Thank you for registering with the Information Governance, Data Protection Officer (IG, DPO) Support Service. We are pleased to confirm that we have received sufficient subscriptions from GMPs across Wales to formally deliver this service and provide the ‘Data Protection Officer as a Service’ function for those practices who have subscribed.
With effect from 1st December 2018 you will have access to the basic service provision, as detailed within the Service Schedule; whilst we recruit staff resources. This initial support will be provided by the existing IG Support Service for GMPs until the additional posts are filled; which we anticipate will be during the early part of 2019. Whilst we are unable to provide a fully functioning service during the first few months, we have acknowledged this by not charging for the service support until the next financial year. The costing model will be effective from the 1st April 2019, on this date NHS Wales Shared Services Partnership (NWSSP) will collate the number of patients registered to the practice at that time. That patient head count will be multiplied by £00.0965 then divided by four to determine the quarterly charge for that first quarter of the financial year. The first quarterly payment will then be taken, as already authorised, by NWSSP on the 31st June 2019, this process will continue every three months. See the example costing model in Section 5.4 of the Service Support Schedule.
Contacting the Support Service
To contact the IG Support Service we ask for you to continue logging your enquiries at This email address is being protected from spambots. You need JavaScript enabled to view it. which is directed to our call management system, ActionPoint. You will receive an email receipt from ActionPoint confirming your Call reference number, this will allow you track progress of your enquiry. We have detailed a standard response time of a maximum of 5 working days, although we will endeavour to respond sooner. As the calls are triaged, regularly throughout the day, they will be allocated a ‘Priority Level’. All urgent enquiries will be provided with a maximum next working day response time. The service
will be available between 9am and 5pm Monday to Thursday with a 4.30 close on a Friday.
Planned communications
We will be arranging a Stakeholder Engagement Webinar session early in January 2019 (date to follow shortly) to inform subscribed practices on the service progression, for example, position on recruitment, development of resources, and further detail on our service implementation plan. This interactive webinar will also be recorded and made available on the Information Governance website for anyone who is unable to access the live session.
During the first few months of 2019 we plan to hold face to face Stakeholder Engagement Seminars arranged, by health board locality. This will give practice representatives and the Support Service Team the opportunity to meet, provide updates on the service progression and clarity on the service priorities, discus any actions from the webinar, and answer any general queries that practices may have at that time.
In addition to these sessions we will producing a monthly Newsletter to keep practices updated with progress of the service, any planned events, latest developments in the resources and knowledge base, training and any other topics we think you may be interested in, etc. The Newsletters will be maintained in a specific area of the Information Governance website, details to follow.
A specific IG, DPO Support Service page has been developed on the IG website where previous communications regarding the service is available for information, this page will be updated as appropriate.
Next Steps
There is a requirement to inform the Information Commissioner’s Office (ICO) of the update to your Data Protection Officer. We have been in contact with the ICO and agreed that the Support Service are able to inform them of such updates on behalf of those subscribed GMPs, particularly with the large number of practices registering with the DPO Support Service at the same time.
We will notify them as follows:
Name of the ‘Data Protection Officer as a Service’ - NHS Wales Informatics Service (NWIS), Information Governance, Data Protection Officer Support Service
Address - 4th Floor, Tŷ Glan-yr-Afon, 21 Cowbridge Road East, Cardiff CF11 9AD
Contact via - This email address is being protected from spambots. You need JavaScript enabled to view it.
We have been assured that where the practice has already notified the ICO themselves of these updates, it will not cause any problems for them.
This information should also be made available to your patients and staff. We recommend that the details are published on the practice website and that staff are made aware so that if they receive any enquiries they know where to direct individuals to.
As the practice DPO, the Support Service requires practices to complete the Welsh IG Toolkit for GMPs on an annual basis. Population and submission of the toolkit will enable the service to measure the practice compliance against legislation, this is a mandatory requirement of the DPO role under GDPR. The current toolkit is open until 31st March 2019. Once the toolkit submissions are received, the service will undertake high level analysis to identify any areas which may require improvement/development and provide recommendations/support for these to be implemented across the practices’. For information: If evidence is not loaded to the toolkit we may request copies, where appropriate, of documentation. For example, IG improvement plans, procedures, patient information, etc to support your submission. We see this analysis of the IG Toolkit submissions as a focal point to inform future priorities of the Support Service
We would like to assure you of our commitment to develop and deliver a high quality IG, DPO Support Service, helping you overcome information governance challenges, providing necessary advice and support to help you embed a robust data protection compliance regime, within the practice.
We look forward to working with you and supporting the practice with this service. If you have any questions please do not hesitate to contact the Support Service at This email address is being protected from spambots. You need JavaScript enabled to view it.
This message from the primary care team clarifies the requirements of the audit documents which form part of your Annual Contract Review for 2018-2019.
The audits will cover the period 01.04.2017 – 31.03.2018.
Recognising that practices have come into some enhanced services incrementally, practices will only have to complete these new audits from the period in which they commenced the new service.
The Anti Coagulation Audit is based on the new service which commenced in January 2017.
The Care Homes Audit is part of the service specification which commenced in April 2017.
If you were not providing either during the dates indicated, then please use the old audit templates to report back to the Health Board.
In respect of diabetes, this will be based on the National Diabetes Audit. Practices are required to participate in this audit, reflect on the findings within the practice. Practices can access their practice level data via Audit Plus and should provide it to the Health Board if requested.
If you have not already done so, can you please ensure these are submitted by 31st December 2018.
Please do not hesitate to contact a member of the GMS contracting team with any queries.
Dear Practice,
We are pleased to attach the final Service Support Schedule for the provision of Data Protection Officer (DPO) for your perusal.
You will find all the relevant information regarding the intended delivery of the service including; the service model, key functions and standard features, level of support you can expect, with anticipated timescales for developing the service and the projected charges.
We intend for the subscription based service to be launched on 1st December 2018. At this point we will be offering a basic service provision whilst we recruit additional staff resources.
Therefore, there will be NO service charge imposed until 1st April 2019, with the first quarterly payment due on 30th June 2019. The service will be charged at a rate of £0.0965 ‘per patient’ and will be based on the most current quarter capitation reports at that time. It has been agreed that a cap of £1,500 will apply to the annual charge.
To subscribe to the Support Service, please complete and return the two attached forms: one requires signing to confirm your agreement for the provision of the service and the second is to authorise NHS Wales Shared Service Partnership (NWSSP) to deduct the appropriate service charge on a quarterly basis.
For the service to proceed NWIS require a minimum number of Practices to subscribe on a national basis, to enable it to be financially viable. Therefore, we would be most grateful if you can return both forms; as detailed on each, to us by the 21st November. This will enable us to confirm the formal commencement on the 1st December.
If you have any further questions that might arise from the attached then please make contact via This email address is being protected from spambots. You need JavaScript enabled to view it.
Kind Regards,
Darren Lloyd
Head of Information Governance
DPO NWIS & Velindre NHS Trust
MSc Healthcare Management
NHS Wales Informatics Service
4th Floor|Ty Glan y Afon|21 Cowbridge Rd East|Cardiff
Dear Colleagues,
In light of recent implementation of the General Data Protection Regulations, we thought it would be timely to send an update to reassure practices that the agreement previously agreed between GPC Wales and Shared Services Partnership (SSP) regarding remote access for their post payment verification work DOES NOT put a practice at risk of breaching their responsibilities under GDPR legislation.
The agreed process for remote monitoring via SSP is as follows:
- SSP will telephone the practice to discuss the planned timing of PPV to ensure this is mutually convenient and then email the practice to confirm the arrangements for the “remote" visit. This includes requesting that the practice complete a signed temporary access agreement - in this document, the practice will see that two post payment verification (PPV) officers sign the agreement which ensures that the PPV process goes ahead if one of the SSP officers was unexpectedly away and thus this ensures minimal disruption to practices preventing rescheduling of the activity.
- The practice then has to provide a password for access to the clinical system to the two designated PPV officers (their email address will be on the practice agreement). This password should be sent via Move-It facility electronically to facilitate a secure and audible email trail.
Feedback so far from practices who have undergone remote PPV have found it far more efficient and less disruptive to the running of the practice. SSP have also seen benefits in terms of more effective time management. Rest assured, in the event of any queries these will be raised with the practice in the normal way and practice given opportunity to address them.
Attached is the formal guidance that confirms that this process does not breach GDPR and this advice has been checked by both NWIS information governance leads and the information commissioners officers. Therefore, this should provide sufficient reassurance to practices.
If you require any further information then please do not hesitate to contact with Mr Scott Lavender (All Wales SSP PPV manager) on 01495 300 729 OR GPC Wales on This email address is being protected from spambots. You need JavaScript enabled to view it.
Warm Regards,
Charlotte