Good TREs work

National Institute For Health Research (nihr) Bioresource projects

119 data files in total were disseminated unsafely (information about files used safely is missing for TRE/"system access" projects).

R7.1 - Access to NHS PDS Spine Mini Service for participant-facing research infrastructure project for Covid purposes only — DARS-NIC-205004-D2F8N

Type of data: information not disclosed for TRE projects

Opt outs honoured: No - consent provided by participants of research study, Identifiable (Consent (Reasonable Expectation))

Legal basis: Health and Social Care Act 2012 – s261(2)(c), Health and Social Care Act 2012 – s261(2)(c)

Purposes: Yes (Research)

Sensitive: Sensitive

When:DSA runs 2020-04-01 — 2020-09-30 2020.04 — 2024.05.

Access method: System Access
(System access exclusively means data was not disseminated, but was accessed under supervision on NHS Digital's systems)


Sublicensing allowed: No


  1. Personal Demographic Service


The NIHR BioResource is a REC-approved Research Tissue Bank that exists to create and manage a large panel of participants who can be invited to take part in experimental medicine studies. These studies are now (April 2020) being directed towards investigating different aspects of Covid, such as:
- tracking the mental health of individuals admitted to hospital with Covid,
- monitoring the effectiveness of shielding among vulnerable patients,
- testing previous blood donors who have contracted Covid for antigens.
In addition, Bioresource are recruiting specific Covid-related cohorts: eg, individuals entering COVID-19 triage wards in Cambridge; and with the intention to expand recruitment to other Trusts and to recruit patients and family members of those under the age of 40 hospitalised with Covid symptoms nationwide.
Under certain circumstances – eg, some of those newly recruited and those exhibiting extreme mental distress – the use of this data will constitute Direct Care.

The need for efficient PDS lookups has become urgent and more important, for the following reasons:
• Recruitment and participation is increasing rapidly, as the Bioresource’s cohorts are mobilised to study different aspects of Covid
• Due to Covid deaths, the likelihood of writing to a recently-deceased participant has risen
• The socioeconomic status of many volunteers is such that their likelihood of foreign travel since December 2019 is greater

Due to the current Covid pandemic, the Bioresource has increased the number of participants, the number of cohorts (eg, two new cohorts consisting of patients hospitalised with Covid symptoms in Cambridge, and nationally patients and family members of those hospitalised under the age of 40), and the number of emails being sent out to participants. This makes the automated PDS lookup indispensable: manual lookup will cease to be a practical alternative.

Cambridge University is the national centre for a country-wide set of recruitment centres. These are based in 13 teaching hospitals - a subset of those with Biomedical Research Centres (BRCs). The project is on its 3rd iteration: there was a local Cambridge BioResource from 2007-11; a loose grouping of 8 BRCs (2012-17); which has now become more centralised grouping (2018-22). The 13 sites are here:

The purpose of this application is to request access to the NHS Patient Demographic Service Spine lookup service. Data in the lookup is limited to regularly-used NHS identifiers - NHS number, Date-of-Birth, Given name, Family name – plus Gender, address or addresses, GP details, and Date-of-Death if deceased.

Following informed consent, participants volunteer their personal details to the NIHR BioResource, either directly online, or at a recruitment site – usually a hospital clinic or blood donation centre. The BioResource holds these contact records in a secure data centre. If granted access to the NHS Personal Demographic Service Spine, the first task will be to use this lookup service to check that the BioResource have correctly identified each participant – if there is no match, the BioResource will ask their recruitment sites to review the information submitted for possible errors, and/or attempt to re-contact the participant directly. The BioResource would not attempt to re-contact a participant where it is known that the individual is deceased.

Over the past 11 years, the national centre has supported over 130 studies involving participant recall, with almost ½ million communications by letter and email, plus phone calls. The application process to request support is described online for both local studies - - and national studies -
In both cases, applications are considered for feasibility and scientific merit by independent bodies – the (Cambridge) Scientific Advisory Board and (national) Steering Committee – and researchers must have ethical approval from an HRA Research Ethics Committee before any approach may be made to participants.

Examples of studies previously approved are available online – e.g. These descriptions are couched in scientific terms: the BioResource are currently working with their Participant Advisory Panel to improve guidance to researchers on how to write a plain language summary.

As a perceived part of the NHS – albeit a part without a healthcare role – it causes great family distress if the BioResource accidentally contact one of their participants who has recently died. The primary objective of this Data Access Request is to take advantage of the technical systems that the NHS has put in place, to prevent such contacts. The BioResource send emails, letters and texts every working day – with automated reminders on non-working days too – so having up-to-date information is key. If approved, the BioResource would like this application to run as long as the BioResource are able to make invitations, accepting that there will be review and renewal processes in place.

As background, the NIHR BioResource is funded by NHS England’s research arm, the National Institute for Health Research, and is sponsored and has governance oversight from Cambridge University Hospitals NHS Foundation Trust (CUHFT). CUHFT is the Data Controller, and one of the two organisations that will process data. Under this application, InHealthcare Ltd (who supply the NHS PDS Spine lookup service the BioResource intend to use) would be another Data Processor – data has to pass through them, and they are contractually obliged to log each user’s use of the NHS PDS Spine lookup service through them.

Participants are recruited across England from patient groups (as at May 2019, there are 4 common and 54 rare diseases represented), from blood donors and from the general population. The BioResource have over 150,000 active participants currently, and the goal is to have 300,000 fully consented participants recruited by 2022.

The experimental medicine studies that the BioResource support are run by independent medical researchers or clinicians, who require separate ethical approval before the BioResource approaches participants on behalf of independent medical researchers or clinicians. Therefore, the BioResource sits between the researchers and the participants: the BioResource do not carry out the research, nor give clinical care, but instead broker study contributions and contacts.

Practically, there is little opportunity for harm from the proposed use of the NHS PDS Spine lookup service: the BioResource are not attempting to find new recruits, but checking details on those already recruited. One moral ambiguity is whether the BioResource should use additional email addresses and telephone numbers delivered through the lookup: the lookup delivers a standard set of data items, which they cannot minimise. The BioResource's view is they should only use such data as given to them by the participant, as there may be reasons why participants chose to withhold other contact details.

The BioResource only seek access to data for consenting participants for whom they hold sufficient details to use the PDS

Either: NHS number + DOB
Or: DOB + Forename + Surname + Sex + Postcode

The BioResource would like to access the NHS Personal Demographic Service to look for recent deaths, and (when a participant is first recruited) to validate their NHS number, or look it up if missing.

The BioResource will use InHealthcare software to ask for details about participants, which returns a short list of data items for each participant if exactly matched. To minimise the data returned further (i.e. to return fact of death instead of date of death) would require a change in this piece of software.

The applicant will only use the data provided and only to achieve the outcomes outlined in this application.

Yielded Benefits:

The NIHR BioResource has been actively recruiting participants throughout the COVID-19 pandemic - initially patients from the COVID-19 triage wards at hospitals, then staff being tested at a drive-thru facility, and now the whole staff group being tested for SARS-CoV-2 antibodies. The last has now started follow-up, which is where the Spine lookup comes in. The NIHR BioResource have also been conducting 2 COVID-19 research studies in a patient-group of > 30,000 participants - to which application DARS-NIC-374223-P4P4L is contributing - and mental health and cognition studies in the rest of the BioResource, another 70,000 participants to date, with more to be added. The key concrete benefits of access to the Spine are: 1. The NIHR BioResource have found that 1 in 200 participants have died since last contact. The NIHR BioResource can now avoid attempting to contact them, which has caused family upset 2. The NIHR BioResource can look up NHS numbers which will improve the linkage success rate in the NHS Digital application referenced above.

Expected Benefits:

For the NIHR BioResource, success in terms of access to the NHS PDS Spine will be measured in the avoidance of distressing communications, particularly during the Covid pandemic. Secondary benefits include the ability to complete and correct data entry on recruitment – NHS number is often missing - and to maintain a robust cohort of members whose NHS numbers can be submitted to request tracing and access to e.g. HES data under subsequent further applications.

The potential distress is real: the BioResource's most recent newsletter to participants attempted to contact two individuals who had recently died – this potential distress will only increase during the Covid pandemic.

The NIHR BioResource is a REC-approved study. The legal basis for processing personal data is Articles 6(1)(e) and 9(2)(j) of the Data Protection Act 2018, namely that they are processing data for “scientific or historical research purposes” and that this is “necessary for the performance of a task carried out in the public interest” - this is described in a Privacy Notice, online at

That “task in the public interest” is supporting experimental medicine studies, with more than 200 approved over the last 12 years. Currently, the BioResource frequently have research nurses checking the NHS Spine one-participant-at-a-time before initiating a new study, which can be a rate-limiting step. So the potential benefit in terms of translational research is real too: nurses would have more time for participant engagement if they could spend less time on preliminary checks.

During the Covid pandemic, this rate-limiting step will impose a significant limitation on planned research activity.


The personal data requested in this application to access the NHS Personal Demographic Service, will not appear in any output. The role of access is to reduce the possibility of distress to participants’ families, to increase participant tracing efficiency, and to make the Bioresource’s processes more efficient during the Covid pandemic..

However, the experimental medicine studies supported by the NIHR BioResource do have many outputs:
• Medical researchers or clinicians are expected to report the outputs of their research in the usual academic way: through peer-reviewed articles and conference proceedings. The BioResource have an annual review to check that they do;
• Data in these publications should be aggregate-only, although increasingly – and as a condition of publication - de-personalised data is made available to other researchers through managed-access repositories (see below);
• Aggregated data may also appear in dashboards, when the research purpose was to make an online tool – see e.g. which exposes data from a previous NIHR BioResource research project.

While this is largely not “their” research, the NIHR BioResource recognises that it has a role and responsibility in communicating these outputs: to provide transparency for the participants about how their data and samples are being used; to encourage new researchers by showing what others have achieved; and to improve data discovery.

The NIHR BioResource, and its forerunner the Cambridge NIHR BioResource:
• Lists approved studies on its website:
• Publishes lay summaries of completed work: - improving this output is a current focus of activity of the local participant panel.
• Lists articles to which BioResource participants contributed:

As part of their “Terms of Conduct” - see - the BioResource seek the return of any novel data generated, if it can enhance the resource. They then bring data together by:
• Depositing de-personalised data in managed access repositories where this has not otherwise happened – see e.g.
• Running the Data Access Committee that oversees access to this data. It reports to the NIHR BioResource Steering Committee, a group that includes representatives of all key the stakeholders – funders, lay members, industry, BRC directors and senior management. The BioResource are in the process of making the list of all those who have ever accessed data in this way visible;
• Linking external resources from the NIHR website – the dashboard mentioned above is also available at

More generally, on behalf of the BioResource, the local NIHR Cambridge BRC Communications team brings newsworthy research and events to participants’ and the public’s attention on their website: and via Twitter. The BioResource also contribute to research events they organise – e.g. - and are aiming to increase their profile by speaking at events such as the Health Data Science conference at the Wellcome Genome Campus in June 2019.

With regards exploitation of outputs, the NIHR as a funding body encourages the commercialisation of translational research. Researchers are free to develop their own IP, although the BioResource will seek cost recovery and a (small) revenue share where there is commercial engagement. The BioResource will also encourage (and on occasion pay for) articles to be Open Access, as this is an NIHR requirement.


The NIHR BioResource are seeking permission to use a lookup service to access the NHS Personal Demographic Service for the purposes of Covid-related research and monitoring. There are multiple vendors of such services; the one BioResource have chosen - InHealthcare - has a simple interface where the BioResource give the secure lookup service some details about a patient that they have recruited to a study, it brokers the connections to and from NHS Digital, and returns more details if there was an exact match, or no details if there is no match or multiple matches.

The details the BioResource provide are NHS number and Date-of-Birth, or Date-of-Birth, Given name, Family name, Gender and Postcode. The details returned are these 6 items, plus a fuller address or addresses, GP details, and Date-of-Death if deceased.

Of these, the most important are NHS number if missing, as this will allow the BioResource to link the participant to other NHS data that they may subsequently request; and Date-of-Death, as this ensures they do not attempt to re-contact the recently deceased. The BioResource will also use the service to identify participants who have joined the study more than once – a risk with any long-running nationwide recruitment campaign.

The lookup queries themselves will run from a recruitment database, held at AIMES, a secure data centre. Note that the AIMES service, while branded Health Cloud, is not a public cloud in the traditional sense; AIMES have Data Security Protection Toolkit accreditation as well as ISO27001. The mechanism will be invisible to the end users of the database: study coordinators and research nurses. As far as the end users see it, the details are simply checked both before and as they are doing their work.

After an initial check, almost all use of the lookup service will be at the point of initiating a communication at the secure data centre.

There are two other potential downstream uses where contact details could leave the premises:

1. The experimental medicine studies the BioResource support are run by independent medical researchers or clinicians. In almost all cases it is the BioResource who make contact with participants: the BioResource centre invite them to have a lab test, give a sample or complete a survey on behalf of the researcher – i.e. the researcher and participant never meet, and contact details are not divulged. However, there have been a few studies where contact details are passed on in order that a researcher can invite participants to have a specialist test at a central location. This can only happen if both [a] the researcher has gained ethical approval for their study from an NHS Research Ethics Committee, and [b] following specific informed consent from each participant. In such cases, researchers must be based in the UK, and contact details are passed encrypted and by secure means (e.g. email). In this case, the NIHR Bioresource will not be using data drawn from this agreement, but email addresses and telephone numbers acquired direct from the participants. The chosen NHS PDS Spine Mini Service provider (InHealthcare) does not pass on such details.

2. Once it has a well-curated list of participants, the NIHR BioResource will apply to enhance its data holding with other NHS Digital data – which will be subject to a separate application or applications. In addition, in many cases participants are recruited at a BRC or NHS Trust, and are also members of e.g. Public Health England or academic rare disease registries, or Clinical Research Facilities’ volunteer panels. The BioResource could potentially share updated personal information with these groups, if that is defined in bilateral contracts, and with participant informed consent. Again, the BioResource will reduce the risks in such data sharing by using encrypted and secure means of communication. In this case, the NIHR Bioresource would apply to amend this agreement to ensure any such registry is also a party to the agreement, with all that entails.

In some instances, staff working within the NIHR BioResource may be substantively employed by the University of Cambridge but working within Cambridge University Hospitals NHS Foundation Trust under an honorary contract governed by the research passport system. An example is provided in the supporting documentation which includes the importance of keeping patient data strictly confidential, and states the following: "Your substantive employer is responsible for your conduct during this research project and may in the circumstances described above instigate disciplinary action against you."

Only the Bioresource Headquarters at the Cambridge University Hospitals NHS Foundation Trust, or staff accredited through the research passport system, will access the data and not the other Bioresource local centres referenced in the protocol. The NHS Digital data obtained under this Data Sharing Agreement will not be shared with the third party organisations running these research studies.

R7.1 - HDR UK Consented research cohorts - identify susceptibility & resilience factors in cohorts - Data (HES & Mortality on IBD patients) — DARS-NIC-374223-P4P4L

Type of data: information not disclosed for TRE projects

Opt outs honoured: No - consent provided by participants of research study, Identifiable, No (Consent (Reasonable Expectation))

Legal basis: Health and Social Care Act 2012 – s261(2)(c), Health and Social Care Act 2012 – s261(2)(c)

Purposes: No (Research)

Sensitive: Non Sensitive, and Non-Sensitive

When:DSA runs 2020-08-06 — 2022-03-31 2020.08 — 2022.03.

Access method: Ongoing


Sublicensing allowed: No


  1. COVID-19 Hospitalization in England Surveillance System
  2. Hospital Episode Statistics Critical Care
  3. Hospital Episode Statistics Admitted Patient Care
  4. Emergency Care Data Set (ECDS)
  5. Hospital Episode Statistics Outpatients
  6. Civil Registration - Deaths
  7. Hospital Episode Statistics Accident and Emergency
  8. Civil Registrations of Death
  9. Hospital Episode Statistics Accident and Emergency (HES A and E)
  10. Hospital Episode Statistics Admitted Patient Care (HES APC)
  11. Hospital Episode Statistics Critical Care (HES Critical Care)
  12. Hospital Episode Statistics Outpatients (HES OP)


BioResource is a collaboration between clinicians and researchers based in BioResource centres across the country with thousands of volunteers both with and without health problems who are willing to be approached to take part in research studies. Studies investigate the link between genes, the environment and health and disease. Volunteers help to ensure that research can be completed quickly making it possible to identify new treatments. BioResource is a bank of genetic information.

The NIHR BioResource Centre has over 150,000 participants, both with and without health conditions, who are willing to be approached to participate in research studies investigating the links between genes, the environment, health and disease.

Volunteers who join the NIHR BioResource Centre donate their DNA via a blood or saliva sample which is used together with other information, such as gender and ethnicity, to match them to specific research studies. Volunteers are free to choose which studies they would like to take part in, allowing the NIHR BioResource Centre to provide researchers with groups of participants, tailor-made to the research study.

The NIHR BioResource is a major project funded by the Department of Health and Social Care through the National Institute for Health Research, funding is routed through the NIHR Cambridge Biomedical Research Centre which is a long-term partnership between the Cambridge University Hospitals NHS Foundation Trust and the University of Cambridge. Cambridge University Hospitals NHS Foundation Trust are the data controller who also process data for this study.

NIHR BioResource Centre has been recruiting patients with Inflammatory Bowel Disease (IBD) since 2017, under the banner of the NIHR IBD BioResource. It now has over 34,000 participants, recruited from over 100 NHS Trusts in England. A cohort size of 30,802 is being submitted for this study. The participants have all contributed samples and data to research, and have agreed to be re-contacted to take part in further experimental medicine studies. Nine such studies have been approved in the last year, ranging from an observational study of bowel health, to an online survey of childlessness, to clinical trials. Data contributed includes a detailed self-reported Health & Lifestyle Survey, with annual repeats and a clinical report. Samples are being used primarily for genetic analysis and stratification into trials. The NIHR is a Department of Health and Social Care funding stream, and the NIHR BioResource has existed in its current form since 2012. Continued recruitment and analysis is funded until 2022.

NIHR BioResource Centre is seeking HES, Civil Registration mortality data and Hospitalisation in England Surveillance System (CHESS) data on these IBD patients for two urgent COVID-19-related research questions and NIHR have confirmed that the proposed linkages will support a number of priority questions included on the SAGE report under How do we best understand and protect vulnerable populations?

1. What is the outcome (hospital admission/Intensive Care Unit admission/death) for patients with IBD on immunosuppressant or anti-TNF therapies who test positive for COVID-19? Are their outcomes worse, the same or possibly better than matched people with IBD not on these drugs?

2. What are the risk factors, including genetic risk factors, associated with susceptibility to, and severity of, infection?

Research Question 1

“Could we compare the outcomes data for patients who are receiving / not receiving immunosuppressants and validate whether this population group are more vulnerable?”

This is a challenging objective, as many of the IBD patients were asked to shield themselves, and so most will not have been exposed to COVID-19.

Some were placed in the high risk group (according to the Shielded Patient List, to which IBD clinicians contributed). These are:
~ People on immunosuppression therapies sufficient to significantly increase risk of infection.
Others were thought to be at Moderate Risk:
~ Those [not on the High Risk list and] with a weakened immune system caused by a medical condition
~ medications such as steroid tablets or chemotherapy.

This analysis hopes to shed light on whether these were the correct categorisations. This is not of mere academic interest: patients remain uncertain as to whether they should un-shield themselves as lockdown eases, and prescribing could change if the evidence supports it.

Research Question 2

“How can we ensure that we fully understand variations in response to COVID-19 infection at the molecular, environmental, social and economic levels, by effectively coordinating the UK's longitudinal population studies to gain a much richer understanding of disease progression and outcomes? “

The NIHR BioResource Centre is one of the studies included in this brief, and it is contributing to a bigger national effort, to consider risk factors of COVID-19. Broad objectives are:

1) Clarify clinical risk factors associated with COVID-19 status and prognosis in order to inform targeted preventative measures (e.g. prioritisation of vaccinations when available) by linkage of e-health records and COVID 19 status/outcome.

2) Establish molecular factors associated with susceptibility to, and clinical trajectory of, COVID-19.

3) Understand resilience to (and recovery from) severe clinical consequences of SARS-CoV-2 infections.

To maximise the value of this research, the NIHR BioResource Centre needs timely information about study participants͛' health status, both prior to diagnosis with COVID-19 and, as the outbreak progresses, during and after treatment.

When the researcher looks at immediate patient impact, the main consideration is: what can we change?
Clinicians could change the message to patients re shielding, if their drug categorisations were incorrect.
Prescribing habits could change if e.g. immunosuppressants are actually a benefit in reducing the severity of COVID-19 in those affected.

Wider public health questions include:
~ could some of the medications in wide-spread use amongst seriously ill IBD patients be re-purposed to fight the more severe symptoms of COVID-19? Or should some be abandoned (across a wider patient group) for the duration of this pandemic?

Additional risk factors for catching, being tested for, and severity of outcome of COVID-19 are also being considered as part of a wider consortium of cohorts. The cohorts will provide information on e.g. genetics and self-reported lifestyle, while NHS Digital data linked to the IBD cohort would provide the medical history and outcomes for this cohort. Communication of risk factors will become urgent, if any of them are both novel and modifiable. However, the main aim is longer term, as complications post-infection already look severe in some, which may have a genetic basis. If so, genetic testing may provide the basis for shielding in future waves or access to specific treatments.

The Shielded Patient List (SPL) is not part of this data request but data will enable research into the factors used to create the SPL.

The legal basis for processing personal data for this purpose falls under Article 6(1)(e) of the General Data Protection Regulations (GDPR), i.e. “a task carried out in the public interest”. It also falls under Article 9(2)(j), “processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes”. The processing of data for this study is a task of public interest as it will facilitate urgent COVID-19-related analyses to inform patient care and public health.

Cambridge University Hospitals NHS Foundation Trust are the data controller who also process data. The University of Cambridge own the IT network upon which the NIHR BioResource recruitment team use, they have no access to the NHS Digital data. The recruitment team also uses the offices at this location (although not to access record level data). The University of Cambridge are not data controllers or data processors of the NHS Digital data.

AIMES Management Services are a data processor. Identifiable data will be transferred securely over the NHS network to the NIHR BioResource Centre tenancy at AIMES Management Services Ltd, a secure data centre in Liverpool. Therefore, AIMES is listed as a Data Processor. Their staff supply the infrastructure, and technical expertise to provide the required level of security.

Expected Benefits:

Anticipated benefits are:

The risk stratification tool used to place IBD patients on the Shielded Patient List may change. If it does not, there should be further evidence that the algorithm used was appropriate – one of the analytic team wrote the risk stratification tool. The output may also change policy around subscribing during the pandemic , and even to clinical trials of therapies found to be beneficial in IBD patients in other individuals.

This study has wider implications that just the IBD patients and will impact other categories of patient on immunosuppressant or anti-TNF therapes.

What is the magnitude of the impact? IBD affects 0.5-1.0% of the population – so ~600,000 people nationwide – and costs the UK tax payer > £2 billion p.a. . Even a small change could make a substantial difference

Unfortunately, the impact of current shielding, is being measured through lives lost. Any rapid change in treatment recommendation will go through NICE, and be monitored for efficacy thereafter

NICE are publishing new guidance around COVID-19 weekly. Research on complications following infection, however, will likely take years.


If a workable model of the interaction of medication (and/or other modifiable risk factors) and COVID-19 disease severity or complications is developed, the order of output expected is:
• Report
• Presentations
• Submission to peer reviewed journal
• Modification of risk stratification tool for shielding

All these outputs will be aggregated with small numbers suppressed in line with the HES analysis guide.

However, as clinicians are leading the analysis, and they will communicate as professional members with others in the British Society of Gastroenterology, it is possible (indeed, to be wished for) that some patients may get a message as part of their usual direct care interactions as a result of learning from the analysis.

In terms of dissemination of results, the primary purpose is to try to change policy for patient benefit.

Beyond that:
1. That this analysis is taking place will appear, with a short plain language summary and list of personnel involved, on the NIHR BioResource website
2. Articles arising from NIHR work must be Open Access, and will also be listed on the website
3. The NIHR BioResource is a key contributor to a Health Data Research UK “Hub”, called “Gut Reaction”, which is specifically focused on IBD. The Hub has a Patient and Public Engagement group which is led by staff and volunteers at the charity Crohn’s & Colitis UK; and a communications team. Between them, they will ensure that an academic text is both acceptable to the public, and accompanied by a readable press release and social media exposure
4. “Gut Reaction” has an active commercial arm, that will seek to reach industry with any outputs
5. The clinicians involved (and indeed, other study and charity workers and members) speak regularly at public meetings, where this topic is likely to raise much interest.

The target date is the Autumn of 2020. The same clinicians are pursuing many other avenues to expedite this work, including, but not limited to: creating apps to allow patients to self-report outcomes; trying to influence analytic priorities in proprietary GP database systems; collaborating across disease groups to build patient numbers; and reaching out internationally.

Results will be fed through the Department of Health and Social Care, which funds the NIHR BioResource, and through clinical networks such as the British Society of Gastroenterology


The NIHR BioResource is requesting:

~ Hospital Episode Statistics
~ Civil Registrationj Mortality data
~ Hospitalisation in England Surveillance System (CHESS) data

NIHR BioResource will flow the following cohort identifiers to NHS Digital:

~ Name
~ address
~ NHS Number
~ Date of birth
~ Participant identifier

NHS Digital will flow back the NHS Digital data with a study id and no identifying data, this data will be linked to the IBD data via the study id.

The NIHR BioResource is not currently recruiting new patients – almost all non-COVID-19 research is paused –so this list will be sent from the NIHR BioResource to NHS Digital just once in the first instance, although further lists are likely over the next few years and an amendment to this Agreement would be submitted to support this. The cohort submitted for use in this application were all recruited under versions 4 and 5 of the consent form (25,066 under Version 4 and 5,736 under Version 5) and versions 5 and 6 of the patient information sheet.

The NHS Digital data will be linked back to the IBD data already held – genetics, lifestyle, clinical reports at record level by a study id.

• HES data is sought since 2017. The earlier data will tell analysts about the severity of a patient’s disease, and recent data about in- and out- patient activity, and whether the patient has COVID-19 or not
• Civil Registration Mortality data is sought, to see if any of the participants had COVID-19 on a death certificate – around 0.5% have died since recruitment
• COVID-19 Hospitalisation in England Surveillance System (CHESS) is sought to provide detail on patients submitted to intensive care and provide treatment and outcome data for those patients with a confirmed COVID-19 diagnosis.

HES data and CHESS data is requested quarterly, Civil Registration death data is requested monthly.

Data will be transferred securely over the NHS network to the NIHR BioResource tenancy at AIMES Management Services Ltd, a secure data centre in Liverpool. Therefore, AIMES is listed as a Data Processor. AIMES supply the infrastructure, and technical expertise to provide the required (very high) level of security.

At AIMES, data will be linked by NIHR BioResource staff to personal data already held by a study id and transferred securely to a Trustworthy Research Environment (TRE), also hosted by AIMES.

For this analysis, data will be record level, reversibly pseudonymised (means participants are identified by a code, and that some people (those that recruited them at clinic, staff in the NIHR BioResource recruitment team) know how to turn that code back into a real person):
1. The analytic group is largely clinicians, for whom some of the participants are also their patients. The analysis is intended to realise immediate clinical benefit, and so obfuscating the relationship between research subject and real person by rendering the data irreversibly de-identified, is unhelpful.
2. Analysis is taking place in a TRE, which is accessed via two-factor authentication, and which passes all data and software tools through a digital airlock, such that uploads and downloads are only permitted if vetted by NIHR BioResource staff
3. The analysts are in a contractual relationship with the Data Controller, through the NHS Research Passport scheme. This, of course, includes a duty of confidentiality
4. The analysts are in a contractual relationship with the NIHR BioResource to limit the purpose of their analysis through each signing a local Data Access Agreement.

Genetic or biochemical results obtained from samples taken for research will not be routinely communicated to participants and only if participants have indicated on their consent form that they wish to be informed in the rare event of being found to be at increased risk of a genetic disease. This information might be relevant to a participant's future health for example if an increased risk of a condition is identified and this condition might be prevented or treated early by the NHS. If the genetic analysis indicates that a participant might be at increased risk of such conditions, and the participant has chosen to be informed about any such risk, the provisional result of the research analysis will be handed back by the IBD team to the participant's consultant or GP for discussion with the participant. A further sample would be taken for analysis within an accredited NHS diagnostics laboratory to confirm any “incidental finding” A health professional or genetic counsellor will feed back to the participant on the final results.

All researchers accessing the NHS Digital data will have an honorary contract as part of the NHS Research Passport scheme with Cambridge University Hospitals NHS Foundation Trust.

The University of Cambridge own the IT network upon which the NIHR BioResource recruitment team work. This team also uses the offices at this location (although not to access record level data).