Confidentiality and QoF

Click Stockport Viaduct for Home Page

Stockport Drs Co-operative
226 - 230 Wellington Rd Sth
Stockport
SK2 6NW

Telephone: 0161 429 6498

26 September 2006

Confidentiality and QoF

Following representations from your LMC, Stockport PCT do not accept the LMC view that patient data accessed for QoF review purposes should be anonymised. Your LMC has therefore provided the following references for practices to decide whether they agree with the LMC's position.

Section 30 of the Department of Health's “Confidentiality and Disclosure of Information Code of Practice (March 2005)” states:

".... a decision to disclose such (patient identifiable) information to the PCT will be a matter for the contractor"

It is quite clear therefore, the Contractor's decision as to whether disclosure is appropriate.

If practices have the Apollo software and are confident that the software adequately anonymises data which according to section 20 of the Department of Health's “Confidentiality and Disclosure of Information Code of Practice (March 2005)” requires:

"the removal of name, address, full postcode, date of birth, NHS number and local patient identifiable codes, and any other detail or combination of details that might support identification"

then they should have no concerns allowing PCT access to appropriately anonymised patient information for their QoF review. If this is not the case then the following references are applicable when contractors are deciding whether disclosure is appropriate.

 Sub paragraph (i) of Section 30 of the Department of Health's “Confidentiality and Disclosure of Information Code of Practice (March 2005)” suggests that for a QoF review (for example) where no system is available to erase all identifying information:

“The practice should make a judgement in the context of each request for information as to whether or not anonymisation is practicable. Where anonymisation is not practicable, data may be released to the PCT in patient identifiable form (but see paragraph 32)."

This section appears to suggest that after reviewing each individual request for disclosure the practice could, if in agreement, release information to the PCT, subject to paragraph 32.

Paragraph 32 states that:

"Where the patient's consent is not sought to identifiable information, the reasons why must be documented and there must be a clear audit trail. The “NHS Code of Practice on Confidentiality” provides further guidance about access to and disclosure of patient-identifiable information."

The paragraph concludes by stating that "Contractors should be prepared to justify such disclosures to a court or regulatory bodies"

Turning now to the “NHS Code of Confidentiality”, Section 16 states in relation to disclosing patient identifiable information:

"Where the purpose is not directly concerned with the healthcare of a patient however, it would be wrong to assume consent. Additional efforts to gain consent are required or alternative approaches that do not rely on identifiable information will need to be developed."

The purpose of the QoF review is clearly not related to the healthcare of the patient, therefore either consent or a system that can anonymise data is required.

Section 17 of the guidance appears to offer a caveat for disclosure only when consent can NOT be obtained:

"There are situations where consent cannot be obtained for the use or disclosure of patient identifiable information, yet the public good of this use outweighs issues of privacy. Section 60 of the Health and Social Care Act 2001 currently provides an interim power to ensure that patient identifiable information, needed to support a range of important work such as clinical audit, record validation and research, can be used without the consent of patients"

However, clearly consent CAN be obtained for the purpose of the QoF review by contacting patients and recording express consent in the same manner as last year.

In Conclusion the decision as to whether Disclosure of Patient Identifiable Information rests with the Contractor.

It is your LMC's view that since the guidance contained within the Confidentiality and Disclosure of Information Code of Practice clearly makes reference to the NHS Code of Confidentiality, then practices should take particular notice of Sections 16 and 17 referred to above.

Newsletter Archive

Useful Medical Links

Practice Resources

Consortium Update

GP Forum