How is consent managed with patients?

There is an important distinction between sharing data for direct care, for example, (when a GP refers a patient to the district nursing case load) and the proactive sharing of patient data for case management based on the results of a risk stratification exercise. In the former case, separate consent for direct care is not required and sharing will continue much as it is done today.

For proactive case management, Virgin will be working with all stakeholders to develop and agree a robust sharing protocol before any sharing takes place. The sharing will be in line with the Information Commissioners (ICO) Code of Practice and best practice guidance issued by the Information Governance Alliance. Virgin will also consider the implications of new guidance issued in preparation for the General Data Protection Regulations which will be effective from May 2018. Stakeholders will include sharing partners, commissioners and patient representatives. As part of the process Virgin will complete a Privacy Impact Assessment which will document the data flows, security and legal basis for sharing. They will also develop comprehensive supporting communication campaigns to ensure that they provide clarity on the sharing, including why they share and who they share with. For reference only, in other regions Virgin have agreed with local GPs two options for obtaining consent from a patient to access their data once they have been identified as appropriate for care coordination:

  • GPs can write to the patient, informing them of the benefits of care coordination, asking for consent to share data.
  • GPs can enter an agreement with Virgin Care Services Ltd (VCSL), for VCSL to be a data processor. VCSL can then contact the patients on behalf of the GPs to obtain consent, using an agreed script.

This is a lengthy topic for discussion and Virgin propose visiting each practice in the area to discuss the pros and cons of different consent options with each practice. Ultimately, it is up to each practice to decide how they want to manage consent and whether they want to share data with Virgin Care for the purpose of care coordination.