Mills & Reeve: Health and Care Update

The Data Protection Act is dead. Long live the Data Protection Act.

The new Data Protection Bill is out. One day it will become a new Act. Parliament will be taking a look, as are we, and you might like to.

The Bill will replace the Data Protection Act 1998. It provides the framework for data protection in the UK along with the General Data Protection Regulations. The Regulations will be taken into UK law when the UK exits the ‘Union’.

The Bill is good news and seen by many information governance practitioners as the final piece of the jigsaw that will make up the data protection reform. It will modernise data protection law to meet the needs of the twenty-first century digital economy. It will also support the delivery of UK health and care services and the fight against cyber-crime.

There is much to digest – the Bill is complex and it will take time to get our heads around all it will mean. It’s likely to undergo critical scrutiny in Parliament and by other interested stakeholders. So, it’s likely that we will see quite a few changes. So more blogs to come!

The Bill has been drafted to sit neatly alongside the EU’s General Data Protection Regulation which comes into force on 25 May 2018 and which will implement the EU Data Protection Law Enforcement Directive on 6 May 2018.

We highlight a few of our early observations on the Bill in our one page briefing. If you have an questions do get in touch with Stuart Knowles or Jill Weston.

Withdrawal of Clinically Assisted Nutrition and Hydration – A topical issue

Yesterday the Court of Protection handed down another very helpful judgment in connection with the withdrawal of Clinically Assisted Nutrition and Hydration (CANH).

This follows swiftly on the heels of the Court of Appeal’s decision in Briggs in July.

The case of M v a Hospital started back in April 2017 (so before the decision in Briggs). It related to a 50-year-old patient with Huntington’s disease who was in a Minimally Conscious State (MCS).

Readers will recall that in Briggs, in terms of Practice Direction 9E (PD9E), the Court of Appeal said this PD did not set up any legal obligation for hospitals to apply to the court in all Persistent Vegetative State (PVS) and MCS cases. It was merely guidance and should not be interpreted as having introduced a requirement that all cases where a decision is to be made about the withdrawal of CANH must come before a court. 

Judgment was handed down in this new case of M partly in response to a request for clarification, from the parties, as to whether legal proceedings were necessary or not when there was agreement between the family and her clinicians that CANH was no longer in her best interests.

The short answer was that Mr Justice Peter Jackson was of the view that, on the facts of this case, it was not necessary to issue legal proceedings as a matter of law but he could understand why, due to the terms of PD9E and the law before the Court of Appeal decision in Briggs, the application was made.  

Mr Justice Jackson noted that in Briggs the question of whether proceedings had been necessary was not decisive and had not been the subject of full argument (particularly from the Official Solicitor (OS)). So, in M, he received written submissions from counsel for the family, the hospital and invited them from the OS. In M the OS was not formally involved in the proceedings and did not have the opportunity to make oral submissions. However, in their written submissions, the OS “trenchantly asserted” that an application to court should be made in every case of proposed withdrawal of CANH unless there is a valid advance decision. 

The judge summarised some of the key points in the OS’s submissions which included:

• The common law requires an application as an essential safeguard for persons who are extremely vulnerable, even where there is agreement.
• Bland should still be followed. 
• The possibility of incorrect diagnosis and incorrect prognosis must be guarded against.
• There are risks attached to over ready acceptance of relatives’ accounts of patients’ likely views.

The judge made the following points:

• The right to life belongs to everyone, enabled and disabled. Individuals who are in PVS or MCS are at the extremes of vulnerability,but many of us will at some time in our lives come to be in a precarious state. Overwhelmingly, treatment decisions up to and including the withholding and withdrawal of life support are taken by clinicians and families working together. No one suggests that these decisions should all be the subject of external supervision.
• Are these cases so different in kind to other serious medical treatment decisions as to justify a completely different approach? The reasons given for requiring all PVS/MCS cases to come before the court could equally apply to a very much larger patient population.
• Consideration must also be given to the deterrent effect of costly and time consuming proceedings. A mandatory litigation requirement may deflect clinicians and families from making true best interests decisions and in some cases lead to inappropriate treatment continuing by default. He noted that in this case, M received CANH which neither her doctors nor her family thought was in her best interests, for almost a year until a court decision was eventually sought.
• It is not suggested that the court be involved in PVS/MCS cases where there is a valid and applicable advance decision, yet the grave consequences of the decision and the risk of error are no different in such cases.

In his judgment, therefore, a decision to withdraw CANH, taken in accordance with the prevailing professional guidance - currently the General Medical Council’s Good Medical Practice guidance, the British Medical Association’s guidance Withholding and Withdrawing Life Prolonging Medical Treatment and End of Life Care and the Royal College of Physicians’ guidance on Prolonged Disorders of Consciousness - will be lawful and the clinicians will benefit from the protection of section 5 Mental Capacity Act.

He was keen to emphasise that the conclusion does not in any way detract from the crucial importance of structured medical assessment in PVS/MCS cases. Nor does it detract from the obvious need for expert second opinions.

However, he highlighted that the court is always available where there is disagreement or where it is felt for some other reason that an application should be made but this will only arise in rare cases. He also emphasised that every case is intensely fact specific and those considering withdrawal of CANH should not hesitate to approach the Court of Protection in any case in which it seems right to them to do so.

So hopefully this now clarifies matters further in such cases. However, if you have any cases which you are concerned about then please do not hesitate to contact our expert team here at Mills & Reeve.

Jill Mason, Partner

A quick guide: How to manage Personal Health Budgets effectively

Commissioners from time to time face legal challenges to decisions about PHBs. These are often complex matters involving individuals in receipt of NHS Continuing Healthcare with long-standing health conditions. It is not uncommon for these legal challenges to emerge as a consequence of a breakdown in the PHB arrangement, or because a request by an individual or their family for a PHB has been refused in the first place. By ensuring a clear and consistent approach to PHBs, commissioners can minimise the risk of a challenge and keep costs to a minimum.

We have produced a quick guide including ten golden rules for managing PHBs – if you would be interested in our quick guide, get in touch with Samuel Lindsay or Jane Williams to request a copy.

Ransomware – Is your health and care organisation cyber-secure ?

Embedding a strong cyber secure culture is a ‘must do’ item on the agenda of all NHS and independent sector health organisations. What is the alternative when failure to safeguard patient sensitive data leads to disaster? And, you don’t want that.

It is only four months since the WannaCry cyber-attack and not to mention the more recent NotPetya cyber-attack. These ransomware attacks remain a salutary reminder of the need to review and tighten up policies and ensure that organisations have back-up systems in place. Victims of ransomware attacks may be tempted to pay the ransom but to do so rarely results in a happy ending.

To find out more – our sister blog, fusion takes a look at the steps you can take to ensure your organisation is cyber secure.

Migration Advisory Committee call for evidence

The Migration Advisory Committee, which advises the Government on immigration matters, currently has a call for evidence on the economic and social impacts of the UK’s exit from the European Union and also on how the UK’s immigration system should be aligned with a modern industrial strategy.

The Government typically implements many of the recommendations of the MAC, so this is an important opportunity for health and care employers to input into the process which will shape the implementation of a new immigration system post-Brexit. The MAC is running events in regional locations over the next few weeks which organisations can attend; the list of locations can be found here.

Our immigration team is continuing to provide advice and support to health and care employers and their European national staff on the implications of Brexit, and actions that European nationals should consider now. This includes providing workshops, briefing sessions, and advice surgeries for staff. Do get in touch with our immigration team if you would like to discuss how we can help.      

Tracy Yates, Consultant

Workplace monitoring – how far can employers go?

We now have guidance from the Grand Chamber of the European Court of Human Rights following its recent decision in Bărbulescu v Romania. The key point to emerge is that for employer monitoring to be compatible with the right to privacy conferred by Convention, advance notification normally needs to be given. You can read a summary of the Grand Chamber’s guidelines on our sister blog, hr law live.

DH consults on proposed changes to legislation as part of the evolution of the Accountable Care Models Contract

The Department of Health has opened a consultation on proposed changes to legislation, which are considered necessary as part of the development of the Accountable Care Models Contract (ACM Contract). 

The latest draft ACM Contract was published in August 2017. This new contract is largely based on the NHS Standard Contract and the APMS contract designed to cover integrated service provision. In developing that contract, a number of areas of legislation have been identified as requiring amendment so that the new contract and care models can operate effectively. The consultation document sets out the proposed amendments and gives an opportunity to comment on them by 5 November 2017. 

Main areas of proposed amendments include:

• Allowing providers to suspend their GMS or PMS contracts while participating in an Accountable Care Organisation (ACO). Patients will move to the registered list of the ACO, or may re-register. There will be an opportunity to reactivate the existing GMS/PMS contract at two year intervals.
• Extension of the restriction on sale of goodwill in medical practices, so that it covers primary care providers operating under the ACM Contract or a sub-contract. This is to ensure that the same rules apply as to existing primary care providers.
• Amendment of the Performer’s List regulations so that providers can confirm that they provide services under the ACM Contract, rather than having to confirm they provide services under GMS or PMS.
• Extension of the complaints handling requirements so that they also apply equally to parties operating under ACM Contracts or sub-contracts. This also aims to provide clarity to service users.

You can access the consultation document here.

Fiona Payne, Principal Associate

Pharmacists should form part of the inspection team, says the RPS

According to the Royal Pharmaceutical Society’s submission to the CQC’s latest consultation on its next phase of regulation, it believes that “all inspectorate teams should include a pharmacist who will have professional and clinical oversight of medicines issues”. Having a pharmacist as an integral part of the team means they will notice any medicines issues which could potentially be overlooked, suggests the RPS.

In addition, the RPS would expect the inspection teams to “make a judgement on how the organisation/pathway being inspected was providing leadership for medicines (systems, processes and medicines optimisation), recognising the importance of medicines and their use across the organisation/ pathway.” For example, the RPS say this should include a review of the systems that are in place for the transfer of medicines information when the patient moves between different care settings, ensuring that there is a process to minimise medicines related risk. Clearly the scope of the CQC and General Pharmaceutical Council would need to be defined making it clear who is responsible for each part of the medicine’s journey.

As for medicines optimisation, the RPS suggest that this should be used as part of the assessment process, to ensure that the organisation/pathway is delivering safe and effective care where medicines are concerned. Example issues include, does the organisation involve patients and their carers in decisions about their treatment and that patients are at the centre of decision making about their medicines.

The CQC has had a number of different regulatory methodologies since it was established in 2009 – its approach has often been based on a national desire for a more regulated health and care service after revelations about poor care found, for example, at Winterbourne View and Mid Staffordshire NHS Foundation Trust. This latest consultation forms part of its wider consultation on changes to the CQC’s inspection regime.

The CQC's consultation includes changes to the regulation of primary medical services, including monitoring the quality in GP practices with which the RPS are in full agreement. Interestingly, they suggest that one of the “key monitoring questions could be whether or not the practice has a practice pharmacist as part of the team. Having a practice pharmacist has shown to free up one hour of GPs time each day..”

You can read the RPS’s full response to the CQC’s consultation here; in the interim we await the CQC's response.

Dawn Brathwaite, Partner

Two more General Data Protection Regulation “myths busted” – the burden on business and breach reporting

The ICO continues with the series of blogs which, it is suggested, aim to separate the “GDPR fact from the GDPR fiction”. These blogs have come in for some criticism – take a look and see what you think. Do you agree with what they say?

What is clear is that, the ICO is working hard to raise the profile of the imminent changes to data protection.

Breach reporting under the GDPR – what are the facts?

It will be mandatory to report a personal data breach if there is a risk to people’s rights and freedoms – if it’s unlikely, then you don’t need to report says the ICO. This will be new territory for many organisations. As things currently stand, most personal data breach reporting is seen as “best practice but not compulsory”.

Establishing what constitutes a high risk for the purpose of reporting a breach to the ICO is key. The ICO’s GDPR overviews set out examples of high risk situations. For example, if there is the potential of people to suffer significant personal detrimental effect – such as discrimination or damage to reputation.

As for when an organisation will need to report the breach, the ICO confirm not later than 72 hours after having become aware of it. But. The ICO will not expect to receive a comprehensive report at the outset. The Regulator is now on record as saying it will not impose a fine in every breach case. In short, it is suggested, reporting a breach in an open and transparent manner (and without undue delay) will mean that fines can be avoided.  

You can read Elizabeth Denham’s blog on breach reporting here.

An onerous and costly regime to administer?

Moving onto another “widely held misconception” according to Deputy Commissioner Steve Wood “that the new regime is an onerous imposition of unnecessary and costly red tape.”  Wood in his blog post asserts that the new regime is “an evolution in data protection, not a revolution” and is keen to emphasise that the GDPR is building on the existing foundations of accountability of organisations for their use of personal data and enhancing the existing rights of individuals. Interestingly, Wood points out that the ICO’s latest annual research “consistently shows that levels of public trust remain low” but that the public would be “more willing” to provide their data, if they could trust organisations to handle it “fairly, securely and responsibly” – so, he claims, an opportunity now exists for organisations that can demonstrate just that.

We understand, many small and medium sized businesses don’t agree that the changes and risks they face in future are not an onerous imposition and that the changes they face could best be described as a ‘evolutionary’. What do you think?

ICO workshops for small organisations in the health sector

For those of you responsible for processing health-related data such as physiotherapists, chiropodists or opticians, the ICO are running workshops on data protection and information security now and in the future – you can find out more on the ICO’s health sector events page.

Mills & Reeve workshops on GDPR

The GDPR's UK implementation date is rapidly approaching, and employers are running out of time to prepare. We are hosting a number of free expert workshops which will explain why this new EU legislation will change the way employee data is managed in the UK (regardless of Brexit) and will explore what practical steps your organisation can take to get ready before the May 2018 deadline. If you are interested in registering for one of the workshops please RSVP indicating the workshop you would like to attend.

Stuart Knowles, Consultant Solicitor

Learning from deaths – are you ready to publish your policy by the 30 September deadline?

It is now three weeks to the deadline for NHS trusts to publish their Learning from Deaths policy – a key requirement for NHS provider boards following the publication of the National Quality Board’s National guidance on learning from deaths.

Supporting trusts with developing or updating their Learning from deaths policy, NHS Improvement has created a Template Learning from Deaths policy. The template provides a high level outline of what needs to be covered in the policy - its use is entirely voluntary and trusts are advised to use their own discretion in adapting or making use of the template to fit their local environment. NHS Improvement has used a colour code throughout the template to help trusts adapt it for their own purposes. Trusts may also choose to amend existing incident management policies so that relevant information relating to Learning from Deaths is included within one overarching document.

Do get in touch if you would like support with preparing your policy ready for publication by 30 September.

Jill Mason, Partner