DSfC - NHS Brighton & Hove CCG - IV

Invoice Validation

Invoice validation is part of a process by which providers of care or services get paid for the work they do.

Invoices are submitted to the Clinical Commissioning Group (CCG) so the CCG is able to ensure that the activity claimed for each patient is their responsibility. This is done by processing and analysing Secondary User Services (SUS+) and Personal Demographic (PDS) data, which is received into a secure Controlled Environment for Finance (CEfF). The SUS+ and PDS data is identifiable and is only used to confirm the accuracy of backing-data sets (data from providers) and determining if the CCG is the responsible commissioner for the patient.

The CCG are advised by the appointed CEfF whether payment for invoices can be made or not.

Invoice Validation will be conducted by NHS South Central and West Commissioning Support Unit

Data must only be used for the purposes stipulated within this Data Sharing Agreement. Any additional disclosure / publication will require further approval from NHS Digital.

Data Processors must only act upon specific instructions from the Data Controller.

Data can only be stored at the addresses listed under storage addresses.

All access to data is managed under Role-Based Access Controls. Users can only access data authorised by their role.

Patient level data will not be linked other than as specifically detailed within this Data Sharing Agreement. Data released will only be shared with those parties listed and will only be used for the purposes laid out in the application/agreement. The data to be released from NHS Digital will not be national data.

NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data)

Onward Sharing

There is no requirement for the analytical teams to re-identify patients, but in the development of cohorts of patients considered to be at risk, the data controllers may need the facility to provide identifiable results back to direct healthcare professionals or local authority direct care staff only for the purpose of direct care. All re-id requests will be processed and authorised by the DSCRO on a case by case basis. National data opt outs are not applied in these cases as they are for the purposes of direct care which follows the legal basis of implied consent.

An example of a request for the re-id of patients for direct care may be;

A&E High Attendance usage

The CCG can filter data to show for example the number of A&E attendances in a given period for each patient. The CCG can then flag to the relevant GP of the patient any patients that require intervention. An outcome of this is earlier intervention in the patient(s) care thus potentially reducing future costs and minimising future risk.

Polypharmacy re-IDs

CCG's can request re-ID of a list of patients to be sent to the relevant GP with a high number of medications (ingredient count) and review the medication for these patients. This can help address the risk of polypharmacy which is recognised as an adverse risk factor for patient safety. A by-product of such reviews may be to reduce costs of medication.

The Re-identification process for direct care is as follows:

1. The CCG identifies a patient cohort (typically small numbers) to be re-identified for the purpose of direct care.

2. The CCG sends a re-id request to the DSCRO. This may be done through the CCG or CSU’s Business Intelligence (BI) Tool, or through a manual form.

3. The DSCRO (either through an automated system or manual checking in line with the request) assesses as to whether the request passes the specified re-identification process checks. Checks include if the requester is authorised to access identifiable data, if the number of patients in the cohort is appropriate, and that the request does not seem inappropriate or outside of expected parameters, including for example around timings and the requestor’s relationship with patients in the data

4. If successful/approved, the DSCRO re-identifies the relevant data item(s) for the appropriate patients and returns the identifiable fields to Health or care professional(s) with a legitimate relationship to the patient. The CCG does not see the identifiable record.

5. DSCROs retain an audit trail of all re-id requests

6. National Data opt outs are not applied for the purpose of direct care

Aggregated reports only with small number suppression can be shared externally as set out within NHS Digital guidance applicable to each data set.

Segregation

Where the Data Processor and/or the Data Controller hold both identifiable and pseudonymised data, the data will be held separately so data cannot be linked.

All access to data is auditable by NHS Digital.

Data for the purpose of Invoice Validation is kept within the CEfF, and only used by staff properly trained and authorised for the activity. Only CEfF staff are able to access data in the CEfF and only CEfF staff operate the invoice validation process within the CEfF. Data flows directly in to the CEfF from the DSCRO and from the providers – it does not flow through any other processors.

Data Minimisation

Data Minimisation in relation to the data sets listed within the application are listed below. This also includes the purpose on which they would be applied -

For the purpose of Invoice Validation:

• CCG of residence and/or registration

University Hospitals Bristol NHS Foundation Trust do not access data held under this agreement as they only supply the building. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Invoice Validation

1. Identifiable SUS+ and PDS Data is obtained from the SUS+ Repository to the Data Services for Commissioners Regional Office (DSCRO).

2. The DSCRO pushes a one-way data flow of SUS+ and PDS data into the Controlled Environment for Finance (CEfF) in the NHS South Central and West Commissioning Support Unit.

3. NHS South Central and West Commissioning Support Unit carry out the following processing activities within the CEfF for invoice validation purposes:

a. Validating that the Clinical Commissioning Group are responsible for payment for the care of the individual by using SUS+ and PDS and/or provider backing flow data.

b. Once the provider backing information is received, this will be checked against national NHS and local commissioning policies as well as being checked against system access and reports provided by NHS Digital to confirm the payments are:

i. In line with Payment by Results tariffs

ii. are in relation to a patient registered with a CCG GP or resident within the CCG area.

iii. The health care provided should be paid by the CCG in line with CCG guidance.

4. The CCG are notified that the invoice has been validated and can be paid. Any discrepancies or non-validated invoices are investigated and resolved between NHS South Central and West Commissioning Support Unit CEfF team and the provider, meaning that no identifiable data needs to be sent to the CCG. The CCG only receives notification to pay and management reporting detailing the total quantum of invoices received pending, processed etc.

Invoice Validation

1. The Controlled Environment for Finance (CEfF) will enable the CCG to challenge invoices and raise discrepancies and disputes.

2. Outputs from the CEfF will enable accurate production of budget reports, which will:

a. Assist in addressing poor quality data issues

b. Assist in business intelligence

3. Validation of invoices for non-contracted events where a service delivered to a patient by a provider that does not have a written contract with the patient’s responsible commissioner, but does have a written contract with another NHS commissioner/s.

4. Budget control of the CCG.

5. Support validating financial payments for contracted and non-contracted activity, determining if the CCG is the responsible commissioner for the patient.

Invoice Validation

The invoice validation process supports the ongoing delivery of patient care across the NHS and the CCG region by:

1. Ensuring that activity is fully financially validated.

2. Ensuring that service providers are accurately paid for the patients treatment.

3. Enabling services to be planned, commissioned, managed, and subjected to financial control.

4. Enabling commissioners to confirm that they are paying appropriately for treatment of patients for whom they are responsible.

5. Fulfilling commissioners duties to fiscal probity and scrutiny.

6. Ensuring full financial accountability for relevant organisations.

7. Ensuring robust commissioning and performance management.

8. Ensuring commissioning objectives do not compromise patient confidentiality.

9. Ensuring the avoidance of misappropriation of public funds.

1. Financial validation of activity

2. CCG Budget control

3. Commissioning and performance management

4. Meeting commissioning objectives without compromising patient confidentiality

5. The avoidance of misappropriation of public funds to ensure the ongoing delivery of patient care