14.Sections 3 to 7 make provision about information standards. An information standard (as defined by section 3) is a document setting out how Scottish health and social care information is to be processed, which includes how it is stored, formatted, indexed and so forth. Section 3(2) allows for an information standard to set requirements by reference to other documents, including ones that may not yet exist which means, for example, that an information standard could require compliance with an internationally recognised technology standard (such as one produced by the International Standards Organisation) including future revisions of it. The concept of “Scottish health and social care information” has the same meaning in Chapter 3 as it does in Chapter 1 (see sections 7(1) and 1(4)).
15.An information standard must specify to whom the requirements about information processing that it sets out applies (see section 3(3)(a)). Different requirements set out in the same information standard document may be made to apply to different persons. The effect of being a person to whom an information-standard requirement applies is that the person falls under a legal duty to comply with it (see section 5).
16.Section 5(2) allows the Scottish Ministers to make regulations imposing civil (as opposed to criminal) sanctions for breaching the duty to comply with an information-standard requirement. Those regulations will be subject to the affirmative procedure (see section 38).
17.A requirement in an information standard may only be made to apply to a person mentioned in section 4(1). The list of persons in that section covers both public and private sector providers of health and social care services in Scotland. It also covers, at paragraph (l), those who provide to the providers of health and social care services products and services that are used for or in connection with electronically processing health or social care information. For example, an IT company providing a health board with cloud storage for keeping patient records would fall within paragraph (l) where the company provided that cloud service knowing it was to be used by the health board for storing patient records. Any requirement in an information standard that might apply to an IT company in such a case could, however, only apply in relation to its processing of Scottish health and social care information as defined; an information standard cannot set requirements in relation to the processing of any other kind of information.
18.Section 6 allows for information standards to be withdrawn. The legal duty to comply with the requirements in an information standard stop applying once the standard is withdrawn. The withdrawal of an information standard is to be effected by putting a notice to that effect on the information-standards website.
19.Every information standard that is produced must be available to the public on the information-standards website (see section 3(4)) unless and until it is withdrawn (see section 6(2)(a)). While there ceases to be a requirement to include withdrawn information standards on the information-standards website, there is no prohibition on their continuing to appear there. It is the notice on the website that the standard has been withdrawn that is determinative of its status.
20.The information-standards website is defined in section 7. Once section 7 comes into force, the Scottish Ministers will be under a duty to use regulations to amend that section so that it specifies on its face the internet domain name of the site (see subsection (2)(a)). Thereafter, the Scottish Ministers will be able to change the specified domain name by further regulations (see section (2)(b)). Regulations specifying the domain name of the information-standards website will have to be laid before the Scottish Parliament in accordance with section 30 of the Interpretation and Legislative Reform (Scotland) Act 2010.
Overview of the Act Overview of Part 1 Chapter 3: Information standards