Regional Health and Social Care Information Sharing Agreement

Main Menu

  • Home
  • Controller Resources
  • Public Facing Resources
  • Agreement Details
  • Confidentiality Agreements
  • Specifications
  • Data Protection Impact Assessments
  • Common Privacy Notices
  • Secondments and Volunteering
  • FAQs

Login Form

  • Forgot your username?
  • Forgot your password?

Home

Regional Health and Social Care ISA

  • Print
  • Email
Category: RegISA Introduction

The Agreement

Every health and social care organisation in the country is identifying substantial requirements to share and use personal confidential data in order to achieve planned improvements in care delivery and in financial efficiency.

It is also the case that many opportunities to improve care are delayed or lost due to the challenges associated with designing and agreeing information sharing agreements on a project by project basis.

The regional Information Governance Steering Group (IGSG) which is chaired by the Chairman of the Berkshire Local Medical Committee at the time of writing manages the agreement and the membership of the agreement on behalf of the members. The Administrator (Frimley Health NHS Foundation Trust at the time of writing) maintains and publishes the agreement documentation and supporting schedules and registers on behalf of the member organisations and IGSG.

This agreement has been reviewed by Queens Counsel and in his opinion it is both lawful and fit for its purpose. A summary of the QCs opinion is attached below.

This agreement builds on the success of the similarly structured prior agreements for the sharing of information for the provision of care and for secondary uses agreements in use since 2013 and replaces the current 2023 version of the provision of care and secondary uses agreements. The aims of the agreement are:

  1. To provide a clear framework for the secure sharing of personal confidential data for the delivery of care and for the management of the health and social care system;
  2. To accelerate the pace with which regional and local sharing requirements can be agreed; and
  3. To reduce the costs of developing and agreeing individual sharing requirements.

Very specifically, this latest iteration of the agreement is designed to better support the development of:

  1. Federated working and networks;
  2. Integrated working and care delivery models;
  3. Real time risk stratification at the point of care for patients with the most complex needs; and
  4. Latest guidance on data controllership resulting from the implementation of GDPR.

Each organisation remains responsible for the control and use of personal confidential data within the organisation as required by the legislation.

Structure of the Agreement

The Regional Health and Social Care Information Sharing Agreement is executed as a subscription agreement. This form of agreement allows controlled processing and sharing to begin as soon as two controllers have signed their sharing documentation. Unlike the traditional multi-party agreement models, processing and sharing does not need to wait until all parties have executed the agreement.

Organisations become members of the agreement by signing up to the master agreement that sets out the scope and terms of membership for the agreement as well as the roles of IGSG, Lead Controllers and the Administrator. The Administrator accepts the new member’s signed master agreement on behalf of the members as a whole.

Implementation

Implementation of the agreement is as follows:

  1. Every member of the framework needs to sign the master agreement;
  2. The agreement is currently and will in future be presented through an electronic signature process as a single document;
  3. Data controller organisations that contribute data to the shared pool as a data flow or information asset are presented with one or more additional documents describing each specific processing and sharing arrangement the controller is expected to contribute to;
  4. Where the master agreement and one or more individual processing and sharing arrangement(s) are executed contemporaneously all documents are presented through an electronic signature process as a single document … with signatures required for each item requiring approval; and
  5. Where subsequent individual processing and sharing arrangements are executed non-simultaneously the documents are presented individually through an electronic signature process for approval.

Some supporting documents are presented below.

  • Summary of the Queens Counsel Opinion
  • Example Agreement Launch Correspondence
  • Example Agreement Distribution Correspondence
Schedule E - Membership of the Regional Information Sharing Agreement

Public, Patient and Service User Facing Resources

  • Print
  • Email
Category: Public, Patient and Service User related documents

To support data controllers with the joint processing and sharing arrangements several documents have been prepared.

The documents attached below include:

  1. Materials to support referrals to Multi-Disciplinary Teams (MDTs) and Integrated Care Teams (ICTs).
  2. Materials to support more general referrals.
  3. Posters that can be displayed in public areas.
  4. Leaflets that can be given to members of the public, patients and service users. 
  5. An example display screen message that can be displayed in public areas.

Earlier public engagement activity

Earlier public engagement activity takes two forms:

  1. Members of the public (as represented by local healthwatch and public and patient engagement forums) are invited to and generally attend regular programme boards as well as assembly, council and members meetings where information governance matters and sharing arrangements are discussed.
  2. Around a dozen events involving the public have been held across the various health and social care economies covered by the sharing framework since 2016 in respect of the major interoperability and sharing proposals of the partner organisations.

Recent and planned public, patient and service user communications activity

Please see below a summary of the future (potentially annual) public, patient and service user communications activity:

  1. Mailing to all addresses including of a leaflet as part of the spring Council Tax mailings
  1. Emailing all NHS staff through organisation distribution lists
  1. Emailing all Local Authority staff through organisation distribution lists
  1. General Practice attendees
    1. The provision of posters and leaflets for GP surgeries
    2. Inclusion of message on waiting room screen
  1. A&E attendees and admissions
    1. Posters and leaflets on display
    2. Statements in discharge letters
    3. Articles in Trust magazines
  1. Posters in Secondary Schools
  1. Opportunistic public contact with the inclusion of a standard paragraph on all outgoing mail, signposting website for further information

Websites

Every data controller will have their own website for public, patient and service user communications.  Examples of how joint processing and sharing arrangements are supported are provided by the following websites

  1. https://www.fhft.nhs.uk/your-visit/privacy-policy-how-we-use-your-information/patient-information/
  2. https://www.berkshirehealthcare.nhs.uk/protecting-your-data-privacy-notice/
  3. https://your-data-matters.service.nhs.uk/privacynotice
  • The Connected Care/Share Your Care solution in the Frimley Integrated Care System
  • The Connected Care/Share Your Care solution in Berkshire West

 

  • Materials to support referrals
  • Posters and leaflets
  • Example public area display screen text

 

Direct Care processing and sharing arrangements

  • Print
  • Email
Category: Processing and Sharing Specifications

The attachments below present the Direct Care processing and sharing specifications in place and in development for the Regional Information Sharing Agreement.

These are presented within the Schedule C Register of Direct Care sharing arrangements and two examples are also attached.

The first example is for General Practice data processed and shared using Connected Care.

The second example relates to General Practice joint processing and sharing arrangements in respect of Federated Working for Extended Hours.

 

Schedule C - Register of Direct Care processing and sharing agreements

See the Mapping of Schedules C, D and E by Agreement here and Mapping of Schedules C, D and E by Organisation here.
See the Mapping of Schedules C, D and E and Information Assets by Organisation here.
  • Example Connected Care Processing and Sharing Specification for Direct Care
  • Example Federated Working Processing and Sharing Specification for Direct Care

 

Other (Secondary) Uses processing and sharing specifications

  • Print
  • Email
Category: Processing and Sharing Specifications

The attachments below present the Other (Secondary) Uses processing and sharing specifications in place and in development for the Regional Information Sharing Agreement.

These are presented within the Schedule D Register of Other (Secondary) Uses sharing arrangements and an example is also attached.

The example is for General Practice data processed and shared using Connected Care.

 

Schedule D - Register of Other (Secondary) Uses processing and sharing specifications

See the Mapping of Schedules C, D and E by Agreement here and Mapping of Schedules C, D and E by Organisation here.
See the Mapping of Schedules C, D and E and Information Assets by Organisation here.
  • Example Other (Secondary) Uses processing and sharing specification for Primary Care Networks using Connected Care
  • Example Other (Secondary) Uses processing and sharing specification using GP datasets and Connected Care

Schedule P - Data Protection Impact Assessments

  • Print
  • Email
Category: Data Protection Impact Assessments

Page last updated on: Wednesday, 17 February 2021 (10:59)

Schedule P - Data Protection Impact Assessments

This schedule to the Regional Health and Social Care Information Sharing Agreement sets out the Data Protection Impact Assessments (DPIAs) relating to the joint processing and sharing specifications in place and in development for the Regional Information Sharing Agreement.

 

Where available, links are provided to PDF versions of the DPIAs. (Please note that for security reasons some DPIAs are not published.)

 

This schedule was prepared on the date at the top of the page and does not reflect additions and changes to the registers and schedules thereafter.

 

Data Protection Impact Assessments

 

ID Name Status Review Date Review Comment
DPIA0001 Connected Care Clinical Platform DPIA0001:Current April 2021 Current - Review due soon
DPIA0002 Connected Care Analytics Platform DPIA0002:Current April 2021 Current - Review due soon
DPIA0003 GP Extended Hours DPIA0003:Current n/a  
DPIA0004 Thames Hospice with Berkshire practices via EMIS DPIA0004:Current March 2021 Current - Review due soon
DPIA0005 SCAS Activity Data DPIA0005:Current n/a  
DPIA0006 Connected Care Personal Health Record (PHR) DPIA0006:Current April 2021 Current - Review due soon
DPIA0007 PCN Analytics DPIA0007:Current April 2021 Current - Review due soon
DPIA0008 Unscheduled Care Notifications DPIA0008:Current April 2021 Current - Review due soon
DPIA0009 Connected Care Clinical Document Sharing (NHS Trusts) DPIA0009:In development n/a  
DPIA0010 Connected Care Clinical Document Sharing (practices) DPIA0010:In development n/a  
DPIA0011 Integrated Care and Multidisciplinary Care DPIA0011:Current n/a  
DPIA0012 Integrated Decisions Recording in Connected Care DPIA0012:Current April 2021 Current - Review due soon
DPIA0013 Child Health (CHIS) extract via Connected Care DPIA0013:Current April 2021 Current - Review due soon
DPIA0014 Connected Care Childrens Social Care DPIA0014:In development n/a  
DPIA0015 Patient Alerts in Connected Care (BHFT) DPIA0015:In development n/a  
DPIA0016 Patient Contacts in Connected Care (BHFT) DPIA0016:In development n/a  
DPIA0017 SUS Risk Stratification Data DPIA0017:In development n/a  
DPIA0018 SCAS GP Encounter Data DPIA0018:Current April 2021 Current - Review due soon
DPIA0019 SCAS 111 Direct Booking with GP Connect DPIA0019:Current December 2021 Current
DPIA0020 Thames Valley Together Analytics (TVP) DPIA0020:Current April 2021 Current - Review due soon
DPIA0021 Frimley ICS Community Services EMIS DPIA0021:Current December 2021 Current
DPIA0022 Connected Care and BSPS Diagnostic Requests and Results DPIA0022:Current April 2021 Current - Review due soon
DPIA0023 Emergency Response Volunteers DPIA0023:Current March 2021 Current - Review due soon
DPIA0024 Emergency Response Staff Secondments DPIA0024:Current March 2021 Current - Review due soon
DPIA0025 ORCHA Signposting to Accredited Apps DPIA0025:Current April 2021 Current - Review due soon
DPIA0026 Thames Valley Together Analytics (BFFC) DPIA0026:Current April 2021 Current - Review due soon
DPIA0027 OOH Activity and Encounter Data DPIA0027:Current April 2021 Current - Review due soon
DPIA0028 CMHTP/GPimhs/MHICS for Surrey and Frimley ICS DPIA0028:Current April 2021 Current - Review due soon
DPIA0029 Care Homes Nursing and Connected Care DPIA0029:In development n/a  
DPIA0030 Connected Care and Thames Valley and Surrey LHCR DPIA0030:Current April 2021 Current - Review due soon
DPIA0031 COVID-19 Anti-body Testing Solution DPIA0031:Current n/a  
DPIA0032 Post-Discharge Case Finding and Analysis DPIA0032:In development n/a  
DPIA0033 External Organisation Access to BHFT RIO DPIA0033:Current December 2022 Current
DPIA0034 FHFT Discharge Planning DPIA0034:In development n/a  
DPIA0035 MHICS for Frimley ICS (East Berkshire) DPIA0035:Current August 2021 Current
DPIA0036 BSPS Diagnostic Requests and Results DPIA0036:Current December 2022 Current
DPIA0037 Serology Data and Connected Care DPIA0037:Current n/a  
DPIA0038 Test and Trace Data and Connected Care DPIA0038:Current March 2021 Current - Review due soon

The master documents are managed by the Administrator and can be viewed online at www.regisa.uk .

 

See also:

  • Mapping of Schedules C, D and E by Agreement
  • Mapping of Schedules C, D and E by Organisation
  • Mapping of Schedules C, D and E and Information Assets by Organisation

 

End of Schedule P

Master Agreement

  • Print
  • Email
Category: Master Agreement Documents

We have compiled an example Master Agreement and its associated annexes and schedules into the document attached below.

The Master Agreement comprises the core membership agreement document that defines the

  1. Scope of the agreement
  2. Agreement principles and policies
  3. Terms and conditions 
  4. Operational commitments made between members
  5. Administration arrangements 

The core agreement terms need to be signed and accepted by members.

The Master Agreement also includes three annexes

  1. Information Governance Steering Group terms of reference
  2. Joint control arrangements – Lead Controller terms of reference
  3. Notification and reporting arrangements applying to all members of the agreement

The Master Agreement also includes:

Schedule A – Risk Sharing and Indemnity Arrangements (where a signature is also required)

Schedule B – Qualifying Standard (where a signed statement confirming the prospective members compliance with the Qualifying Standard is required)

 

Attached below you will find an example of an email to go out in advance of the agreement and an example of a second email cover note to go out when we distribute the agreement for signature.

 

  • Example Master Agreement
  • Example Agreement Launch Correspondence
  • Example Agreement Distribution Correspondence
  • The Queen's Counsel's Opinion regarding the fitness for purpose and the lawfulness of the agreement

Current membership of the Regional Health and Social Care Information Sharing Agreement (Schedule E)

Page 1 of 3

  • 1
  • 2
  • 3
  • You are here:  
  • Home

Back to Top

© 2021 Regional Health and Social Care Information Sharing Agreement