Information Sharing Agreement

Organisations within the Surrey Heartlands Integrated Care System are now working more closely together as part of an Integrated Care System (ICS), within four Integrated Care Partnerships (ICPs), and Primary Care Networks (PCNs).

ICS, ICP, and PCN partner organisations need to share and use personal confidential data in order to take forward key transformational activities and achieve planned improvements in care delivery and financial efficiency.

The Surrey Heartlands Health and Social Care Information Sharing Agreement [pdf] 454KB has been established to support this. 

Managing the Agreement

The Surrey Heartlands Data Governance Group (DGG) manages the agreement on behalf of the members. The Administrator (NHS Surrey Heartlands at the time of writing) maintains and publishes the agreement documentation and supporting schedules and registers on behalf of the participating organisations [xlsx] 23KB and the DGG.  The Administrator can be contacted by email at:

syheartlandsicb.isaadmin@nhs.net

The Surrey Heartlands Health and Social Care Information Sharing Agreement is aligned with the principles of data sharing detailed within the Surrey Multi Agency Information Sharing Protocol (MAISP) – Surrey County Council.

The Surrey Heartlands Health and Social Care Information Sharing Agreement is based on the Berkshire Regional ISA that has been reviewed by Queens Counsel and in his opinion, it is both lawful and fit for its purpose. A summary of the QCs opinion is available.

The aims of the agreement are:

  1. To provide a clear framework for the secure sharing of personal confidential data for the delivery of care and for the management of the health and social care system
  2. To accelerate the pace with which regional and local sharing requirements can be agreed, and
  3. To reduce the costs of developing and agreeing individual sharing requirements.

Specifically, this latest iteration of the agreement is designed to better support the development of:

  • Federated working and networks
  • Integrated working and care delivery models, and
  • Latest guidance on data controllership resulting from the implementation of GDPR.

Each organisation remains responsible for the control and use of personal confidential data within the organisation as required by the legislation.

Structure of the Agreement

The Surrey Heartlands Information Sharing Agreement is executed as a subscription agreement. This form of agreement allows controlled processing and sharing to begin as soon as two controllers have signed their sharing documentation. Unlike the traditional multi-party agreement models, processing and sharing does not need to wait until all parties have executed the agreement. 

Organisations become members of the agreement by signing up to the master agreement that sets out the scope and terms of membership for the agreement as well as the roles of DGG, Lead Controllers and the Administrator. The Administrator accepts the new member’s signed master agreement on behalf of the members as a whole.

Implementation of the agreement

Implementation of the agreement is as follows.

  1. Every member of the framework needs to sign the master agreement
  2. The agreement is presented through an electronic signature process as a single document
  3. Data controller organisations that contribute data to the shared pool as a data flow or information asset are presented with one or more additional documents describing each specific processing and sharing arrangement the controller is expected to contribute to
  4. Where the master agreement and one or more individual processing and sharing arrangement(s) are executed contemporaneously all documents are presented through an electronic signature process as a single document with signatures required for each item requiring approval
  5. Where subsequent individual processing and sharing arrangements are executed non-simultaneously the documents are presented individually through an electronic signature process for approval

Direct Care processing and sharing arrangements

These documents detail the approved Direct Care processing and sharing specifications under the Surrey Heartlands Information Sharing Agreement.

Surrey Care Record (electronic shared care record system)

  • SCR001 – General Practices
  • SCR002 – Adult Social Care Data: Surrey County Council
  • SCR003 – Acute Data: Ashford & St. Peter’s Hospital
  • SCR004 – Mental Health Data: Surrey & Borders Partnership Foundation Trust
  • SCR005 – Acute Data: Royal Surrey Foundation Trust Hospital
  • SCR006 – Acute Data: Epsom and St. Helier Hospitals
  • SCR007 – Acute Data: Surrey & Sussex Healthcare
  • SCR008 – Community Provider Data: Central Surrey Health
  • SCR009 – Community Provider Data: First Community Health & Care
  • SCR010 – Children’s Social Care Data: Surrey County Council

Thames Valley & Surrey Direct Care

  • TDC001 – General Practices
  • TDC002 – Adult Social Care Data: Surrey County Council
  • TDC003 – Acute Data: Ashford & St Peter’s Hospital
  • TDC004 – Mental Health Data: Surrey & Borders Partnership NHS Foundation Trust
  • TDC005 – Acute Data: Royal Surrey NHS Foundation Trust
  • TDC006 – Acute Data: Epsom and St. Helier Hospitals
  • TDC007 – Acute Data: Surrey and Sussex Healthcare NHS Trust
  • TDC008 – Community Provider Data: Central Surrey Health
  • TDC009 – Community Provider Data: First Community Health & Care
  • TDC010 – Children’s Social Care Data: Surrey County Council

Project Fusion (sharing of GP and community service records)

  • PFU001 – General Practices
  • PFU002 – Central Surrey Health / CSH Surrey

SEND (special educational needs and disability):

  • SEN001 – Surrey Heartlands Clinical Commissioning Group
  • SEN002 – Surrey County Council Children

Other (secondary) uses processing and sharing arrangements

The documents below detail the approved Other (secondary) uses processing and sharing specifications under the Surrey Heartlands Information Sharing Agreement.

Thames Valley & Surrey Population Health Management

  • TSU001 – General Practices
  • TSU002 – Adult Social Care Data: Surrey County Council
  • TSU003 – Acute Data: Ashford & St Peter’s Hospital
  • TSU004 – Mental Health Data: Surrey & Borders Partnership NHS Foundation Trust
  • TSU005 – Acute Data: Royal Surrey NHS Foundation Trust
  • TSU006 – Acute Data: Epsom and St. Helier Hospitals
  • TSU007 – Acute Data: Surrey and Sussex Healthcare NHS Trust
  • TSU008 – Community Provider Data: Central Surrey Health
  • TSU009 – Community Provider Data: First Community Health & Care
  • TSU010 – Children’s Social Care Data: Surrey County Council

Integrated Commissioning Team

  • ICT001 – Surrey Heartlands Clinical Commissioning Group Children’s
  • ICT002 – Surrey Heartlands Clinical Commissioning Group Adults
  • ICT003 – Surrey County Council Children’s
  • ICT004 – Surrey County Council Adults

Current approved sharing by partner organisations

There is a participating organisations [xlsx] 22KB spreadsheet which provides details of which organisations are participating in each data sharing initiative detailed above. 

Data Protection Impact Assessments

Data Protection Impact Assessments (DPIAs) are completed for all processing and sharing activities approved under Surrey Heartlands ISA framework.  Copies of summary DPIAs are available on request from the Administrator.

syheartlandsicb.isaadmin@nhs.net

Privacy notices

Organisations which share data under the Surrey Heartlands ISA framework will ensure that their Privacy Notices are updated to cover the sharing activity. 

For ease of reference please find below links to the Privacy Notices for activities being taken forward under the Surrey Heartlands ISA framework: