We continue to have concerns with regards to the new DPIA shared with SST practices by the Childhood Immunisation Service (CHIS). We are aware that some practices have already signed up to this agreement, whereas others are wanting to go ahead, but are awaiting more information.

The CHIS service is now the responsibility of the NHS South Central and West Commissioning Support Unit (SCW CSU) to deliver. It is a contractual obligation for practices to provide vaccination data to CHIS, but what is not specified in the contract is how this data is to be shared with CHIS.

We are concerned that the current DPIA agreement exposes GPs to a risk of liability with the Information Commissioners Office (ICO) should there be a data breach whilst data is being processed by a third party (namely Apollo/Magentus) that has been contracted by the SCW CSU.

While some amendments have been made to the End User Licence Agreement following feedback, CHIS are yet to confirm the details of who assumes Data Controller responsibilities at each stage of the process.

Moreover, we are mindful that the BMA have recommended that practices ‘Freeze sign-up to any new data sharing agreements or local system data sharing platforms’, as part of their collective action recommendations.

Presently, Magentus are willing to provide £100,000 of indemnity, but the sanction available to the ICO is far greater than this. We are awaiting further clarification from CHIS and feedback from the ICO as to their likely response should such a data breach occur. We will keep you apprised of any new developments regarding this matter.

In the meantime, practices are advised that their options include:

• Continue to complete a manual report to CHIS, in the format they provide;
• Provide a manual report to CHIS, containing the required data set, in a format that suits the practice; or
• Sign up to the automatic data extraction through the DPIA with the assurances presently provided and be aware of the risk of liability and limited indemnity provided by Magentus.

It is also important to note that this new automated process would extract information on 6 to 8 week checks from your clinical systems; whilst practices are contractually responsible for delivering these checks, it is not a contractual responsibility for practices to share data with CHIS on whether they have been completed.

Practices are encouraged to get in touch with us if you have any further concerns in the meantime.

SSTLMC Team27/08/24