Report

by the Comptroller
and Auditor General

Department of Health

Investigation: clinical correspondence handling at NHS Shared Business Services

HC 41 Session 2017–2019 27 June 2017

Our vision is to help the nation spend wisely.

Our public audit perspective helps Parliament hold government to account and improve public services.

The National Audit Office scrutinises public spending for Parliament and is independent of government. The Comptroller and Auditor General (C&AG), Sir Amyas Morse KCB, is an Officer of the House of Commons and leads the NAO. The C&AG certifies the accounts of all government departments and many other public sector bodies. He has statutory authority to examine and report to Parliament on whether departments and the bodies they fund have used their resources efficiently, effectively, and with economy. Our studies evaluate the value for money of public spending, nationally and locally. Our recommendations and reports on good practice help government improve public services, and our work led to audited savings of £734 million in 2016.

Report by the Comptroller and Auditor General

Ordered by the House of Commons
to be printed on 26 June 2017

This report has been prepared under Section 6 of the National Audit Act 1983 for presentation to the House of Commons in accordance with Section 9 of the Act

Sir Amyas Morse KCB
Comptroller and Auditor General
National Audit Office

22 June 2017

In March 2016, NHS Shared Business Services informed NHS England and the Department of Health that it had discovered a backlog of approximately 435,000 items of unprocessed clinical correspondence. This investigation sets out the commissioning and contracting responsibilities for misdirected clinical correspondence; the build-up of the backlog of clinical correspondence within NHS Shared Business Services; and the action taken by it and NHS England to investigate, understand and rectify the problem.

Investigations

We conduct investigations to establish the underlying facts in circumstances where concerns have been raised with us, or in response to intelligence that we have gathered through our wider work.

© National Audit Office 2017

The material featured in this document is subject to National Audit Office (NAO) copyright. The material may be copied or reproduced for non-commercial purposes only, namely reproduction for research, private study or for limited internal circulation within an organisation for the purpose of review.

Copying for non-commercial purposes is subject to the material being accompanied by a sufficient acknowledgement, reproduced accurately, and not being used in a misleading context. To reproduce NAO copyright material for any other use, you must contact copyright@nao.gsi.gov.uk. Please tell us who you are, the organisation you represent (if any) and how and why you wish to use our material. Please include your full contact details: name, address, telephone number and email.

Please note that the material featured in this document may not be reproduced for commercial gain without the NAO’s express and direct permission and that the NAO reserves its right to pursue copyright infringement proceedings against individuals or companies who reproduce material for commercial gain without our permission.

Links to external websites were valid at the time of publication of this report. The National Audit Office is not responsible for the future validity of the links.

11503 06/17 NAO

The National Audit Office study team consisted of:
Matin Abbasikia, Laura Atherton, Ele Brown, Francesca Duke, David Hakin, Louise McLeod, Sarah Perryman, under the direction of Ashley McDougall.

This report can be found on the
National Audit Office website at
www.nao.org.uk

For further information about the National Audit Office please contact:

National Audit Office
Press Office
157–197 Buckingham Palace Road
Victoria
London
SW1W 9SP

Tel: 020 7798 7400

Enquiries: www.nao.org.uk/contact-us

Website: www.nao.org.uk

Twitter: @NAOorguk

What this investigation is about

1 The NHS commissions administrative services to support primary care providers such as general practitioners (GPs). These are known as primary care support services. They include updating patient registration lists and processing contractual payments to GPs. During the period to which this report relates, redirecting correspondence such as test results was also included in these commissioned services. The correspondence may have been misdirected where patients had changed practice or correspondence was sent to the wrong practice. In all such cases the redirection sought to direct mail to the correct address.

2 Between 2008 and 2012, NHS Shared Business Services (NHS SBS) entered into contracts with 26 Primary Care Trusts (PCTs). These contracts were to provide primary care support services, including redirecting clinical correspondence. NHS SBS is a limited company set up as a joint venture between the Department of Health (the Department) and a private company, Sopra Steria. The Department has a 49.99% share in NHS SBS. In 2015, NHS SBS had revenues of around £87 million from its services to the NHS, of which the primary care support services accounted for approximately £12 million (Appendix Two). NHS SBS calculate that the mail redirection service accounted for £193,000 a year of this.

3 When the Health and Social Care Act 2012 abolished PCTs in April 2013, the National Health Service Commissioning Board (known as NHS England) was established, and became the commissioner of primary care support services. NHS SBS continued to provide these services in the East Midlands, North East London and South West England.

4 In March 2016, NHS SBS informed NHS England and the Department that it had discovered approximately 435,000 items of unprocessed clinical correspondence.1 This later rose to 709,000 items after NHS SBS found more boxes of unprocessed clinical correspondence in its archives. This investigation will set out:

the commissioning and contracting responsibilities for misdirected clinical correspondence;

the build-up of the backlog of clinical correspondence within NHS SBS; and

the action taken by NHS SBS and NHS England to investigate, understand and rectify the problem.

5 Our work is based on a review of available documents from NHS SBS, NHS England and the Department.

1 Clinical correspondence is a record of a patient interaction with a healthcare professional. NHS England’s review found only approximately 1,000 items of the 709,000 in the backlog were not clinical correspondence.

Summary

Key findings

The contracts

1 Between 2008 and 2012, NHS Shared Business Services (NHS SBS) entered into contracts with 26 Primary Care Trusts (PCTs) to provide primary care support services. The contracts were with PCTs in North East London, East Midlands and the South West. Most included a service to redirect clinical correspondence which had been sent to the wrong GP or other clinical providers. NHS SBS estimates that it redirected around 700,000 items of mail each year, although it did not record the nature or volume of misdirected correspondence received (paragraphs 1.1 to 1.3 and Figure 1).

2 PCTs were abolished in 2013 and NHS England took over the contracts with NHS SBS. NHS England told us it considered that there was no opportunity to review, amend or renegotiate the terms of those contracts before the contracts were transferred to it. NHS England continued to manage the contracts as PCTs had, via local teams. It did not review the contracts later (paragraphs 1.4, 1.6 and Figure 2).

3 Under most of the PCT contracts, NHS SBS had a contractual responsibility to process and redirect clinical correspondence. Only 21 of the 26 contracts explicitly required redirection services. However, none of the contracts contained key performance indicators (KPIs) to measure how well NHS SBS was delivering the redirection service although there were KPIs for other services provided by NHS SBS. There were no direct financial incentives or penalties attached to NHS SBS’s performance in redirecting mail, although the work remained a contractual responsibility (paragraph 1.5).

The incident

4 When NHS SBS took over the work from the East Midlands PCTs in 2011, it inherited a backlog of unprocessed clinical correspondence. NHS SBS’s initial checks found 8,146 items of unprocessed correspondence including clinical notes, temporary resident forms and child protection conference notes. NHS SBS does not know where or for how long these items had been held before it received them from the PCTs. NHS SBS told us that it used the same people and methods to redirect mail as the PCTs had used (paragraph 2.1).

5 Over the next four years, local teams and reviews within NHS SBS observed the backlog continuing to grow:

NHS SBS’s internal monthly reports in 2011 and 2012 noted the backlog in its East Midlands processing centre.

In January 2014, a review by NHS SBS found a backlog of around 205,000 items across the three regions and highlighted the clinical risk to patients of notes not being with GPs.

In June 2015, an administrator estimated the backlog in the East Midlands to be 351,500 items. (paragraphs 2.2 to 2.4, and Figure 4).

6 In June and July 2015, an NHS SBS administrator raised concerns with NHS SBS senior managers about the backlog in the East Midlands. The administrator sent three emails about the backlog to NHS SBS’s Head of Medical Records Centre of Excellence and corporate governance team. NHS SBS replied on 31 July 2015, and confirmed that the administrator’s concerns had been passed to a senior manager (paragraph 2.4).

7 In August 2015, the administrator raised further concerns that the backlog was being destroyed. The Head of Medical Records Centre of Excellence investigated and concluded that 35 sacks of records had been destroyed in line with NHS England’s policy that medical records can be destroyed 10 years after the death of the patient. It is not clear from the evidence we have seen whether the mail destroyed was part of the backlog of unprocessed mail but the Medical Records Manager noted that the sacks may also have included completed outstanding medical record reports and urgent/clinically urgent requests (paragraph 2.5).

8 Senior managers within the NHS SBS primary care services business unit knew about the clinical risk to patients in January 2014 but it did not develop a plan to deal with the backlog. NHS SBS told us that despite an action plan to improve the wider medical records function, there was no improvement to the mail redirection service. The backlog was added to the primary care services risk register on 16 September 2015. The description of the risk included the costs to clear the backlog, but not the potential harm to patients. NHS SBS first considered the size of the backlog, its financial, reputational and clinical risks in November 2015, in a report by an operational NHS SBS manager (paragraphs 2.3 and 2.6).

9 The November 2015 report led to the eventual escalation of the incident to the NHS SBS chief executive. In December 2015, NHS SBS began to review the contents of a sample of boxes from the backlog and found that they contained some clinical correspondence. On 6 January 2016, the information governance manager rated the incident as a serious incident requiring investigation. An internal investigation found that staff had considered the misdirected clinical correspondence a lower priority than other work as there were no performance indicators attached to it. NHS SBS’s managing director and chief executive heard the internal investigation’s findings on 3 March 2016 (paragraphs 2.7 to 2.11).

The response

10 NHS SBS informed NHS England (its customer) about the problem on 16 March 2016 and told the Department of Health (its shareholder) the next day. NHS SBS put forward a proposal on how to clear the backlog in six weeks. NHS SBS’s chief executive told the NHS SBS board about the backlog on 24 March 2016. The chief executive reported that staff considered this work to be ‘just filing’, although he stressed that this did not excuse the backlog (paragraphs 3.1, 3.2 and 3.4).

11 NHS England set up a National Incident Team (NIT) to deal with the backlog on 23 March 2016. The NIT included representatives from NHS England, NHS SBS, the Department of Health (the Department) and Public Health England. The NIT’s responsibilities included reviewing the backlog to assess clinical and reputational risks, developing an action plan to deal with the backlog and monitoring its implementation (paragraph 3.7).

12 The Department of Health decided in April 2016 not to alert Parliament or the public to the incident. It considered that it did not have an accurate picture of the scale of the incident or of the potential harm to patients. It believed there was a risk of questions that the Department could not yet answer, potentially leading to unnecessary worry among patients and the public (paragraph 3.12).

13 The Department informed Parliament of the incident on 21 July 2016. The Department considered that, as the NIT needed to contact GPs and patients to access medical records to establish whether there had been any actual harm to patients, the incident was likely to become publicly known. NHS England believed patients should be told quickly that they may have been harmed. At this point the Department was still unable to provide clarity about the extent of any potential harm to patients or whether all relevant correspondence had been identified from NHS SBS’s archives. The Secretary of State made a written statement to Parliament about ‘an issue with a mail redirection service’ at NHS SBS, advising that this was also disclosed in the Department’s Annual Report, which made reference to ‘a large backlog of unprocessed correspondence relating to patients (paragraph 3.14).

14 NHS England wanted to scan the documents before they were sent to GPs so that there would be a record of all of the items being sent out. NHS England and the Department expected the repatriation of low-priority correspondence to GPs to start by July 2016. NHS England and NHS SBS encountered a number of problems reconciling what was to be sent to each GP with what was in the envelopes sent from NHS SBS to NHS England for scanning. Scanning began on 14 September 2016. NHS England waited to start scanning until it was satisfied that scanning and issuing the documents provided by NHS SBS would not generate any breaches of patient confidentiality (paragraph 3.8).

15 NHS England was dissatisfied with NHS SBS’s cooperation in understanding the facts and causes of the incident. The main report by NHS SBS’s internal auditors in May 2016 on the effectiveness of the internal investigation, root cause analysis and management response to the incident did not provide NHS England with the level of assurance it required that the incident had been appropriately investigated and the causes clearly established. NHS SBS disputed NHS England’s right to commission further work and there were significant delays in NHS England’s internal auditor securing access to relevant NHS SBS information. NHS England considered that NHS SBS was being obstructive and unhelpful in providing the access NHS England sought. NHS SBS has told us that it does not consider that it was obstructive or unhelpful. It planned a cooperative and collaborative approach with NHS England and was concerned to make sure that the audit process was properly managed and did not duplicate work carried out by others. It told us that it faced difficulties because of the requirements imposed by its contracted internal auditor and the need to obtain confirmations from relevant people involved before certain information was shared with NHS England. It was September 2016, four months after the report by NHS SBS’s internal auditor was disclosed to NHS England and six months after the incident was first disclosed to NHS England, before agreement was reached for NHS England’s internal auditor to access the material required for its review. Even then it was not able to complete the review to its satisfaction as it did not have full access to people or documentation (paragraphs 3.15 to 3.20).

16 The final audit report commissioned by NHS SBS into the incident found weaknesses in oversight at NHS SBS. It reported that NHS SBS had:

weaknesses in the process for dealing with clinical correspondence;

a lack of awareness of its importance; and

a lack of urgency in dealing with the incident once it was escalated to senior management.

NHS England’s internal auditor agreed with these findings (paragraphs 3.17 and 3.18).

17 NHS England’s internal auditor concluded that there was no assurance that all unprocessed correspondence had been identified. NHS SBS’s internal auditor reported that it could provide reasonable assurance that, as a result of the process followed by NHS SBS, all archived materials had been successfully identified. NHS England’s internal auditor took a different view. Additionally, the Department’s internal auditor reviewed the governance arrangements in place in the Department’s investment into NHS SBS and found that:

the Department had not taken up two of its three seats on the SBS Board; and

there is a conflict of interest between the Secretary of State’s responsibility for the health service as a whole and his position as an NHS SBS shareholder (paragraphs 3.21 and 3.22).

18 As at 31 May 2017, the review of the backlog of correspondence has found 1,788 cases of potential harm to patients. NHS England and NHS SBS have identified just under 709,000 items of unprocessed correspondence in total. NHS England classified 2,508 items as high priority. GPs have assessed 2,159 of those as having ‘no patient harm’ and are still examining the remaining items, with 229 classified as ‘potential harm’. GPs have yet to respond on 175,000 items of correspondence assessed by NHS England to be lower priority, despite having received payment to review these additional items in February 2017. NHS England is still investigating the cases where potential harm has been identified. It expects to complete all review work by December 2017. No actual harm has been identified yet (paragraphs 3.23 to 3.25 and Figures 5 and 6).

19 NHS England estimates the cost of the incident will be at least £6.6 million for administration alone, and is still discussing with NHS SBS how the costs will be split. NHS SBS has borne £2.26 million of these costs so far but this does not include any contribution towards the costs incurred by NHS England. Without prejudice negotiations between the two parties are ongoing (paragraph 3.26).

Part One

The contracts

Commissioning the initial contracts

1.1 Before the Health and Social Care Act 2012, Primary Care Trusts (PCTs) were responsible for commissioning local health services (Figure 2a). This included primary care support services. Examples of these services are updating patient registration lists, processing contractual payments to GPs and redirecting correspondence. Each year NHS Shared Business Services (NHS SBS) processed around 15,500,000 tasks under the primary care support services contract. This included an estimated 700,000 items of mail a year that needed redirection, although NHS SBS did not log its nature or volume.

1.2 From 2008, NHS SBS was one of the companies contracted by PCTs to redirect clinical correspondence as part of its primary care support services work (Figure 2a and Figure 3). Clinical correspondence received by NHS SBS includes:

Cytology screening requests and results and other test results;

child protection notes;

patients’ medical records;

treatment plans and changes to patients’ medication regimes;

forms registering people temporarily with a GP in a different area; and

other miscellaneous correspondence.

1.3 NHS SBS had contracts with 26 PCTs in North East London (from 2008), East Midlands (from 2011) and the South West (from 2012), 21 of which required NHS SBS to redirect clinical correspondence. Staff had verbal, rather than formal instructions for how to sort the post. NHS SBS told us that there was a clear process for dealing with mail redirection that had been inherited from the relevant previous Primary Care Trust providers when it took the contracts on. In some cases, NHS SBS staff were told to read only what was necessary to determine the correct addressee and not to read the content of the mail. This was to keep personal data private. Staff would then use NHS databases to send mail to the correct GP. NHS SBS told us that the quality of information on correspondence sent to NHS SBS was sometimes poor, for example containing incomplete details or illegible items which made it difficult to redirect documents.

NHS England’s later oversight of the contracts

1.4 The Health and Social Care Act 2012 abolished PCTs and created NHS England. The contracts with NHS SBS novated from PCTs to NHS England on 1 April 2013 (Figure 2b). The National Audit Office has since published good practice guidance on contract management.2 We recommend that contracts have performance measures, for example targets covering all aspects of services provided. These should be linked to financial incentives and penalties.

1.5 None of the 21 contracts that explicitly required a mail redirection service contained key performance indicators (KPIs) to measure how well NHS SBS was providing the redirection service. There were no direct financial incentives or penalties attached to NHS SBS’s performance in redirecting mail. The KPIs monitored were around the speed and accuracy of, for example, registrations with GPs, medical records processing, screening appointments and payments to GPs. Where the mail redirection service was included in the contract they contained different definitions of the redirection service. NHS SBS told us that it concluded the absence of KPIs reflected the understanding of original commissioners and NHS SBS that this was a low-priority mail redirection service rather than a priority clinical task. Nevertheless, NHS SBS accepts that this was still a contracted activity for 21 of the 26 contracts. NHS England told us that it believed that NHS SBS accepted that the service was being provided under the contracts to all of the 26 areas covered by the contracts.

1.6 NHS England did not identify that the contracts lacked KPIs for redirecting clinical correspondence. NHS England told us there was no opportunity to review, amend or renegotiate the terms of those contracts before the contracts were transferred to it. NHS England continued to manage the contracts through local teams when they transferred from PCTs, because the longer-term plan was to provide primary care support services under one national contract. It did not review the contracts later.

1.7 When we completed our annual audit of NHS England in July 2014, we recommended that NHS England assess how it would know how well all aspects of the organisation, including its many contractors, were performing. We also said it should consider the general risks associated with gaps in assurance. While recognising that progress has been made in this area, we have continued to raise concerns about potential gaps in third-party assurances in subsequent years.

1.8 In 2015, NHS England decided that primary care support services would be delivered nationally, under one operating model. After a competitive procurement, in June 2015, NHS England awarded the contract to Capita. NHS England undertook a full review of the primary care support contracts to determine what services to include in the Capita contract. NHS England decided that the mail redirection service would not be included. From May 2015, it told GPs in the areas served by NHS England’s in-house primary care support services provision to return information sent to the wrong practice back to the original sender. NHS England did not send this instruction to NHS SBS. However, NHS SBS obtained a copy of this letter, and by November 2015, on its own initiative, had stopped providing the redirection service.

1.9 Primary care support services previously being provided by NHS England transferred to Capita from August 2015. The services previously being provided by external contractors transferred to Capita when the contracts ended. For NHS SBS this was 31 March 2016 (Figure 2d).

2 Comptroller and Auditor General, Good practice contract management framework, December 2016, available at: www.nao.org.uk/wp-content/uploads/2016/12/Good_practice_contract_management_framework.pdf

Part Two

The incident

The growth of the backlog

2.1 When NHS Shared Business Services (NHS SBS) took over the redirection service from East Midlands Primary Care Trusts (PCTs) in 2011, it performed audits of outstanding workloads. It found 8,146 items of unprocessed correspondence consisting of 5,808 clinical notes, 1,399 temporary resident forms and 939 child case conference notes across Derby and Leicester PCTs. Some of the child protection case documents dated back up to 10 years as they had become separated from the medical records that identified the children concerned. NHS SBS does not know where or for how long these items had been held before it received them from the PCTs. NHS SBS told us that it used the same people and methods to redirect mail as the PCTs had used.

2.2 On several occasions, NHS SBS identified the backlog of clinical correspondence. In August and September 2011, monthly reports for the NHS SBS operational teams highlighted a backlog of clinical notes in its East Midlands processing centre. Further monthly reports during 2011 and 2012 raised concerns about how slowly teams were processing clinical correspondence. In April 2013, the monthly report said NHS SBS was tackling the backlog of clinical correspondence. Email correspondence between an NHS Trust, a PCT and NHS SBS managers in the East Midlands in December 2011 indicates that there was confusion about who was responsible for the redirection of clinical correspondence.

2.3 Between 2011 and March 2016, the backlog grew from 8,000 to 435,000 items (Figure 4). A process review carried out by NHS SBS in January 2014 alerted NHS SBS senior managers to a backlog of 205,000 items of correspondence across the three regions. The files were stored in a room labelled ‘clinical notes’. A subsequent review found that the label had been removed by an SBS general manager because “you don’t want to advertise what’s in that room”. NHS SBS told us that it was important that documents were held securely and therefore not having a label on the door was appropriate as part of this. The process review highlighted the clinical risks to patients from correspondence not reaching their GP. NHS SBS did not make a plan to address the clinical risks but told us that an action plan to improve the wider medical records function had not improved the mail redirection service.

2.4 In June 2015, an NHS SBS administrator raised concerns with a senior manager about a build-up of correspondence in the East Midlands and estimated the backlog to be 351,500 items. He said that he had tried to contact the Caldicott Guardian (who is responsible for keeping patient data secure), but the job was vacant. (An NHS SBS audit report also found there was no full-time Information Governance manager in post at that time.) The administrator said correspondence was delivered to the administration centre, filed into boxes and ‘shifted out of sight’. The administrator had been told that the backlog would be processed when spare staff were available. The administrator sent three emails to NHS SBS’s Head of Medical Records Centre of Excellence and the corporate governance team about the backlog between 12 June 2015 and 29 July 2015. On 31 July 2015, the corporate governance team confirmed it had passed the concerns to a senior manager.

2.5 In August 2015, the administrator asked for an update and said that colleagues had started to destroy some documents in the backlog. The Head of Medical Records Centre of Excellence looked into this claim and found that NHS SBS had destroyed 35 sacks of records in line with NHS England’s policy that medical records can be destroyed 10 years after the death of the patient. These contained correspondence dated between January 2011 and August 2012, including clinical information for patients who could not be traced. The Medical Records Manager noted that the sacks may also have included completed outstanding medical record reports and urgent requests but that due to volumes there were no details recorded at an individual patient level. It is not clear if NHS SBS established whether the correspondence should have been forwarded before it was destroyed. It is also not clear from the evidence we have seen whether the mail destroyed was part of the backlog of unprocessed mail.

2.6 NHS SBS added the backlog to its primary care service division risk register on 16 September 2015. The risk description did not consider potential harm to patients: it only recognised the costs of dealing with it. NHS SBS estimated the cost as £45,000. It was November 2015 when the clinical risk was raised with senior management in a report produced by an NHS SBS primary care support services manager. The report considered the financial, reputational and clinical risks around the backlog.

Recording and assessing the incident

2.7 After discussing the November 2015 report, local NHS SBS managers decided to review a sample of the boxes from the backlog to see what they contained. The review took place on 18 December 2015 and found that they held some unprocessed clinical correspondence. NHS SBS’s chief financial officer, who was also the senior information risk officer, overheard managers discussing the contents of the boxes. He advised that it should be reported to the information governance team.

2.8 NHS SBS’s incident management policy states that any event that could lead to harm ought to be logged within 48 hours. However, the head of medical records did not log the incident in the NHS SBS incident management system until 7 January 2016.

2.9 NHS SBS human resources started an investigation into the incident and appointed a project manager on 21 January 2016. The work started on 15 February 2016 when suitable staff were in place. On 23 February 2016 the investigation team confirmed that the boxes held information that could impact on patient care. The investigation found that NHS SBS treated processing clinical correspondence as a lower priority than other work as it had no key performance indicators. It also found that staff had not had written instructions for dealing with misdirected correspondence before December 2014.

2.10 The NHS SBS’s managing director and chief executive heard the human resources investigation’s findings on 3 March 2016. An NHS SBS senior clinical adviser tested a sample of records, including some child protection records, to assess clinical risk on 10 and 13 March 2016. On 16 March 2016, the adviser reported to senior managers that there may have been a break in treatment for some patients. The NHS England child safeguarding lead, who took direct control of handling high-risk cases, reviewed 237 child protection notes between 13 and 29 March 2016.The NHS England lead identified 56 high priority cases and one requiring immediate action to trace the child and raise a safeguarding concern with the local safeguarding team.

2.11 NHS SBS did not report the incident to the Information Commissioner’s Office (ICO). On 6 January 2016, an information governance assessment confirmed the backlog was a serious incident requiring investigation, but the person completing the form wrongly ticked that there were no clinical data at risk. This reduced the score for the seriousness of the incident, contributing to NHS SBS’s conclusion that the incident need not be reported to the ICO. NHS SBS assessed the incident again on 3 March 2016. Again it decided that the incident need not be reported. NHS SBS stated in its 2015 Annual Report (published in July 2016) that it had reported no incidents to the Department of Health (the Department) or the ICO in the year to 31 December 2015. After NHS SBS informed NHS England about the incident on 16 March 2016, NHS England made a formal report to the ICO on 18 April 2016. The ICO’s inquiry is not yet complete. NHS SBS did not report the incident to the ICO.

Part Three

The response

3.1 On 9 March 2016, NHS SBS’s chief executive verbally told the NHS SBS audit committee chair about the incident. NHS SBS told NHS England about the backlog on 16 March 2016 and told the Department the next day. NHS SBS told NHS England that the incident involved unprocessed data which had been stored for longer than would be expected under normal processing conditions and included clinically related information. NHS SBS reported that the backlog did not involve a breach of security, loss of data or loss of information.

3.2 NHS SBS’s board was told on 24 March 2016. When the backlog was reported to the board the chief executive said that the primary care support services team had considered this work to be ‘just filing’ but that this did not excuse the backlog. Between May and July 2016, NHS SBS’s board discussed progress on a weekly basis. It also commissioned its internal auditor, BDO, to report about the incident.

The work of the National Incident Team

3.3 NHS England set up a National Incident Team (NIT) on 23 March 2016. The NIT’s responsibilities included reviewing the data within the backlog to assess clinical and reputational risks, developing an action plan to deal with the backlog (Figure 5) and monitoring its implementation. The NIT included representatives from NHS England, NHS Shared Business Services (NHS SBS), the Department of Health (the Department) and Public Health England. It reported to the senior information risk owner of NHS England, who provided regular updates to the NHS England board and audit and risk assurance committee.

3.4 NHS SBS made a proposal to NHS England and the Department setting out how it would hire 45 extra staff to clear the backlog in six weeks. It put in place a dedicated team at its Tingley site to start the work. The NHS SBS team was managed by a senior NHS SBS manager, with a senior NHS England manager providing overall direction of the processing of the correspondence. The same NHS England manager also managed a small team of NHS England administrative staff and a clinical review team working on the incident response. On 5 April 2016, NHS SBS confirmed to the NIT that there were 572,051 items of unprocessed correspondence from all three regions. This grew to 582,217 items by 25 April 2016 after NHS SBS found 15 more boxes of correspondence which it sent to the NIT.

3.5 NHS SBS informed the NIT that their South West region had been using the archives as a storage facility. The only data which should be placed in archives are medical records for patients who have died or who are not currently registered with a GP. The NIT asked NHS SBS for an inventory of what had been put into archives but NHS SBS was unable to provide this information. Between April and August 2016 NHS SBS, supported by NHS England and the Department, performed a risk-based review of the boxes in archives and identified 272 additional boxes of clinical correspondence which had not been processed.

3.6 NHS SBS staff looked first at the unprocessed correspondence to identify items clearly about cervical screening or safeguarding in April 2016, because of the risks to patients from further delay in getting these items to their GPs. A clinical review team appointed by the NIT reviewed these items again to assess whether they should be categorised as high priority (Figure 5). In April 2016, the Department told the NIT that it should follow up high-risk cases as a matter of urgency with local clinicians and return the low-risk cases to GPs at the end of the review process. This approach was agreed by the NIT and approved by NHS England’s clinical governance.

3.7 The NIT clinicians then looked at the remaining correspondence to identify items that should be treated as high priority for return to the correct GP practice, because the patient was at risk of harm if there was more delay. Items requiring immediate action were passed to the relevant medical director or the correct GP on 25 April 2016. NHS England asked them for confirmation of whether the patient had been harmed by the delay in processing the correspondence within seven days. The NHS SBS team prepared the lower priority items for later return to GP practices. NHS England asked GPs to look at the patient’s medical record and to confirm whether they may have been harmed by the delay in receiving the correspondence. NHS England defined harm as “any significant impact on prognosis, any extension to the period in which significant symptoms were experienced and any increase in the intensity or duration of treatment required”.

3.8 By 25 April 2016, NIT clinicians had reviewed approximately 80,000 items of correspondence. This number grew to 352,000 by 12 June 2016. NHS England and the Department expected the repatriation of low-priority correspondence to GPs to start by July 2016. NHS England wanted to scan the documents before they were sent to GPs so that there would be a record of all of the items being returned. NHS England and NHS SBS encountered a number of problems reconciling what was to be sent to each GP with what was in the envelopes sent from NHS SBS to NHS England for scanning. When NHS England checked what NHS SBS had put in each GP’s envelope it found that some contained correspondence for other GP practices. NHS England re-sorted all of the low-priority correspondence to keep patients’ personal data secure. Scanning began on 14 September 2016. NHS England waited to start scanning until it was satisfied that scanning and issuing the documents provided by NHS SBS would not generate any breaches of patient confidentiality.

3.9 By the end of December 2016, NHS England had sent all correspondence considered as low priority back to the correct GPs. It asked GPs to review the correspondence and report back whether there were any cases of potential harm. NHS England did not initially specify when it needed a reply, although it had agreed a 4–6 week timescale for assessments with the British Medical Association. It wrote again in March 2017 requesting a reply by 31 March 2017.

3.10 In April 2016, a group that represents GPs in the East Midlands area contacted NHS England to tell it that several practices had received backlog correspondence from NHS SBS. In at least one case, the correspondence included a letter from NHS SBS saying its redirection service ended on 31 May 2015 and that the correspondence should be returned to the original sender. One practice received correspondence going back to 2005, and contained child safeguarding records. This predates the NHS SBS contract and it is unclear where this correspondence had been kept since 2005.

3.11 NHS England was also informed by 45 GPs in London that they had received batches of unprocessed correspondence back from NHS SBS. NHS England retrieved the correspondence from the London practices and processed it as part of the backlog.

Communicating the incident

3.12 In April 2016, the Department considered its public communications about the incident. The Department considered that addressing the patient safety concerns raised by this incident was the primary priority for it and the NHS England. It decided not to alert Parliament or communicate about the incident to the public immediately. The Department took this approach because, at that point, there had been no cases of actual harm uncovered by the NIT and only a small number of high-risk cases were being followed up with local clinicians. It considered that it did not have an accurate picture of the scale of the incident or of the potential harm to patients and that there was therefore a risk of questions that the Department could not yet answer, potentially leading to unnecessary worry among patients and the public.

3.13 Additionally, the Department noted that any communications stating that NHS SBS was at fault in not forwarding the correspondence could void any insurance held by NHS SBS. This would leave NHS SBS or the Department liable for the costs of dealing with the backlog, including potentially the work of GPs and any damages sought by patients harmed by the incident.

3.14 In early July 2016, NHS England had completed the triage for high-risk cases. The Department considered that, as the NIT needed to contact GPs and patients to access medical records to establish whether there had been any actual harm to patients, the incident was likely to become known to the public. NHS England believed patients who their GPs thought may have been harmed should be told quickly, in line with the law and guidance about being honest with patients. NHS England also thought that patients should be told so that they could give consent for any further treatment or tests that might be needed to find out whether they had suffered harm. At this point the Department was still unable to provide clarity about the extent of any potential harm to patients as the NIT had not finished reviewing items to identify the high-priority cases. The Department was still unsure if all relevant correspondence had been identified from NHS SBS’s archives. NHS England and the Department briefly reported a ‘serious incident’ in their 2015-16 Annual Reports both making reference to “a large backlog of unprocessed correspondence relating to patients”. They laid the annual reports before Parliament on 21 July 2016. The Secretary of State made an accompanying written statement that referred to “an issue with a mail redirection service” at NHS SBS.

Assurance and governance

3.15 In March 2016, the NHS SBS board commissioned a review from its internal auditor, BDO, on the effectiveness of controls over the management of personal identifiable data. The review gave some assurance over the physical access controls in place for NHS SBS medical record storage as there had been no valid reported incidents, indicating that medical records had not been obtained inappropriately or lost by NHS SBS. The review did not cover the root causes and management of the incident.

3.16 NHS SBS, NHS England and the Department agreed a joint assurance approach to secure assurance over the effectiveness of the NHS SBS internal investigation, root cause analysis and management response to the incident, while minimising duplication. The work was led by NHS SBS’s internal auditor with input from NHS England’s and the Department’s internal auditors. NHS England’s internal auditor, after consultation with the Department’s internal auditors, provided a set of questions to be included within the scope of the work to be undertaken by NHS SBS’s internal audit team.

3.17 The second review was completed by NHS SBS’s internal auditors in early May 2016. As the fieldwork was largely complete by the time the other auditors were engaged, NHS England’s internal auditors asked for an expansion of the scope but the fieldwork was complete before they could make the work a joint audit. They therefore requested access to the working papers given that they had not been involved in the work and/or given access to NHS SBS. The review by BDO concluded that NHS SBS lacked awareness of the clinical correspondence’s importance and there were weaknesses in its process for dealing with it. BDO’s report also highlighted NHS SBS senior management’s lack of urgency in dealing with the incident.

3.18 In June 2016, NHS England, after reviewing the BDO report, concluded that the BDO report did not provide it with the required level of assurance that the incident had been appropriately investigated and the causes clearly established. NHS England instructed its own internal auditors, Deloitte, to start a review into NHS SBS’s response to the incident. It therefore asked that Deloitte be provided with access to BDO’s audit. NHS SBS disputed NHS England’s right to commission further work and there were significant delays in NHS England’s internal auditor securing access to relevant NHS SBS information. NHS SBS felt that it had exceeded its contractual responsibilities by providing NHS England with the BDO report and access to some of its working papers. On 29 July 2016, the NHS England chief executive wrote to the permanent secretary at the Department asking for urgent help, in their capacity as NHS England’s sponsor and co-owner of NHS SBS, in resolving the issue of NHS England’s audit access rights. In early September 2016, NHS England told the Department that NHS SBS was still being obstructive and unhelpful in providing the access NHS England sought.

3.19 NHS SBS has told us that it does not consider that it was being obstructive or unhelpful. It told us that it committed at the outset to a cooperative approach with NHS England and was concerned to make sure that the audit process was properly managed and did not duplicate work carried out by others. It told us that it faced difficulties because of the requirements imposed by its auditor (BDO) and the need to obtain confirmations from relevant people involved before certain information was shared with NHS England. The consent of BDO to disclose the report was contingent on third parties signing ‘hold harmless’ letters (to limit the internal auditor’s liability in the event of legal action). NHS SBS would not release the BDO report to NHS England and the Department until they signed such letters which indemnified BDO for any future disclosure. Both NHS England and the Department signed the ‘hold harmless’ letters. NHS SBS and BDO felt unable to share with us their reports into the incident unless we also signed a letter. This is common practice among audit organisations. We declined to sign any letter that would limit our ability to report on the incident. Instead, we obtained the reports from the Department of Health and NHS England, by exercising our statutory access rights.

3.20 On 8 September 2016, the parties agreed to allow NHS England’s internal auditor access to the material it had requested but Deloitte has confirmed to us that it never had access to all the working papers it sought. Deloitte’s final conclusion in October 2016, summing up its work on the NHS SBS incident response, was that it could not provide assurance over a number of areas due to a lack of available evidence.

3.21 NHS SBS also commissioned BDO to carry out work to determine its review process was appropriate to provide assurance to NHS England and the Department that all relevant archived materials had been successfully identified and returned. BDO concluded in September 2016, that it could provide reasonable assurance that, as a result of the process followed by NHS SBS, all archived materials had been successfully identified and returned from the NHS SBS archiving estate. NHS England’s internal auditor, in reporting to NHS England on this work, concluded that “no assurance can be provided that all unprocessed correspondence has been identified”, due to the risk-based approach taken to the archive review.

3.22 Following the incident, the Department asked its internal auditors to report on the Department’s oversight and governance of NHS SBS. It found that since 2014, the Department had not taken up two of its three seats on the NHS SBS board. It concluded that there was a conflict of interest between the Secretary of State’s responsibility for the health service as a whole and his position as an NHS SBS shareholder. The Department recognised the potential conflict of interest but has confirmed that the patient safety aspect would override any shareholder interest it has in NHS SBS.

Impact of the incident

3.23 NHS England and NHS SBS have reviewed just under 709,000 items of unprocessed correspondence. (Figure 6). As at 31 May 2017, the review of the backlog of correspondence has found 1,788 cases of potential harm to patients. Some 333 of these patients have died. As at 31 May 2017, there is no evidence that there is any connection between the backlog of correspondence and the death of these people. NHS England is still investigating the cases where potential harm has been identified and another 9,728 high- and low-priority cases where the patient is no longer registered at the practice.

3.24 As at 31 May 2017, GPs have reviewed around 360,000 documents but their reviews are not complete. GPs have yet to give NHS England an assessment of potential harm for 175,000 items of correspondence assessed to be of lower priority, despite having received payment to review these additional items in February 2017. There are 80 high-priority correspondence items where GPs have not yet responded to NHS England. NHS England sent reminders to GPs in March, asking them to reply by 31 March 2017.

3.25 NHS England expects that the number of patients who may have been harmed will increase when more GPs respond. NHS England is still investigating the cases where potential harm has been identified. It expects to complete this in December 2017 because the nature of the subsequent clinical review work to investigate cases of potential harm requires review by multi-disciplinary clinicians, access to patients and discussion with GPs. No cases of actual harm have been recorded to date.

3.26 The full costs of dealing with the incident are not yet confirmed, and NHS England and NHS SBS are still discussing how costs will be allocated. NHS England has made payments to 7,330 GP practices totalling £2.5 million to compensate them for the time spent assessing the potential for patient harm due to the delay in the correspondence, and for reporting the outcome of their assessments to NHS England. NHS England’s most recent estimate of administrative costs for dealing with the incident amounts to £6.6 million, including payments made to GPs. The estimate does not include possible penalties from the Information Commissioner’s Office, or compensation payments to patients. NHS SBS has borne £2.26 million of the administrative costs of dealing with the incident so far but this does not include any contribution towards the costs incurred by NHS England. Without prejudice negotiations between the two parties are ongoing.

Appendix One

Our investigative approach

Scope

1 Our investigation focuses only on the management of misdirected correspondence by NHS Shared Business Services (NHS SBS). It does not examine NHS SBS’s wider work for the NHS or the activities of either primary care trusts (PCTs), which preceded NHS England, or Capita, which succeeded NHS SBS. It sets out the facts about the response to the incident by NHS SBS, NHS England and the Department of Health (the Department). It does not assess the validity or otherwise of any clinical assessments of whether or not there was clinical harm as a result of delays in redirecting clinical correspondence, as this requires clinical skills. Our investigation begins with NHS SBS starting to supply primary care support services to PCTs in 2008, and finishes at the end of April 2017.

Methods

2 In examining these issues, we drew on a variety of evidence sources.

3 We liaised closely with NHS SBS which provided the services; NHS England, which oversaw the contract from 2013; and the Department which is part-owner of NHS SBS and sponsor of NHS England.

4 We interviewed individuals from these three organisations, and reviewed their reports and documents to establish commissioning and contracting responsibilities, how and when the backlog occurred, and the action taken by all three parties once the backlog was discovered.

5 The documents reviewed from NHS SBS and NHS England, included:

internal management documents from NHS SBS;

internal audit reports commissioned by NHS SBS, NHS England and the Department;

board papers for NHS SBS and NHS England;

NHS SBS’s Audit and Risk Committee minutes;

information management documents;

the work of the National Incident Team established by NHS England;

correspondence within NHS SBS and between NHS SBS and others; and

NHS SBS, NHS England and the Department’s annual report and accounts.

Appendix Two

NHS Shared Business Services

Design and Production by NAO External Relations
DP Ref: 11503-001