Practice Services- Process for review and sign-off of Data Sharing Agreements

Data Sharing Agreement (DSA) Sign off process:

Roles and responsibilities

Practice Manager – review and sign-off DSA’s in SCOPE 1. Share all new DSA at IG Board for the previous period. Log DSA’s on Practice IA/IF Log and retain a signed copy in a known place in the practice digital infrastructure.

Practice Clinical Lead review and sign-off DSA’s in SCOPE 1 with PM

BrisDoc IG Lead – point of escalation and review for PMs for SCOPE 2 DSA’s. Review of DSA log to support Practice DPST submission.

BrisDoc DPO –  point of escalation for PMs in absence of BrisDoc IG Lead and/or escalation for BrisDoc IG Lead.

Scope 1 DSA’s

Where a DSA is a request for

• anonymised low volume patient data over existing transfer mechanisms e.g. via a portal, NHSMail password protected
• practice facts and figures e.g. staff numbers, number of appointments data over existing transfer mechanisms e.g. via a portal, NHSMail password protected
• specific patient data for the delivery of direct patient care over existing transfer mechanisms e.g. EMIS
• where the DSA is a request from the ICB, PCN, NHSE

The Practice Manager should confer with appropriate practice colleagues to verify the purpose of the data sharing, sign the DSA and log on the Practice IA/IF log.

Scope 2 DSA’s

• anonymised high volume patient data over existing/new transfer mechanisms
• practice facts and figure that requires some PID data to be shared e.g via a portal, NHSMail password protected
• specific patient data for non-direct care over existing/new transfer mechanisms
• DSA requires specific BrisDoc DPO to sign
• practice financial data
• where the DSA is a request from an organisation is not as listed in SCOPE 1

The Practice Manager should confer with the appropriate practice colleagues to verify the purpose of the data sharing initially, then if there is a concern or a higher balance of risk, escalate to the BrisDoc IG Lead, who will provide guidance or refer to the DPO for signature. The Practice Manager will log the DSA log on the Practice IA/IF log

Version Control