Seòmar agus comataidhean

A working prototype of clinical portal is currently under development within a consortium of South and East NHS boards led by NHS Lothian. North and West NHS board consortia are currently defining and assessing their delivery options. The incremental approach advocated in the eHealth Strategy is part of our design. The current phase of portal work is intended to give us much clearer indications of the benefits of different approaches, how much they will cost and how long they will take. We want this information to be available before we invite boards to commit to a particular route for delivering portal benefits. The three regional consortia, encompassing all territorial boards, are due to report in late summer 2010. The Clinical Portal Programme Board will then be in a position to consider issues of timing and affordability of clinical portal deployment.

The Scottish eHealth Programme recommends a standards-based approach when choosing or developing ICT systems, with a preference for open standards to ensure the maximum level of interoperability. The eHealth N3 network allows for standard data formats to be communicated between applications, and a good example of this is the SCI Gateway application that enables the secure transfer of documents between primary and secondary care using SIGN standards and national XML definitions. Indeed, SCI Gateway has now been deployed in Wales.

The eHealth standards library, published on the eHealth website, lists standards statements that have either been approved or are in progress.

A further notable development in this area is that, as part of the national procurement for a Patient Management System (TrakCare), a contract has been signed for an integration product called Ensemble (which lies at the heart of TrakCare). This will enable interoperability between applications within and across boards, and relies on the definition and adoption of standard data formats, many of which are open and international.

The Scottish Government does not centrally hold information on the number of unauthorised access to electronic patient data. It is the responsibility of individual NHS boards to record, report and investigate in line with their own local policies and procedures.

The Scottish Government encourages NHS boards to bring serious data breaches including serious unauthorised accesses to the Health Department and the ICO simultaneously.

NHS Scotland uses information security risk analysis and management methods to identify and mitigate risks. The NHS Scotland Security Policy states that boards will undertake a survey of their information systems and data, and make an assessment of the likely security risks, including an evaluation of the likely impact and occurrence of any threats. Boards then introduce measures to mitigate these risks. This approach was taken in the evaluation of the Emergency Care Summary record and will be used as TrakCare is deployed in boards.

Information on the volume of incidents relating to the accessibility of hospital records or laboratory test results is not collected centrally.

Hospital discharge records, which are collected centrally, are coded with diagnostic information relating to the patient''s stay. Although medication errors may be identifiable in certain circumstances, the data would not fairly and accurately reflect the true prevalence of such errors or give an indication of harm to patients.

Patient safety is a key priority for the Scottish Government. It is vital for patients to have confidence that when they access any part of the healthcare system, they will receive the best available treatment without fear of harm. The Scottish Patient Safety Programme is being implemented in every NHS board and is designed to improve the safety of care.

NHS boards are responsible for ensuring the quality, safety and effectiveness of the services they provide. Appropriate governance arrangements are in place and these arrangements are the subject of review by a number of external bodies and agencies. NHS Quality Improvement Scotland (NHS QIS) has commenced a review of all NHS boards in Scotland with regard to performance against NHS QIS Clinical Governance and Risk Management Standards.

Clinical portal is not a single system but a range of joined up products and services that will provide clinicians with a single route to access priority information. NHS boards are currently working in regional consortia to determine how best to deliver clinical portal based on their different starting points and technical environments. Key considerations will be the availability of priority information held electronically within national or local NHS board clinical systems, and the technical infrastructure on which clinical portal will be deployed. Detailed design of the portal, including the level of performance which is acceptable to clinicians for front-line use, will be determined by boards. Clinical portal responsiveness is likely to be impacted more by the wider technical environment and the number of different clinical information sources than by the number of simultaneous clinical portal users. The incremental approach adopted to delivery of clinical portal will enable the portal to grow and develop at a pace that is in step with the clinical usage.

At the current time only one board has this situation prior to implementing TrakCare.

(a) Contraceptive data is recorded and collected at individual health board level on the various clinical systems and may contain personal identifiable information.

(b) Compulsory detention under Mental Health Scotland Act: All compulsory detentions are notified by the NHS board to the Mental Welfare Commission, Edinburgh. Notification includes patient demographic data, date and type of section etc. Mental Welfare Commission have an Information Management Portal which is used to maintain individual service user records (containing full patient demographic data). If the patient is detained under the Mental Health Scotland Act this is recorded against the service user record and the notification form received from the individual NHS board is scanned and uploaded in to the service user record.

(c) GUM clinic information: Client data is held in NASH (National Sexual Health System). This includes patient demographic data as well as administrative and clinical data.

(d) Termination of pregnancies notified to Chief Medical Officer under provisions of Abortion Act 1967: Notification includes patient demographic information. ISD anonymise data for statistical presentation.

The Scottish Government expect NHS Scotland systems and processes to comply with the Data Protection Act 1998, the Human Rights Act 1998 and any other relevant law. The European Court of Human Rights case predated the Data Protection Directive 95/46/EC and the Data Protection Act (1998) which set out the principles that organisations must comply with in the handling of personal data. Under the Data Protection Act 1998, NHSS organisations must be able to demonstrate that appropriate technical, managerial and organisational steps are in place. NHS boards therefore adopt a risk based approach to determine what measures are appropriate taking into account the state of technology at the time, the cost of implementing such measures and the nature of the data to be processed and the harm that might result from, for instance, unauthorised access. Issues of access control and audit of access will be important considerations as new systems promoting the sharing of information in the interests of safe effective and efficient provision of care are developed.

This covers individual licence costs, and deployment and support charges for the five participant boards for a 10 year period. The costs for TrakCare in Lothian Health Board are not included.