How we use Patient Data
Connected Health Cities is a collaboration of key partners and stakeholders working together and learning from each other to improve care for our citizens living in the North of England.
We collate and analyse health and social care data* in secure ways that protect everyone’s data privacy. We have developed a number of projects that examine how we can improve health and patient outcomes by analysing data and giving our health professional access to information that makes a difference to how they deliver services.
*Data is information about you from your records (such as health records or social care records). We will refer to this as “patient data”.
Read how the CHC IG framework was implemented by GM CHC here.
Who are our Partners?
Our key partners are:
- The NHS
- Local authority services, for example; social care, housing and education
- Healthcare service provider organisations
- Healthcare charities
- Patient and public associations
- Companies producing healthcare products and services
Who benefits from CHC?
All projects will benefit the public, patients, and may benefit the local economy by:
- Improving frontline services through collaboration with leading researchers, healthcare organisations and companies who provide healthcare services.
- Using patient data to gain insights and publishing results into the public domain.
- Working with industry partners to enhance knowledge and skills of staff and accelerate innovation.
Why are you using patient data?
We use patient data so that we can identify the best treatment practices and find out what works well, where and for whom. The data that we are using already exists within the NHS but it is currently underused.
By working closely with those that deliver care and by sharing our results we will create a Learning Health System. A Learning Health System continually improves care services and health, making healthcare more efficient by providing the right information to healthcare providers in a timely way so that this information can be quickly integrated into standard practice.
CHC uses information for projects which:
- Map how ill the population is in your area and what services are provided and working well or less well.
- Link data sets and look across larger time periods so that we can gain greater insights into the services that are provided and the types of people that these services work well for and the types of people they work less well for.
- Exploring better ways of providing services to people with a particular condition or a particular set of circumstances which might be influencing outcomes.
- We can provide data to influence commissioners to help design services based on population and local needs.
We will be able to promote the highest quality of care using the latest scientific evidence obtained from this data.
Our collaboration will accelerate research into both new and improved treatments (including into new medicines, medical devices and health apps) and how to improve services by using evidence.
What data does CHC use?
Our projects use data from GPs, hospitals and care services, relevant to the disease area they are investigating. Some projects link this data together so that we can see all the care a patient has received. For more information about the specific datasets used in each project please click this link: (CHC Data Catalogue).
Most of the patient data that we hold is de-personalised patient data (you cannot be identified from it); data that identifies you is removed or scrambled before it is sent to us.
The patient data that we hold may look like this:
Some CHC projects do hold patient identifiable data (CHC Data Catalogue).
We can only hold identifiable data if we have your consent or if we have been given approval to do so by the Health Research Authority or the Secretary of State for Health following an assessment by an independent committee called the Confidentiality Advisory Group. You can find out more about this here.
All the data we hold is protected and is only shared with CHC analysts that are undertaking an approved research study or health service (care pathway) analysis.
In the rare cases where the data is personally identifiable it will only be shared in accordance with your rights under Data Protection legislation, the Common Law Duty of Confidentiality, the NHS Constitution, and in keeping with professional and NHS Codes of Practice.
How do you protect the data you hold?
The NHS implements stringent Information Governance (IG) standards, which we follow. We have additional strict policies to ensure we use and store data responsibly. Data sharing agreements ensure we work with the data providers to maintain high data standards.
We ensure that your data will be safe and secure while it is transferred to us.
Each CHC has put a number of ‘safeguards’ in place to make sure any data they hold is safe and used appropriately.
Before any of the projects receive data they look at what the data-risks are and how they can protect against them (the safeguards). We have discussed these safeguards with patient and public representatives to make sure that they agree with the approach and that they trust that the data-use is in the interest of patients and public.
The safeguards are the things CHC do to ensure that data is safe, secure and used appropriately, these include:
- Restricting data access only to approved people who are trained about confidentiality. These researchers are also required to sign a declaration that commits them to protect your data and use it only for the purposes that they agreed to when they obtained it.
- Using secure passwords to ensure access is protected.
- Scrambling some of the data so it can only be seen by those who have the right code.
- Keeping IT systems up-to-date and protecting against viruses and hacking.
- Making sure that anyone accessing data has appropriate training and is approved by the CHC organisation.
All data analysis is done in our data centres (no-one can make copies to take out of the data centre). If other organisations want to analyse the data and they have the correct approvals, then they must sign a Data Sharing Contract that makes clear what they can use the data for and what happens if they don’t follow the rules.
Each organisation that hosts a CHC is also required to complete the NHS’s Information Governance Toolkit . They will also need to complete the Data Security and Protection Toolkit that will soon replace the Information Governance Toolkit. These toolkits allow organisations to assess themselves or be assessed against Information Governance policies and standards and provide assurance that the data is held securely and used appropriately.
We will make sure that we know about any data quality problems and address them so that the data that we use can be relied upon. We will make sure that any published results will be presented in an anonymous way (such as in tables showing the number of people with a particular condition) so it won’t be possible to identify anyone. Information about small groups or people with rare conditions that could potentially identify someone would not be published.
Will CHC protect my rights to confidentiality?
We are committed to protecting your privacy at all times and will only use patient data ethically and in accordance with all relevant legislation, such as the Data Protection Legislation, the Human Rights Act 1998 and the Common Law Duty of Confidentiality.
You can find out more about what this means by reading the Code of Practice on Confidential Information. This provides good practice guidance for organisations collecting, analysing, publishing or otherwise disseminating confidential information concerning, or connected with, the provision of health services or adult social care in England.
Because we are processing data that has been collected within the NHS, i.e. information from your patient record about when you received care, we are also committed to following the principles and values relating to using and sharing personally identifiable data that are set out in the NHS Care Record Guarantee and the NHS Constitution.
If you want to know how the NHS uses your patient data you can find out more here.
What can I do if I don't want you to use my data?
Most of the data that we use is de-personalised so we cannot identify you. This means that your own data cannot be removed from the data that we hold as we are unable to identify who you are and the data that relates to you.
If we are using data that identifies you, you have either given your consent to one of our projects or we have been authorised by the Health Research Authority or the Secretary of State for Health to use this data.
If you have given your consent to one of the CHC projects you have the right to withdraw your consent. This can be done by using the instructions given to you when you agreed to be involved.
If we are using data that identifies you because we have support from the Health Research Authority or from the Secretary of State for Health, you still have the right to object to your data being included. You can find out how to do that here.
A national data opt-out was introduced on 25 May 2018, providing a facility for individuals to opt-out from the use of their data for research or planning purposes. By 2020 all health and care organisations are required to apply national data opt-outs where confidential patient information is used for research and planning purposes.Find out more about the national data opt-out programme
Do CHC share data with other organisations?
The CHC regions have entered into data sharing contracts with a number of partner organisations. To find out more, follow the links below.
In future, we may want to share data that we hold with others to improve local services. We are consulting on a suitable governance arrangements across CHC, and these arrangements will be scrutinised by the Health Research Authority. This already happens for the Born in Bradford study.
Who checks how CHC are using data?
Each CHC has a Board overseeing all of their projects. We have secure environments that have audit trails and documented procedures on how to handle data securely.
The four CHC regions regularly consult with external stakeholder boards and staff working in the Connected Health Cities Hub. The work of CHC is presented to the public at regional events and in “citizens’ juries”. Every project has a page on our website where the public can submit feedback.
What happens if something goes wrong?
Even with all these safeguards in place sometimes things can go wrong. CHC staff track cybersecurity developments to ensure they implement the latest data security patches to protect against malware and other threats. See for example these resources from NHS Digital.
CHC will make sure that in the unlikely event that an incident does occur, a thorough investigation is done and changes are made to prevent it happening again.
How do I take part in CHC?
If you have any questions or concerns about how we use your patient data, please contact us.
Where can I find further information?
Here are some more links on your rights and the ways that the NHS uses patient data:
The National Data Guardian’s Panel – this is the panel that advises the Secretary of State on information governance matters across the health and social care system. This website includes links to the Independent Information Governance Review that was conducted in 2012 and the Government’s response, as well as the more recent report on new measures to strengthen security of patient data and help people make informed choices about how their patient data is used.
The Confidentiality Advisory Group who provide independent expert advice to the Health Research Authority (for research applications) and the Secretary of State for Health (for non-research applications) on whether applications to access personally identifiable patient data without consent should or should not be approved, in accordance with the law (Section 251).
The Information Commissioner (the UK’s Data Protection Regulator) who can offer independent advice and guidance on the law and personal data, including your rights and how to access your personal data.