Information Sharing Agreement
Organisations within the Surrey Heartlands Integrated Care System are now working more closely together as part of an Integrated Care System (ICS), within four Integrated Care Partnerships (ICPs), and Primary Care Networks (PCNs).
ICS, ICP, and PCN partner organisations need to share and use personal confidential data in order to take forward key transformational activities and achieve planned improvements in care delivery and financial efficiency.
The Surrey Heartlands Health and Social Care Information Sharing Agreement [pdf] 450KB has been established to support this.
Managing the Agreement
The Surrey Heartlands Data Governance Group (DGG) manages the agreement on behalf of the members. The Administrator (NHS Surrey Heartlands at the time of writing) maintains and publishes the agreement documentation and supporting schedules and registers on behalf of the member organisations [xlsx] 18KB and the DGG. The Administrator can be contacted by email at:
The Surrey Heartlands Health and Social Care Information Sharing Agreement is aligned with the principles of data sharing detailed within the Surrey Multi Agency Information Sharing Protocol (MAISP) – Surrey County Council.
The Surrey Heartlands Health and Social Care Information Sharing Agreement is based on the Berkshire Regional ISA that has been reviewed by Queens Counsel and in his opinion, it is both lawful and fit for its purpose. A summary of the QCs opinion is available.
The aims of the agreement are:
- To provide a clear framework for the secure sharing of personal confidential data for the delivery of care and for the management of the health and social care system
- To accelerate the pace with which regional and local sharing requirements can be agreed, and
- To reduce the costs of developing and agreeing individual sharing requirements.
Specifically, this latest iteration of the agreement is designed to better support the development of:
- Federated working and networks
- Integrated working and care delivery models, and
- Latest guidance on data controllership resulting from the implementation of GDPR.
Each organisation remains responsible for the control and use of personal confidential data within the organisation as required by the legislation.
Structure of the Agreement
The Surrey Heartlands Information Sharing Agreement is executed as a subscription agreement. This form of agreement allows controlled processing and sharing to begin as soon as two controllers have signed their sharing documentation. Unlike the traditional multi-party agreement models, processing and sharing does not need to wait until all parties have executed the agreement.
Organisations become members of the agreement by signing up to the master agreement that sets out the scope and terms of membership for the agreement as well as the roles of DGG, Lead Controllers and the Administrator. The Administrator accepts the new member’s signed master agreement on behalf of the members as a whole.
Implementation of the agreement
Implementation of the agreement is as follows.
- Every member of the framework needs to sign the master agreement
- The agreement is presented through an electronic signature process as a single document
- Data controller organisations that contribute data to the shared pool as a data flow or information asset are presented with one or more additional documents describing each specific processing and sharing arrangement the controller is expected to contribute to
- Where the master agreement and one or more individual processing and sharing arrangement(s) are executed contemporaneously all documents are presented through an electronic signature process as a single document with signatures required for each item requiring approval
- Where subsequent individual processing and sharing arrangements are executed non-simultaneously the documents are presented individually through an electronic signature process for approval
We have compiled an example Master Agreement template [pdf] 450KB and its associated annexes and schedules. The Master Agreement comprises the core membership agreement document that defines the:
- Scope of the agreement
- Agreement principles and policies
- Terms and conditions
- Operational commitments made between members
- Administration arrangements
- The core agreement terms need to be signed and accepted by members.
- Data Governance Group Terms of Reference
- Joint control arrangements – Lead Controller Terms of Reference
- Notification and reporting arrangements applying to all members of the agreement
- Schedule A – Risk Sharing and Indemnity Arrangements (where a signature is also required)
- Schedule B – Qualifying Standard (compliance with requirements is verified by the Administrator)
If your organisation would like to sign up to the Surrey Heartlands Health and Social Care Information Sharing Agreement, please complete the Qualifying Standard Checklist [pdf] 675KB and email it to the Information Governance team.
Direct Care processing and sharing arrangements
These documents detail the approved Direct Care processing and sharing specifications under the Surrey Heartlands Information Sharing Agreement.
Surrey Care Record (electronic shared care record system)
- SCR001 – General Practices
- SCR002 – Adult Social Care Data: Surrey County Council
- SCR003 – Acute Data: Ashford & St. Peter’s Hospital
- SCR004 – Mental Health Data: Surrey & Borders Partnership Foundation Trust
- SCR005 – Acute Data: Royal Surrey Foundation Trust Hospital
- SCR006 – Acute Data: Epsom and St. Helier Hospitals
- SCR007 – Acute Data: Surrey & Sussex Healthcare
- SCR008 – Community Provider Data: Central Surrey Health
- SCR009 – Community Provider Data: First Community Health & Care
- SCR010 – Children’s Social Care Data: Surrey County Council
Thames Valley & Surrey Direct Care
- TDC001 – General Practices
- TDC002 – Adult Social Care Data: Surrey County Council
- TDC003 – Acute Data: Ashford & St Peter’s Hospital
- TDC004 – Mental Health Data: Surrey & Borders Partnership NHS Foundation Trust
- TDC005 – Acute Data: Royal Surrey NHS Foundation Trust
- TDC006 – Acute Data: Epsom and St. Helier Hospitals
- TDC007 – Acute Data: Surrey and Sussex Healthcare NHS Trust
- TDC008 – Community Provider Data: Central Surrey Health
- TDC009 – Community Provider Data: First Community Health & Care
- TDC010 – Children’s Social Care Data: Surrey County Council
Project Fusion (sharing of GP and community service records)
- PFU001 – General Practices
- PFU002 – Central Surrey Health / CSH Surrey
SEND (special educational needs and disability):
- SEN001 – Surrey Heartlands Clinical Commissioning Group
- SEN002 – Surrey County Council Children
Vaccination Confidence Calls
- CV001 – Vaccination Confidence Calls
Other (secondary) uses processing and sharing arrangements
The documents below detail the approved Other (secondary) uses processing and sharing specifications under the Surrey Heartlands Information Sharing Agreement.
Population Health Management (Primary Care Network Development Programme)
- PHM001 – General Practices: Guildford & Waverley ICP
- PHM002 – CCG: Guildford & Waverley ICP
Thames Valley & Surrey Population Health Management
- TSU001 – General Practices
- TSU002 – Adult Social Care Data: Surrey County Council
- TSU003 – Acute Data: Ashford & St Peter’s Hospital
- TSU004 – Mental Health Data: Surrey & Borders Partnership NHS Foundation Trust
- TSU005 – Acute Data: Royal Surrey NHS Foundation Trust
- TSU006 – Acute Data: Epsom and St. Helier Hospitals
- TSU007 – Acute Data: Surrey and Sussex Healthcare NHS Trust
- TSU008 – Community Provider Data: Central Surrey Health
- TSU009 – Community Provider Data: First Community Health & Care
- TSU010 – Children’s Social Care Data: Surrey County Council
Integrated Commissioning Team
- ICT001 – Surrey Heartlands Clinical Commissioning Group Children’s
- ICT002 – Surrey Heartlands Clinical Commissioning Group Adults
- ICT003 – Surrey County Council Children’s
- ICT004 – Surrey County Council Adults
Current approved sharing by partner organisations
There is a spreadsheet [LINK] which provides details of which organisations are participating in each data sharing initiative detailed above.
Data Protection Impact Assessments
Data Protection Impact Assessments (DPIAs) are completed for all processing and sharing activities approved under Surrey Heartlands ISA framework. Copies of summary DPIAs are available on request from the Administrator.
Organisations which share data under the Surrey Heartlands ISA framework will ensure that their Privacy Notices are updated to cover the sharing activity.
For ease of reference please find below links to the Privacy Notices for activities being taken forward under the Surrey Heartlands ISA framework:
- Surrey Care Record [LINK]
- Project Fusion – please refer to your GP Practice’s website
- EMIS Enterprise Search & Report – please refer to your GP Practice’s website
- Population Health Management (Primary Care Network Development Programme) – Guildford & Waverley ICP – please refer to your GP Practice’s website
- Integrated Commissioning [LINK]