GP commissioning 'poses new data risks'

The National Information Governance Board also warned expertise may disappear as experienced data management officers face redundancy as a result of the NHS reforms.

The report says assurance and compliance issues in primary care must be addressed, noting that at present GPs are not subject to the same information governance standards as PCTs.

GPs are not subject to the DH’s information governance framework, do not routinely use information governance toolkits to assess compliance and are not audited for data management.

The report, by governance board NHS lead Amanda Johashen, says: “Consortia are already processing significant amounts of identifiable data and also may not be completing information governance toolkits or have any information governance capability.”

It says: “These organisations may not specifically be used to processing large amounts of data for secondary purposes and may not have an adequate understanding of the legislative or regulatory framework.

“It is also unknown whether their IT or security arrangements are compliant with NHS requirements.”

The report also says maintaining staff capacity is “fundamental” to information governance as the NHS restructures.

But it adds: “Many of these roles have been put at risk of redundancy and consequently there is a serious risk that much of this expertise will disappear.”

The report says IT systems change much more slowly than NHS policy, and many existing systems were put in place before current confidentiality requirements were implemented. Many organisations will be resorting to inefficient temporary solutions, which are unsustainable in the long term.

Governance board papers for May identify concerns about GP consortia and primary care trust clusters. The Information Commissioner’s Office has already identified the risk of managers “stumbling into illegality” by inadvertently breaching the Data Protection Act in allowing clusters access to information held by PCTs.