128. As well as the national Summary Care Record, the NHS Care Records Service aims to create more detailed patient records at local level and the capacity to share rich clinical information between local organisations. In this chapter we examine the development of local Detailed Care Records (DCRs) and the systems which will support them. We look particularly at:

• The different visions of how local electronic records systems will work, including significant areas of uncertainty, as well as the substantial benefits of introducing shared local systems;
• Progress to date on the delivery of the various components of local electronic record systems and the timetable for the completion of shared DCR systems;
• Arguments about the way forward on the development of DCR systems; and
• Issues relating to the safety and reliability of DCR systems and the model for patient consent.

Vision and potential benefits

129. The creation of DCR systems represents a large and complex set of projects and accounts for the bulk of expenditure on the NCRS.[152] One official described DCR systems as the "Holy Grail" of the national programme.[153] In this section we look at how DCR systems will work and their great potential to improve patient care. We focus in particular on:

• The overall vision for shared DCR systems;
• The benefits offered by DCR systems;
• The various component systems which will contribute to the shared record and the infrastructure developments required to support the DCR; and
• Outstanding areas of uncertainty about exactly what will be provided.

OVERALL VISION

130. NPfIT's original vision for creating shared local records systems was set out in its specification document for the "Integrated Care Records Service", published in 2003. The document described the need for "integrated clinical information systems across the whole care continuum" and envisaged that "the patient will pass seamlessly through the system with…information flowing with the patient". Integrated local record systems were described as "the foundation and bed-rock for integrated care".[154] Integrated records systems would support "care pathways", examples of which included a routine GP visit, a hospital referral to fit a pacemaker, and the A&E admission of a diabetic suffering a hypoglycaemic attack.[155] Electronic systems to support these "care pathways" were to be delivered in basic form by December 2006 and in full by 2010.[156]

131. However, the Department's descriptions during our inquiry of local record systems, now referred to as "Detailed Care Records" (DCRs), bore little resemblance to this blueprint, and did not make reference to the 2003 specifications.[157] Nor was it clear whether DCRs are still intended to support the integrated "care pathways" set out in 2003. There was a stark contrast between the specific and detailed vision set out for the "Integrated Care Records Service" in 2003, and the vague and shifting vision set out for the DCR in 2007.

132. During out inquiry, the Department did provide general, high-level descriptions of how DCR systems will work. We were told that the broad aim of the DCR project was to standardise the information collected from a range of local records systems, including hospital and GP records and imaging databases, and from these create an integrated record. Hospitals, GP surgeries and other provider organisations would continue to have local records systems, and not all the information held locally would be available on the DCR. However, local systems would need to be able to communicate with each other and to exchange data to create the integrated DCR. The exact information contained in the DCR, and the size of the area covered by each DCR network, would be likely to vary across the country, and would also depend on the specific clinical requirements for managing the patient.[158]

133. The Department's 12 June 2007 memorandum described existing local storage systems where patient information is generally kept on a range of different records which often overlap and are very rarely linked together. A single patient may have:

• A GP record, "usually held electronically but often supplemented by paper records";
• An electronic hospital record with administrative and demographic details at each hospital the patient has visited;
• Separate paper records containing clinical information at each hospital visited;
• Further separate records for maternity care, mental health care, sexual health care, and for each separate A&E attendance;[159] and
• Records of care received in the community, for example for long-term conditions.

134. The Department described the ultimate goal of the DCR project as to bring information from these separate records systems together to create a shared electronic record accessible across the local area. The Department stated that:

The Programme [NPfIT] has a clear objective to reduce this duplication of diverse records by providing a patient centred electronic Detailed Care Record that spans these areas. As a minimum, this would be within a hospital but there are real benefits when providing a consistent record across a local health community and across the boundaries involved in care pathways for a patient.[160]

135. Other witnesses described the potential of the DCR project to enable communication between distinct organisations, as well as providing shared records. Fundamental to this communication is the ability of separate IT systems to exchange information, a concept known as "interoperability". Dr Paul Cundy highlighted the importance of ensuring that systems are compatible:

You want the electronic island of hospital to be able to communicate a meaningful message about a patient to the electronic island that is relevant (e.g. the general practice)…and that is precisely what interoperability is about and I believe that is precisely what you are seeing the programme now moving towards.[161]

136. DCR systems can also change the way that care is delivered by supporting clinical processes and decision-making, and allowing activities such as prescribing to be done electronically. Frank Burns described more sophisticated DCR systems as "patient care management systems" rather than merely patient records systems.[162] Alan Shackman, an IT consultant, commented on the great potential for changing clinical processes by introducing DCR systems. He stated that:

The summary care record is basically an information repository…but a detailed care record is much more than that… The key thing is that the detailed care record more than a database allows clinicians and others to do things. It allows them to prescribe drugs, to order tests. It allows care plans to be devolved. It allows quite complicated things to be done…[163]

BENEFITS FROM DETAILED CARE RECORD SYSTEMS

The Department's view

137. Witnesses consistently emphasised the benefits of providing shared local electronic records. The Department of Health's March 2007 memorandum set out a range of advantages, including:

• Increasing efficiency by ensuring that relevant information can be shared more quickly and the same information is not collected and recorded on multiple occasions;
• Underpinning the provision of integrated care between different organisations, between primary and secondary care, and even between different parts of the same organisation. This will offer particular benefits for the growing number of patients with long-term conditions;[164] and
• Reducing medical errors, by providing more accurate and timely clinical information and, for example, through the provision of electronic prescribing services.[165]

Other views

138. Other witnesses agreed that DCR systems have great potential to increase the integration of care, and particularly to improve care for patients with chronic and long-term conditions.[166] The Renal Association stated that:

…the great majority of health gain from NHS CRS will be in local health communities. The largest early gains will be in the care of people with chronic disease.[167]

139. Frank Burns argued that the greatest benefits will derive from sophisticated clinical systems which not only record and share information but also automate clinical processes such as prescribing. He stated that:

…these systems actually support practising clinicians in their day-to-day work providing better care for patients; and where clinical management systems have been installed…there is very serious evidence of the capacity of these systems to improve patient care… The real priority for the NHS…in my view, and I think it is a view that is supported by most clinicians, is for detailed care records at a local level.[168]

140. Others agreed that the benefits gained from implementing local DCR systems were significantly greater than those from the national SCR system. The Association of the British Pharmaceutical Industry wrote that:

…increasing patient safety through the active monitoring of safety and efficacy of new and existing medicines…cannot be achieved without access to the detailed electronic patient record. This will not be provided by Connecting for Health in the proposed centrally-held Summary Care Record.[169]

141. Most witnesses confirmed that DCR systems would offer a substantial range of significant benefits. The very strong case for their introduction was summarised by Frank Burns:

Having to make the case for [local] electronic records is on a par with having to make the case for the telephone, the television, central heating and the motor car.[170]

INFRASTRUCTURE AND COMPONENTS FOR THE DETAILED CARE RECORD

142. Achieving the ultimate vision for the DCR, and the many benefits which it offers, relies on the success of a large number of complex projects. These include upgrades both to the infrastructure supporting IT across the NHS and to large numbers of local IT systems in hospital, community facilities and GP surgeries. In order to achieve the level of system interoperability necessary to support effective DCR systems, Connecting for Health has set out to replace significant elements of existing NHS IT systems.

A national foundation

143. A fundamental part of the infrastructure for the proposed DCR systems is the New National Network for the NHS (N3), provided by BT under a national contract. N3 connects all NHS organisations in a private network and will be the vehicle for all sharing of information between separate IT systems. The secure communication necessary for DCR systems to share information safely and efficiently relies heavily on N3.[171]

Local building blocks

144. Responsibility for implementing DCR systems falls largely to the Local Service Providers (LSPs) operating within each of the five regional "clusters". LSPs are responsible both for the upgrading of large numbers of local IT systems, and for ensuring the interoperability between systems required to support the DCR. The main projects being undertaken by LSPs are set out below:

a)  The replacement of hospital Patient Administration System (PAS) software is a vital step in creating DCRs. All hospitals will receive new PASs which have the capacity to communicate both with national NPfIT systems, such as the Spine, and with other local systems, for example GP systems. All patient data on existing PAS systems will be transferred to the new systems. Two different PAS products are being installed. In the London and Southern clusters, the Millennium system (supplied by the US company Cerner) will be provided.[172] In the remaining 3 clusters, a new product called Lorenzo (developed by iSoft, a UK firm) is to be introduced.[173] As well as replacing administrative functions, the new PAS applications will offer some clinical functions: it is intended, for example, to use the Millennium system to support electronic prescribing.

b)  The introduction of new PAS systems for community and mental health providers, the majority of which previously relied on paper systems, is another key step. Again, new community PAS systems will be interoperable with national and local systems. In the London cluster, the RiO system (supplied by CSE Servelec) will be provided for community and mental health care organisations.[174] In the remaining four clusters, the community PAS system will be the same product as the hospital PAS system.

c)  The replacement or upgrade of some GP practice IT systems was also planned, in particular to ensure that all practices had software which is interoperable with national and local NPfIT systems. Connecting for Health has now decided instead to allow each practice to choose a new or upgraded system from a range of different packages accredited by NPfIT. In order to be accredited, such systems much be fully interoperable with other NPfIT systems. This initiative is known as GP Systems of Choice.[175]

d)  LSPs will also install Picture Archiving and Communications Systems (PACS) in all hospitals. PACS systems allow X-rays and other images to be captured, stored and shared electronically and will be one of the components of shared DCR systems.[176]

e)  Local systems will be further enhanced through the provision of more sophisticated clinical systems, particularly in hospitals. Such systems are intended to build where necessary on the functionality provided by new PAS systems, offering more detailed patient record storage as well as more automation of clinical processes. Such systems are typically specific to individual hospital departments, such as cardiology, or to specific patient groups, such as renal patients.[177] We discuss such systems in more detail in the box below.

145. Connecting for Health has chosen to create the DCR by replacing or upgrading a wide range of stand-alone IT systems and ensuring that all such systems are interoperable both with each other and with the national NPfIT infrastructure.[178] The collation of information from these systems to form a shared care record is the ultimate goal of the DCR project.

What do we mean by "sophisticated clinical systems"? In hospitals, a clinical information system is typically a computerised medical record that provides the usual functions of the patient's paper record. It enables the recording of clinical data generated at times of patient-professional interaction and the presentation of such data at subsequent contacts. Clinical data include problems, symptoms, signs, diagnoses, severity scales, patient expectations, plans, medication, interventions and outcomes. More sophisticated clinical information systems also support clinical actions such as test ordering, scheduling of investigations and procedures, prescribing and communication. Details may be recorded at contacts (such as ward rounds. consultations or telephone calls), or to document clinical interventions (such as counselling, physiotherapy, angiography, or surgery). Some information will be recorded in structured, coded form, and some as free text. To date, clinical information systems have typically been designed to focus on the care of patients with defined diagnoses (e.g. diabetes), or to support specific interventions (such as prescribing, operations, endoscopy) or the work of individual departments (e.g. cardiology or urology). However, such systems do not create a comprehensive record for patients with chronic disease or multiple problems, particularly when such patients are seen by many different clinicians. To meet this requirement, still more sophisticated systems are needed, which focus on the individual patient irrespective of the context in which they are seen, and record and support all their problems and care in a single longitudinal record.

A common language

146. Sharing information between different organisations and care settings will require more standardisation and coding of data. This is vital if complex clinical information is to be exchanged accurately and efficiently between a range of practitioners. Efforts to increase the standardisation of clinical information have been co-ordinated by Connecting for Health and include:

• Agreement on the introduction of the Systemised Nomenclature of Medicine, also known as SNOMED CT, across the NHS.[179] SNOMED CT is a single comprehensive database of codes covering diseases, operations, treatments, drugs and a number of other areas. It is described by Connecting for Health as "the language of the NHS Care Records Service";[180]
• The development of an NHS Data Dictionary so that the meaning of different clinical and administrative terms in the context of the NHS is understood consistently;[181] and
• Attempts to increase the use of the NHS number as a unique identifier for patient information. This is vital to developing integrated records as it allows patient episodes which take place in different hospitals, or different departments of the same hospital, to be linked together.[182] Connecting for Health introduced the NHS Numbers For Babies scheme, which allocates a lifetime NHS number at birth, in 2002.[183]

We discuss the requirements for standardising information to support DCR systems in more detail below.

AREAS OF UNCERTAINTY

Appearance and content of the DCR

147. In spite of the obvious scale and ambition of the DCR project, the Committee received uncertain and sometimes conflicting evidence about what Connecting for Health and its suppliers will actually deliver. Most fundamentally, it was not clear what the shared DCR will be able to do and exactly what information it will contain.

148. Officials offered some information on this point. Dr Gillian Braunold explained that the DCR will enable information sharing between primary and secondary care, replacing slower paper-based communication.[184] Dr Simon Eccles commented on the importance of ensuring that the new systems installed in GP practices, hospitals and community care organisations are interoperable.[185] But officials did not supply precise details about the appearance or specification of shared DCR systems.

149. Explanations from suppliers were similarly opaque. Patrick O'Connell of BT, the LSP for London, described the DCR as "a single view so that a patient's record can be viewed in a variety of care pathways". Guy Hains of CSC, LSP for three of the five regional clusters, stated that:

The Detailed Care Record is variously at the GP and a secondary care setting like a hospital where your treatment record will be held.[186]

150. Professor Naomi Fulop of King's College London, whose research has examined the delivery of NPfIT systems in the acute sector, succinctly captured concerns about the lack of detailed information on the DCR:

What I would add about the detailed record is that it has not been communicated to people what it is.[187]

Depth of information sharing

151. In light of this problem, witnesses inevitably raised other questions about the specific plans for DCR systems. Dr Paul Thornton, a GP, questioned the level of detail of information sharing that DCR systems would offer, concluding that:

Detailed Care Records…can never provide the level of detailed data sharing which would be necessary for shared care.[188]

152. Suppliers provided little reassurance, commenting that the degree to which local organisations store and share information electronically will in part be for them to decide. Guy Hains of CSC stated that:

University Hospital Birmingham has an advanced view; it wants to move to a very high level of electronically-stored records. Other hospitals may choose also to have a reference to paper-held records. We are not mandating the level of efficiency and automation to which those hospitals take their full records.[189]

153. Neither suppliers nor officials made clear whether organisations would be subject to specific requirements for sharing information through DCR systems. Witnesses argued that it is therefore difficult to assess the level of detail which DCR systems will provide and to judge the clinical value of the planned records.[190]

Breadth of information sharing

154. A related set of concerns focussed on the range of organisations and the geographical area which will be covered by each DCR. Professor Naomi Fulop and Dr Paul Thornton both highlighted fears that organisations which are geographically adjacent may be unable to share information, because they form part either of different health economies or of different NPfIT clusters. Such barriers, they argued, would inevitably reduce the value of the shared DCR.[191]

155. Suppliers stated that the scope of information sharing would be decided locally. Guy Hains compared plans for two different areas:

…one would be Morecambe Bay Acute Trust where there are 2,500 users effectively on one system compared with Greater Manchester…They have a system for Greater Manchester with about 13,500 users on it.[192]

156. The Department of Health told us that there is likely to be significant variation regarding the breadth of the area across which DCR systems will be shared. The Department's 12 June 2007 memorandum stated that:

…in future, records can be shared amongst a locally determined health community that is on the same IT system. Typically, as a minimum, this is at GP practice level or hospital level but can span Strategic Health Authorities (SHAs) or other local health communities as agreed between the NHS and suppliers.[193]

Sophistication of new systems

157. Some witnesses also questioned whether the new administrative and clinical systems due to be supplied as components of the DCR would represent significant improvements on existing systems. The Renal Association, for example, commented that:

Many renal centres have well-developed decision support systems that should not be lost by the introduction of generic less flexible systems. It is unclear whether the proposed Lorenzo solution will be able to offer the same level of sophistication on which we have come to rely.[194]

158. Frank Burns argued that the upgrading of hospital PAS software would not represent a significant advance in itself, as such systems have been in used in hospitals "for the last 20 years".[195] He pointed out that significant advances will not be possible until more complex clinical systems are installed, a development for which there is no clear timetable.[196] Mr Burns also commented that:

Many in the NHS believe that by the time the systems procured are implemented…what they end up with will not be the sophisticated clinical management systems that they need for modern healthcare.[197]

We provide more detail on what is meant by "sophisticated" clinical systems in the box above.

Progress and implementation

159. Although many questions were raised about precisely what DCR systems comprise, these were significantly outnumbered by concerns about when such systems would be delivered. In this section, therefore, we look at the progress to date on implementing the various components of local record systems and the shared DCR itself. We look particularly at:

• Progress in developing each of the specific systems and components which will make up the DCR;
• The timetable for the completion of the shared DCR itself;
• Reasons for delays to elements of the DCR project and to the provision of shared local records;
• Progress on the delivery of new hospital PAS software; and
• Progress on developing coding systems, a unique identifier and clinical information standards to enable data sharing.

PROGRESS ON SPECIFIC SYSTEMS

160. Progress to date on each of the main systems which will contribute to the shared DCR is set out below:

a)  The N3 Network and National Data Spine, which provide the backbone for all sharing of information between systems, are both operating successfully. Officials told us that more than 19,000 N3 connections have been installed across the NHS and that the system had been completed two months ahead of schedule.[198] Functions are being added to the National Spine incrementally following earlier delays of around ten months to software delivery.[199] With regard to the N3 network, Richard Granger stated that "we have one of the biggest virtual private networks on the planet and people take that for granted."[200]

b)  By contrast, the delivery of hospital PAS systems has been significantly delayed. The Department acknowledged that implementation is "up to two years behind the original schedule".[201] Because of the importance and complexity of this element of the DCR project, we examine it in specific detail below.

c)  The delivery of community and mental health PAS software has apparently been more successful than that of hospital systems. Officials told us that 105 systems have been deployed in total.[202] Patrick O'Connell stated that BT has made 18 deployments of the RiO systems to community providers in London.[203] CSC stated that 60 community PAS deployments have been made across its three clusters.[204] But Alan Shackman argued that the community software deployed by CSC represented an interim solution that will have to be replaced once again when the Lorenzo product becomes available.[205]

d)  Connecting for Health procured a catalogue of accredited GP systems in February 2007 under the GP Systems of Choice initiative, which we discuss further below. Connecting for Health has also put in place a system for transferring records between GP practices, known as GP2GP.[206]

e)  Picture Archiving and Communication Systems (PACS) have been successfully implemented in three-quarters of hospitals, according to the Royal College of Radiologists.[207] Several witnesses argued that, because of the maturity of PACS technology and the enthusiasm for implementing these systems, such success would have been achieved irrespective of NPfIT.[208] However, the Department disagreed, pointing out that the speed with which PACS applications have been delivered has increased dramatically as a result of the national programme.[209]

f)  The delivery of Electronic Transfer of Prescription (ETP), also known as electronic prescribing systems, has been less successful, particularly in hospitals. Officials told us that while use of ETP systems is growing in GP and community settings, use in the acute sector is limited to a "handful" of hospitals.[210] Richard Granger told the Committee that hospital ETP systems will be introduced "over the next two to three years".[211] In Delivering 21^st Century IT, published in 2002, the Department set a target for 100% coverage of ETP systems in the NHS by the end of 2007.[212]

g)  The delivery of other more detailed clinical systems has been very limited, largely because of the delays in implementing basic hospital PAS applications. Although such systems are not a prerequisite of shared DCR systems, more clinically rich systems will add significant value to the DCR.[213] The Lorenzo and Millennium systems are likely to offer some clinical functions, but Connecting for Health also put out a tender earlier this year for a range of other clinical systems. We discuss this in more detail below.

h)  Due to the delays to a number of constituent projects, progress on the delivery of shared Detailed Care Records has hardly begun, as we set out below.

DELIVERY OF THE DETAILED CARE RECORD ITSELF

Officials' views

161. The Department did not provide an exact timetable for achieving the ultimate goal of the DCR project, the delivery of the shared record itself. Its initial submission in March 2007 stated that:

The transformation from paper to digital information will take place gradually up to 2010 and beyond.[214]

162. The subsequent memorandum, received in June 2007, argued that specific completion dates could not be given because of the wide range of systems being delivered across different parts of the country and different tiers of care. The Department also pointed out that DCR systems will be built up incrementally and as such do not necessarily have a fixed implementation or completion date. The Department concluded that:

…it is not a single monolithic system due for delivery or go-live at one point in time. The Programme comprises a range of new and existing systems, introduced incrementally and meeting the Programme's objectives over time…LSPs' plans are all based on delivering incremental improvements.[215]

163. Officials also challenged the view that the delivery of DCR systems as a whole is behind schedule, arguing that each element of the new systems should be considered separately. Richard Granger stated that:

It is inaccurate to state that the whole of the programme is late. That is not true. Some of the programme is late, some of it is on time and some of it is early…[216]

Suppliers' views

164. BT, the LSP for the London cluster, provided a clear timetable for the completion of DCR systems within this area. In its written evidence, the company stated:

The foundations of the NPfIT system provided by BT are now built, operating and secure. Culturally integrating these systems so they become second nature for NHS staff is well underway. Over the next five years, the goal is to complete this programme.[217]

165. In oral evidence, Patrick O'Connell set out a still shorter timetable for the completion of DCR systems in London:

…this year and next year [i.e. 2007 and 2008] we are rolling out the basic stand-alone capability…once it is established that we have the capability then we intend to link it together…In a stand-alone capability we should finish in 2009 and complete and integrated in about 2010.[218]

Thus, according to Mr O'Connell, all London hospitals, community providers and GP surgeries will have had their basic systems upgraded by 2009 and integration of systems to create the DCR system will take place in 2010. However, as discussed above, the exact content of the DCR, and the degree of information sharing that will initially be possible, were not made clear.

166. CSC, the LSP for three of the five NPfIT clusters, did not provide such a precise timetable for the introduction of DCR systems. Guy Hains told the Committee that the Lorenzo system, intended to be the main PAS software for hospitals and community providers, would be implemented for the first time "in the middle of next year", suggesting an overall timetable some way behind that of BT.[219] Fujitsu, the LSP for the Southern cluster, did not provide evidence to the Committee.

Other views

167. Other witnesses were more sceptical about when DCR systems would be delivered. The British Association for Community Child Health described detailed shared records as "a mirage with an ever receding completion date".[220] Alan Shackman pointed out the continuing delays to the introduction of hospital PAS applications have meant that more sophisticated clinical systems cannot be deployed. He concluded:

…there remains no definitive timescale for introducing the clinically focused software that would take functionality in any significant way beyond the basic PAS functionality that was available to the NHS when NPfIT began in 2002.[221]

168. Frank Burns also commented that more "clinically rich" systems, from which the greatest benefits will be derived, have proved the "slowest in coming forward".[222] Mr Burns gave the specific example of acute trust electronic prescribing systems, one of the original objectives of the NPfIT project and an important component of DCR systems. He stated that:

As far as the hospital side is concerned, electronic prescribing is the very last in the list of things that are going to be delivered by NPfIT, and there are people who fear they will never ever be delivered.[223]

169. In short, witnesses argued that even if some form of shared DCR systems were delivered in the next few years, more clinically rich systems will take much longer to provide.[224] In this context, the current lack of clarity about content and levels of information sharing within DCR systems is worrying, especially when compared with the 2003 specification documents which provided a lot of specific detail about the project's original goals.[225] Dr Martyn Thomas expressed grave concern about the loss of clarity about what the project will deliver and changes to the "milestones" for demonstrating step-by-step progress on the development of the DCR. He argued:

What typically happens is that people start redefining what the milestones meant, in order to claim success for milestones and to put off the day when they have to admit that things have gone wrong, and they start arguing about what it was they really were setting out to do at the beginning, so they start getting a bit weasely about what the specification really was…[226]

GENERAL CAUSES OF DELAY

170. It is clear that some elements of DCR systems, such as the N3 network and hospital PACS, have been delivered on time. Yet others, such as hospital PAS and ETP systems, have fallen significantly behind schedule, leading to overall delays in the delivery of shared records themselves. A very wide range of reasons was suggested for the delays to these elements of the project, as we set out below.

Officials' views

171. Officials offered several explanations for the delays to DCR systems:

a)  Significant expansion to the scope of the project had been a cause of delays. This included the addition of a number of projects, for example PACS, QMAS and GP2GP transfer, to the overall scope of NPfIT. Richard Granger acknowledged that the addition of new systems had set back the implementation of DCR systems, but argued that "in the real world it would be ridiculous to imagine that halfway through a ten-year programme you would only be doing the same things as you set out five years ago".[227]

b)  This problem was compounded by the fixed budget for the project. Officials argued that development problems could not be resolved by spending extra money, for example on temporary staff, and that some time delays were therefore inevitable when difficulties were encountered. Mr Granger told us that "the only expression of dealing with problems on this programme is necessarily time, because we are operating within a financial cap and the functionality demands have tended to increase rather than decrease".[228]

c)  The implementation of new systems, particularly where this involved a replacement of existing systems, proved more difficult that envisaged.[229] We discuss this with particular reference to new hospital PAS deployments below.

Suppliers views

172. Suppliers offered somewhat different, though not conflicting, explanations for delays. Patrick O'Connell of BT argued that NPfIT "is following a profile that is somewhat typical of very large national transformation programmes".[230] He went on to state:

I have been managing these things for about 24 years now…Typically, they do have a slow start but with the right spirit and the right expertise on both sides they get around the corner and they start to perform…I think you will see us picking up speed as we go along.[231]

173. CSC argued that the sheer scale and complexity of the programme had led to delays. The company stated that "the deployment of technology across an organisation as complex and far reaching as the NHS" represented a unique undertaking, making it difficult to provide accurate timetables for completion. CSC also described the original timetables for the programme as "ambitious".[232]

Other views

174. Other witnesses offered a wide range of explanations for delays to DCR projects. The most commonly suggested were:

• Unrealistic and overambitious timescales for delivering new systems.[233] Stalis, a UK technology firm, stated that "project goals must be realistic and those for NPfIT in general and the Care Records Service in particular were not".[234]
• A lack of clear specifications for what the programme would deliver. Dr Martyn Thomas argued that without such specifications "any schedule that you put together…is built on sand".[235]
• A failure to appreciate the need for changes to processes and working practices to accompany the installation of new systems. Witnesses argued that this had meant organisations were often unprepared to receive new systems or unwilling to volunteer for implementations.[236]
• The excessively centralised approach adopted by the programme, not only to procurement but also to the delivery of new systems. Witnesses argued that this approach had stifled local activity, for example on implementing hospital PAS software, and left individual organisations frustrated and disengaged.[237] Professor John Feehally of the Renal Association commented that: "if at the beginning of this sorry process they had simply given local health networks some resource and said, 'You will just simply resolve the question of the primary care computer system talking to the hospital computer system', we would all now be smiling".[238]
• A lack of clinical and user engagement in the development of new systems which has made it difficult to stimulate progress and activity at a local level.[239] The BMA argued that increased clinical engagement "could have highlighted potential problems at an earlier stage" and thereby reduced overall delays.[240]

UPGRADING HOSPITAL PATIENT ADMINISTRATION SYSTEM SOFTWARE

175. The delays to the delivery of new hospital PAS software were highlighted as a particular cause for concern. These delays have had the knock-on effect of delaying the deployment of more sophisticated clinical systems in secondary care. Such systems are a core element of the DCR: shared records cannot be achieved without properly functional and integrated electronic hospital records.

Progress and timetables

176. Progress on implementing new PAS systems has varied across the different regional clusters, as we detail below.

a)  BT plans to install Cerner's Millennium PAS software at hospitals across London. Patrick O'Connell told the Committee on 7 June that BT planned to complete all local deployments by 2009 but that only one deployment has taken place to date, at Queen Mary's hospital in Sidcup.[241] The Millennium system has also been deployed at Homerton and Newham hospitals as part of a local procurement with no connection to NPfIT. BT had originally planned to use IDX as its hospital PAS supplier but switched to Cerner's Millennium system in July 2006.

b)  Cerner's Millennium system will also be deployed by Fujitsu at hospitals in the Southern cluster. Like BT, Fujitsu had planned to use IDX as its supplier but switched to Cerner in June 2005. Fujitsu and BT had worked together on a "Common Solution Project" for installing hospital systems across their clusters, but this partnership was also dissolved in 2005.[242] Alan Shackman stated in March 2007 that the Millennium system had been deployed at five acute trusts in the Southern cluster. He commented that after "a false start", progress on deployments was "encouraging".[243]

c)  In the North East, Eastern and North West & West Midlands clusters, CSC plans to deploy iSoft's Lorenzo software in all hospitals. Unlike Cerner's Millennium system, which is already widely used in the US, Lorenzo is a new-build application.[244] There have been no deployments of Lorenzo to date and none are planned until mid-2008, according to CSC.[245] Richard Granger told us that Lorenzo would be trialled in Germany in June 2007 but confirmed that no deployments in England would take place until 2008.[246] Guy Hains commented that CSC was putting "an awful lot of support" into developing the product.[247] CSC has made 11 deployments of a more limited PAS application, iPM, at hospitals in the North West & West Midlands cluster.[248] However, Alan Shackman described iPM as a system "with no clinical functionality" which could not contribute to a shared DCR system.[249]

Reasons for delays to hospital PAS implementation

177. Differing explanations were given for the delays to the two main hospital PAS applications, Millennium and Lorenzo. Although some deployments of Cerner's Millennium system have now taken place, implementation is still behind schedule. Richard Granger commented that one cause of the delays had been difficulties in "anglicising" Millennium, which is primarily used in the US, so that it could operate in the NHS.[250] Patrick O'Connell commented that switching software suppliers from IDX to Cerner had delayed hospital PAS deployments in London.[251] Mr O'Connell also cited the breakdown of the "Common Solution Project" between Fujitsu and BT as a cause of delays.[252]

178. Regarding the Lorenzo system, Richard Granger stated the sheer complexity of building a new software system from scratch had delayed the project.[253] Guy Hains of CSC commented that the need for rigorous testing and the decision to make Lorenzo an internationally available product had both contributed to delays.[254] Mr Hains also acknowledged that takeover speculation regarding iSoft, the company developing Lorenzo, had added to the problem, commenting that "uncertainty regarding iSoft and its future ownership has proved an unwelcome distraction".[255]

179. Richard Granger also pointed out that the process of actually deploying new hospital PAS software had proved more difficult than expected, particularly because of the need to move data from old systems onto new ones without causing excessive disruption to the delivery of care. He stated that:

Brownfield site implementations are incredibly difficult…You might have half a million records…that have to be cleaned up by staff in the hospital…It is a big heavy-lifting systems engineering job. It is like replacing the core systems in a small government department or small corporation…in a weekend.[256]

Impact of delays

180. Hospital PAS applications are a fundamental element of DCR systems and delays to their deployment have been a primary cause of difficulties in making progress on the provision of shared records systems. Witnesses also pointed out other problems caused by delays in upgrading hospital systems, including:

• A possible impact on patient safety in hospitals with particularly old computer systems, because of reliability problems and difficulties in maintaining out-of-date software.[257] One witness described a trust buying new parts for its PAS from eBay because they were no longer available elsewhere;[258] and
• Frustration and disengagement at local level because of continuing delays, and particularly because the delays to new PASs prevent more clinically rich systems from being deployed.[259]

CODING AND INFORMATION STANDARDS

181. So that information can be accurately shared and combined between the different parts of the DCR system, data will increasingly need to be recorded in a standard way. The Department of Health described the need for "a much more structured approach" to record keeping, stating that:

…clinicians will need to adopt the new approach to record keeping. This will need a cultural change in the practices of health professionals which should not and could not be led by an IT programme but must be seen as a significant improvement to patient care and therefore owned and led by the NHS.[260]

The NHS number

182. Witnesses highlighted the importance of the unique identifier, the NHS number, in increasing the standardisation and quality of a patient's record. Professor Carol Dezateux of the Institute of Child Health described the 2002 introduction of NHS Numbers for Babies, which allocates a lifetime NHS number at birth, as "an outstanding success".[261] But Dr Mark Walport of the Wellcome Trust pointed out that the NHS number is not yet regularly used for all patients whenever they come into contact with the NHS.[262] Professor Dezateux argued that the NHS number should be used whenever a patient interacts with the health service. She commented:

There is not a mandated system for doing that but it is not technically challenging or difficult to do, given the right leadership and the right go-ahead.[263]

183. The difficulties caused when a unique identifier is not used were outlined by Dr Gill Markham of the Royal College of Radiologists. She described the inconsistent use of the NHS number as a "huge difficulty", giving the example of problems with the sharing of diagnostic images.[264] She commented that:

…largely because of this [inconsistent use of the] unique identifier, you cannot transfer images; and there is an enormous industry at the moment with people burning CDs, putting the images onto CDs that then get sent to the hospital that might be two miles down the road…[265]

184. Dr Markham and Professor Dezateux both pointed out that consistent use of the NHS number has been achieved in Scotland, which has a separate numbering system. They argued that this should be a key priority for the NHS in England and that effective use of a unique identifier would significantly improve the quality of clinical information, benefiting both direct patient care and clinical research.[266] In its 16 July memorandum, the Department of Health told us that plans are in place to achieve more comprehensive usage of the NHS number, but did not set a specific timetable for achieving this:

Work underway currently with the authority of the National Programme Board is aiming to ensure that the NHS number is mandated by the Information Standards Board and subsequently adopted incrementally for use within IT systems across the NHS within a reasonable period.[267]

185. Dr Markham also highlighted the need to allocate temporary NHS numbers rapidly, for use for example when patients are admitted unconscious for emergency treatment, but added that these temporary numbers should be subsequently reconciled with the unique permanent NHS number.[268]

Coding systems

186. As mentioned above, significant progress on introducing a single coding vocabulary into the NHS has already been achieved. Connecting for Health has been active in the development of SNOMED CT, an internationally recognised coding system for recording clinical data including symptoms, diagnoses, treatments, drugs and a range of other information.[269] SNOMED CT will be used to code data in both SCR and DCR systems. The importance of using a common coding system across the NHS was highlighted by Dr Paul Cundy. He explained that:

Exchanging or sharing data between systems that have disparate coding arrangements creates unnecessary complexity and introduces dangers. It is accepted that all systems in the NHS should use a common coding system and one has been identified; SNOMED.[270]

Clinical information standards

187. However, witnesses argued that there was also a need for a more holistic approach to standardising information for use in DCR systems. The Royal College of Physicians (RCP) pointed out that alongside a universal coding system there is a need for agreed datasets and approaches to structuring information. Such "information standards" will allow information to be shared meaningfully between clinicians, reduce the potential for errors, and make it easier to use data for health research. The RCP argued that significant work was required to agree information standards for different clinical specialties (e.g. cardiology and gastroenterology), different disease areas (e.g. diabetes and epilepsy) and different care settings (e.g. outpatients, admissions and GP consultations).[271] Coding, in short, offers a common vocabulary, but exchanging detailed clinical information also requires an agreed syntax, which is likely to vary between different clinical specialties and patient groups.[272]

188. Unfortunately, there was little evidence of progress in this important area. The RCP stated that:

The definition of this detail and the structure of the record to record it should be agreed nationally, based on work undertaken by appropriate professional bodies such as the Royal Colleges and Specialist Societies. To date the Colleges have not been requested to undertake this work…[273]

189. When questioned about plans for this work, officials argued that Connecting for Health has had regular contact with Royal Colleges and other specialist societies.[274] Lord Hunt also told us that a new forum would be established at national level between Connecting for Health and the Academy of Medical Royal Colleges.[275] But officials did not explain the purpose of such engagement and did not set out plans or progress on developing the necessary professionally-agreed information standards.[276]

Changing working practices

190. Central agreement on new ways of coding, structuring and recording clinical information is of little value if such systems are not used at a local level. Officials commented that the implementation of clinical coding systems at the front line was likely to prove challenging, especially in secondary care. Richard Granger stated that:

It is going to be a long and difficult process to get the complexities of secondary care to code information in a way that it can be used outside of the location in which it was originally created.[277]

191. Mr Granger also commented that difficulties had been encountered when implementing Cerner's Millennium system at hospitals in the Southern cluster because of the need to code more information at the point of care.[278] But officials did not say how they planned to address such problems on a wider scale. Nor was it made clear what support will be given to hospitals and other organisations to change working practices. Alan Shackman underlined the lack of focus on changing clinical processes:

…the change management, changing the process…was going to be covered by the Modernisation Agency, which no longer is with us, so I struggle a bit to find any concerted way of helping make the process change happen whereas of course there is a most concerted way of actually getting the technology in.[279]

The way forward

192. It is clear that some elements of the DCR programme, such as the creation of the N3 network and the roll-out of hospital PACS systems, are set to be successfully achieved. However, it is equally evident that other parts of the project are beset by significant problems. The most serious of these are:

• The lack of clarity about the ultimate vision for the shared DCR record, particularly the area which will be covered and the level of information which will be shared;
• The absence of a clear timetable for implementing shared DCR records; and
• Ongoing delays to the delivery of new hospital PAS software, a key prerequisite for implementing both shared record systems and more sophisticated local hospital EPR systems. The failure to deploy the Lorenzo system anywhere in the NHS is a particular concern.

AN INDEPENDENT TECHNICAL REVIEW?

194. Amongst those witnesses to call for an independent technical review of the programme were the UK Computing Research Council and Computer Weekly magazine,[280] but the clearest explanation of the case for a review came in a submission from a group of 23 "senior academics in computing and systems".[281] The 23 academics drew on a "Dossier of Concerns" submitted to the Committee in 2006, which detailed a litany of problems with the programme.[282] These concerns, totalling 35 in all, ranged from poor planning, an over-centralised approach and unrealistic timescales and budgets, through to "inappropriate aggression and machismo" and "fear of failure".[283] The submission concluded that:

…our analysis illustrates very dramatically the number, variety and complexity of the concerns surrounding NPfIT, and thus provides a compelling argument for commissioning a detailed review of the project, carried out by evidently-independent experts with full access to all relevant information and personnel.[284]

195. The case for an independent review was put to the Committee in more detail by Professors Martyn Thomas and Brian Randell, both members of the group of 23 academics. Professor Randell pointed out that public IT programmes have benefited from such reviews in the past and stressed that the review should look at operational as well as technical aspects of the programme.[285] Professor Thomas gave the example of the new Swanwick air traffic control system, which he argued had benefited significantly from an external review.[286] He also argued that a review by external experts would be able to resolve issues which the programme's leaders might be unaware of or unwilling to acknowledge:

…my experience of carrying out those reviews is that people get blinded by the fact that they are too close to the project and they get compromised by the fact that they cannot stand back and admit errors.[287]

196. Officials and suppliers both denied the need for an independent, external review. Richard Granger argued that the programme had already been heavily scrutinised, for example by the National Audit Office, and that Ministers had therefore concluded that a further review was not necessary.[288] Guy Hains pointed out that suppliers were subject to regular reviews, both technical and commercial, and stated that elements of the programme were in effect reviewed every two months.[289] Guy Hains and Patrick O'Connell both pointed out that individual systems were subject to high levels of audit and testing.[290] Mr Granger was particularly dismissive of the "Dossier of Concerns" prepared by the 23 academics:

If there are people who want to work from an evidence base, the door has always been open for them to come and work with us, but people who just lob cold collations of negative media coverage in so-called dossiers hardly do themselves a service as a serious group of people that are working from a robust evidence base.[291]

197. Andrew Hawker suggested that rather than undertaking a full-scale review, elements of the programme should be subject to more independent testing with published outcomes.[292] Professor Thomas argued that if this approach were chosen then such testing should focus not only on the technical security of new systems, but also on how DCR systems would actually be used once implemented. He stated that:

…my instinct would be to do lots of prototyping and work with the clinicians in the frontline to really find out what works for them, what they are happy with, what works with their patients, and then to stand back and decide what you want to do on a national basis…[293]

INCREASING LOCAL OWNERSHIP

198. Some of the strongest criticism of the approach adopted by NPfIT to developing DCR systems argued that procurement and implementation have been too centralised, stifling local ownership and innovation.[294] The need to maintain a balance between central and local input into the programme was acknowledged by officials. Richard Granger commented:

…you come back to this paradox of the necessity of strong local leadership and management ownership…with a necessity of buying things at a higher level in the NHS in order to make them affordable. So we have to do both; it is not an either/or…there has to be a balance struck between standardisation and localisation...^.[295]

The need for central input

199. Officials strongly defended the value of the central direction and leadership which have characterised the programme to date, highlighting in particular that:

• Centrally procured and managed contracts have helped to ensure that widespread upgrades to local systems are affordable. Richard Granger argued that where EPR systems have been purchased locally, these have not proved affordable in the long term.[296] He commented that "it is not about all the money being spent nationally. It is about the unit cost being too high if things are bought locally".[297]
• The national approach is necessary to ensure the consistent development of new systems across the country, rather than the previous "islands of excellence".[298] Lord Hunt argued that: "the national approach that we have taken was absolutely essential in terms of ring-fencing the resource, giving it the priority and ensuring that the NHS did move in step."[299]
• Central input has a particular role in ensuring interoperability between newly procured systems, a fundamental part of establishing shared DCR systems. Richard Granger argued: "if we would like to indulge ourselves with 200 rich local systems across the NHS we not only cannot afford them, we will forever be locked into information not being moveable between locations…"[300]

The need for local input

200. Officials and other witnesses also pointed out the clear advantages of involving local organisations, particularly in the development of the systems which will make up the shared DCR record. The following arguments in particular were put forward:

• The involvement of local users, particularly clinicians, is vital if implementation of new systems is to be successful. Lord Hunt pointed out: "it has got to make sense for senior management to engage the clinicians because if you have an institution where the clinicians have not been involved the one thing you can be sure is that when the PAS system is introduced it is not going to work very well".[301]
• Ensuring interoperability between systems is best done at a local level and would have been treated as a higher priority if the programme had not been centrally managed. In particular, PCTs should have been given responsibility for ensuring interoperability between local systems.[302]
• PCTs are responsible for commissioning healthcare in general and should therefore be made accountable for implementing the DCR, as shared record systems are fundamental to the delivery of care. Frank Burns made the case for more PCT involvement with the programme, arguing that "there needs to be some local accountability for ensuring that patients have reliable records".[303]

Shifting the balance of power: steps to date

201. There is some recent evidence of changes to the approach to delivering DCR systems in light of the case for increased local input. There are three main examples:

a)  The NPfIT Local Ownership Programme (NLOP), which was implemented following a review of the management of NPfIT in October 2006. NLOP devolves responsibility for implementing local systems, and for some elements of the management of LSP contracts, from Connecting for Health to the 10 regional SHAs.[304] SHAs were made formally accountable for "implementation and the realisation of benefits" from the programme from 1 April 2007.[305] Lord Hunt stated that implementing NPfIT has been made one of the four key priorities for SHAs.[306] Richard Granger commented that senior staff at SHA level have already become closely involved in the running of the programme and "dealing day-to-day with key contractual management issues in collaboration with Connecting for Health people and frontline staff from trusts".[307]

b)  GP Systems of Choice (GPSoC), which will allow GP practices to choose their software supplier for new or upgraded practice systems to support the DCR. Suppliers will be approved by Connecting for Health, and will be required to meet interoperability standards, but individual practices can then choose from a number of accredited software systems.[308] GPSoC was launched in March 2006 and procurement of approved suppliers began in February 2007.[309]

c)  The procurement of a range of additional systems through a tendering process begun by Connecting for Health in March 2007. This procurement is separate from the main LSP contracts and covers a wide variety of clinical and administrative systems with the potential to support the delivery and increase the sophistication of local DCR systems.[310] Additional systems procured in this way must be interoperable with all other NPfIT systems.

202. Witnesses were generally supportive of these efforts. Professor Naomi Fulop argued that NLOP might help to address the problem of users feeling "at the bottom of the food chain", but asserted that it must be "more than a token gesture".[311] Patrick O'Connell commented that NLOP would help to speed up deployments in London, although he did not explain how.[312] Dr Paul Cundy expressed support for providing a choice of suppliers for GPs, although he pointed out that this was actually a requirement of the 2003 GMS contract.[313] Dr Jon Orrell, a GP, commented that GpSoC had "brought the programme back from the brink of disaster".[314]

Shifting the balance of power: future prospects

203. The programme's leaders clearly acknowledged the need for a balance between central and local input into the development of DCR systems.[315] It is likewise clear that recent initiatives such as NLOP and GPSoC have increased local accountability and introduced choice for some users. Yet many witnesses argued that the balance is still not right, and that more needs to be done to increase local ownership of the programme.[316] This argument seems particularly compelling given that many of the national elements of the programme have been completed, while local deployments are the main challenge for the future.

204. In this context witnesses made several suggestions for further increasing the local ownership of the programme:

a)  Frank Burns proposed that all local organisations should be given a choice of new systems, rather than having to wait for the delivery of products, such as Lorenzo, which have been badly delayed. Mr Burns argued that as long as interoperability between systems can be assured, it does not matter which specific system is installed in each organisation. However, he acknowledged that existing LSP contracts might make it difficult to increase choice in the short term.[317] Richard Granger did state that if further delays occurred to the delivery of Lorenzo then the Millennium system would be made available to hospitals in the three CSC clusters.[318]

b)  Other witnesses suggested that Connecting for Health should set central standards for new systems which could then be purchased through a local procurement process. Dr Martyn Thomas stated that central standards for interoperability would be crucial to ensuring that records could be shared, but that central accreditation of new systems need not prevent procurement and implementation from taking place locally.[319] Frank Burns recommended developing a national "catalogue" of approved systems for local organisations to choose from, similar to the approach adopted for GPSoC.

c)  Frank Burns argued that the NPfIT Local Ownership Programme, which devolves responsibility for delivery to SHAs, did not go far enough. He argued that accountability should be further devolved to PCTs if increased local ownership was to be achieved.[320]

Security, reliability and consent

205. Although the ultimate goal of implementing shared DCR systems is some way from completion, a number of local component systems have been successfully deployed. As a result, the Committee was able to examine some of the operational challenges raised by DCR systems. In particular, we heard evidence on:

• Plans for safeguarding the external security of shared record systems;
• The importance of ensuring that DCR systems and the networks which support them have high levels of reliability, especially as dependence on IT systems for clinical purposes increases;
• The challenge of maintaining operational security as the number of people with access to patient records increases. A particular issue was the use of smartcards to access DCR systems; and
• The appropriate model for patient consent for the creation and sharing of local records.

TECHNICAL SECURITY

Security targets

206. Questions were raised about the external security of DCR systems, particularly in light of the intention to share detailed and often sensitive health information between organisations. Dr Martyn Thomas was critical of the apparent lack of targets for protecting security, arguing that this would make it difficult to hold suppliers to account:

…if you do not know how tolerable it is for a security breach to occur, you do not know how much effort you need to put into building systems that are adequately secure to meet your targets...[321]

207. But suppliers told us that no specific security targets existed simply because no breaches of security were acceptable. Guy Hains of CSC explained that,

Both parties understand that no system is foolproof, but in terms of any weaknesses that we find in our system, or is found through audit, we are contracted to remedy it quickly. Any issue where we do not remedy will be a failure by us as a contractor…it is a zero tolerance environment.[322]

208. Mr Hains also argued that suppliers have clear general security standards to meet, with regard both to protecting systems from outside attack and to the encryption of data being transferred between DCR systems.[323] He also pointed out that LSPs undertake "ethical hacking" to test their security systems, commenting:

We are trying to break our own systems and we use the brightest and best…on a global basis.[324]

System architecture

209. The Committee also heard that technical security will be more difficult to maintain because of the centralised architecture of the data storage and transfer systems designed by LSPs. According to witnesses, regional data storage centres and the use of the national network to share information will make even "local" DCR systems substantial targets for attack.[325] The perceived problem was summarised by the Foundation for Information Policy Research:

It is a principle of security engineering that we can build system with functionality, scale or security—or indeed with any two of these attributes, but not all three. Secure and highly functional systems have to be local, or compartmented.[326]

210. But officials and suppliers argued that the architecture of DCR systems would indeed be compartmented. Richard Granger commented that the planned architecture for data storage and transfer had been "incorrectly" presented as "monolithic" by commentators. Guy Hains of CSC agreed that building more local or more compartmented systems made maintaining security easier, but argued that this is precisely the aim for LSPs in designing DCR systems:

…it is not one large monolithic system…it is absolutely the case that more modular, simpler and smaller systems are more easily protected and upgraded in future. That is exactly the approach we have taken. There is emphasis on keeping tight controls and boundaries and…firm levels of control over message-passing and encryption, making sure that the connectivity that we create is safe. That is the essence of the design.[327]

SYSTEM RELIABILITY

211. Related concerns were raised about maintaining the reliability of DCR systems and preventing systems from crashing or data from being lost. The scale of the potential dangers posed by reliability problems was highlighted by a power failure at a CSC data storage centre in Maidstone in July 2006. 72 PCTs and 8 hospitals lost access to their administrative records systems for several days when back-up systems also failed.[328]

212. Some witnesses argued that failures of this type would be increasingly likely as the complex and interconnected systems which make up the DCR are developed and joined together.[329] Professor Brian Randell told the Committee that:

My specialist friend…has done a lot of work on estimating failures. As a guesstimate, not estimate, he said that NPFIT would be likely to fail about once every four days.[330]

213. But the Department of Health strongly defended the likely reliability of DCR systems, arguing that Professor Randell's comment was "not supported by any evidence".[331] Officials also pointed out that the failure at the Maidstone centre had been an isolated incident and that general system reliability was adequate. Richard Granger told us that CSC had been fined £3 million as a result of the Maidstone incident and that the company had since "doubled the amount of resilience" within their data storage system.[332] He described such difficulties as "growing pains" and dismissed predictions of wider reliability problems as "scaremongering".[333] He also praised the reliability of the N3 network and the data transfer system which will support local DCRs:

BT run both the network and the core national messaging systems and there is a very strong body of evidence from the published service availability data for both those pieces of national infrastructure that not only do they work but they have the level of reliability and dependability which is appropriate to the task.[334]

214. Guy Hains told us that CSC had learnt lessons from the Maidstone incident and had increased the resilience of its systems as a result. He stated that the maximum time limit for resolving system failures had been reduced to 24 hours, with shorter limits for key clinical areas. He also pointed out the importance of developing "contingency and manual procedures" to ensure that clinical services could be maintained in the event of system failure.[335] Finally, Mr Hains stressed that no data had been permanently lost as a result of the Maidstone power failure.[336]

SMARTCARDS

215. Many of the planned operational security measures for DCR systems are the same as those described for the SCR in Chapter 3. Likewise, many of the debates about the likely impact of systems such as role-based access controls described in Chapter 3 apply to the DCR as well as the SCR. Rather than repeat these arguments, we focus in this section on an operational security measure with particular significance for the DCR: smartcard access.

216. The debate about the use of smartcards was ignited when an acute trust in Warwickshire authorised staff in its A&E department to share smartcards when accessing the trust's newly installed PAS application.[337] This was in clear breach of the principle of a unique smartcard for each user. Officials told us that the decision to allow sharing, authorised by the board of the trust, had now been reversed.[338] Connecting for Health also stated that no breach of confidentiality had occurred as a result of the incident.[339]

217. The Assistant Information Commissioner acknowledged that local security breaches of this type had occurred and stated clearly that the sharing of smartcards represented an unacceptable breach of operational security systems:

…there have been some graphic examples where perhaps security precautions have been circumvented by people logging on for a whole shift, using one card rather than their own cards. That must be stamped out; there cannot be any of that.[340]

218. But other witnesses argued that the misuse of smartcards would prove inevitable unless they could provide immediate access to systems. Dr Paul Cundy commented that unless "instantaneous" access to DCR systems could be achieved, smartcards would inevitably be seen as an "obstacle" to clinical processes, particularly in a busy, multidisciplinary environment such as A&E.[341] It is notable that the justification given for sharing smartcards by the acute trust board in Warwickshire was that access to the new PAS application could take between 60 and 90 seconds.[342]

219. CSC, the LSP for the West Midlands area, acknowledged that smartcard sharing had resulted from slow access times. Guy Hains commented:

The sharing of smart cards was really about the fact that the system did not provide a sufficiently immediate log on for people who wanted to use the system quickly…we recognise the need for a smart card log on procedure of 10 seconds.[343]

220. Richard Granger told us that Connecting for Health had considered using "slicker" systems than smartcards for accessing DCR systems. He explained that facial pattern recognition, retinal recognition or fingerprint recognition systems had all been examined. However, Mr Granger concluded that facial pattern and retinal recognition had been rejected because the underpinning technology remained "immature", while fingerprint recognition was impractical in a clinical environment where many staff wear gloves.[344]

CONSENT SYSTEMS

221. The majority of the evidence we received on patient consent related to the SCR rather than the DCR and we discuss this in Chapter 3. Witnesses argued that the prospect of a nationally available SCR tended to raise more concerns about privacy than that of locally shared DCRs. Frank Burns commented:

I think that the only reason you have been having the [consent] debate is because they have gone for a national model with the summary care record. If they pursue a local approach to development of a detailed care record…you would be able to explain to people why their own GP needs to share information with a specialist at the hospital…and in that context I think the public would be much less concerned.[345]

Shared records

222. In spite of this, a number of witnesses did highlight the need for robust local consent procedures, particularly for the sharing of information between the separate systems which make up the DCR. The Royal College of GPs argued for "organisational boundaries around information" so that data could not be shared between organisations without the patient's explicit consent.[346] This suggestion, similar to the 'amber' consent position for the SCR, was also put forward by that BMA and the British Computer Society.[347]

223. The Department stated that patients would be able to limit access to their detailed records in this way:

…people can choose to have their information held electronically but not accessible to anyone outside the organisation that created it—thereby recreating an electronic version of the status quo.[348]

Local records

224. This would mean that patients could in effect opt out of having a shared DCR. However, the Department pointed out that as the local systems which make up the DCR are introduced, an increasing amount of information, particularly from hospitals, will be stored electronically on LSP servers.[349] Thus it will often not be possible to prevent patient-identifiable information from being placed on LSP records systems. The Department stated that:

Individuals may ask those who are providing care for them whether or not it is possible to withhold information from the new IT systems but in many cases this will be impracticable. Some forms of care, X-rays, laboratory tests etc will generate records within the new systems automatically and the only way to prevent this is to choose not to have that particular care or treatment.[350]

225. Richard Granger highlighted the problems that would be caused by allowing patients to opt out of any form of electronic record storage:

If an individual is so distressed that they do not want an x-ray to be conducted electronically, I think ministers would need to decide whether it was indeed in the public interest to maintain wet film processing, a 19^th century technology, for these distressed individuals.[351]

Sealed envelopes

226. The Department also commented that local "sealed envelopes" will be available to safeguard particularly sensitive information held in DCR systems.[352] But Guy Hains of CSC stated that exact specifications for DCR "sealed envelopes" had not yet been given to LSPs by Connecting for Health and that the technology was unlikely to be available before 2009.[353]

Conclusions and recommendations

Vision and potential

227. Patient record systems which record detailed clinical information that can be shared or joined electronically within and between a range of local organisations are the "holy grail" for NPfIT. Such Detailed Care Record (DCR) systems can bring dramatic improvements to the safety, quality and efficiency of NHS care, not only through faster access to and sharing of patient information, but also by supporting key clinical processes such as imaging and prescribing. More sophisticated clinical systems can further improve care, for example by supporting clinical decision-making and providing automatic messages and alerts to challenge unsafe practices.

228. Achieving the widespread uptake of DCR systems is therefore the single most important advance that the NHS can make towards the provision of faster, better integrated and more patient-centred care. The potential benefits from detailed systems are wider than those offered by the national SCR system. Moreover, the goal of providing DCR systems to all NHS providers in England was clearly set out in the specification document on which NPfIT was based and tendered. It is thus on NPfIT's success in implementing DCR systems that the programme's effectiveness should ultimately be judged.

229. Yet there is a perplexing lack of clarity about exactly what NPfIT will now deliver. It is not clear what information will be recorded and shared on DCR systems, nor the range of organisations that will be able to share information. Suppliers told us there will be significant variation between the size of different areas. The Department stated that DCR systems may be confined to areas as small as a single hospital or as large as an entire SHA. While local control over the new systems is a desirable goal, it is surprising that the architects of the DCR were not able to provide a clearer vision of what is planned. There is an explanatory vacuum surrounding DCR systems and this must be addressed if duplication of effort at a local level is to be avoided. We recommend that Connecting for Health:

• Publish clear information about its plans for DCR systems, stating in particular what area will be covered by shared records and what degree of information sharing will be possible; these plans should make reference to the original specifications for the Integrated Care Records Service, making clear how the scope of the project has changed since 2003; and
• Set out clear milestones for achieving the increasing levels of interoperability and automation offered by DCR systems.

153   Q 10 Back

154   National Programme for Information Technology, Output Based Specification Version Two, Integration Care Records Service" Part II - LSP Services, 1 August 2003, p.4. Back

155   Ibid, Introduction, pp.44-45. Back

156   Ibid, Part II - LSP Services, pp.72-3 Back

157   See Ev 5-6 and Ev 117 (HC 422-III) Back

158   Ev 117 (HC 422-III) Back

159   Ibid Back

160   Ev 117 (HC 422-III) Back

161   Q 102 Back

162   Q 500 Back

163   Q 413 Back

164   See Ev 2-4 Back

165   More detail about the potential impact of DCR systems on patient safety was provided in the Department's 16 July memorandum. See Ev 147 (HC 422-III), section 15.1. Back

166   Ev 143 Back

167   Ev 92 Back

168   Q 500 Back

169   Ev 17 Back

170   Ev 142 Back

171   More detail on N3 is provided in Chapter 2. Back

172   Q 400 Back

173   Q 256 Back

174   Q 373 Back

175   Q 36 Back

176   See Q 20. The provision of PACS systems did not form part of the initial 2002 NPfIT contracts but was subsequently added to LSP contracts. Back

177   See Q 520 and Q 556 Back

178   See Q 419. Some witnesses argued that this is different, and inferior, to the approach in other countries where the main goal has been to ensure interoperability at a local, but not necessarily a national, level. The Foundation for Information Policy Research, for example, concluded (Ev 64) that "The NHS has a long, sad history of failed attempts at autarky in IT". Back

179   Q 10 Back

180   See www.connectingforhealth.nhs.uk/systemsandservices/data/snomed Back

181   For more details, see www.datadictionary.nhs.uk Back

182   See Q 550 for examples of the problems caused by inconsistent use of the NHS number Back

183   See www.connectingforhealth.nhs.uk/systemsandservices/nhsnumber/nn4b Back

184   Q 10 Back

185   Q 608 Back

186   Q 259 Back

187   Q 416 Back

188   Ev 189-190 Back

189   Q 266 Back

190   See, for example, Ev 177 Back

191   See Ev 136 (HC 422-III) and Ev 189-190 respectively Back

192   Q 280 Back

193   Ev 118 (HC 422-III) Back

194   Ev 90 Back

195   Q 515 Back

196   Ibid Back

197   Ev 144 Back

198   See Ev 10 and Q 45 respectively Back

199   National Audit Office, Department of Health: The National Programme for IT in the NHS, HC 1173, p.4 Back

200   Q 2 Back

201   Ev 9 Back

202   Q 581 Back

203   Q 373 Back

204   Q 253 and EPR 46A (unpublished) Back

205   Ev 178-9 Back

206   See Ev 9. Dr Paul Cundy argued (Q 96) that provision of the GP2GP system was a requirement of the 2003 GMS contract and not a specific achievement of NPfIT. Back

207   Q 551 Back

208   See Q 512 and Q 96. Frank Burns stated (Q 512) that "It would be almost impossible not to achieve a rapid roll-out of PACS given central funding." Back

209   Ev 10 Back

210   See Qq 621-627 Back

211   See Q 623. The Department provided more details regarding plans for electronic prescribing systems in its 16 July memorandum-see Ev 147 (HC 422-III), sections 9.1-9.4. Back

212   Department of Health, Delivering 21^st Century IT support for the NHS: national strategic programme, June 2002, p.6 Back

213   Q 503 Back

214   Ev 11 Back

215   Ev 122 (HC 422-III) Back

216   Q 37 Back

217   Ev 47 Back

218   Q 439 and Q 375 Back

219   See Q 256-we discuss the introduction of hospital PAS systems later in this chapter. Back

220   Ev 35 Back

221   Ev 177 Back

222   Q 503 and Q 501 respectively Back

223   Q 544 Back

224   Q 501 Back

225   See National Programme for Information Technology, Output Based Specification Version Two, Integrated Care Records Service, 1 August 2003 Back

226   Q 159 Back

227   Q 46 Back

228   Q 75 Back

229   Q 35 Back

230   Q 372 Back

231   Ibid Back

232   Ev 52 Back

233   See, for example, Ev 99 Back

234   Ev 116 Back

235   Q 106 Back

236   For example, Professor Naomi Fulop (Q 422) criticised the lack of focus on "socio-cultural issues and change management issues in implementing these systems." Back

237   See, for example, Ev 84 and Ev 45 Back

238   Q 507 Back

239   See, for example, Ev 82 and Ev 39 Back

240   Ev 45 Back

241   See Qq 373-375 Back

242   Patrick O'Connell of BT described the "Common Solution Project" (Q 376) as "…a well-intentioned idea that should work at the macro level but did not work at the practical level because it turns out that the differences were more than seemed reasonable at the time." Back

243   Ev 179 Back

244   Q 57 Back

245   Q 256 Back

246   Q 572 Back

247   Q 256 Back

248   EPR 46A, unpublished Back

249   Ev 178 Back

250   Q 57 Back

251   Q 378 Back

252   Q 376 Back

253   Q 57 Back

254   Q 256 Back

255   Ibid Back

256   Q 35 Back

257   Q 382 Back

258   Q 385 Back

259   See Q 385 and Q 501 Back

260   See Ev 118-119 (HC 422-III). The continuing need for some information in free text was also acknowledged by the Department. Back

261   Q 338 Back

262   Q 339 Back

263   Q 338 Back

264   Q 522 Back

265   See Q 550. In its 16 July memorandum, however, the Department of Health argued that the inability to share images generally results from "the legacy of locally-commissioned systems that are not interoperable" rather than the lack of a unique identifier. Back

266   See Q 556 and Q 338 respectively. We discuss the use of the NHS number to support clinical research in more detail in Chapter 5. Back

267   Ev 147 (HC 422-III), section 5.26 Back

268   Q 524 Back

269   Q 10 Back

270   Ev 130 (HC 422-III) Back

271   See Ev 100-101 Back

272   The RCP gave the example of work to develop a standard approach to collecting and recording information about acute medical admissions. It commented (Ev 101) that "The Royal College of Physicians has developed both generic medical record-keeping standards and standards for the structure and content of the acute medical admission." Back

273   See Ev 101, the RCP pointed out that it has pioneered work on information standards for the acute medical admission, but this had not been done in conjunction with Connecting for Health. Back

274   Q 610 Back

275   Q 580 Back

276   By contrast, the Committee heard on its visit to Canada that developing detailed clinical information standards had been one of the earliest priorities for Canada Health Infoway, the organisation responsible for developing EPR systems. Back

277   Q 10 Back

278   Ibid Back

279   See Q 422. The Modernisation Agency was closed in 2004. Back

280   See Ev 125 and Ev 55 respectively Back

281   Ev 164 Back

282   See www.editthis.info/nhs_it_info/Main_Page for more details. Back

283   For full details, see Ev 166-167 Back

284   Ev 167 Back

285   Q 329 Back

286   See Q 132. Professor Thomas also provided detailed written evidence regarding reviews of major IT programmes-see Ev 124-126 (HC 422-III). Back

287   Q 159 Back

288   Q 74 Back

289   Q 330 Back

290   See Q 280 and Q 498 respectively Back

291   Q 75 Back

292   Q 160 Back

293   Q 90 Back

294   See, for example, Q 507 Back

295   See Qq 583-587 Back

296   See Q578. Mr Granger gave the example of local EPR procurements in the Wirral, Blackburn and Bradford. Back

297   Ibid Back

298   Q 577 Back

299   Ibid Back

300   Q 587 Back

301   See Q 615. The importance of local clinical involvement in implementing new hospital PAS applications was highlighted during the Committee's visit to Homerton hospital. Back

302   See Q 556, Q 507 and Q 527 Back

303   Q 527 Back

304   See Q 583. SHAs will be given individual targets for completing deployments. Back

305   See EV 147 (HC 422-III) , section 16.2. Back

306   Q 580 Back

307   Q 605 Back

308   Q 36 Back

309   The Department of Health provided more detail about the standards and requirements for suppliers to be approved through the GPSoC process in its 16 July memorandum. See EV 147 (HC 422-III) , section 5.17. Back

310   See Connecting for Health, Additional Supply Capability & Capacity Framework Agreement, 26 March 2007. Clinical systems specified in the tender include hospital and GP administration systems, e-prescribing, integrated care planning, a range of departmental systems and systems for specific patient groups including oncology and renal patients. Back

311   See Ev 140 (HC 422-III) and Q 470. Back

312   Q 471 Back

313   Q 99 Back

314   Ev 162 Back

315   Q 583 Back

316   Q 520 Back

317   Q 556 Back

318   Q 576 Back

319   Q 108 Back

320   See Q 520 and Q 527 Back

321   Q 139 Back

322   Q 315 Back

323   Q 280 Back

324   Ibid Back

325   Ev 165 Back

326   Ev 65 Back

327   Q 313 Back

328   North West and West Midlands CSC Maidstone Data Centre Issue, Connecting for Health Press Release, 31 July 2006 Back

329   Ev 165 Back

330   Q 325 Bac