PRIMIS policies and procedures

What data do we hold?

Registration data

Anyone wishing to make use of our tools must register as a member of the PRIMIS Hub. As part of the registration process, individuals provide their name, email address, contact telephone number and are asked to select a security question to which they must provide an answer. Members who use CHART must provide details of their practice national ID and GP IT system during the software configuration. Those members who request access to the GRASP suite of tools will be asked for details of their employer type (CCG, GP practice etc), role and practice national ID (where appropriate).   

Use of the data that you provide us with is governed by our Privacy Notice [see right]. 

The lawful basis for PRIMIS to process your personal data is related to GDPR article 6 (b) i.e. it is necessary for the performance of the membership contract between us.

Practice data

Practices submit their practice data to PRIMIS for use with CHART Online, our online comparative analysis service.

For the majority of our audit tools, practices submit aggregate practice data. However, in some situations one-line-per-patient de-identified data may be required to allow greater depth of analysis (e.g. by researchers or a Health Service body). In such instances practices are asked to complete a Data Processing Agreement (DPA) before they are able to upload data, outlining the purpose of the data collection activity and permissions to view the data.   

PRIMIS is not involved in the collection of patient identifiable data for standard quality improvement activities. Occasionally PRIMIS might facilitate the collection of patient identifiable data to support primary care research.

PRIMIS does not share data with the pharmaceutical industry for standard quality improvement activities. With prior agreement and only when specified within a joint working agreement, there may be pre-determined circumstances where aggregated, summative data only may be submitted. The purpose is to assess the success of the joint working initiative. Please note that this would never involve the reporting of patient or practice level data and would always be supported by a Data Sharing Agreement with the Data Controller (individual GP practices).

Use of the practice data that you provide us with is governed by our Information Governance (IG) Policy [see right].

CHART Online and data

To benchmark your practice data against other practices in your locality or against national averages, send your data to CHART Online.

CHART Online is a secure, central database storage facility located on a University of Nottingham server. The results are displayed via a web browser.

Data can be sent to CHART Online by selecting the 'Send to CHART Online' link on the summary sheet view in CHART or practice upload tool.

Access to data in CHART Online

To access the online comparative views in CHART Online, you must:

• be a member of the PRIMIS Hub

• be employed by a practice that has submitted data to CHART Online (automatically approved) 

Or

• have permission to view comparative data in CHART Online (need to seek approval from the relevant body)

• occasionally PRIMIS is asked to disclose summative data to a third party that is not otherwise referenced in the Data Processing Agreement and in such cases the PRIMIS Information Governance Committee makes recommendations or gives signed approval for the data to tbe released. A third party might include a Health Service body or academic institution. Please note that PRIMIS does not disseminate practice data to any third party in any format that identifies the practice without its prior permission and does not share data with commercial parties

Other services

PRIMIS provides data reporting and collection services to CCGs in support of local initiatives and incentive schemes. This involves the secure transmission of practice and patient-level data (de-identified and names named patient data) from CHART to servers located at the CCG or CSU.

PRIMIS Strategic Development Board (SDB) Information Governance Sub Committee (IGSC) 

Purpose 

To monitor all data extraction projects* that PRIMIS undertakes to ensure that PRIMIS has identified and correctly addressed any information governance concerns or issues.

*This might involve:

• the production and distribution of data extraction specifications, queries and reports

• the design and distribution of data entry tools

• the design and distribution of data presentation interfaces

• data storage

• data sharing with the commissioner of the project, stakeholders and members of the PRIMIS Hub membership service

IGSC Membership

• Professor Emeritus (Primary Care) - Chair
• Managing Director, PRIMIS
• Information and Software Development Manager, PRIMIS
• Head of Operations, PRIMIS
• Independent Information Governance Specialist;
• Patient representative/s
• Practice representatives
• Secretary

Functions and operational procedures

• To review and approve the PRIMIS Information Governance (IG) Policy
• To review and approve information governance protocols for each data extraction project that PRIMIS undertakes (including those that do not impact directly on an individual’s privacy) that vary from the standard model as defined in the Information Governance Policy  
• To receive and review all applications for data access outside the agreed information governance policy and make recommendations or give signed approval for release  
• To provide advice and guidance to the management team, helping to resolve issues and risks where necessary  
• To verify PRIMIS’ performance in relation to information handling should this be called into question  
• To consider any incidents which impinge on data governance to ensure appropriate policies are put in place as a result  
• Meetings are scheduled on a quarterly basis (however the IGSC may be convened by email, teleconference or extraordinary meeting if an urgent IG issues arise) and minutes are produced

PRIMIS Information Governance roles and responsibilities

Role	Responsibilities
Senior Information Risk Owner (SIRO)	Executive level management of all information risks/assets, protecting the confidentiality of patient/service user information and appropriate information sharing Reports to the IGSC ensuring that it is aware of risks, decisions and/or actions needed to ensure IG legislation compliance Promotes an organisation culture for protecting and using data Provides a focal point for managing information risks/incidents
IG Lead	Monitors internal compliance and is independent of data processing activities Manages the ISMS (and certification to ISO 27001) Manages Data Security and Protection Toolkit (DSPT) submissions Reports to the SIRO
Caldicott Guardian	Is the ethical conscience of the organisation Is concerned with the management of patient information provides a focal point for patient confidentiality and information sharing issues Reports to the IGSC
Data Protection Officer (DPO)	Informs and advises on data protection obligations and impact assessments Contact point for data subjects and the supervisory authority Is independent and adequately resourced Reports to the IGSC

PRIMIS contact details

By email	mailto:enquiries@primis.nottingham.ac.uk
By post	PRIMIS, 15th Floor, Tower Building, University Park, University of Nottingham, Nottingham NG7 2RD
By telephone	0115 84 66420