Protecting Patient Data  

The Trust

Kensington and Chelsea PCT is the NHS body charged with delivering local health services across the Royal Borough of Kensington and Chelsea in central London. Serving a population of 190,000 people, the PCT works with GP practices, the local authority and hospital trusts to enhance the efficiency of local health services and to make them more accountable to the patients and communities they serve.

PCTs bring together GP services and community health services such as health visiting and district nursing, thereby delivering better integration of services. GP systems now have to meet stringent standards in IT to ensure that they will integrate with those installed under the National Programme for IT in the NHS. Following full implementation of a government directive from 2003, the PCT has taken control of the delivery of IT services to the 44 GP practices within its jurisdiction, as well as 15 other primary care sites. To provide a support and management service, suppliers require electronic access to the systems that reside within the GP practices through the NHS broadband network N3.

But N3 is an “untrusted environment” with a nationwide user base of 1 million in which there is a key concern about the security of patient identifiable data (PID). PID contains sufficient information to be able to identify it as belonging to a specific patient. Government guidance dictates that PID “must not be transmitted in the clear across N3,” hereby requiring all access to PID through N3 to be adequately protected from the untrusted environment.

A second challenge related to management and support. GP Systems of Choice, a national initiative to give GPs a choice of clinical systems, has given PCTs responsibility for delivering management and support services to GPs. The PCT also wanted GPs and practice staff to have remote access to their practice systems.

Technical Requirements

 In meeting the above challenges, Kensington and Chelsea PCT also insisted that any solution should also satisfy a stringent set of technical requirements, namely to:

• Establish secure communications between the GP sites and the PCT through N3 to ensure safe transfer of PID between the PCT and GP practices.
• Compliance with information governance standards from NHS Connecting for Health, the agency in charge of “digitising” the NHS.
• Extend the reach of the PCT Active Directory® service into the GP sites to ensure the efficient deployment of PCT systems that will support GP practice-based commissioning,.
• Provide a route for centralised support and administration of the GP sites' ICT systems from the PCT by PCT technicians and their service partners.
• Offer a pathway and mechanism for the ongoing management and deployment of antivirus and software updates.
• Deliver a method of reliable backup and restore of GP systems, which in Kensington and Chelsea come from three different vendors, controlled by the PCT.

Hytec’s GPsecure™ solution

After completing a pilot study to fully evaluate Hytec’s proposed solution, the PCT commissioned Hytec to implement the project-based solution, developed specifically for GPs and now branded as GPsecure™, across the 44 GP practices throughout the Royal Borough.

Whilst providing secure connections between GP practices and the PCT, via the N3 network, GPsecure™ also:

• Protects patient identifiable data, held on GP systems, from threats posed by insecure networks such as the N3.
• Enables centralised remote support and management of GP systems by PCT staff and their service partners.
• Provides GPs with fully authenticated, secure remote access to their practice systems.
• Creates the technical environment for systems that support Practice Based Commissioning in GP surgeries  

Benefits

GPs in Kensington and Chelsea now enjoy far better and more responsive support. They no longer need to wait for individual engineers to visit their practice to handle antivirus or software updates. Routine work that formerly took hours now only takes minutes. GPs and practice managers can access their desktops with the flexibility to access PID from remote locations without security worries.  

Remote Working Helps GPs Improve Patient Care

With the Hytec solution, GPs working in Kensington and Chelsea can now access systems within their practices from remote locations in a secure manner either through the Internet or wireless technology.

The PCT’s IM&T Manager lftikhar Din says: “With remote access, GPs do not need to return to their practices to consult patient data or clinical notes—as a result, they can spend more time with their patients. They can enjoy much greater flexibility secure in the knowledge that patient confidentiality is not at risk.”  

Technicians Manage Software and Antivirus Updates Centrally

The GP systems within the jurisdiction of the PCT were previously managed by 10 engineers visiting each of the practices on a regular basis to implement software and antivirus updates. Although located in a geographically compact urban borough, the support desk system generated inefficiencies, cross borough travel, and often resulted in unnecessary downtime.  

Iftikhar Din says: "All computers controlled by the PCT in GP practices are now being centrally managed from a central site. It is much easier to make sure that the antivirus software and all other relevant upgrades are up to date. What used to take hours, plus time to organise and travel time, now takes minutes."  

All GP Practices Achieve Highest Level of Compliance

The PCT is striving, through this project, to bring every GP practice up to the same high level where IT tools and security of patient data is concerned. Iftikhar Din says: "With the GPs linked into the PCT core network, we can decide what updates go to which practices. All this is done remotely without downtime and we can also inventory the software at the GP practices so we know exactly what is out there."

GP practices in Kensington and Chelsea serve a highly mobile population and both patients and staff often transfer between practices. Iftikhar Din comments: "Every practice has a standard configuration on its site. We are standardising the infrastructure so if practitioners or nurses move between practices they will find exactly the same ICT tools wherever they work."  

Data Quality and Training improves at Doctors' Surgeries  

As a result of the project, the PCT is now meeting national NHS targets for the improvement of data quality. The value of high quality patient-held information has never been so important to the NHS.  

Iftikhar Din says: "Data quality is crucial and the availability of complete, accurate, and timely data is important in supporting all the current NHS strategies, including the modernisation agenda, national service frameworks, clinical audit and governance, and clinical and performance indicators."  

Good quality data is vital to the performance and management of the activities of a PCT and Kensington and Chelsea is no exception. It is also helping the PCT to assess the ICT training needs of GP practices and benchmark their levels of computer literacy.  

GPs Gain Overview of Patient Journey through PCT

GPs are now connected to the PCT community information system, which is hosted centrally, and, as a result, have an overview of their patients' journeys through the different services at the PCT.  

Iftikhar Din says: "We are now getting a read-only view on the community information system so that GPs will be able to track where their patients have been. So we've got a project where a GP can input an NHS patient number and view all the activity for that NHS number on our community system."  

Previously, all such searches were performed manually and often required an IT technician to visit the practice to manage the search. "GPs were getting fed up with having to request searches in different departments and often made overlapping searches," says Iftikhar Din, "Now, we only need to make an information request once, instead of many times."