NHS Digital Data Sharing Remote Audit: NHS North Central London Clinical Commissioning Group

Purpose

This report records the key findings of a remote data sharing audit of NHS North Central London Clinical Commissioning Group (NCL CCG) between 25 April and 4 May 2022. It provides an evaluation of how NCL CCG conforms to the requirements of both:

• the data sharing framework contract (DSFC) CON-369360-Z5R7D v2.01
• the data sharing agreement (DSA) DARS-NIC-362253-J5V8L-v3.2

 This DSA covers the provision of the following datasets:

In the DSA, the Controller is NCL CCG, and the Processors are North and East London (NEL) Clinical Support Unit (CSU), North of England CSU (NECS) and Microsoft UK. However, since the DSA was signed, there have been changes to the Processors and their roles, significantly NEL CSU. Currently the Processors are NEL CCG, London Shared Services (LSS), NECS and Microsoft UK. Further changes to these organisations are expected in July 2022 as the CCGs transition to Integrated Care Boards (ICBs) and South West London CCG assumes responsible for the infrastructure from LSS.

Because of these ongoing changes, the audit focused on the commissioning activities undertaken by NCL CCG, supported by NEL CCG and LSS. This audit did not consider the risk stratification and invoice validation activities by NCL CGG, nor did it include NECS which is predominately providing Data Services for Commissioners Regional Office (DSCRO) related services.

Data provided by NHS Digital is used to provide intelligence to support the commissioning of health services. The data is analysed so that health care provision can be planned to support the needs of the population within the CCG area.

This report also considers whether NCL CCG, NEL CCG and LSS conform to their own policies, processes and procedures.

The interviews during the audit were conducted through video conferencing.

This is an exception report based on the criteria expressed in the NHS Digital Data Sharing Remote Audit Guide version 1.

Audit type and scope

Data recipient’s acceptance statement

NCL CCG and NEL CCG have reviewed this report and confirmed that it is accurate. 

Data recipient’s action plan

NCL CCG and NEL CCG will establish a corrective action plan to address each finding shown in the findings tables below. NHS Digital will validate this plan and the resultant actions at a post audit review with the NCL CCG to confirm the findings have been satisfactorily addressed. The post audit review will also consider the outstanding evidence at which point the Audit Team may raise further findings.

The following tables identify the 5 agreement nonconformities, 1 observation, 5 opportunities for improvement and 3 points for follow-up raised as part of the audit. Given the changing nature of the Processors involved, some of the findings have been allocated to NCL CCG, even though the CCG may not be directly responsible for its action.

Use of data

NCL CCG confirmed that the datasets were only being processed and used for the purposes defined in the DSA and were not being linked with another dataset.

Data location

NCL CCG and the Processor confirmed that processing and storage locations, including disaster recovery and backups, of the datasets were limited to the locations shown in the following table. These locations conform with the territory of use defined in clause 2c of the DSA.

Backup retention

The duration for which data may be retained on backup media is:

The audit was based upon a sample of the data recipient’s activities, as observed by the audit team. The findings detailed in this audit report may not include all possible nonconformities which may exist. In addition, as the audit interviews were conducted through a video conference platform, certain controls that would normally be assessed whilst onsite could not be witnessed.

NHS Digital has prepared this audit report for its own purposes. As a result, NHS Digital does not assume any liability to any person or organisation for any loss or damage suffered or costs incurred by it arising out of, or in connection with, this report, however such loss or damage is caused. NHS Digital does not assume liability for any loss occasioned to any person or organisation acting or refraining from acting as a result of any information contained in this report.