Home
AGM March 2026
The Regional IG Steering Group and the Regional ISA members held the 2025/26 Regional ISA Annual General Meeting via Teams at 10:30 am on the 25th March 2026. On behalf of the Regional IG Steering Group and the Regional ISA members we wrote to all local health and social care organisations that are members of the Agreement to provide stakeholders with details of the Meeting.
The link to the Teams meeting was included in an email invitation.
The purpose of the Regional ISA Annual General Meeting is to ensure that the Regional ISA members can have an authoritative say on the governance of the framework and the manner in which the framework is used to support joint processing and sharing arrangements across the Buckinghamshire, Oxfordshire and Berkshire West ICS, the Frimley ICS and the Surrey Heartlands ICS as well as the joint processing and sharing arrangements that go beyond the three host ICSs.
The agenda for the AGM was as follows and a link to the presentations used in the AGM is included here (20260325publishedAGMslides) and at the end of the agenda:
- Welcome
- Declarations of interest
- Conduct of the meeting and check for priority AOB items and requests from members attending
- Summary of the scope, status and membership of the Regional ISA and the current joint processing and sharing arrangements supported
- 2025/26 Key decisions made and policies agreed (Regional ISA Policies (regisa.uk)):
- Approvals given through delegated authority
- Future service transformation and digital developments to be supported by the Regional ISA
- Quoracy, membership, frequency and administration of the Regional ISA and the IGSG meetings:
- Quoracy requirements, attendance and delegation
- Members’ views on improving diversity of attendance
- Introduction of lay membership
- Retiring IGSG meeting members
- Nominations *** and election of new IGSG meeting members
- Election of the Regional IGSG meeting Chairman
- Nominations for and appointment of the Regional ISA Administrator
- Matters arising from Regional IGSG meeting membership changes
- Regional IGSG meetings during 2026/27 and the Timing of the 2026/27 Annual General Meeting
- Quoracy requirements, attendance and delegation
- Any other business
(*** Nominations are required for regular IGSG meeting members as well as the roles of IGSG Chair and ISA Administrator.)
Common Privacy Notices
Below you'll find the agreed and approved general privacy, fair processing and informing texts that can be linked to directly by data controllers or used by controllers in building their own notices.
| Name | Status | Purpose |
|---|---|---|
| TVS Care Record – Example privacy leaflet | Current | An example privacy leaflet This page contains an example privacy leaflet that can be utilised while ICS comms teams are preparing ICS-specific materials. (Also at https://www.thamesvalleysurreycarerecords.net/yourinfo/ .) |
| TVS Care Record – Example poster | Current | An example privacy poster This page contains an example privacy link poster based on the Frimley ICS version. |
| TVS Care Record – Privacy link text, social media and waiting area/reception display screen examples | Current | A short document containing suggested text This page contains suggestions for text to support links to the main privacy notice pages with link text, social media and waiting area/reception display screen examples. |
| TVS Care Record – Staff newsletter example text | Current | A short document containing suggested text This page contains suggestions for text to support links for staff to access the staff/professionals-related materials. |
| TVS Care Record – A brief description | Current | A brief (2 page) description of the TVS Care Record processing arrangements. The audience for this page is data subjects wanting a quick summary of why and how information is used to support their care. The page provides a link to the TVS Care Record website for more information and also provides a brief summary of the data subjects rights, TVS Care Record controllers’ responsibilities and contact details for the lead controller for the TVS Care Record and the ICO. (Also at https://www.thamesvalleysurreycarerecords.net/yourinfo/ ) |
| TVS Care Record – A summary description | Current | A 5 page summary-level description of the TVS Care Record processing arrangements. The audience for this page is data subjects wanting a slightly more detailed description of why and how information is used to support their care. In addition to the 2 page document, this document includes for its readers:
The page provides a link to the TVS Care Record website for more information and also provides a brief summary of the data subjects rights, TVS Care Record controllers’ responsibilities and contact details for the lead controller for the TVS Care Record and the ICO. (Also at https://www.thamesvalleysurreycarerecords.net/yourinfo/ ) |
|
TVS Care Record - Narrative - (The Story of Everything) As a PDF document |
Current |
A detailed description of the TVS Care Record processing arrangements. The audience for this page includes:
The page covers:
(Also at https://www.thamesvalleysurreycarerecords.net/yourinfo/ ) |
| General Referrals | Current | Example notice for referrals. This notice explains that information about the data subject will be shared with the organisation and professionals who receive the referral. |
| MDT/ICT Referrals | Current | Example notice for referrals to Multi-Disciplinary Teams and Integrated Care Services. This notice explains that information about the data subject will be shared with the organisation and professionals who receive the referral. The notice also provides details of the classes of organisations that may receive referrals and that may be involved in using and processing the data. The notice is accompanied by a checklist for MDT referrers. |
| Local COVID-19 Privacy Policy text for data controllers | Legacy | Example privacy policy text for data controllers in respect to the COVID-19 response. This notice describes how controllers may use data subjects' information to protect the data subject and others during the COVID-19 outbreak. It supplements controllers' main Privacy Notices and states that health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. (Please note that you will need to link this to your main privacy notice.) The policy text is based on the original issued by NHS Digital and NHS X with additional information added to cover local arrangements, controllers and processors. |
| Personal Health Record Privacy Policy | Retired | The privacy policy text for the Share Your Care Personal Health Record. This privacy policy statement describes the privacy and processing arrangements for the Share Your Care Personal Health Record service commissioned by Frimley Health NHS Foundation Trust and provided by the Share Your Care solution providers. The policy is published to ensure everyone understands how we capture, manage and use your data through the Share Your Care Personal Health Record and to explain how we use the personal information that you supply to us through the Share Your Care Personal Health Record. Locally, Share Your Care is also known to professional users as Connected Care. |
| Local Shared Care Record Privacy Policy for Primary Care | Legacy | Example privacy policy text for primary care relating to local shared care records. The example shared care record text outlines how local health and care services are working more closely together to provide a joined-up service to meet local residents' needs and explains that working together improves the quality of care because the clinicians and other professionals involved in treatment and care provision have better, more timely and more complete information on which to base their decisions. |
| Example Video | Legacy | Example of a patient facing video. This video outlines why and how confidential patient data is used for direct care as well as securely to support the management of the local health system and also how it can be used securely to improve care through research. |
Policies
Several policies have been set by the Information Governance Steering Group (IGSG) of the Regional ISA framework. These are presented below.
Policy Decisions and Status
- Acceptable DSPT Status
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Acceptable DSPT Status - Qualifying Standard Assurance Checklist
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Appropriate Policy Document arrangements
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - BOB and Frimley IGSG sub-Group Terms of Reference
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Delayed Decision Implementation
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Health Visitor and School Nurse Classification
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - ICB Access to Shared Care Record PID
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Joint Arrangements Across Frimley and Surrey Heartlands
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Local Government and NHS Reviews Uninterrupted Compliance Policy
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Military Practice and HM Prison Organisations Qualifying Standard
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Schedule B - Qualifying Standard
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Sharing of Anonymous Information – Health and Social Care Act (2012) s.251D (aka s.96 of the Health and Care Act (2022))
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Supplementary Definitions for Local Authority Access to Shared Care Records
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Use of Regional ISA information assets with Artificial Intelligence
(Policy category: A General Policy Decision / Policy status: Current - expires 30th April 2030) - Access to Shared Care Records from Overseas
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Care Homes Qualifying Standard
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Childrens Social Care Access to Shared Platforms
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Community Pharmacy Membership
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Derivation Criteria for communications materials supporting TVS-Connected Care
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Local Application of the National Data Opt-Out
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - New Analytics Report Approvals
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - New Data Feed Approvals
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Normal Place of Residence Policy Shared Platforms
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Patient and Resident Financial Data Processing
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Policy for the publication of data and results derived from TVS-Connected Care
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Research Data Access Policy (incl Research Data Access Panel ToR)
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - Third Party Access via other organisations operational systems to TVS-Connected Care data
(Policy category: A TVS Decision / Policy status: Current - expires 30th April 2030) - BOB IGSG sub-Group Terms of Reference
(Policy category: A General Policy Decision / Policy status: This policy has been replaced) - Frimley IGSG sub-Group Terms of Reference
(Policy category: A General Policy Decision / Policy status: This policy has been replaced) - Buckinghamshire IGSG sub-Group Terms of Reference
(Policy category: A General Policy Decision / Policy status: This policy has expired) - COVID Interim Policies
(Policy category: A General Policy Decision / Policy status: This policy has expired) - Normal Place of Residence Policy
(Policy category: A General Policy Decision / Policy status: This policy has expired) - Oxfordshire IGSG sub-Group Terms of Reference
(Policy category: A General Policy Decision / Policy status: This policy has expired) - Access to Connected Care from Overseas
(Policy category: Connected Care Policy / Policy status: This policy has expired) - CCG Connected Care PID Access
(Policy category: Connected Care Policy / Policy status: This policy has expired) - Childrens Social Care Access to Connected Care
(Policy category: Connected Care Policy / Policy status: This policy has expired) - Connected Care Data Use and Rights
(Policy category: Connected Care Policy / Policy status: This policy has expired) - Connected Care Records Management
(Policy category: Connected Care Policy / Policy status: This policy has expired) - Supplementary Definitions for Local Authority Access to Connected Care Policy
(Policy category: Connected Care Policy / Policy status: This policy has expired)
ISA helpdesk (fhft.icsinformationgovernance@nhs.net).
Legal Opinion Summaries
While its member organisations extend beyond the following local health and social care economies, the Regional Health and Social Care Information Sharing Agreement primarily serves:
- Buckinghamshire Oxfordshire and Berkshire West ICS;
- Frimley ICS; and
- Surrey Heartlands ICS (where the Surrey Heartlands ISA is a derivative of the Regional ISA at the time of writing).
Together these ICSs serve over 3.5m residents across 19 local authorities and around 450 health and social care providers (including approximately 350 practices) - all of which are participants in the various local shared care records.
The local shared care records
There are three main types of shared care record in place within the three ICSs. These are:
- Arrangements based on specialised clinical systems such as:
- Diagnostic imaging
- Pathology; - Electronic Patient Record (EPR) systems such as:
- General Practice systems that that been configured for use by multiple partners
- Trust’s internal systems that have also been configured for use by multiple partners; and - The traditional shared care record systems themselves that pool data from multiple sources into a single broadly accessible repository for both direct care and analytics purposes.
To confirm their lawfulness, the data sharing and processing arrangements represented by the shared care records have been subjected to extensive scrutiny by local subject matter experts. The arrangements (with a particular emphasis on Graphnet-based solutions) have also been subjected to scrutiny by solicitors and by Kings Counsel and in general both have confirmed that the arrangements are suitably lawful and robust.
Connected Care and TVS
Connected Care began as the name for the Graphnet supplied shared care record solution that is now in use to support patients and residents across Berkshire, Buckinghamshire, Farnham, North East Hampshire and Surrey Heath. As the pivotal processing arrangements are the same for both Connected Care and the Thames Valley and Surrey Care Record (TVS), the statements that follow also apply to the TVS processing.
Connected Care now comprises the shared care record as well as an analytics solution that is known locally as Connected Care System Insights. While System Insights offered considerable value before the COVID pandemic hit us, it has been an incredibly important tool in helping us to address the pandemic pressures as well as our subsequent work on system recovery. Furthermore, as we move beyond dealing with the pandemic, System Insights is pivotal to our ability to bring insightful, evidence based and innovative solutions to our work establishing an Integrated Care System.
The opinion summaries
In 2019, Solicitors and King’s Counsel carried out a review of our local arrangements (including our legal bases for the processing) and observed that arrangements are fit for purpose and that communications and engagement are robust and wide-ranging. (A copy of this opinion summary can be found here https://regisa.uk/documents/2019QCopinion.pdf).
Solicitors confirm that this opinion continues to apply (https://regisa.uk/documents/2023DACBopinion.pdf) which means that our current legal bases for processing remain consistent and compatible with data protection legislation and common law.
Solicitors also confirm the lawfulness of our approach to the provisioning of and access control for: anonymous data (for planning and system management); pseudonymous data (for managing cohorts); and identifiable data (for direct care) https://regisa.uk/documents/2023DACBdatamartOpinionFinal.pdf.
In late 2022, we again approached Counsel and instructed him to review and advise on the lawfulness of our approaches to four specific topic areas where analytics are performed for direct care as well as other (secondary) uses. These are:
- Our approach to pseudonymisation and anonymisation;
- Our approach to the processing of data for risk stratification;
- Our approach to the processing of Secondary Uses Service (SUS) data; and
- Our application of the National Data Opt-out.
Counsel supports our position on these topics and brief summaries of Counsel’s advice in respect of the above can be found at https://regisa.uk/documents/2023KCopinion1.pdf and https://regisa.uk/documents/2023KCopinion2.pdf.
Page 1 of 2