understanding of the underlying causes and look to commission improved supportive networks, this would be ongoing work which would be continually assessed.

14. Insight to understand the numerous factors that play a role in the outcome for patients in all datasets. The linkage allows the reporting both prior to, during and after the activity, to provide greater assurance on predictive outcomes and delivery of best practice.

15. Provision of indicators of health problems, and patterns of risk within the commissioning region.

16. Support of benchmarking for evaluating progress in future years.

17. Assists commissioners to make better decisions to support patients and drive changes in health care.

18. Allows comparisons of providers performance to assist improvement in services – increase the quality.

19. Allow analysis of health care provision to be completed to support the needs of the health profile of the population within the ICB area based on the full analysis of multiple pseudonymised datasets.

20. To evaluate the impact of new services and innovations (e.g. if commissioners implement a new service or type of procedure with a provider, they can evaluate whether it improves outcomes for patients compared to the previous one).

DIRECT CARE

1. Enables clinical intervention to prevent worse outcomes, such as A&E attendance.

2. Allows the ICB to perform their statutory duty to protect patients.

3. Allows clinicians with direct care responsibilities to improve quality of care for patients identified. This may reduce the risk of unwanted emergency hospital admission, premature complications of disease and of premature death.

Not stated in the register.