1 Executive Summary and Safety Statement (page 30 of 18) in Clinical Safety Case Report (chapter 3 of 5) within Core Information Standard: Reports

This is an updated version of the Core Information Standard (CIS) Safety Case, which now includes Digital Social Care Information products made up of an updated standard for “About Me”, a standard for the sharing of data from Local Authorities and guidance on which sections of the CIS should be in the Care Homes view. This clinical safety case should be reviewed on an annual basis.

This PRSB Core Information Standard (CIS) standard [Ref.1] has been developed following extensive consultation with patients, carers and other citizens, health and care professionals and system vendors as set out in the Core Information Standard Final Report and Core Information Standard Survey Results and Analysis Report [Ref.2]. It is intended to be used as the standard set of headings, under which data can be viewed in any shared care record, with a clear aim that different shared care records should be interoperable. Local care records (LCR) will consist of data from multiple sources in both health and social care settings. It will not include all data from all sources and is intended to be information that is felt to be important to share.

PRSB has been asked to define a CIS, which is “A set of “Concept” headings, referred to as “Sections” under which users need to be able to view the data. This will sit in a local care record; the development and design of which will be done locally.”

However, the data viewable under these sections is entirely dependent on the source data being shared and processed appropriately so that the correct information is available under the right section at the right time and is readily accessible. The user experience is dependent on the design of the systems and the graphical user interface (GUI). All these things on which the sections are dependent are out of scope of this clinical safety review.

The CIS is only a single component of a shared care record and a separate end to end safety case will need to be made for each record system. Such a safety case may reference this clinical safety case for the Core Information Standard element of it.

The CIS model does not contain all the contextual information available for data items and therefore it is not expected that the Core Information Standard will be the only view available in any shared record system.

The CIS view of information is over and above and in no way a replacement for existing health record systems. It is also a “Core” record and will not, by definition, contain all data.

The safety case is for a read only record for direct care and if it should become a read/write record and source of original data, the safety case would need to be reviewed. Any use for secondary uses of the data should also consider any clinical safety impacts.

The Hazard workshop for the CIS identified 30 hazards. The addition of the digital social care information products identified an additional six hazards. The review as a result of changes to the sex and gender data items resulted in a change to one hazard and the addition of another hazard. Thirty one of these have an acceptable residual risk of 2. The remaining six have a residual risk of 3, which includes two of the new hazards.

Many of the hazards are concerning the data, which could be missing, misplaced, inaccurate or conflicting and potentially present but inaccessible. Mitigations for all of these include system design and training.

There are hazards related to some specific sections. These are Allergies, Medications, Problems and Diagnoses, Alerts and Care plans. In these areas the concerns are about the different data models in contributing systems and the need for training in both using local care records and recording data in source systems, which needs to be shared. Also, the significance of getting the information wrong.

One hazard was initially identified as being at risk level 4 is:

Hazard 16: Sex data item may cause accidental disclosure of gender reassignment without consent. However, this hazard was subsequently re-evaluated as a result of updates to the standard and clarification of the disclosure risk and scored 3, reduced to 2 on mitigation. The hazard now reads as follows: Hazard 16: Recording an individual's 'Gender identity' alongside their 'Sex at birth (observed)' in their clinical record and displaying together along with 'Administrative gender' (derived from the Personal Demographics Service) may cause accidental disclosure of transgender, non-binary or gender diverse status causing psychological harm.

The other hazards with a residual undesirable risk level of 3 are:

• Hazard 8: The context or provenance of the information is lost, unknown or misunderstood. The CIS is a set of sections under which information is displayed, but that this view does not allow all the useful context and provenance of the information. Other views of the data should be made available using the relationships between data items defined in the Logical Data Model for LCRs. The addition of data from Local Authorities (which may include child protection or vulnerable adult data) and the About Me section, (which is created by the subject of the record or their proxy) have increased the importance of users of the system understanding the source of the data and its context when making judgements on the validity of an entry.

• Hazard 11: Significant problems, diagnoses, conditions or procedures are not visible to healthcare user. The Problems and Diagnoses section it is recognized that further work needs to be done to develop a clear idea of precisely what data should be contained in it. Methods for updating and curating the data will also need to be established.

• Hazard 24: Failure to adopt the CIS. The development of the CIS standard needs to be supported in its adoption by promotion by NHS Digital, NHS England, PRSB, social care bodies including care home and local authority representatives and pharmacy bodies and stakeholder organisations who have provided endorsement for the standard. The heterogeneity in the data items recorded by different local authorities and care homes will increase this risk as certain centres may consider the scope of the standards as limited or difficult to implement. Failure to adopt it risks multiple different models being adopted, resulting in lack of interoperability and lack of user familiarity. Leading to loss of benefit and potential patient harm.

• Hazard 25: CIS used out of scope. The safety case is based on the CIS being used in scope. The heterogeneity in the data items recorded by different local authorities and care homes will increase this risk as certain centres may consider the scope of the standards as limited or difficult to implement. The implementation guidance should be followed.

• Hazard 30: Patient data error in interconnecting systems (Out of scope for Middleware Manufacturer noted here for Health Organisation only). The addition of data from Local Authorities has increased this risk to a level 3 and it remains at this level of residual risk. Identifying demographics information should be obtained from established sources such as the Patient Administration System [PAS] or national Patient Demographic Service [PDS]) – however, it is recognised that data may be missing, incorrect, incomplete, out of date or corrupt; creating a clinical safety risk. Local Authorities have identified significant issues in NHS number tracing, which is legal requirement.

• Hazard 31 – Data in the legal section misunderstood or missing: The importance of being able to locate original documents was strongly emphasised. It is critical during transfers of care that there are processes in place to ensure original documents (e.g. DNACPR forms) can be viewed and mechanisms are there to ensure that these documents are up to date. It is recognised that national solutions are currently being sought to this problem.

All risks identified in the Hazard log are transferred, to those who incorporate the Core Information Standard and the Digital Social Care information into their EHR (Electronic Health Record). There are mitigations and training recommended for the risks that should be undertaken where possible to reduce them to the lowest possible risk.

Any safety incidents occurring, which might be due to the CIS must be reported promptly to the PRSB for review.