We helped a programme targeting ex-smokers with lung health checks to complete information governance procedures and ensure personal data is protected.

Background

The Targeted Lung Health Check (TLHC) Programme team at Lancashire and South Cumbria Integrated Care System (ICS) needed help with information governance (IG). The health checks are offered to current or ex-smokers aged 55-74, aiming to diagnose and treat lung conditions, often before symptoms appear.

This was part of a national pilot study, and the entire project needed a Data Protection Impact Assessment (DPIA). The main challenges were the number of stakeholders involved and the tight timescales dictated by the national team.

Action

We helped the ICS understand why and how to complete a DPIA. Where some decisions had not yet been made (for example system suppliers and clinical providers), our expert team shared their insights and recommendations to ensure the project team could move forward quickly once decisions were made.

The multi-agency project meant that multiple DPIAs were required, but we advised that the best approach would be to map and assess the project from end to end. This gave the ICS the confidence that all data protection risks would be identified and managed, and meant that a single robust DPIA could be completed for the entire project.

Impact

Although the project was fast-paced, we kept up with the key dates and ensured sufficient risk assessments were completed at every stage.

By providing expert advice on data sharing and processing across all partner organisations, we ensured that individuals’ rights were not infringed.

It was crucial that all stakeholders were able to understand the needs of the project. Our IG team took great care in explaining the key points in simple terms. This meant the IG teams at the local NHS trusts and the ICS had the confidence and assurance to support and progress the project.

The team clearly detailed the project needs in a single DPIA document. As later versions needed to include different data controllers and processes, we used the tools and learnings from previous risk assessments to ensure that the clinical benefit was always at the forefront of these submissions.

“By completing the DPIA for the entire project, NHS Midlands and Lancashire‘s IG team ensured that all data sharing and processing was mapped and all data protection risks were identified and mitigated.

“All required versions of the DPIA were completed in line with the project live dates, and we were confident that the patients’ needs were always at the forefront of the project.”

Anne Turner and Lisa Flanagan | Senior Programme Managers: Targeted Lung Health Checks