Good TREs work
Digital Health And Care Wales projects
- Benchmarking in UDAL (partially via "system access")
- Application for transfer of data from NHS Digital to NHS Wales Informatics Service
30 data files in total were disseminated unsafely (information about files used safely is missing for TRE/"system access" projects).
Benchmarking in UDAL — DARS-NIC-769782-X5C1F
Opt outs honoured: unknown (Excuses: Does not include the flow of confidential data)
Legal basis: Health and Social Care Act 2012 s261(2)(a)
Purposes: No (Specialised Commissioning Hub)
Sensitive: Non-Sensitive
When:DSA runs 2024-11 – 2027-11 2025.01 — 2025.01.
Access method: System Access
(System access exclusively means data was not disseminated, but was accessed under supervision on NHS Digital's systems)
Data-controller type: DIGITAL HEALTH AND CARE WALES
Sublicensing allowed: No
Datasets:
- SUS-APC_UDAL
- SUS-EC_UDAL
- SUS-OP_UDAL
Type of data: Anonymised - ICO Code Compliant (note: this information not disclosed for TRE projects )
Objectives:
Digital Health and Care Wales (DHCW) requires access to NHS England Data for the purpose of creating a benchmarking dashboard. The purpose of this dashboard is to enable Health Boards in Wales to be able to compare their own metrics with others across Wales and England.
The following NHS England Data will be accessed:
Secondary Uses Services Admitted Patient Care, Accident & Emergency, and Outpatients data necessary because these cover the core areas that are required by DHCW to fulfil their purpose.
The level of the Data will be pseudonymised.
The Data will be minimised as follows:
Limited to Data between April 2019 and latest available. Data is required for this period to ascertain any trends compared with historic values and to maximise the ability to understand how the numbers are changing over time. This time period covers the COVID-19 pandemic to allow for a comparison with figures before the COVID-19 pandemic.
The Data will cover all uses of English hospital services. This coverage is required to enable the creation of benchmarking dashboard metrics covering nearly all conditions, mortality, data quality, quality, efficiency, etc, some of which are quite specialised. It will also allow for the creation of comparable peer groups for the hospitals in Wales.
DHCW is the controller as the organisation responsible for ensuring that the Data will only be processed for the purpose described above.
The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(e) -processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
The lawful basis for processing special category data under the UK GDPR is:
Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
Expected Benefits:
The use of the data could:
help the system to better understand the health and care needs of populations.
lead to the identification or improvement of treatments or interventions, or health and care system design to improve health and care outcomes or experience.
advance understanding of regional and national trends in health and social care needs.
advance understanding of the need for, or effectiveness of, preventative health and care measures for particular populations or conditions.
inform planning health services and programmes, for example to improve equity of access, experience and outcomes.
inform decisions on how to effectively allocate and evaluate funding according to health needs.
provide a mechanism for checking the quality of care. This could include identifying areas of good practice to learn from, or areas of poorer practice which need to be addressed.
The services provided to the Health Boards are expected to identify improvement opportunities which the Health Boards may then exploit by making changes to systems, processes, resources, or infrastructure to improve patient experience and care.
Specific benefits to the public are expected to be improved services across Wales as Health Boards better understand how their own figures compare to others across England and Wales, and are able to make appropriate changes to their services as a result.
It is hoped that publication of the dashboard will add to the body of evidence that is considered by organisations and individual care practitioners charged with making policy decisions or decisions on treatment for or within the NHS.
All of the outputs will remain within NHS Wales and Welsh Government, but will be promoted within these areas.
Outputs:
The expected outputs of the processing will be the ability for Health Boards across Wales to be able to benchmark a wide range of key metrics such as mortality.
The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.
The outputs will be communicated to relevant recipients through the following dissemination channels:
Benchmarking dashboard
The target dates for production and dissemination of the outputs are before the end of 2024. The benchmarking dashboards will be an ongoing resource.
Processing:
No data will flow to NHS England for the purposes of this Data Sharing Agreement (DSA).
NHS England will provide DHCW with access to Data via the Unified Data Access Layer (UDAL) Data Share service*. UDAL is a data management system within NHS England that enables patient data to be processed and made available for analytical purposes.
*The "Data Share" Service entails a data provider (NHS England UDAL) and a data consumer (DHCWs data platform), where the provider (NHS England) is in control of who receives data, when it is updated and how frequently.
NHS England will provide access to the relevant records from the SUS datasets to DHCW. The Data will contain no direct identifying data items. The Data will be pseudonymised and individuals cannot be reidentified through linkage with other data in the possession of the recipient. DHCW will extract subsets of the data where required to support the creation of the benchmarking dashboards. Data accessed under this DSA will be stored on a separate server to the Data supplied under DARS-NIC-660630-L4H3T. Only certain DHCW employees will have access to the Data, and these data sets are not to be linked.
The Data will be stored on servers at NHS England (UDAL) and DHCW.
DHCW does not store data on the cloud at present.
The Data will not be transferred to any other location.
The Data will be accessed onsite at the premises of DHCW, and by authorised personnel via remote access.
DHCW must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.
For remote access:
- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;
- Access controls granting users the minimum level of access required are in place;
- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;
- Multifactor authentication (MFA) is required for remote access;
- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;
- All remote access is undertaken within the scope of the organisations DSPT (or other security arrangements as per this DSA) and complies with the organisations remote access policy.
The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).
The Data will not leave England/Wales at any time.
Remote processing will be from locations within England/Wales. The data will not leave England/Wales at any time.
Access is restricted to employees of DHCW.
All personnel accessing the Data have been appropriately trained in data protection and confidentiality.
The Data will not be linked with any other data.
There will be no requirement and no attempt to reidentify individuals when using the Data.
Analysts from DHCW will process the Data for the purposes described in Objective for Processing.
Application for transfer of data from NHS Digital to NHS Wales Informatics Service — DARS-NIC-660630-L4H3T
Opt outs honoured: No (Excuses: Consent (Reasonable Expectation), Statutory exemption to flow confidential data without consent)
Legal basis: Health and Social Care Act 2012 - s261(5)(d)
Purposes: No (Specialised Commissioning Hub)
Sensitive: Sensitive
When:DSA runs 2023-11 – 2024-11 2024.05 — 2024.08.
Access method: Ongoing
Data-controller type: DIGITAL HEALTH AND CARE WALES
Sublicensing allowed: No
Datasets:
- Uncurated Low Latency Hospital Data Sets - Admitted Patient Care
- Uncurated Low Latency Hospital Data Sets - Emergency Care
- Uncurated Low Latency Hospital Data Sets - Outpatient
- Uncurated Low Latency Hospital Data Sets - Critical Care
- SUS for Commissioners
Type of data: Identifiable
Objectives:
Digital Health and Care Wales (DHCW) requires access to NHS England data specifically for Welsh residents treated in England.
DHCW requires episodic information on Welsh residents as processed by Health & Care establishments outside of NHS Wales for the purpose of:
Direct care
Healthcare planning
Commissioning and validation of services
Value based healthcare
National Tariff reimbursement
The development of national policy
Supporting the information needs of the Health Boards in the management of their
resources and services.
Support the management and planning of health services
Enable general medical research and statistical functions
Identify public health issues
Monitor improvements in public health on behalf of other organisations responsible
for public health provision
Develop, monitor and evaluate government policies, and otherwise support the
work of the Health & Social Services Group of the Welsh Government
Contribute to the production of Welsh Government statistical publications
Improve the patient or carer experience
In support of information processed as part of the collection and remuneration of
dispensed drugs by Community Pharmacies
In support of information processed as part of transactions through the delivery of
additional services by Community Pharmacies
National Clinical Audits data
These purposes fall under DHCWs powers of which is reflected in a Direction issued by the Welsh Government:
Welsh Government issued general powers:
https://www.gov.wales/digital-health-and-care-wales-establishment-and-functions
General power set out in the following directions:
https://www.gov.wales/digital-health-and-care-wales-directions-2020
https://www.gov.wales/digital-health-and-care-wales-no2-directions-2021
Directing letter describing these functions:
https://www.gov.wales/digital-health-and-care-wales-dhcw-direction-use-health-service-data?_ga=2.197054255.2062409619.1680265872-1268629993.1655389813
DHCW relies on the specific provision in Section 23(3) of the National Health Service (Wales) Act 2006 which provides that nothing in provision made by or under this or any other Act affects the generality of any direction made under section 23(1).
This agreement is to permit the flow of identifiable Secondary Use Service (SUS) data back into Wales following Welsh residents being treated in NHS England established healthcare providers.
Identifiable data is required as it is part of the purposes previously defined and as described within DHCWs functions and powers. As part of DHCWs responsibilities DHCW have robust processes of ensuring that the data is rendered unidentifiable where appropriate for any secondary purpose for onwards disclosure if there is no corresponding lawful basis to provide identifiably to any other agency or statutory body.
DHCW also require the data in identifiable form in order to respond to any direct care requirements. A centralised copy of all Welsh residents is maintained in the data warehouse.
In many respects the secondary use of data determined by Digital Health and Care Wales is just part of the collective responsibility that includes Welsh Ministers. Welsh Government (and Welsh Ministers) are responsible for the resident population of Wales wherever treated, with DHCW having the legal responsibility for the wider collection, processing and dissemination of said Welsh resident information.
To address the Common Law Duty of Confidentiality the data is disseminated for the purposes of direct care. DHCW must satisfy themselves that they have an appropriate legal basis to then utilise that same data for their non-direct care / secondary use purposes.
The data will be minimised to Welsh residents who were treated in England.
DHCW is the sole Controller who will also (solely) process the data. Data will only be processed by substantive employees of DHCW. Direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patients.
The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject;
The lawful basis for processing special category data under the UK GDPR is:
Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
Yielded Benefits:
From data already provided under the current agreement / Provision of Services Arrangement (POSA) the following expected benefits have been achieved. Improved patient Care Improved delivery of Health Services Joined up Health Care Funding benefits / financial Health protection and prevention including Covid-19 data
Expected Benefits:
There are three main direct & indirect healthcare implications for DHCW:
Managing patient pathways across boundaries, particularly the management of the Single Cancer Pathway and determining those patients that are waiting for treatment.
Managing complications where patients treated in England present back at their local hospital with infections and other complications.
Preventing recall of patients unnecessarily when they have had treatment in English Hospitals
For indirect healthcare provisions and additional to that described above other benefits of receiving the SUS data are to:
Enable the management of individual SLAs with English providers in relation to:
Identification of the patterns of patient flows for each Local Health Board;
Assess the appropriateness of the care pathway
Performance planning
Facilitate the development of key performance/efficiency/clinical indicators
Monitor geographical equity of access/provision;
Facilitate evidence based commissioning.
Financial governance, planning and improved expenditure
Quality of care provision
Identification of inappropriate activity
Identification of variations in clinical outcomes
Outputs:
Outputs will be varied, but are expected to cover at least the following:
1. Commissioner reporting.
2. Readmissions analysis.
3. Production of project / programme level dashboards.
4. Monitoring of acute / community / mental health quality.
5. Responding to ad-hoc request from NHS Wales organisations and Welsh government
6. Data Quality and Validation measures allowing data quality checks on the submitted data
7. Patient Stratification, such as:
o Patients at highest risk of admission
o Most expensive patients (top 15%)
o Frail and elderly
o Patients that are currently in hospital
o Patients with most referrals to secondary care
o Patients with most emergency activity
o Patients with most expensive prescriptions
o Patients recently moving from one care setting to another
i. Discharged from hospital
ii. Discharged from community
8. Analysis of Clinical and Patient Outcomes
Processing:
No data will flow to NHS England for the purposes of this Agreement.
NHS England data will provide the relevant records from the SUS datasets to DHCW. The data will contain directly identifying data items.
The data will not be transferred to any other location.
DHCW may, at any time, receive requests for data from medical professionals for Direct Care purposes. In this case direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patient(s).
The data will be stored on servers at DHCW.
The data will be accessed onsite at the premises of DHCW only.
The data will not leave England/Wales at any time.
Access is restricted to employees or agents of DHCW
All such individuals are substantive employees of DHCW.
All personnel accessing the data have been appropriately trained in data protection and confidentiality.
The data will be linked at person record level with Welsh medical data.
DHCW will only process/analyse the data for the purposes described above.