Mills & Reeve: Health and Care Update

Patients to benefit from faster access to new medicines in a deal agreed with the pharma industry

A newly published Department of Health and Social Care policy paper outlines the terms agreed between the Department, NHS England and the Association of the British Pharmaceutical Industry for a new branded medicines deal.

The heads of agreement set out how the voluntary scheme for branded medicines pricing and access will improve patient access to medicines, keep the branded medicine bill affordable for the NHS and support innovation and the life science industry at time when the UK’s position on Brexit is being finalised.

Under the scheme patients will see the most effective medicines and vaccines come into use more quickly and “the NHS will have absolute certainty that the sales of branded medicines will not grow by more than 2 per cent in any of the next five years – or industry refunds the money”, says Mike Thompson, Chief Executive of the ABPI. The full voluntary scheme document, if agreed, will be published later in 2018.

The deal would look to achieve faster NICE appraisals for new medicines and cost-effective medicines will be available more quickly for patients and come with guaranteed funding. There will also be an opportunity for companies to engage earlier with the NHS or government through a single route. Equally, there is a commitment to develop and publish a ‘commercial framework’ once the voluntary scheme is in place.

The Secretary of State Matt Hancock, commenting on the new deal, said that the NHS’s medicines bill would be cut by £930 million next year.

Jane Williams, Senior Associate 

Safety watch dog investigates variation in mental health care in emergency departments

On 23 November 2018 the Healthcare Safety Investigation Branch published their latest full investigation report into the provision of mental health care to patients presenting at the emergency department. 

It followed HSIB being notified about a patient called Diane who, unfortunately, committed suicide. She was a 57-year-old woman who had a history of mental health problems and was in the care of the community mental health service. She presented four times to the same emergency department following self-harm but received different levels of care on each occasion. She was referred for mental health assessments on the first two occasions but not thereafter.

The report will be an essential read for both providers and commissioners. The executive summary can be found at pages 6–7 and the conclusion at pages 39–40.

The report notes that emergency departments treat approximately 220,000 cases of self-harm a year (but highlights that a recent study suggests that this figure may underestimate the true rate by 60 per cent).

There are four safety recommendations aimed at improving patient care.

1. NHS England ensures there is a sustainable funding model for 24/7 urgent and emergency mental health liaison services in acute general hospitals with emergency departments.
2. National Institute for Health and Care Excellence review and amend guidance for the management of self-harm in the emergency department.
3. The Royal College of Emergency Medicine, in conjunction with the Royal College of Psychiatrists develops and disseminates national guidance for emergency department practitioners to standardise the conduct of the initial assessment of a person presenting following a mental health emergency.
4. The Care Quality Commission reviews and updates its inspections criteria for emergency departments to ensure equal weight is given to the quality of care provided to people with urgent mental health problems as they do to people with urgent physical health. This would be consistent with its commitment to parity of esteem for mental health. 

In addition, HSIB make two safety observations.

1. The data regarding mental health presentations is not sufficiently robust to allow for demand for mental health services to be adequately assessed and the impact of service provision to be measured.
2. Initial assessment of patients, on arrival at an emergency department may benefit from inclusion of key factors from the Royal College of Emergency Medicine guideline. 

And one safety action is noted:

The National Institute for Health and Care Excellence has changed the wording of clinical guideline CG16 to reflect the findings of the investigation. “Consideration should be given to introducing the Australian Mental Health Triage Scale, as it is a comprehensive assessment scale that provides an effective process for rating clinical urgency so that patients are seen in a timely manner. Do not use the Australian Mental Health Triage Scale to predict future suicide or repetition of self-harm.”  

Jill Mason, Partner

Gosport – the Government’s response

On 21 November 2018 Department of Health and Social Care published Learning from Gosport.

The response describes three types of action.

• Measures already in place and established.
• Reforms in place and developing.
• Changes where we need to go further.

With regard to listening to patients, families and staff the key actions include:

• legislating, subject to parliamentary time, to make all NHS trusts in England publish annual reports on concerns raised by staff who speak up; and
• CQC reviewing how it assesses the statutory duty of candour.

They make some powerful points in this chapter such as “the report helps us to see that ignoring the voices of patients, families and staff can cost lives”. They note a number of themes in the panel’s report that are common to other reports in recent years e.g. the quality of investigations is patchy and lessons are not consistently being learned or implemented. The Government believes that now is the time for a different approach. The Department plans to publish a strategy for improving the way feedback is managed and used in the NHS later this year.

With regard to ensuring care is safe they note that patient safety is a continual challenge and that the governance and oversight of care within a hospital is the most important line of defence against failures in care. With regard to Gosport, they note that the problems stemmed from a lack of oversight of quality and clinical governance within the hospital and the wider health system at the time. Looking at learning, they observe that gathering data is only part of what is needed and they are also taking action to ensure that there is careful analysis and pattern recognition that then leads to action. This chapter concludes with the statement: “whilst inspection and regulation are vital in identifying and addressing cases of poor or unsafe care, the best means of prevention lie in the hands of healthcare organisations and the people working in them”.

Finally, in the chapter on identifying and addressing problems in care, 11 key actions are listed. These include revision of the NHS Serious Incident Framework which we are told is “currently being revised”. Tabulated paragraphs 4.41 – 4.54 covers police, criminal justice and inquests which is a topical issue for many of our clients. The Government is to explore what more can be done to ensure that various investigations are appropriately sequenced and co-ordinated. They will look at how they can be organised so they can meet the interests of justice and are fully compliant with the relevant statutory remits whilst also recognising and addressing the concerns and priorities of patients and their families. Us lawyers get a mention here too. The Ministry of Justice is developing a protocol consisting of key principles which they propose that public bodies and their legal representatives sign up to as to the approach that will be taken at inquests when a public body is represented. The aim being to help make sure bereaved families are at the heart of the process and that the process is truly inquisitorial and seeks to identify lessons to be learned.

Jill Mason, Partner

Homelessness and the duty to refer – guidance for NHS staff

New guidance for NHS trusts and foundation trusts has been published by the Department of Health and Social Care on the duty to refer service users who may be homeless or threatened with homelessness to a local housing authority.

Health providers already support and refer service users who are homeless or at risk of homelessness, as part of their safeguarding responsibilities and usual daily work. The duty to refer seeks to extend the good practice that already exists and ensure that services are working together to prevent homelessness.

This duty came into effect on 1 October 2018 under the Homelessness Reduction Act 2017 which introduced a new legal duty on specified public services – for health services, the impact will be on trusts and foundation trusts in the provision of any of the following NHS health services:

• accident and emergency services in a hospital
• urgent treatment centres
• in-patient treatment (of any kind)

NHS staff who come into contact with people who are homeless or at risk of homelessness are under a duty to refer to local housing authority – the minimum legal requirement for a referral is the inclusion of:

• the individual’s contact details
• the individual’s consent
• the agreed reason for the referral (that they are homeless or threatened with homelessness)

Health providers in consultation with the Faculty for Homeless and Inclusion Health have developed a downloadable example referral form for hospitals to use. However, health providers may make a referral to a local housing authority in any manner they wish providing they include the minimum of information required by law, as set out above. Local housing authorities have been asked to provide a standard email address that duty to refer referrals can be sent to: dutytorefer@[insertlocalauthorityname].gov.uk. To find out more, you can read the Department’s guidance here.

While there is no sanction in the Act for breach of the duty there is the possibility of it being enforced through contractual means by commissioners or by judicial review.

Jill Mason, Partner

Do we need to give more teeth to coroners’ preventing future deaths reports?

The publication of the Grenfell Tower fire ‘Preventing Future Deaths’ report is a salient reminder of how PFD reports can be used at any time to highlight a risk to life that needs action. But, at the same time, brings into focus the question whether the law needs to change to make sure these PFD reports can be made to deliver some change.

It would seem that this may be the only way to ensure that vital recommendations are not ignored. The Senior Coroner’s report into the deaths following the fire at Grenfell Tower illustrate the breadth and the limitation of PFDs. These coronial reports have little teeth: there is “no coronial power in relation to the content, adequacy or implementation of the response to a PFD”. The legal effect of the PFD report is that the recipient of the report must provide a response within 56 days containing details and a timetable of any action which has been taken or is proposed, or an explanation as to why no actions is proposed.

A PFD entails no more than the coroner bringing some information regarding a public safety concern to the attention of the recipient, reports Amy Street of Serjeants’ Inn in her blog post: The Grenfell Tower fire ‘Preventing Future Deaths’ report: the breadth and the limitations of PFDs.

The responses will be interesting and deserving of careful study.

Development agreements, options and the procurement rules

The recent Court of Appeal decision in Faraday Development provides further clarity around when development agreements will and will not be subject to the procurement rules – there is guidance too for those drafting voluntary ex ante transparency notices (better known as VEAT) and there are also remedy-related points to note.

The appeal in Faraday Development concerns the application of public procurement law to contracts by which local authorities seek to bring about the development of land in their ownership.

This decision will be of interest to those involved in NHS land disposals – building on Lord Carter’s review of NHS property and estates which identified a major opportunity for the NHS to release value from inefficiently used or unused land no longer required to deliver health and care services. It is also likely to affect decisions made by the Ministry of Defence, local authorities and other public sector bodies as they seek to dispose of their estates.

The Court of Appeal’s landmark decision has wide-ranging implications for those working in the health and care sector. To find out more, including the lessons to take away, head over to our procurement portal. 

Christian Young, Principal Associate

NHS Digital to end controversial data sharing agreement with the Home Office

The long-running debate on the controversial arrangements under which the NHS shared patients’ medical records with the Home Office for tracing immigration offenders has come firmly to an end according to NHS Digital.

Concerns were raised by a number of organisations about the practice of data-sharing governed by the Memorandum of Understanding (MoU) between NHS Digital and the Home Office. It was strongly felt that NHS Digital had not been robust enough in upholding the interests of patients and maintaining the confidentiality of data collected for the purposes of health and social care. The agreement was suspended in early May and we understand that a new MoU is being drafted to narrow the scope of the information sought.

Stuart Knowles, Consultant

Getting clinical governance right

Clinical governance is widely recognised as the mechanism for ensuring the safety and quality of patient care. Good governance is the means of supporting the early identification of risks and concerns that lead to individual, team and wider organisational learning. Having a culture of good governance has been the focus of many recommendations following inquiries into poor care – from Mid Staffs to Morecambe Bay.  

While most of the care falls around the middle of the quality curve. Clinical governance aims to shift the performance of health and care organisations closer to the standards of the best and reduce the variations in the quality of care provided. It is needed to reassure the public that the care received is of the highest standard.

Good governance requires the "development of a culture where healthcare professionals are motivated to routinely think: Am I doing it right? How can I do better?"

New clinical governance handbook

The General Medical Council has recently published Effective clinical governance for the medical profession: A handbook for organisations employing, contracting or overseeing the practice of doctors. The handbook has been designed for those individuals or groups of individuals who play an important leadership role in delivering and assuring the quality of clinical governance processes for doctors.

In the main, this will be the board or governing body of a health and care organisation but it may also include owners of independent sector organisations and, in some circumstances, individual doctors. Anyone involved managing and delivering clinical governance will also find the handbook a useful resource.

The guide was first published in 2013 after the introduction of revalidation – the process through which doctors show they are up-to-date and fit to practise. Changes in the revised version reflect learning and system developments from the first five years of revalidation.

Signatories to the handbook

What is its purpose?

Designed to provide boards with a description of the core principles underpinning effective clinical governance for doctors focusing particularly on responsibilities in the Responsible Officer regulations. The guide acts as a resource to support organisations in evaluating the effectiveness of their local arrangements in areas such as:

• leadership, delivery and quality of clinical governance for doctors
• medical revalidation
• identifying and responding to concerns about doctors
• pre-employment checks for doctors

It is worth noting that responsibility for and delivery of various aspects of clinical governance for doctors are different across the UK, sectors and type of organisation – they are dependent on whether an organisation acts at a local or national level. It should also be used with other relevant clinical governance guidance.

There is no requirement to report against the handbook but organisations may find it useful to record how it has been used in practice when preparing for future CQC inspections and internal audit work. It may also be used as an aid to annual board reporting.

Jog Hundle, Partner

A more muscular ICO. Data watchdog picks its cases to make a point…

Six month prison sentence for car mechanic found accessing personal data.

In a first, the Information Commissioner’s Office has used the Computer Misuse Act 1990 to prosecute a motor industry employee for accessing personal data relating to thousands of customers from his former employer.

The employee worked for accident repair firm, Nationwide Accident Repair Services and used his colleagues’ log in details to access a software system containing the records of customers’ names, telephone numbers, vehicle and accident information.

The data watchdog has, in the past, prosecuted under the Data Protection Act 1998 or 2018, but in appropriate cases, it can prosecute under other legislation. In this case, under section one of the Computer Misuse Act 1990 – to reflect the nature and extent of the offending, and for the sentencing court to have a wider range of penalties available. Under section one, a court can award a custodial sentence of up to two years.  

ICO pushes the boundaries to protect customer rights

This latest decision is a warning to anyone thinking of obtaining and disclosing personal data without permission – the ICO will use any regulatory power at their disposal to protect the rights of individuals and organisations.

Mr Kasim pleaded guilty to a charge of securing unauthorised access to personal data between January 2016 and October 2016 and was sentenced at Wood Green Crown Court. Running in tandem, confiscation proceedings under the Proceeds of Crime Act, to recover any benefit obtained as a result of the offending, have been commenced.

Is this decision a sign of future of prosecutions from the ICO? We shall have to wait and see.

Stuart Knowles, Consultant

Don’t forget about your password system, says the ICO. Are passwords the best way to protect data?

Health and care organisations need to ensure that they are using the right authentication scheme when dealing with personal data online.

The ICO has published new guidance on the use of passwords in online services and encryption to protect data in the context of taking appropriate technical and organisational security measures. 

So, what does the password guidance say ? Here are some key takeaways.

• While the GDPR does not specifically mention passwords, you are required to process personal data securely by means of “appropriate technical and organisational measures to prevent unauthorised processing of personal data”.
• Passwords are a common means of protecting access to systems that process personal data. Setups must therefore be “appropriate” to the particular circumstances of this processing.
• The measures themselves must ensure a level of security appropriate to the nature of the data being protected and the harm that could be caused by unauthorised access.
• Consider whether there are any better alternatives to using passwords.
• Any password system must protect against theft of stored passwords and "brute-force" or guessing attacks.
• Four additional considerations to take account of when designing your password system.

- Use of an appropriate hashing algorithm to store passwords.

- Protecting the means by which users enter their passwords.

- Defending against common attacks.

- Use of two-factor authentication.         

ICO guidance offers technical and practical tips

But organisational context is important. To help organisations get under way, the guidance looks at how to choose the right authentication scheme and questions whether passwords are the best choice, with examples, supported by further guidance on passwords from the National Cyber Security Centre. It also covers core issues that organisations need to consider when implementing a password system.

On the issue of password renewal, the cyber security industry has changed its thinking and the ICO has taken a view:

“You should only set password expirations if they are absolutely necessary for your particular circumstances. Regular expiry often causes people to change a single strong password for a series of weak passwords. As a general rule, get your users to create a strong initial password and only change them if there are pressing reasons, such as a personal data breach.” 

Helping organisations with encryption too; the ICO has also published encryption guidance which is a widely-available measure with relatively low costs of implementation.

Stuart Knowles, Consultant