27.5.20 Communication from NHS England and NHSX to GP and CCG DPOs
This communication is being sent from NHS England and NHSX to all GP and CCG Data Protection Officers to advise them of the imminent integration of eConsult’s online consultation services into the NHS App and the information governance arrangements that have been put in place to facilitate the prompt rollout of this solution to GPs. eConsult is just one of many suppliers and does not necessarily need to be adopted as a result of the NHS App integration.
Given the importance of online consultation solutions in supporting Government guidelines regarding social distancing and isolation during the Covid-19 pandemic, national compliance arrangements have been agreed with NHS Digital, NHS England and NHS Improvement, and NHSX that do not require active opt-in by GPs. This will facilitate rapid rollout to take place.
Please note that these arrangements only apply to GP practices that use, or intend to use, the eConsult service.
The eConsult platform is an online consultation solution that is already being utilised by a significant number of GPs and some other care providers. In most cases, eConsult will have been procured by CCGs on behalf of practices, although some practices may have procured the eConsult product directly. There has been a long-standing intention to integrate online consultation products into the NHS App and the eConsult product has been through this integration process. The integration had been in live testing in 8 practices since early December 2019.
The integration means that NHS App users that are registered to practices using the eConsult solution will be able to go through an eConsult journey from within the NHS App. The eConsult will arrive at the practice in the usual way. The original intention was to roll out the integrated solution gradually, but due to the covid-19 crisis we have now put measures in place to enable this to happen as a national ‘switch on’. This means that, starting from 28th April 2020 patients that are registered with a practice using eConsult will be enabled to submit eConsults via the NHS App. This will be an accelerated rollout with practices being enabled throughout a two-week period as we monitor performance.
As eConsults will arrive in the practice in the same way as before, practices are unlikely to see any significant change as a result of this initiative. However, they may experience an increase in eConsults due to usage via the App. The experience of those practices that have been testing the integration is positive, the additional channel was used by patients to submit eConsults without having a negative impact on the practice staff regarding volumes. Overall the pilot showed an average of 3.37 eConsult per day per 1000 patients.
Information Governance Roles, Responsibilities and Agreements
NHS England and NHS Improvement, NHSX and NHS Digital, have sought legal advice on the data sharing and processing arrangements that need to be in place to support roll out of the integration between eConsult and the NHS App. Following this advice and in the interests of rapid deployment to support the Covid-19 response, we have established an approach to data sharing and processing as follows:
● For the purposes of GDPR, the GP and NHS England will act as Joint Data Controllers for the provision of the integrated service provided by eConsult via the NHS App. The NHS App is provided by NHS Digital.
● Both NHS Digital and eConsult will be Processors for this service.
● Practices using eConsult (or their CCG on their behalf) will have entered into a Principal Agreement with eConsult, providing a legal contract from a commercial perspective.
NHS England, as a Joint Data Controller, has entered into a Data Processing Agreement with eConsult for the provision of this integrated service and you can find a copy of the Data Processing Agreement attached. NHS England has also undertaken assurance and due diligence of eConsult, as required under GDPR.
We have also attached a copy of a Joint Data Controller Agreement that outlines the GP and NHS England’s respective responsibilities with regards this arrangement. To summarise, your GP(s) will retain responsibility for managing their patients’ personal data, including subjects’ rights requests and local personal data breaches. NHS England will be responsible for managing any system-wide incidents and national assurance of eConsult’s compliance with data protection legislation on GPs’ behalf. We have also attached a copy of the Data Protection Impact Assessment for your information.
These documents do not require signing by your GP(s), though you or they may contact us using the details below with any concerns or questions.
Please note that NHS England and NHS Improvement, NHSX and NHS Digital, upon receipt of appropriate legal advice, have reviewed and are comfortable with both the terms of the Data Processing Agreement and the approach we have proposed to enable rapid deployment to support the NHS’ Covid-19 response. These arrangements will be formally reviewed within six months to ensure they remain fit for purpose in the longer term.
If you have any queries or concerns regarding this communication, please contact NHSX’s Information Governance Policy Team at firstname.lastname@example.org.