Here are some tips to prepare for the introduction of the Model Exchange Agreement so that you can meet the June 30 deadline with your data exchange agreements: data exchange has long been recognized as essential for direct delivery within the NHS: Caldicott`s 2013 review made it clear that gaps in patient care should not be due to the inability to effectively share data. The Health care and social care act 2015 introduced the obligation to share certain types of data (personal data and anonymized data) when it comes to facilitating the care of a patient. While it is possible to anonymize certain data that NCPs must share, it is inevitable that some information may identify individuals and be particularly sensitive personal data or “special category data” under the General Data Protection Regulations (GDPR). Our health care and data protection teams work closely together to help young NCPs develop their governance models and agreements, including data exchange agreements. According to the RGPD, there must be a legal basis for the transmission of personal data. There is no single legal basis for the transmission of personal data and what is appropriate depends on the nature of the data, the purpose of the processing and whether the party is acting in the public or private interest. To enable effective operation and meet the objective of the NCP, the exchange of data by NCPs must go beyond the legal exchange of information about direct patient care. With a team of more than 200 lawyers and national coverage, we are one of the leading companies that legally advise and support the NHS and independent health organizations. We act for more than 100 NHS bodies and we are on all national framework agreements – NHS SBS, NHS CPC, HealthTrust Europe, NHS Resolution, NHS Commercial Alliance and CSC. NHS England has published an agreed model with GPC England for data sharing and data processing for PCNs, available on the NHS England GP contracts page – click here. I also attached both documents to this email. NHS England will establish an agreement on the sharing of NCP models to ensure compliance with the RGPD.
The agreement is only a proposal and not mandatory. Unfortunately, one size doesn`t suit everyone when it comes to PCN settings. While it is useful to have a model document so that NCPs do not have to develop their own contract, as outlined in the guide, the model does not replace legal advice. There are some legal issues that NCP members must address before concluding and signing their data exchange agreement, including: The ability of organizations in each network to effectively exchange data between all members and associated parties will be critical to the success of the project. This will extend to public, private and service sector organizations that are expected to form networks. If your NCP uses a data processor (a computer/software company) to enable data sharing, who is responsible for managing the contractor? Who owns the contract and meets the requirements of the RGPD? Have you been diligent with respect to the contractor (and all subcontractors) required by the data protection rules? The Crown`s commercial services have issued a useful memo containing standard contractual clauses for data processing contracts, see Appendix A.