management of personal health budgets, complaints, safeguarding cases, medicines management etc. ). Involves collection of new data where the CCG will be receiving or sending identifiable data (PID) about patients and or staff. The project or activity is CCG led and will involve significant changes in processing of PID by providers (e.g. commissioning of new services, transfer of services or decommissioning of a service). The project or activity is CCG led and will impact on the way GP’s will process or share PID (commissioning a new information sharing portal/solution, providing guidance to GPs about sharing patient information). What information do I need to provide in the PIA assessment template? Stage 1 Information about the project and or activity (including project documentation/attachments)- briefly explain project aims, purpose and benefits to the organisation. Outline also project rationale and approval process. Description and details of data affected (including frequency of transfers)- describe the data/data fields and identify if it is personal confidential data, summarise records are being processed and how (e.g. transferred out due to change of provider). How many records are being processed (approximate is fine, order of magnitude is required i.e. ‘tens’, ‘hundreds’, ‘thousands’). Data retention- Length of time that the records/information will be retained. Please refer to NHS retention schedules (on the POD), consulting the IG Lead for advice if required. For example, will paper data be archived off-site and where? What are the arrangements for – destroying paper, or electronic media containing data, or deleting records? Processing data for secondary use (not related to direct care)- does the objective mean that anonymised data can be used instead of personal identifiable/confidential data. Highlight if the data will be: Anonymised: all non-essential identifiable information removed. Risks of potential re-identification need to be considered, for example, small numbers in certain categories (for example, rare health conditions/combinations of health conditions, incidents relating to care, minority ethnic groups, transgender, etc). Pseudonymised: as anonymised, except that this is usually used when data processing is at individual service user to support risk stratification or pathway design. NHS numbers/identifiers and other non-essential information are replaced with a key to protect privacy and prevent identification.
management of personal health budgets, complaints, safeguarding cases, medicines management etc. ). Involves collection of new data where the CCG will be receiving or sending data (PID) about patients and or staff. The project or activity is CCG led and will involve significant changes in processing of PID by providers (e.g. commissioning of new services, transfer of services or decommissioning of a service). The project or activity is CCG led and will impact on the way GP’s will process or share PID (commissioning a new information sharing portal/solution, providing guidance to GPs about sharing patient information). What information do I need to provide in the PIA assessment template? Stage 1 Information about the project and or activity (including project documentation/attachments)- briefly explain project aims, purpose and benefits to the organisation. Outline also project rationale and approval process. Description and details of data affected (including frequency of transfers)- describe the data/data fields and identify if it is personal confidential data, summarise records are being processed and how (e.g. transferred out due to change of provider). How many records are being processed (approximate is fine, order of magnitude is required i.e. ‘tens’, ‘hundreds’, ‘thousands’). Data retention- Length of time that the records/information will be retained. Please refer to NHS retention schedules (on the POD), consulting the IG Lead for advice if required. For example, will paper data be archived off-site – and where? What are the arrangements for destroying paper, or electronic media containing data, or deleting records? Processing data for secondary use (not related to direct care)- does the objective mean that anonymised data can be used instead of personal identifiable/confidential data. Highlight if the data will be: Anonymised: all non-essential identifiable information removed. Risks of potential re-identification need to be considered, for example, small numbers in certain categories (for example, rare health conditions/combinations of health conditions, incidents relating to care, minority ethnic groups, transgender, etc). Pseudonymised: as anonymised, except that this is usually used when data processing is at individual service user to support risk stratification or pathway design. NHS numbers/identifiers and other non-essential information are replaced with a key to protect privacy and prevent identification. identifiable