NHS Wales pilots privacy alert software

NHS Wales is using FairWarning privacy monitoring software at two pilot sites to monitor access to patient records through the Welsh Clinical Portal.

The NHS Wales Informatics Service said a six month pilot project of the Northgate Managed Services software is being run in Hywel Dda Health Board looking at use of the Portal by Prince Philip Hospital, Llanelli and West Wales General Hospital in Carmarthen.

An evaluation will follow the pilot and a spokesperson for NWIS told EHI Primary Care that it would then be considered whether the system was suitable for use in other parts of the NHS in Wales including GP practices. The NWIS said the pilot will also look at whether the software could be used to monitor access to the Individual Health Record, Wales’ emergency summary record.

The pilot is due to run until autumn 2011 in a joint project between NHS Wales’ central information governance team and Hywel Dda Health Board to check that appropriate access is being made to the Portal.

A spokesperson for NWIS said the system works by pulling audit files from the different systems to be monitored. She added: “This enables identification of users who are engaging in patient record access patterns and indicates any potential snooping, password sharing or other suspicious behaviours including fraud or identity theft. It will help NHS Wales provide a detailed analysis of the benefit of automated tools in comparison to manual audit processes.”

The spokesperson said the FairWarning software was chosen through the NHS Wales tender process and it was decided that the supplier had a wide experience in the health sector and that its software was already being successfully used in Scotland.

In May Northgate Managed Services announced that it had won the contract to roll-out its FairWarning system across Scotland.

NWIS has also announced that it has signed up nearly 60 organisations to the Wales Accord on the Sharing of Personal Information. Information sharing protocols are part of the accord which aims to provide a framework for service-providing organisations that hold information about individuals and may need to share that information with others.