Kent and Medway mobilise integrated health and social care record

The KMCR is designed to improve outcomes and experiences for the citizens of Kent and offer considerable efficiencies and time-saving benefits to health and social care professionals across the county.

Benefits of the KMCR will include:

Patients will no longer need to keep repeating their medical and social care history when seen by different services.

Patients will be able to access their own data, helping them feel more involved and engaged in their own care.

The KMCR will enable clinicians and social carers to see what care citizens are receiving from other services such as medication prescribed, alerts or allergies, hospital test results and if the patient has a social care package. This more detailed and timely information will allow faster clinical decisions to be made, improve communications between referrers and service providers and improve continuity of care.

The KMCR does not give full access to patient records to all services but is designed to share key information that will allow health and social care professionals give local people better care and support. Information shared through the KMCR includes:

• Demographics
• Next of kin / Carer details
• Medications (current)
• Allergies
• Safeguarding alerts
• Pathology results
  • Chronological list of contact with health and social care professionals, including A&E attendances
• Key social care data (children & adults)
• Mental health summary data including medication (children and adults)
• Referrals to other organisations
• Carer & care provider details e.g. if they are being looked after by multiple agencies and contact details for each organisation
• The current location of the patient e.g. inpatient, care home, step-down, mental health unit
• Advance Directives e.g. Do Not Attempt Resuscitation (DNAR)
• Care plans (including end of life plans, crisis care plans, anticipatory care plans).

THE KMCR SUPPORTS KENT AND MEDWAY’S RESPONSE TO THE COVID-19 PANDEMIC

The KMCR is also contributing to Kent and Medway’s COVID response and recovery. A COVID dashboard has been developed to coordinate recovery and response planning across the county. The COVID dashboard provides greater intelligence and information about the virus such as hot spots, demographic information etc. In response to the pandemic, the KMCR includes information about when a patient has been tested or diagnosed with COVID to ensure continuity of care across different care settings. Rapid progress has been made in weeks rather than months as part of the county’s COVID-19 response plan and collaborative effort.

Dr Navin Kumta, clinical chair of Kent and Medway CCG said, “We are looking to this shared record to deliver a significant transformational change in Kent and Medway. As well as helping us improve the quality and safety of care for patients, it will underpin our drive to integrate citizen’s records across health and social care.”

Clair Bell, Cabinet Member for Adult Social Care & Public Health at Kent County Council commented: “The KMCR is a significant step forward which will provide benefits to health and social care professionals, and most importantly to our Kent and Medway residents. It is also a good example of how collaboration between organisations can deliver better services for everyone. I am looking forward to seeing the positive impact this will have on speed and quality of care for our residents for years to come.”

Matt Dunkley, Corporate Director for Children, Young People and Education at Kent County Council said: “The KMCR will join up records across Children’s Social Care, Adults Social Care, and community and acute health services in both Kent and Medway. This will support more timely information sharing and better decision making amongst professionals, for the benefit of Kent residents. We are looking forward to the positive impact this should have in the way we can support the most vulnerable children in Kent.”

Cllr David Brake, Portfolio Holder covering Public Health for Medway Council, said: “We are pleased to be working with our health partners on the Kent and Medway Care Record. This new innovative approach will help our residents receive better coordination of care to suit their individual health and social care needs. We are committed to supporting our most vulnerable residents, even more so in these challenging times.”

The solution is provided by Graphnet Health Ltd. The project to deliver the solution is being led by Cantium Business Solutions.

Brian Waters, chief executive, Graphnet, commented: “Kent and Medway are using a shared record as it is intended – as a driver for transformation. We are very much looking forward to working in partnership with them, helping ensure that care is efficiently and effectively co-ordinated, and that clinical decisions are well informed.”

Steve Whiting, client director for healthcare at Cantium, said: “We are very proud of the work we are doing alongside the health and social care organisations in the area to bring the KMCR to life. It’s a complex project but one which we are extremely committed to driving to success, given its potential to transform the care that people receive, in some instances changing and saving lives.”

All health and adult social care organisations must, by law, share information with each other about patients they are caring for directly, to improve care, in line with the provisions of the Health and Social Care (Safety and Quality) Act 2015. The implementation of the KMCR will enable Kent and Medway to meet this requirement mandated by central government.

Access to the KMCR will be governed by General Data Protection Regulation (GDPR) and the Data Protection Impact Assessment (DPIA) which has been approved by NHS Kent and Medway CCG.

All core providers and local authority social care teams will have access to the KMCR by April 2021. In the future, citizens will also be able to access their own patient records through the KMCR and planning for this will start from next year.

1. What sort of health and care information will be shared?

The Personal Data that is shared in the KMCR includes:

Identifying Data: Forename, Surname, Address, Date of Birth, Gender, Age, Postal Address, Postcode, Telephone Number and NHS Number.

Other categories of Personal Data: This includes:

• A list of diagnosed conditions – to make sure your clinical and care staff have an accurate record of your care
• Medication – so everyone treating you can see what medicines you have been prescribed
• Allergies – to make sure you’re not prescribed or given any medicines you can have an adverse reaction to
• Test results – to speed up treatment and care and to ensure tests are not repeated
• Referrals, clinical letters and discharge information – to make sure the people caring for you have all the information they need about other care and treatment you are having elsewhere
• Care plans (where available) – for health and care workers involved in your care to view a joined-up plan of care and the wishes you’ve asked for in relation to your care
• Relevant information about people that care for you and know you well.
• Basic details about associated people e.g. children, partners, carers, relatives etc.

2. Why do you want to share the information in my care record?

By bringing health and social care information together in one place for every authorised professional involved in your care, we can improve the safety, accuracy, speed and quality of your care.

3. Doesn’t everyone involved in my health and care already have access to my information?

At the moment your records are kept by individual organisations involved in your care.

For example, your GP will have a record and if you attend hospital, they will create a separate record. If you use adult and children’s services in local authorities, they will also create a record.

At the moment these are unlikely to be shared, meaning they can be inaccurate or incomplete. Bringing these electronic records together in one place will provide a fuller picture about your health.

4. Who will be able to access my health records? Personal Data will only be shared between the health and social care organisations that are signed up to the KMCR Joint Controllers Agreement. These include:

• Primary care (e.g. your GP practice)
• Community services
• Mental health services
• Local authority social care departments
• Secondary care (e.g. hospitals)
• Specialist services (e.g. ambulances)

Your information in the KMCR can only be seen by care professionals from these organisations directly involved in providing care to patients and service users. Only those involved in your direct care will access information that identifies you.

5. What are the main uses of data in the KMCR?

The data within the KMCR will be used for the following purposes:

Individual patient and service-user care, to:
a. protect the vital interests of patients and service-users and those of their associated carer(s).
b. support the provision of health or social care treatment or services to individuals, including their diagnosis and treatment, and the management of their care and support.
c. identifying those at risk of illness and disease and to provide preventive care.
d. activate and empower individuals in their own care by providing a personal health record.
e. coordinate, improve and optimise patient flows.
f. help management of health or social care services.
g. provision of a personal health record.
h. grant access to treatment escalation plans.
i. allow use of KMCR analytics to guide care, improve allocation of resource and prevent harm to patients.

6. How long is the data kept?

The KMCR holds a set of information about you from the health and social care organisations that provide care for you locally.

The records of those health and social care organisations are subject to retention periods set out in documents such as the IGA (Information Governance Alliance) Records Management Code of Practice for Health and Social Care.

As the information about you on the KMCR comes from local organisational systems, the data will be kept for the same amount of time that it is kept on those local systems.

7. What is the legal basis for processing data within the KMCR?

Health and social care organisations have a duty to share personal data under s251B of the Health and Social Care Act 2012, where it is:

(a) likely to facilitate the provision to the individual of health services or social care in England, and
(b) in the individual’s best interests.
The legal basis for processing data within the KMCR is ‘the provision of health or social care services’ GDPR Article 9(2)(h) and GDPR Article 6(1)(e) for a ‘task carried out in the public interest’.

8. Who is the data controller?

The KMCR is not a data controller. The organisations providing your care locally are the controllers of the data they hold about you and are working in partnership to ensure it is available for sharing within the KMCR when needed to benefit your care.

If you have any concerns about data sharing, please speak to the local care organisations who hold your records.

As there will be more than one organisation involved in the provision and processing of information about your care across the Partnership, the various system leads will act as Joint Data Controllers in accordance with the General Data Protection Regulation (EU GDPR 2016) and UK Data Protection Act 2018.

9. How can I access the information held in my record? (Subject Access Request)

You have a right to request information that is held about you. The KMCR is a collection of information from organisations across Kent and Medway that provide you with care services. (Please note it is not all the information held on you by each organisation that has cared for you, as each organisation involved in your care keeps their specific records locally). To access records of your care, you must contact the organisation(s) that have been or are currently providing your care, as they will have the full record of the care they have provided to you. This is called a Subject Access Request (SAR).

10. How is the data stored?

A record of care is held on each organisation’s secure electronic system (local record) e.g. a GP practice will have their own system for recording patient information. Graphnet, a supplier of healthcare systems, has designed a secure system that integrates data from those multiple electronic health and social care systems to provide a live and read-only summary of that data to a health or social care worker when required for the purposes of direct care.

11. Is it secure?

Yes, the data held in the KMCR will be stored securely in a resilient UK cloud-based platform hosted by Microsoft. The KMCR is subject to stringent cyber-security assessments to ensure there is strong protection to maintain the safety of health and care data.
Appropriate technical and security measures in place to protect the KMCR include:

• complying with Data Protection Legislation;
• encrypting Personal Data transmitted between partners;
• implementing and maintaining business continuity, disaster recovery and other relevant policies and procedures
• a requirement for organisations to complete the Data Security and Protection (DSP) Toolkit introduced in the National Data Guardian review of data security, consent and objections, and adhere to robust information governance management and accountability arrangements;
• use of ‘user access authentication’ mechanisms to ensure that all instances of access to any Personal Data under the KMCR are auditable against an individual accessing the KMCR;
• ensuring that all employees and contractors who are involved in the processing of Personal Data are suitably trained in maintaining the privacy and security of the Personal Data and are under contractual or statutory obligations of confidentiality concerning the Personal Data.

The NHS Digital Code of Practice on Confidential Information applies to all NHS and care staff, and they are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. All staff with access to Personal Data are trained to ensure information is kept confidential and is only shared with other professionals in the patient’s best interests.

12. What are my rights regarding information about me contained in the KMCR?

Under the Data Protection Legislation, you have the right to:

• be informed of our uses of your data (the purpose of this privacy notice)
• request copies of your personal information, commonly referred to as a Subject Access Request (SAR)
• have any factual inaccuracies corrected
• request the restriction or suppression of your personal data. This is not an absolute right and only applies in certain circumstances
• not be subject to automated decision making or profiling. There is no automated decision making or profiling in the KMCR
• complain about the handling of your data to an organisations data protection officer or to the regulator
• also have the right to object to processing of your personal data in certain circumstances.

13. How can I object to my data being shared via the KMCR?

You have a legal right to object to your data being shared. Your objection will be considered on a case by case basis. When considering your objection, we will consider whether you can still be provided with safe individual care. Please contact your health and care provider to discuss this further. This could be your GP practice or the health or social care staff that provided or are currently providing your treatment and care.

We ask you to think carefully before making this decision. Sharing your health and social care information will make it easier for services to provide the best treatment and care for you when you most need it.

Health and social care staff use your confidential patient information to help with your treatment and care. For example, when you visit a hospital your consultant may need to know the medicines you take.
Your health or social care provider can advise you of how you can use the NHS National opt-out for secondary use of your data i.e. for statistical analysis.