Wider release of NHS prescribing data Consultation document

Transcription

2 Contents 1. Introduction Primary care prescribing Prescription Pricing Division (PPD) Current provision of prescribing data The NHS Information Centre Release of other primary care data by The NHS Information Centre Planned release of practice level prescribing data Requests for wider release of prescribing data Information governance Data Protection Act Common Law Duty of Confidentiality The Freedom of Information Act The Human Rights Act ISO 27001: Confidentiality: NHS Code of Practice The Information Security management: NHS Code of Practice Re-use of Public Sector Information regulations Risks and benefits Potential benefits associated with the wider release of prescribing data Potential risks associated with wider release of prescribing data 9 4. Proposals for wider release of prescribing data Raw PCT level prescribing data Raw practice level data for specific NHS purposes only.. 12 Copyright 2008 the NHS Information Centre 2

3 1. Introduction The NHS Information Centre for health and social care (IC) aims to promote the wider use of NHS transactional data for the purposes of improved patient care and the delivery of local NHS services. This paper provides an overview of the current position regarding the availability of prescribing data. It also reviews the legislation, regulations and Department of Health (DH) policy that covers prescribing data and proposes options for the wider release of this data. 1.1 Primary care prescribing Prescribing in primary care is the most common NHS intervention. Approximately 780 million items were prescribed and dispensed last year at a cost of over 8 billion to the NHS. In this paper, the term prescribing data refers to information collected from dispensed prescriptions which have been prescribed in primary care in England (excluding by dentists),. 1.2 Prescription Pricing Division (PPD) Primary care prescribing information is derived from prescriptions submitted by community pharmacists and general practices (where those items are either personally administered at the practice or directly dispensed to patients) to the Prescription Pricing Division (PPD) of the NHS Business Services Authority (BSA). The primary role of the PPD is to ensure that chemists and dispensing doctors are reimbursed appropriately for the dispensed medicines and that the costs and fees paid are charged back to the appropriate NHS budget. The data collected has high accuracy and is returned to the NHS for a variety of purposes including benchmarking, performance and financial management and to support prescribing initiatives. The BSA is the data controller for this data. 1.3 Current provision of prescribing data The benchmarking capability is provided via the Prescribing Toolkit, an electronic information system that allows password protected access to a set of practice and PCT level comparators. These comparators are available quarterly and annually over the latest three year period available. Detailed performance management and analysis of practice and PCT level prescribing is available through a second password protected system, epact, which allows the user to query monthly data for the most recent 5 year period at the level of the individual presentation if required. Financial monitoring reports are sent to each practice and PCT on a monthly basis, and practice and PCT level accounting reports are sent to PCTs every month. On line practice level prescribing data is provided to each PCT for their own practices only via the Prescribing Toolkit and epact. Strategic Health Authorities (SHAs) can access epact and Toolkit data for all the SHAs and only their PCTs. The NHS Information Centre (IC), DH, NICE and the Copyright 2008 the NHS Information Centre 3

4 Healthcare Commission have access to all PCTs, all SHAs and national level data via this route. 1.4 The NHS Information Centre The IC hosts the national Prescribing Costs Analysis (PCA) database which is constructed from data supplied monthly by the PPD. This is recognised as the official database for any prescribing data requests, national statistics and parliamentary questions. Some PCA data is available at PCT level but no data is available at practice level. The IC is the data controller for this data. The IC produces a series of national level prescribing reports which are published on the website and so publicly available. These include the annual PCA report and the annual Statistical Bulletin: Prescriptions Dispensed in England (derived from the PCA database), plus a number of other reports and summaries about prescribing trends that use data mainly from the epact system. The IC therefore holds very limited prescribing data at sub-national level but our staff access PCT level information through epact. We have a data sharing agreement with the PPD that we can use epact and the Toolkit to obtain and release such data to the DH and NHS bodies. The IC can request practice level prescribing data from the PPD for specific purposes although each extract needs to be approved by the PPD. Such data is normally required by the DH. These requests are usually to inform the development of policy initiatives or to monitor their outcome. The IC does not publish or release practice level prescribing data. All external requests to the IC for data at this level are sent to the BSA as data controller. Access is determined by the interpretation of relevant legislation and current DH policy. This data is protected by the Copyright, Design and Patents Act Any information supplied is for personal use only, including noncommercial research. Use for any other purpose requires a licence from the data controller. DH policy prevents release of practice level data to industry. This policy is subject to review, and comments made in response to this document will be considered as part of the review: o Data..will be aggregated to PCG/T level, or to groups of 50 GPs, whichever is the less, before being passed on to the industry. Issued October Release of other primary care data by the NHS Information Centre The IC has published practice level Quality and Outcomes Framework (QOF) data for 3 years. This includes a statistical bulletin, a number of spreadsheets and an online database so that the general public can access the results for their practice. Copyright 2008 the NHS Information Centre 4

5 Although the PPD does not publish prescribing information at practice level the total number of items prescribed by each practice is reported each month on their public website. Details given include the practice name, address and practice identifier code. 1.6 Planned release of practice level prescribing data The NHS Comparators website will provide some practice level prescribing data later this year. This will be as comparators for a number of key therapeutic areas in the same format as the Prescribing Toolkit. The website is password protected and available via the NHS net to appropriate national bodies (including the IC), SHAs, PCTs and GP practices. This data is a copy of that already available to the NHS through the Prescribing Toolkit. Provision through the NHS Comparators website is intended to allow easier alignment with other practice level data sets, including QOF data. 1.7 Requests for wider release of prescribing data The number of requests for practice level prescribing data has increased over the past year, particularly from commercial companies. Senior colleagues from the BSA, PPD and the IC met late last year to discuss these requests. The IC agreed to produce a discussion document seeking to determine whether it was possible to make prescribing data more generally accessible with due regard to appropriate legislation, professional regulations and current DH policy. Copyright 2008 the NHS Information Centre 5

6 The following part of this document covers the issues relating to the potential release of prescribing data outside the NHS. 2. Information governance Information governance issues will be thoroughly addressed and it will be ensured that appropriate steps are taken to comply with the legal, regulatory and professional obligations set out in the various Acts, Codes and Standards including: The Data Protection Act 1998 The Common Law Duty of Confidentiality The Freedom of Information Act (FOIA) 2000 The Human Rights Act 1998 ISO 27001:2005 Confidentiality: NHS Code of Practice The Information Security Management: NHS Code of Practice Re-use of Public Sector Information regulations 2.1 Data Protection Act 1998 The Data Protection Act 1998 established a set of principles for the safekeeping and handling of information that contains person identifiable data. The principles apply to information held in either an electronic or structured manual filing system The independent EU Advisory Body on Data Protection and Privacy consisting of all the Information Commissioners in Europe (including UK) issued the following statement in June 2007: Drug prescription information whether in the form of an individual prescription or in the form of patterns discerned from a number of prescriptions, can be considered as personal data about the physician who prescribes this drug, even if the patient is anonymous. EU Advisory Body on Data Protection and Privacy, June Common Law Duty of Confidentiality Common law is not documented in an Act of Parliament. It is a form of law based on previous court cases decided by judges. The law is applied by reference to those previous cases, and is said to be based on precedent. Copyright 2008 the NHS Information Centre 6

7 2.3 The Freedom of Information Act (FOIA) 2000 The FOIA lays down requirements for public bodies (including the NHS) to keep and make information available to the public on request. The main features of the Act are: a general right of access to recorded information held by public authorities, regardless of the age of the record/document; and a duty on every public authority to adopt and maintain a scheme, which relates to the publication of information by the authority and is approved by the Information Commissioner. This right of access comes with numerous exemptions, some of which will be applicable here. For example: Prescribing data are provided to the PPD by community pharmacists and dispensing practices under an obligation of confidence. This information is collected under statutory obligation (i.e. not offered ) for a limited purpose (BSA/PPA Statutory Directions). The data is thus confidential by virtue of the way it is collected. Knowledge of the number of items prescribed by a practice allows an estimate to be made of the dispensing activity and income of a nearby community pharmacy. This information could be used by commercial companies to influence the local market around new openings and relocations. 2.4 The Human Rights Act 1998 The Act incorporates the European Convention on Human Rights into UK law, allowing an individual to assert their human rights in UK courts. Article 8 of the Act the right to respect for private and family life is the most relevant section to the processing of information. 2.5 ISO 27001:2005 This Standard provides a code of practice and a set of requirements for the management of the security of information/records. The Standard is published in two parts. Part one provides a code of practice for information security management. Part two provides a specification for information security management systems. 2.6 Confidentiality: NHS Code of Practice The Confidentiality Code of Practice offers detailed guidance on: Copyright 2008 the NHS Information Centre 7

8 protecting confidential information; informing individuals about uses of their personal information; offering individuals appropriate choices about the uses of their personal information; and the circumstances in which confidential information may be used or disclosed. 2.7 The Information Security Management: NHS Code of Practice The Information Security Management: NHS Code of Practice is a guide to the methods and required standards of practice in the management of information security for those who work within or under contract to, or in business partnership with NHS organisations in England. The Code provides a key component of information governance arrangements for the NHS. The guidelines contained within the Code of Practice apply to types of NHS information. 2.8 Re-use of Public Sector Information regulations These regulations encourage public bodies to re-use the information they have collected for the benefit of business, society and the citizen ie the collective good. Requests for such information must state the purpose for which the information is to be used, and the objective to be achieved. It is also required that the benefits and any negative effects that information sharing might bring to society or to individuals should be assessed.. 3. Risks and benefits The following outlines potential risks and benefits of wider release of prescribing data. 3.1 Potential benefits associated with the wider release of prescribing data Practice level information down to presentation level is already available to the NHS. It is provided as raw data and in a range of formats (including using volume and population weightings) to allow more accurate interpretation, comparisons with other organisations and time trend analysis. This is provided via the NHS net and is password protected. In addition the IC publishes regular reports and provides specific analyses and information on request from PCTs. Commercial companies will have significant potential benefits in obtaining access to this data. For example: commercial informatics companies claim to be able to reformat the data for presentation to PCTs in a way that would be superior to the Copyright 2008 the NHS Information Centre 8

9 current systems provided by the NHS. This would be determined by market forces, but is likely to be at a cost to the NHS. 3.2 Potential risks associated with wider release of prescribing data The release of raw data may produce misleading information, if it is used out of context. Prescribing data is not directly linked to the number of patients or the conditions for which the drugs were prescribed. This makes interpretation of any variation almost impossible. There is considerable variation in prescribing patterns, which may relate to a wide range of factors, including: patterns of local service provision, patient demographics, deprivation, long term illness, co-morbidities, etc. Prescribing data can be linked to other data but correlations are not necessarily causal and interpretation is often subject to the ecological fallacy. There are no simple conclusions about levels of prescribing and quality of care Audit Commission, General Practice in England, 9 July 2002 Concerns have been expressed about the potential identification of practices providing services for sensitive conditions, such as emergency hormonal contraception, HIV, drug addiction, Alzheimer s disease, schizophrenia, etc. The provision of sensitive services may be known locally, but national release of information could lead to lobbying by patient support groups, the pharmaceutical industry and local or national media. Publication of information at practice level could lead to the identification of an individual GP (particularly single-handed practice or a GP with special interests). This could be resolved by anonymising the practice details, although the potential to identity a practice may still exist where practice size and PCT data are available. Prescribing data for treatments for rare conditions may lead to identification of patients. The normal practice to reduce this risk is by suppressing the data if it falls below a minimum agreed reporting level. There may be a political dimension in that there could be comparisons about the local implementation of national policy and NICE guidance, or about local access to high cost treatments such as fertility and cancer treatments (post code prescribing). As before, inappropriate interpretation of primary care data in isolation may lead to misleading information. Practices, prescribers and the NHS may face increased targeting from the pharmaceutical industry. The industry would argue that access to more comprehensive data would be in the public interest. The House of Commons Health Select Committee (2005) and the Public Accounts Committee (January 2008) have commented on the influence of the pharmaceutical industry on prescribers. There is potential to damage the use of the existing longitudinal databases in pharmacovigilance and health outcomes: Release of identifiable practice level prescribing data may threaten patient confidentiality in over 7 million patients whose anonymised data Copyright 2008 the NHS Information Centre 9

10 has already been released into the public domain for the purposes of research (via GPRD, QResearch, THIN, IMS Health etc) Release of identifiable practice level prescribing data will require that practice ID must be removed from all future longitudinal datasets. This may have a negative impact on case control and other studies where it is routine to control for practice environment and culture. The epact system does contain a small number of errors, which it is PPD policy not to correct. Information on over 780 million items per year are collected and used for a wide range of reports and information systems. Some errors are inevitable, and it is not possible to correct one area due to inconsistencies this would produce in other reports and systems. The PPD system was designed to support a payment process, so such corrections to raw data are not required. However, the Data Protection Act requires that published data must be accurate and up to date. Release of data known to be incorrect is in breach of the Act, and opens up the risk of legal action. Copyright 2008 the NHS Information Centre 10

11 4. Proposals for wider release of prescribing data Publication of raw practice level data is not permitted under DH policy and is unlikely to be allowable under current legislation. Also, it may not be in the best interests of the NHS or the public to disclose raw data due to the potential for it to be misleading. We are therefore not proposing to publish raw practice level prescribing data. However, release of data in a way that supports the work of the NHS, has no negative impact on service delivery, guarantees patient confidentiality, provides benefit to the public and is in the public interest, may be allowable. The issue of errors within the data remains and will need to be investigated further in discussion with the PPD and BSA. This consultation seeks views on the following proposals: Publish raw PCT level prescribing data Provide raw practice level data for specific NHS purposes only We appreciate that there are a range of stakeholders, both professional and commercial, who would wish to comment on these proposals. We feel that a wide consultation is appropriate, so this paper is published on the IC website with an associated form highlighting issues on which we welcome comments. Other comments on these proposals are also welcome. Professional stakeholders include: DH, PPD, BSA NHS organisations Pharmacy related organisations Medical related organisations Nursing related organisations Employer organisations: NHS Confederation Patient related organisations (Long term Conditions Alliance, Patients Association) The Information Commissioner 4.1 Raw PCT level prescribing data We understand that the release and publication of PCT level data is appropriate with regard to current legislation and is within DH policy. Points to consider: Copyright 2008 the NHS Information Centre 11

12 Such data could be supplied directly in response to requests, or published regularly in agreed formats on the IC website. For example: quarterly data at BNF chapter and section level could be published on the website, but lower level, for example: chemical substance, data provided only on request. It may be appropriate for there to be an approval mechanism for the direct supply outside the NHS of low level data (ie chemical substance, product, presentation level), and for there to be controls in place regarding use or dissemination. There may be some sensitive clinical areas where release into the public domain is inappropriate. 4.2 Raw practice level data for specific NHS purposes only It may be appropriate to release raw practice level prescribing data where there is a clear purpose and benefit to the NHS. This could apply to wider release within the NHS only, or to release both within and outside the NHS. For example: release to external and /or commercial organisations who wish to develop innovative support solutions for use by the NHS. Points to consider: It would be necessary to establish a Review Group to consider under what circumstances data can be released and to develop criteria to support the process There may be some sensitive clinical areas where greater control or restriction is required, or where release of data into the public domain is inappropriate. Any disclosure of raw data will require clear governance arrangements and binding contracts with those to whom data is released to ensure the data is used only for the intended purpose. The risk of inadvertent or deliberate disclosure remains, and the IC and the PPD will have a responsibility to ensure that data re-use and information sharing policies are in place and adhered to by all parties. This document is published on the IC website. The associated response form covers the issues on which we particularly value your comments. You are welcome to comment on wider issues. Copyright 2008 the NHS Information Centre 12