Facilitator Handbook 2005 - PRIMIS

Your Local PRIMIS Scheme
PRIMIS Facilitator Handbook
local scheme (PCO, MAAG, research network, etc.), the practice would have several data
collection agreements.
Scheme managers are advised to review and, where necessary, update agreement terms on a
regular basis.
Confidentiality of practices
Practices must be anonymised in feedback or other reports that present analyses of data in a
comparative fashion. This implies that each practice must have a code number or name
assigned to it, and that the key to the code is itself kept securely. Different data quality
improvement schemes may require different anonymised codes. If all practices in a scheme
agree, then practice identities may be disclosed. However, preservation of anonymity should
be the starting point.
Even when using an anonymised code to identify practices, schemes must still take extra care
when presenting analyses showing a small number of practices that share certain
characteristics. For example, if a scheme produced a graph highlighting results for a subset of
practices in a small geographical area that contained only two or three practices, it might be
possible to infer the identity of those practices.
Security of IT systems
The possibility of unauthorised access to data held in the scheme’s computer systems must be
considered. Although any data extract may, in itself, conform to the requirements of patient
confidentiality, linking or otherwise cross-referencing it to other data sets may make it possible
to identify patients.
Anti-virus software
If the scheme is receiving any data directly from practices using MIQUEST, then – as with the
receipt of any external disks – arrangements will need to be made to ensure thorough and
comprehensive use of anti-virus software. The scheme will require virus-scanning software that
is regularly updated. It will also need internal security policies and procedures to be reviewed
and revised appropriately. This issue also needs to be discussed with practices.
Practices will need to review their own internal security arrangements and ensure that good
quality and updated anti-virus software is in place to scan disks received from their local
facilitator. Internal procedures may have to be reviewed and revised to ensure that these
issues are dealt with comprehensively. See the latest version of the PRIMIS Guidelines for
further details.
Personal integrity
During the course of their work, the staff of data quality improvement schemes will encounter
confidential information, perhaps in the form of documents or letters in practice offices.
Absolute personal integrity is essential. The subject is complex and reference should be made
to the section on confidentiality in the PRIMIS Guidelines.
Data Protection Act 1998
Practices involved in the scheme must be appropriately registered for the Data Protection Act
and ensure that registration is kept in order. See
www.hmso.gov.uk/acts/acts1998/19980029.htm#aofs for more information.
PRIMIS 11