Mills & Reeve: Health and Care Update

Government announces its plans to protect patient sensitive data and strengthen cyber security

The Government has published its response Your Data: Better Security, Better Choice, Better Care to the National Data Guardian’s review of Data Security, Consent and Opt-outs and the CQC’s review Safe Data, Safe Care.

The response accepts the recommendations in both reviews. It also makes commitments to (a) put the National Data Guardian role and functions on a statutory footing by 2019 and (b) introduce “stronger sanctions by May 2018 to protect anonymised data, including severe penalties for negligent or deliberate re-identification of individuals." The response also includes investment in data and cyber security above the £50 million identified in the Spending Review and includes a new £21 million capital fund for major trauma centres and to improve NHS Digital’s national monitoring and response capabilities.

Recent incidents, including the May 2017 WannaCry cyber-attack have underlined the need for health and care organisations to implement essential, strong data security standards to minimise the impact to front-line services. Boosting cyber resilience remains an urgent priority for the health and care sector. The Government response includes wide-ranging plans to strengthen organisations across the NHS and social care against the threat of global cyber-attacks.

The Government’s response includes wide-ranging plans to strengthen organisations’ data protection and cyber security systems across the NHS and social care including:

• Adopting and promoting the ten data security standards, as proposed by the National Data Guardian’s review.
• Adopting the CQC’s recommendations on data security.
• NHS Digital is working to redesign and update the Information Governance Toolkit to support and underpin the new standards but taking account of the needs and expectations of different organisations when considering their data security capability. This new toolkit will be in place by April 2018.
• Chief executives will be held to account for standards that are being implemented and maintained and this will be assessed during inspections by the CQC from September 2017.
• NHS Digital is to build on its suite of advice and support services, called CareCERT to support health and care organisations prepare their own resilience to cyber security threats, and to respond effectively and safely when they occur.
• NHS Digital will support local organisations by broadcasting alerts about cyber threats, providing a hotline for dealing with incidents, sharing best practice across the health system and carrying out on-site assessments to mitigate against cyber security.
• The NHS Standard Contract  2017/18 now requires NHS organisations to implement and adopt data security standards as recommended by the National Data Guardian.
• Enabling informed individual choice on opt-outs, including steps to give patients and the public more access to, and control over, their personal data. By March 2020 people will be able to use online services to see how their personal confidential data collected by NHS Digital has been used for purposes other than direct care.
• The Information Governance Alliance will publish anonymisation guidance based on the Information Commissioner’s Office Code of Practice on Anonymisations in 2018.
• The Department of Health and its partners will clarify the legal framework by working with the Confidentiality Advisory Group to ensure its approval process, under section 251 of the NHS Act 2006, enables organisations to access the information they need, for example, for invoice validation.

Learning from the May 2017 ransomware attack

Following this incident, Will Smart, the Chief Information Office of the health and social care system has started a lessons learned review, to report in October 2017 to inform further action. 

Immediate lessons include:

• Organisations to implement critical CareCERT alerts, including software patches and keep anti-virus software up to date.
• NHS England and NHS Improvement to follow up critical CareCERT alerts within 48 hours to confirm local organisations have taken necessary action.
• Organisations to have moved away from unsupported systems by April 2018.
• Ensuring organisations, Boards and their staff are taking the cyber threat seriously.

Key messages for providers, commissioners of health and care services and health and care professionals

There are immediate and longer-term actions centred on ensuring local organisations are implementing the ten data security standards supported by the CareCERT suite of national support services and backed up by clear contractual obligations and by assurance and regulatory action. The Government’s response to each of the National Data Guardian’s and the CQC’s recommendations are set out at Annexes A and B, including the implementation plan at Annex G.

What to take away

We know that many of the recommendations made in the Government’s response are being taken forward by organisations ensuring that essential security requirements are being implemented.

Do get in touch if you require support as we have a team of health information governance experts here to help.

Stuart Knowles, Consultant

Jill Weston, Principal Associate

CQC report on the state of care in mental health services

On 20 July CQC published its report on the State of care in mental health services 2014 to 2017 setting out findings from their comprehensive inspections of specialist mental health services.

The conclusion is perhaps the best place to start – they explain that, as regulator, they are duty bound to describe the problems that they have encountered on their inspections but they also highlight that it is important not to lose sight of the very many positive messages in their report.

As at 31 May 2017:

• 68 per cent of core services provided by NHS trusts and 72 per cent of those provided by the independent sector were rated as good.
• 6 per cent of NHS and 3 per cent of independent sector core services were rated as outstanding.
• 36 per cent of NHS and 34 per cent of independent sector core services were rated as requires improvement for safe.
• 4 per cent of NHS and 5 per cent of independent sector core services were rated as inadequate for safe.

From April 2015 to March 2017, 21 warning notices were issued to NHS mental health trusts and 91 to independent providers.

The problems encountered include:

• Far too much variation in quality and access across different services.
• Outdated and sometimes institutionalised care.
• Frustration voiced by staff about clinical record systems.
• A number of providers needing to improve their risk assessment.
• A lack of learning, sometimes because of poor quality investigations or incident reporting / auditing.
• Too many services for people with learning disability where staff were not applying the Mental Capacity Act appropriately. Too few staff in some services had received MCA training and there was no plan in place to address this.
• Failure to provide staff with training in mental health legislation.

Particularly with regard to restraint they noted:

• Great variation across the country in how often staff physically restrain patients. 
• During 2013/14 more than 6,000 people who spent time in hospital were subject to at least one incident of restraint. 
• Collectively they experienced more than 23,000 incidents of restraint and 960 people had been restrained five times or more that year. 
• Prone restraint had risen in several settings too.   
• Staff were not recording all incidents of restraint (and not documenting or recording seclusion or long term segregation either) as required by the Mental Health Act Code of Practice.
• In response to this, CQC are strengthening their assessment of how and how often services use physical restraint.

CQC state that those who deliver and commission care must learn from the services that are getting it right.

NHS Providers produced their overview of CQC’s report too – you can read this here.

How we can help

We frequently provide training on the MHA and MCA (and indeed, the interaction between the two pieces of legislation). Please do let us know if you would like to discuss your training requirements.

Jill Mason, Partner

The latest on NHS Continuing Healthcare: A report from the NAO

The National Audit Office has published its report into NHS continuing healthcare funding following its investigation last month. The report sets out the facts relating to NHS CHC and, in particular, access to CHC funding. According to the NAO, the number of people assessed as eligible for CHC funding has been growing by an average of 6.4 per cent a year over the last four years. In 2015-16 nearly 160,000 received, or were assessed as eligible for, CHC funding in the year, at a cost of £3.1 billion.

Key findings of the investigation include:

• The current assessment process can raise people’s expectations about whether they will receive funding and does not make best use of assessment staff.
• Many people are waiting longer than 28 days for a decision – the national framework states that in most cases people should not wait more than 28 days.
• Decisions on eligibility have a “significant” financial impact on the individual, CCG and local authority. CCGs must legally provide funding for CHC, irrespective of the number of people that are referred and are assessed as eligible.
• There is an increase in the number of people receiving CHC funding and funding of CHC is a “significant” cost pressure on CCGs’ spending. NHS England would like CCGs to make savings of £855 million on CHC and NHS-funded nursing care by 2020-21 against the prediction of growth, although CCGs do not have spending plans setting how they propose to achieve these savings against the background of a growing and ageing population.
• Variation exists between CCGs in both the number and proportion of people assessed as eligible for CHC – this suggests that there may be differences in the way CCGs are interpreting the national framework to assess whether people are eligible for CHC due to the complexity of this framework.
• Improving the assurance processes and monitoring access to CHC - the shortage of data on CHC makes it difficult to know whether eligibility decisions are being made fairly and consistently. Currently, no data is collected on how many individuals appeal to the CCG against unsuccessful CHC funding decisions. Since April 2017, NHS England and the DH have expanded the data collected on CHC.

The report confirms the DH has been working with NHS England, local authority representatives and charity groups to understand the impact of the National Framework on delivery of CHC and where there might be scope for improvements. Figure 16, page 37 of the report sets out the areas where the Department of Health and NHS England expect CCGs can deliver CHC savings. The initiatives include investing in CHC workforce skills and capacity and reviewing the CHC checklist and assessment tools.

CHC funding is widely acknowledged as “a complex and highly sensitive area” – CCGs do get in touch if you have any questions.

Jill Mason, Partner

National guidance on learning from deaths: a reminder

Before everyone heads off for a summer break we thought it might be a good opportunity to remind readers about the publication of this guidance back in March 2017.

As you will recall the guidance is a framework for NHS Trusts and NHS Foundation Trusts on Identifying, Reporting, Investigating and Learning from Deaths in Care. The aim was to kickstart a national endeavour on this front.

One part of this was the requirement that each Trust should publish an updated policy on how it responds to and learns from deaths of patients who die under its management and care. This has to be done by September 2017. 

This policy should cover how your processes respond to:

• the death of an individual with a learning disability
• the death of an individual with mental health needs
• the death of an infant or child
• a still birth or maternal death

It should also cover:

• Approach to undertaking case record reviews
• Categories and selection of deaths in scope for case record reviews

The details of what is expected are set out in Annex C of the guidance (at pages 26 and 27).

We have a large team experienced in supporting providers with investigations and inquests. Please do get in touch if we can assist further.

Jill Mason, Partner

More support for NHS employers around pay and conditions for apprentices

New guidance from the NHS Staff Council offers general advice on the employment of apprentices in the NHS – however, it does not cover specific apprenticeship programmes or cover those employed through the Apprenticeship Training Agencies. The guidance must be considered together with any other relevant apprenticeship policy guidance and /or statutory requirements.

This five page guidance note provides support in a number of areas, such as:

• apprenticeship agreements 
• general requirements for apprenticeships
• approaches around the employment and pay of apprentices

More details about the public sector apprenticeship targets (which are not mentioned in the guidance note) can be found here. Our separate briefing about the broader strategic issues facing levy-paying employers may also be helpful.

Jog Hundle, Partner

Putting it out there. The Jeremy Corbyn case.

Putting confidential information in the public domain - can you ever do it?

Remember when Virgin Trains posted a picture of Jeremy Corbyn sitting on the floor of one of their trains? Jeremy Corbyn had posted the suggestion he couldn’t get a seat. Not true came the retort!  

Did Virgin Trains breach the Data Protection Act? Not as far as Mr Corbyn is concerned – so says the Information Commissioner's Office.

Virgin Trains did not break data protection law and the reasons why are set out in a blog post by the ICO’s head of enforcement, Steve Eckersley.

So, what were the reasons for the ICO’s decision?

There are exceptions that allow organisations to process personal data outside its published conditions and policies as long as it has a “legitimate interest” to do so. In the case of Virgin Trains, the ICO’s view was that it “had a legitimate interest, namely correcting what it deemed to be misleading news reports that were potentially damaging to its reputation and commercial interests.”

In order to achieve Virgin Trains' legitimate interests, the ICO acknowledged it needed to publish an image of Mr Corbyn showing that there were empty seats on his journey and the only way to do so would be to publish an image of Mr Corbyn on that journey.

But. The ICO did conclude that Virgin Trains did breach the DPA when it published images of other passengers on the same service as Mr Corbyn – they "should have taken better care to obscure the faces of people on the train." However, the ICO has “stopped short of formal regulatory action to reflect the exceptional circumstances of the breach."

Lessons for health and care data controllers  

Sometimes you can be bold when a complainant uses a public forum to air their complaint and ramp up the pressure on your organisation. It might be appropriate for the response to be likewise aired. Even in sensitive matters (like patient information) there are possible tactics to adopt to properly defend yourself against unfair criticism in the court of public opinion and from journalists who have only one side of the story.

Our health information governance team includes an ex-journalist on hand to help. Contact Stuart Knowles for more information. 

Compensation in the Employment Tribunal: Tribunals should consider compensating for ‘career ending losses’ in appropriate cases

In the case of Small v Shrewsbury and Telford Hospitals NHS Trust, the claimant, Mr Small began working for the NHS Trust Respondent in May 2012. He was 56 years of age at the time and was engaged as an agency worker on a temporary assignment, although he understood that he might be offered full time and permanent employment in due course. His engagement was terminated after only two months. He brought proceedings in the Employment Tribunal alleging that the reason for the termination of his contract was that he had made a protected disclosure, and the Tribunal found in his favour, specifically that he had been subjected to an unlawful detriment because he had made a protected disclosure under section 47B Employment Rights Act 1996.

Mr Small claimed compensation for lost earnings up to his anticipated retirement date in 2022. He produced evidence that he had been unable to find alternative work in the same field of work, despite making numerous applications, and he argued that the reason that he had not been successful in his applications was the fact of his dismissal and particularly that the Trust would not provide him with a reference. The Tribunal acknowledged that the dismissal had had a ‘career ending’ impact for Mr Small, but declined to award him compensation through to retirement as claimed. Mr Small was awarded lost earnings for an 18 month period only. He appealed and the matter fell to be considered by the Court of Appeal.

The Court of Appeal found in Mr Small’s favour. They relied on the previously decided case of Chagger v Abbey National PLC where it was held that, in principle, a claimant can recover for loss of earnings beyond the date on which employment would have otherwise terminated and can, in principle, claim for the ‘stigma’ that he or she suffers in the labour market. The court determined that, notwithstanding the fact that Mr Small had not raised this argument himself before the Employment Tribunal (Mr Small had been unrepresented at the Tribunal hearing), in the circumstances of the case, including the Tribunal’s own findings about the stigma Mr Small faced in the labour market following his dismissal, the Tribunal should have considered this matter of its own volition. The matter of Mr Small’s compensation will be sent back to the Employment Tribunal to be re-considered.

While Mr Small was initially awarded a sum exceeding £50,000 in compensation, his successful appeal may mean that he is awarded a significantly higher sum. While not all cases will involve career ending losses, this case is a timely reminder of the potential significant consequences should claimants be able to establish that an unlawful act has taken place (such as being subjected to an unlawful detriment because they have made a protected disclosure) which has effectively ended their ability to secure new employment.

Fiona Hargreaves, Senior Associate

Reflections on the National Practice Managers Association Conference 2017

The PMA’s Transforming General Practice conference took place 14 days after the snap general election. It was a good time to pause and reflect on the General Practice landscape.

Dennis Dunn, chair of PMA and chair of Mid Cheshire Hospitals NHS Foundation Trust, gave the opening address: “tomorrow cannot and must not look like today”. The traditional model of GPs working in small local surgeries will be a thing of the past – today, many GP practices are working as part of a network or federation.

So, what needs to change to facilitate scaling up primary care while seeking to manage clinical pressures and meet quality, service and safety targets?

We share some of the issues and challenges highlighted during the conference:

• A need to capitalise on new technologies.
• A need to extend and develop the healthcare workforce, including increasing the number of GPs which is an area of major concern.
• A need for GPs to adopt a business approach to primary care.
• Improving primary care premises such that they are fit for purpose, but also allowing for collaborative health and social care services to be provided.
• A need to signpost patients to the best possible providers to give them the right care - encompassing a need to collaborate with other practices and professionals to provide best care, including sharing staff and premises.

Looking ahead – the General Practice in 2020

We are now regularly seeing a shift in the approach of GPs who are looking to either merge, collaborate or federate with other practices to facilitate better delivery of integrated patient care while taking advantage of opportunities to bid for additional contracts, make economies of scale and deal with the ongoing workforce and workload pressures.

The way practices come together can take various forms, and there are different legal relationships that fit different situations. What is clear, and was echoed by a speaker at the conference who has learnt from their own experiences, that if GPs are looking to merge or collaborate with another practice, they need to do their homework. Due diligence is key to ensuring GPs are not faced with historic liabilities and claims. How practices hold their property can also have a major impact on what decisions GPs make and what GPs need to do, to give effect to the change in status.  

It is important that in the bid to move forward and to innovate the legal implications are not lost, as they can have far reaching consequences.

Louise Robinson, Principal Associate

Court of Appeal criticises patient lawyers

This is a case decided in March but which seems worthy of comment given the financial pressures that NHS trusts find themselves under.

R (on the application of YZ) v Oxleas NHS Foundation Trust and West London Mental Health NHS Trust was a judicial review challenge to the decision made by a psychiatrist at Oxleas to seek to transfer the claimant to Broadmoor Hospital and the decision of Broadmoor to accept him.

The judicial review challenge was brought by Richard Charlton Solicitors on behalf of YZ.

The Court of Appeal concluded that there was no breach of Article 3 or 8 of the European Convention of Human Rights and that the transfer was absolutely necessary.

We will not go into the facts in detail. However the following points are of note:

• The Court of Appeal stated that these proceedings should never have been pursued before the court. The judgment sets out the facts in detail to enable Lord Thomas to show how diligently the doctors and trusts concerned had tried to treat the claimant, how carefully they had taken the decision and how wholly unjustified the criticism was to which they had been subjected.
• The court noted that the costs for the claimant and the two trusts were in the region of £58,000 - £75,000 each. It was commented that such claims are a highly detrimental distraction to the proper operation of the NHS and had caused the expenditure of substantial sums which could and should have been used instead for the treatment of patients.
• The court stated that, in future, the Legal Aid Agency should carefully examine the circumstances in which they allow such cases to be pursued given the very significant costs that the NHS incurs as a result.
• The Article 3 claim was described as being hopeless on the facts and a claim that should never have been advanced. It was even described as “gratuitously offensive” to make such a claim against the two trusts who had done so much to try and treat the claimant in the best manner possible.
• When a challenge is made in the Administrative Court to the lawfulness of decisions involving the transfer into or out of a High Security Hospital, the court will pay the highest regard to the bona fide professional judgement of the responsible clinician (RC). If the decision is bona fide it would require compelling evidence to show that judgement is one to which the court should not pay the highest regard. 
• Applications for judicial review of decisions to transfer should be very rare indeed. The interposition of challenges to transfers, save in rare circumstances, would interfere with the proper conviction of a carefully balanced system, which seeks to protect the public from a convicted criminal who continues to pose a serious risk to the public in a way that also protects the interests of the convicted criminal.
• The decision to transfer was unimpeachable. Once that decision is made the extent of the detailed operation of that regime, such as observations necessary for the safety of others and of the patient are matters for the detailed operation of the regime and not for the court.
• A challenge to the adequacy of reasons is rarely, if ever, appropriate. It certainly should not be used, as it was in this case, as collateral means of challenging the merits of the decision.

Should you receive a Pre-Action Protocol letter threatening a judicial review this is something to act upon quickly. We support numerous mental health clients around such challenges so please do not hesitate to contact us to discuss any possible judicial review. It is worth investing time at the outset responding to such a letter in order to avoid the issue of proceedings.

Jill Mason, Partner

Another Court of Appeal Decision in the field of mental health

The case of Secretary of State for Justice and Welsh Ministers v MM and PJ was referred to in the case of Djaba which we have recently posted a blog on so we thought it might be helpful to include some details on this case too.

The Court of Appeal heard two cases together relating to MM and PJ because they raised the issue of deprivation of liberty in two contexts. They described them as relating to:

• Where a mental health patient who is “detained by a criminal court” seeks to be conditionally discharged into circumstances that deprive him of his liberty (MM).
•  Where a mental health patient detained in a “non-criminal context” seeks to be moved from hospital under a Compulsory Treatment Order (CTO) which has the effect of depriving him of his liberty (PJ).

The appeals raised questions about the nature and extent of the powers of the First-tier Tribunal (FTT).

MM

MM was detained under sections 37 and 41, conditionally discharged and then recalled to hospital. He had capacity and wanted to agree to a lesser form of restriction than detention in hospital.

He argued that any detention would be lawful, if he consented to it, and that a care plan including terms that would necessarily deprive him of his liberty should not prevent a FTT imposing a general condition that he must comply with his care plan.

His application for conditional discharge was refused by the FTT. The Upper Tribunal allowed his appeal and the case came before the Court of Appeal as the Secretary of State appealed that decision.

The case related to the powers of the tribunal and the effect of consent.

The Court of Appeal made the following points:

• The Mental Health Act does not provide a power in the FTT to impose conditions on a conditional discharge that extend to the imposition of an objective deprivation of liberty.
• Where conditions amounting to a deprivation of liberty are compulsorily imposed by law, the agreement of an individual cannot prevent that compulsory confinement from constituting a deprivation of liberty.
• Conditions have to be considered by reference to their real and not technical effect.
• A condition of residence in itself is not a deprivation of liberty. The most common condition that might be a deprivation of liberty is continuous supervision, including the lack of availability of any unescorted leave.
• There is no scope for consent in a case such as this.
• The power of deferment to permit arrangements to be made to discharge could be used in an appropriate case to invoke the separate jurisdiction of the Court of Protection to authorise a DOL, if the patient is incapacitated.
• It cannot be said that it was Parliament’s intention to authorise detention outside hospital when a patient is conditionally discharged. If that conclusion presents practical difficulty, then it is a matter for Parliament to consider.

PJ

PJ also had capacity to make decisions about the restriction of his liberty. He was detained under section 3 and had been made the subject of a CTO with conditions which included:

• He was to reside at a care home with nursing and adhere to the rules of residence at the home.
• He was to abide by the section 117 care plan.
• He was to abide by the risk mitigation plan for community access which specified the nature and extent of the supervision of him.

PJ applied under section 72 for discharge but this was refused. His appeal was successful so, again, the case came before the Court of Appeal as Welsh Ministers appealed that decision.

Paragraphs 54 – 59 and 62 – 63 of the judgment were relied upon by the Court of Appeal in Djaba.

The Court of Appeal again concluded that:

• There is no “umbrella” power that can be exercised by the tribunal to authorise a patient’s deprivation of liberty outside hospital.
• There is no lacuna in the scheme.
• However practical and effective it may be to provide for a tribunal to have such a power Parliament has not provided for the same.
• For the purposes of the CTO scheme the relevant powers are vested in the responsible clinician (RC).
• The statutory framework that provides for the CTO scheme provides both practical and effective protection of a patient’s Convention rights.
• The tribunal has a distinct and separate power.
• The power to discharge a patient in the circumstances provided for in section 72 does not extend to a power exercisable by a tribunal to scrutinise the lawfulness of conditions imposed by the RC. That challenge must go to the High Court in judicial review.
• The CTO scheme does not exist outside the scheme of fundamental rights nor does it override them.

Cold towels will be provided!

Jill Mason, Partner