IGT: The key to NHS data?

1 April, 2013

On Friday March 8th I attended a packed session of the NHS-HE forum convened to examine the NHS Information Governance Toolkit (IGT) and discuss its application to higher education (HE) institutions. Formerly, interest in the IGT has been generally limited to NHS trusts but since it started to be used for assessment by the National Information Governance Board (NIGB) it has permeated the consciousness of university based researchers. The toolkit is currently applied to those seeking access to patient data not covered by consent or confidentiality agreements (under section 251 of the NHS 2006 act) and also to institutions seeking access to the N3 network.

I am approaching this issue from a somewhat oblique angle, unlike many of the forum’s participants I don’t work directly with patient data in a research environment. However, the topic of information governance in university health faculties is one that crops up very frequently in our discussions with institutional central services and it’s clear the subject is causing considerable trepidation.

What can be learned?

Despite the somewhat specialist subject matter of the morning’s presentations, there were some important lessons that central services staff could take away from the speakers’ experiences.

I’d say that the key take-home message for those in support roles is that this is not a responsibility which can be devolved away entirely to research staff. There are degrees of involvement, it’s true, but compliance is conditional on the alignment of institutional policies and HR procedures with the strictures of NHS information governance requirements. In all the cases we heard from, redrafting central policies and procedures has been a vital step for those satisfying the IGT. This isn’t to say that all faculties will be obliged to meet the same requirements, that would be impractical, but for institutions considering refreshing their data policies, adopting a joined-up approach and taking account of potential future needs in this area could save a lot of time.

Presentations from the IGT coalface came from a number of researchers who had negotiated the complicated process required to achieve section 251 compliance. These all had a common, underlying theme that would give most HE managers pause for thought; specifically, the sheer amount of research resource that is being tied up in an essentially bureaucratic process. One group had two people working for 18 months fulfilling requirements that would enable them to link datasets and still, after all that time, didn’t have access to the data they need. The provision of central support and expert guidance from people familiar with both NHS and HE requirements could have realised tangible time savings in this process.

The question of whether that support is best offered at an institutional level, or nationally, or both is not yet clear but nevertheless, if universities are serious about unlocking the research benefits of working with NHS data it’s an issue that they must engage with.

It is clear that there is considerable work required before the toolkit can be cleanly applied to HE institutions; the language and use models are firmly grounded in the NHS and can’t be simply transposed.

Associated guidance

The kit is not without its benefits and offers a good introduction to best practice for those new to the subject. If that is of interest to you, other guidance to look into is that connected to the ISO20071/2 standards on information security and that offered by UCISA on the same subject.

A final piece of advice for those who may be beginning the application process now - if you can find someone who has experience of working with information governance for an NHS trust, and they are happy to speak with you, a conversation could save you significant time and effort when deciphering the language and requirements of the toolkit. There are also new resources available from the NIHR covering best practice, frameworks and researcher specific training. These will be available online in due course but can be obtained now by directly contacting Richard Corbridge, Chief Information Officer at the NIHR.