Organisations within the Surrey Heartlands Integrated Care System are now working more closely together as part of an Integrated Care System (ICS), within four Integrated Care Partnerships (ICPs), and Primary Care Networks (PCNs).
ICS, ICP, and PCN partner organisations need to share and use personal confidential data in order to take forward key transformational activities and achieve planned improvements in care delivery and financial efficiency. The Surrey Heartlands Health and Social Care Information Sharing Agreement has been established to support this.
The Surrey Heartlands Data Governance Group (DGG) manages the agreement on behalf of the members. The Administrator (NHS Surrey Heartlands Clinical Commissioning Group at the time of writing) maintains and publishes the agreement documentation and supporting schedules and registers on behalf of the member organisations and the DGG. The Administrator can be contacted by email.
The Surrey Heartlands Health and Social Care Information Sharing Agreement is aligned with the principles of data sharing detailed within the Surrey Multi Agency Information Sharing Protocol (MAISP) – Surrey County Council.
The Surrey Heartlands Health and Social Care Information Sharing Agreement is based on the Berkshire Regional ISA that has been reviewed by Queens Counsel and in his opinion it is both lawful and fit for its purpose. A summary of the QCs opinion is available here.
The aims of the agreement are:
- To provide a clear framework for the secure sharing of personal confidential data for the delivery of care and for the management of the health and social care system
- To accelerate the pace with which regional and local sharing requirements can be agreed, and
- To reduce the costs of developing and agreeing individual sharing requirements.
Specifically, this latest iteration of the agreement is designed to better support the development of:
- Federated working and networks
- Integrated working and care delivery models, and
- Latest guidance on data controllership resulting from the implementation of GDPR.
Each organisation remains responsible for the control and use of personal confidential data within the organisation as required by the legislation.
Structure of the Agreement
The Surrey Heartlands Information Sharing Agreement is executed as a subscription agreement. This form of agreement allows controlled processing and sharing to begin as soon as two controllers have signed their sharing documentation. Unlike the traditional multi-party agreement models, processing and sharing does not need to wait until all parties have executed the agreement.
Organisations become members of the agreement by signing up to the master agreement that sets out the scope and terms of membership for the agreement as well as the roles of DGG, Lead Controllers and the Administrator. The Administrator accepts the new member’s signed master agreement on behalf of the members as a whole.
Implementation of the agreement is as follows:
- Every member of the framework needs to sign the master agreement;
- The agreement is presented through an electronic signature process as a single document;
- Data controller organisations that contribute data to the shared pool as a data flow or information asset are presented with one or more additional documents describing each specific processing and sharing arrangement the controller is expected to contribute to;
- Where the master agreement and one or more individual processing and sharing arrangement(s) are executed contemporaneously all documents are presented through an electronic signature process as a single document with signatures required for each item requiring approval; and
- Where subsequent individual processing and sharing arrangements are executed non-simultaneously the documents are presented individually through an electronic signature process for approval.
We have compiled an example Master Agreement and its associated annexes and schedules. The Master Agreement comprises the core membership agreement document that defines the:
- Scope of the agreement
- Agreement principles and policies
- Terms and conditions
- Operational commitments made between members
- Administration arrangements
The core agreement terms need to be signed and accepted by members.
The Master Agreement also includes three annexes:
- Data Governance Group Terms of Reference
- Joint control arrangements – Lead Controller Terms of Reference
- Notification and reporting arrangements applying to all members of the agreement
The Master Agreement also includes:
Schedule A – Risk Sharing and Indemnity Arrangements (where a signature is also required)
Schedule B – Qualifying Standard (compliance with requirements is verified by the Administrator)
If your organisation would like to sign up to the Surrey Heartlands Health and Social Care Information Sharing Agreement, please complete the Qualifying Standard checklist and email it to us.
Direct Care processing and sharing arrangements
These documents detail the approved Direct Care processing and sharing specifications under the Surrey Heartlands Information Sharing Agreement:
Surrey Care Record (electronic shared care record system):
Thames Valley & Surrey Direct Care:
Project Fusion (sharing of GP and community service records):
SEND (special educational needs and disability):
Other (secondary) Uses processing and sharing arrangements
The documents below detail the approved Other (secondary) Uses processing and sharing specifications under the Surrey Heartlands Information Sharing Agreement:
Population Health Management (Primary Care Network Development Programme)
Thames Valley & Surrey Population Health Management:
Integrated Commissioning Team
Current Approved Sharing by Partner Organisation
There is a spreadsheet which provides details of which organisations are participating in each data sharing initiative detailed above.
Data Protection Impact Assessments
Data Protection Impact Assessments (DPIAs) are completed for all processing and sharing activities approved under Surrey Heartlands ISA framework. Copies of summary DPIAs are available on request from the Administrator.
Organisations which share data under the Surrey Heartlands ISA framework will ensure that their Privacy Notices are updated to cover the sharing activity.
For ease of reference please find below links to the Privacy Notices for activities being taken forward under the Surrey Heartlands ISA framework:
- Surrey Care Record
- Project Fusion – please refer to your GP Practice’s website
- EMIS Enterprise Search & Report – please refer to your GP Practice’s website
- Population Health Management (Primary Care Network Development Programme) – Guildford & Waverley ICP – please refer to your GP Practice’s website
- Integrated Commissioning
Please contact the Administrator for the Surrey Heartlands ISA by email.
Content last updated by CCG’s Data Protection Officer on 18/11/2021.