Privacy policy

What is a privacy notice?

Find out about privacy notices and what they should include.

The UK General Data Protection Regulation (GDPR) requires that data controllers provide certain information to people whose information (personal data) they hold and use. A privacy notice is one way of providing this information. This is sometimes referred to as a fair processing notice.

A privacy notice should identify who the data controller is, with contact details for its Data Protection Officer. It should also explain the purposes for which personal data are collected and used, how the data are used and disclosed, how long it is kept, and the controller’s legal basis for processing.

Find out more

Data analytics

How we use de-identified personal data to support our purpose: to lead the NHS in England to deliver high-quality services for all.

How we use de-identified personal data to support our Purpose: “To lead the NHS in England to deliver high-quality services for all”

Data analytics and NHS England’s purpose

Supporting NHS England’s Purpose

NHS England needs information to achieve its Purpose – To lead the NHS in England to deliver high-quality services for all. Our analysis of de-identified personal data relating to peoples’ NHS care is essential to providing us with much of this information.

Our purpose statement provides clarity on what NHS England is seeking to achieve. It drives both ‘what’ we do (how we add value and what our priorities are) as well as ‘how’ we operate (our values, behaviours and accountabilities, and structures). NHS England’s operating framework sets out what we will do to achieve our Purpose and how we will do it:

enabling local systems and providers to improve the health of their people and patients and reduce health inequalities;
making the NHS a great place to work, where our people can make a difference and achieve their potential;
working collaboratively to ensure our healthcare workforce has the right knowledge, skills, values and behaviours to deliver accessible, compassionate care;
optimising the use of digital technology, research and innovation; and
delivering value for money.

Activities to deliver these, and all of our public tasks are underpinned by functions and duties set out in legislation. Our statutory functions relate to, for example, the commissioning of primary care services, some secondary care services, and to the administration of screening services. A selection of our statutory duties from the NHS Act 2006 is set out below:

13C. Duty to promote NHS Constitution

13D. Duty as to effectiveness, efficiency etc.

13E. Duty as to improvement in quality of services

13F. Duty as to promoting autonomy

13G. Duty as to reducing inequalities

13H. Duty to promote involvement of each patient

13I. Duty as to patient choice

13J. Duty to obtain appropriate advice

13K. Duty to promote innovation

13L. Duty in respect of research

13M. Duty as to promoting education and training

13N. Duty as to promoting integration

13NA. Duty to have regard to wider effect of decisions

13NB. Guidance about discharge of duty

13NC. Duties as to climate change etc

13ND. Guidance about discharge of duty under section 13NC etc

13O. Duty to have regard to impact on services in certain areas

13P. Duty as respects variation in provision of health services

As a statutory organisation NHS England is legally obliged to perform its functions and duties. We cannot perform them without a clear understanding of how the NHS is performing in relation to them. It essential that we have information about all aspects of NHS services and its operating environment to achieve our Purpose.

Much of the information that we need can only be produced by analysing data obtained from providers of NHS care. The data that we analyse is de-identified or ‘pseudonymised’ personal data. This is data that relates to individuals, with for example information about the care they have received, but with no data items that identify them directly. NHS England may analyse this data to facilitate any of its statutory functions and duties. As the data is de-identified people’s confidentiality is respected.

Analytical environments

The Unified Data Access Layer (UDAL) is our main analytical environment. It is a secure de-identified environment, technically and organisationally segregated both from source environments holding identifiable data and from the environment in which pseudonymisation is performed. (Our legacy environments use the same processes).

The general principle in UDAL is that users only have access to the data for which they require access. No data outside of “public” data is available to all users as standard. This public data includes published data as well as some additional internally derived reference data. It does not include any patient level data.

Access to UDAL for new users must be approved by line managers, and the Data Operations team being led by the Information Asset Owner. Further approval and justification is required for access to the restricted pseudonymised datasets.

Data collections

NHS England has a power to collect and analyse information from health organisations, when directed to do so by the Secretary of State for Health and Social Care, using powers under the Health and Social Care Act 2012. When acting under directions, NHS England may collect and analyse personal data, including confidential information for purposes set out in the direction. When directed NHS England has a power to require the provision of data by health providers.

When pseudonymised and transferred to our de-identified environments the data may be analysed for purposes relating to any of our statutory functions or duties as described above, provided that this is not incompatible with the purpose for which the data was collected.

Merger with NHS Digital

In February 2023 NHS Digital merged with NHS England. NHS England acquired many of NHS Digital’s statutory powers and duties and has also become controller responsible for processing previously conducted by NHS Digital.

Before the merger, both NHS England and the Secretary of State for Health and Social Care could give a direction requiring NHS Digital to collect and analyse data from providers of NHS services.

When directed, NHS Digital could then require the provision of the data by these providers. This data could include fully identifiable personal data and confidential information. NHS Digital would then disseminate the data in pseudonymised form to NHS England for our analysis. The data processed by NHS England analysts was considered ‘anonymous in context’.

With the merger, the Secretary of State can make similar directions to NHS England, and all existing directions to NHS Digital are to be read as if given by the Secretary of State to NHS England. The consequence of this is that NHS England can collect and analyse fully identifiable personal data when directed to do so.

As NHS England is now responsible for the de-identification process, we now have the technical ability within the organisation to re-identify the data held in pseudonymised form. So, it can no longer be considered ‘anonymous in context’. To prevent re-identification and maintain confidentiality, NHS England must separate the processing of identifiable data collected under directions from the derived pseudonymised data held in our analytical environments.

To this end the Secretary of State has given the NHS England De-Identified Data Analytics and Publication Directions 2023. These require NHS England to put in place arrangements for the governance of ongoing processing of de-identified data that it previously obtained from NHS Digital and a framework for the future analysis, linkage and de-identification of data NHS England needs to access in the exercise of its functions in connection with the provision of health services.

As the directions mandate the processing by NHS England of de-identified personal data in support of its functions, the lawfulness of processing such data for any purpose that is “…not incompatible with the purpose for which the identifying data was obtained…” is explicit and transparent. This depends on the segregation of pseudonymised and identifiable environments as explained above.

The links below give access to directions given to NHS Digital by NHS England and the Secretary of State.

Sources of the data

The information may be collected by NHS England under directions, from any organisation that provides health services to the NHS, including NHS Trusts, NHS Foundation Trusts, GP Practices and other primary care providers and local authorities.

Categories of personal data

The details of the individual collections are specified in the directions. This may include records representing individual items of care, or summarised information including just numbers.

Where information about individual patients and their care is collected, this will usually include their NHS Number, other similar identifiers, postcode and date of birth. These are needed to make sure that the data is correct, and to allow linkage to other data. The data will include information about the health care received, administrative information, and may include ethnicity.

As described above identifiable personal data collected under directions is pseudonymised and transferred to our de-identified environments for analysis.

Categories of recipients

Within NHS England personal data collected under directions is processed by teams authorised to manipulate the data in identifiable form, to prepare it for the purpose set out in the direction. This processing may involve linkage to other datasets held by NHS England.

Data is released in pseudonymised form to NHS England’s de-identified environments, in accordance with the Analytics Directions described above. From here it may be accessed by analysts.

Data may be released in identifiable form only where there is an established legal basis, for example approval by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (‘section 251 support’) – see for example Assuring Transformation.

Data may be released to other organisations in a form that is anonymised in line with the Information Commissioner’s Anonymisation code of practice, or in identifiable form where there is an established legal basis. All requests for data from other organisations are dealt with by the Data Access Request Service.

Legal basis for processing

For UK GDPR purposes NHS England’s lawful bases for processing are:

Article 6(1)(c) – ‘…legal obligation…’ when acting under directions from the Secretary of State, and

Article 6(1)(e) – ‘…exercise of official authority…’ when processing in support of our statutory functions.

For the processing of special categories (health) data the conditions may be one or more of articles

9(2)(h) – ‘…health or social care…’;

9(2)(i) – ‘…public health…’

9(2)(j) – ‘…research purposes or statistical purposes…’.

NHS England as a data controller

Details of our data protection responsibilities and how to contact us.

NHS England is a data controller under the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Our head office address is:

NHS England London
Wellington House
133-155 Waterloo Road
London, SE1 8UG

How to contact us

Please contact us if you have any questions about our privacy notice or information we hold about you:

Customer Contact Centre
Telephone: 0300 311 22 33
Email: [email protected]
General Post (including complaints, but not legal proceedings): NHS England, PO Box 16738, Redditch, B97 9PT

Our Customer Contact Centre opening hours are 9am to 3pm Monday to Friday, except Wednesdays when we open at the later time of 9.30am. We are closed on bank holidays.

Contact details of our Data Protection Officer

NHS England have appointed a Data Protection Officer (DPO). If you have any queries about this privacy notice or about how NHS England process personal data please contact our DPO at the address below.

Jon Moore (interim DPO)
Delivery Directorate
NHS England
7 and 8 Wellington Place
Leeds, West Yorkshire
LS1 4AP

E-mail: [email protected]

The role of the Data Protection Officer

As a public authority, NHS England is required to appoint a data protection officer (DPO). This is an essential role in facilitating ‘accountability’, and the organisations’ ability to demonstrate compliance with the GDPR. The essential qualities of the role are to provide support, advice and assurance of all our activities that involve processing personal data.

The DPO reports on compliance to our senior management teams and is empowered to raise data protection matters with our Board if necessary.

The DPO has expert knowledge of data protection law and practices, and a detailed understanding of how NHS England processes personal data.

NHS England has a comprehensive suite of policies and procedures that addresses all aspects of information governance and data protection. These govern how we ensure that the personal data we are responsible is processed and shared lawfully, and that peoples’ data protection rights are respected.

NHS England’s legal basis for processing personal data

NHS England is a public body established by the NHS Act 2006 as amended by the Health and Social Care Act 2012. As such our business is based upon statutory powers which underpin the legal bases that apply for the purposes of the GDPR. The legal bases for the majority of our processing is:

Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

For entering into and managing contracts with the individuals concerned, for example our employees the legal basis is:

Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Where we have a specific legal obligation that requires the processing of personal data, the legal basis is:

Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.

Where we process special categories data, for example data concerning including health, racial or ethnic origin, or sexual orientation, we need to meet an additional condition in the GDPR. Where we are processing special categories personal data for purposes related to the commissioning and provision of health services the condition is:

Article 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…

Where we process special categories data for employment or safeguarding purposes the condition is:

Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…

NHS England may also process personal data for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings), for the purpose of obtaining legal advice, or for the purpose of establishing, exercising or defending legal rights. Where we process personal data for these purposes, the legal basis for doing so is:

Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject; or
Article 6(1)(f) – processing is necessary for the purposes of legitimate interests pursued by the controller.
Where we process special categories of personal data for these purposes, the legal basis for doing so is:
Article 9(2)(f) – processing is necessary for the establishment, exercise or defence of legal claims; or
Article 9(2)(g) – processing is necessary for reasons of substantial public interest.

In How we use your information we set out most of the key ways in which we may process your personal data for the purposes of, or in connection with our statutory functions. If you want to know more about how we process your data please contact our Customer Contact Centre.

How long do we keep information about you?

You can obtain a copy of our Corporate Records Retention and Disposal Schedule and Primary Care Services Retention Schedule from our Privacy Notice web site, or by contacting our Customer Contact Centre. We also comply with the Records Management Code of Practice for Health and Social Care published by the Information Governance Alliance.

Your rights

The GDPR includes a number of rights that are more extensive that those in the Data Protection Act 1998. We must generally respond to requests in relation to your rights within one month, although there are some exceptions to this.

The availability of some of these rights depends on the legal basis that applies in relation to the processing of your personal data, and there are some other circumstances in which we may not uphold a request to exercise a right. Your rights and how they apply are described below.

Right to be informed

Your right to be informed is met by the provision of this privacy notice, and similar information when we communicate with you directly – at the point of contact.

Right of access

You have the right to obtain a copy of personal data that we hold about you and other information specified in the GDPR, although there are exceptions to what we are obliged to disclose.

A situation in which we may not provide all the information is where in the opinion of an appropriate health professional disclosure would be likely to cause serious harm to your, or somebody else’s physical or mental health.

Right to rectification

You have the right to ask us to rectify any inaccurate data that we hold about you.

Right to erasure (‘right to be forgotten’)

You have the right to request that we erase personal data about you that we hold. This is not an absolute right, and depending on the legal basis that applies, we may have overriding legitimate grounds to continue to process the data.

Right to restriction of processing

You have the right to request that we restrict processing of personal data about you that we hold. You can ask us to do this for example where you contest the accuracy of the data.

Right to data portability

This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and NHS England. For this to apply the data must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.

Right to object

You have the right to object to processing of personal data about you on grounds relating to your particular situation. The right is not absolute and we may continue to use the data if we can demonstrate compelling legitimate grounds.

Rights in relation to automated individual decision-making including profiling

You have the right to object to being subject to a decision based solely on automated processing, including profiling. Should we perform any automated decision-making, we will record this in our privacy notice, and ensure that you have an opportunity to request that the decision involves personal consideration.

Right to complain to the Information Commissioner

You have the right to complain to the Information Commissioner if you are not happy with any aspect of NHS England’s processing of personal data or believe that we are not meeting our responsibilities as a data controller. The contact details for the Information Commissioner are:

Information Commissioner’s Office
Wycliffe House
Water Lane,
Wilmslow SK9 5AF

Website: ico.org.uk
Telephone: 0303 123 1113

How we use your information

How we use personal data to perform our functions.

Our workforce

How we use personal data for employment purposes

Purposes for processing

We process your personal data in the main because the processing is necessary for the purposes of a contract of employment we have with you. In some cases, we may process information only once we have received your consent for us to do so. In other cases, we will process data in order to comply with legal requirements, both contractually and non-contractually. The reasons for which we may process your personal data may include (but are not limited to):

Staff administration (including payroll)
Pensions administration
Workforce planning, and provision of facilities such as estates, car parking and IT
Equal opportunities monitoring
Staff health and wellbeing, safety and security, e.g. CCTV and staff identity badges
Provision of management information
Surveying of staff to support organisational initiatives
Business management and planning
Accounting and Auditing
Accounts and records
Crime prevention, detection of fraud and prosecution of offenders
Education
Management of organisational change
Supporting emergency preparedness and business continuity
Health administration and services
Compliance with obligations, e.g. returns to Cabinet Office/Government departments
Board member ‘fit and proper person test’ (FPPT) data capture.

Categories of personal data

To carry out our activities and obligations as an employer/engaging body we may process the following data:

Contact details such as names, addresses, telephone numbers
Emergency contact(s)
Education and training, incl. development reviews (appraisals)
Employment/identity records (including professional membership, qualifications, references and proof of identity and eligibility to work in the UK)
Bank details
Pay, benefits and Pension details (incl. National Insurance number)
Information around travel and subsistence; expenses
For staff driving a vehicle for work purposes: vehicle details, details of driving licence and vehicle insurance, tax, MOT etc.
Personal demographics (including protected characteristics such as gender, race, ethnicity, sexual orientation, religion, date of birth, marital status, nationality)
Medical information including mental and physical health
Information relating to health and safety
Trade union membership
Offences (including alleged offences), criminal proceedings, outcomes and sentences
Employment Tribunal applications, Employee Relations cases, complaints, accidents, and incident details
Employment details (position details, salary, full time equivalent (FTE) etc., status in relation to organisational change)
Support provided under employee assistance programmes.

Please note this list is not exhaustive and may change over time.

Information sharing and recipients

There are a number of reasons why we may have to share your personal information with third parties.

There may be circumstances where information is shared without your consent, for example:

The disclosure is necessary for a statutory function of NHS England or the third party to whom the information is being disclosed
There is a statutory obligation to share the data; for example, making returns to the Cabinet Office, Department of Health, Office of National Statistics etc.
Disclosure is required for the performance of a contract
Disclosure is necessary to protect your vital interest; for example in medical emergency situations
Disclosure is made to assist with prevention or detection of crime, or the apprehension or prosecution of offenders
Disclosure is required by a Court Order
Disclosure is necessary to assist NHS England to obtain legal advice.

We may need to share your information with the following organisations/categories of organisations (further detail below):

Other employers – to obtain pre-employment references or to enable you to undertake a secondment or corporately sponsored volunteer role
Disclosure and Barring Service (DBS) – obtain employment background checks and necessary criminal record checks
Occupational health provider – information about your health and attendance to enable them to provide advice and guidance to HR and your manager.
Payroll and pensions providers – to process your pay and pension
Employee benefits providers – to allow them to support you with the employee benefits services you wish to take up
ICT providers – to grant you access to ICT systems necessary to perform your role
Training and development providers – to enable you to undertake approved learning and development activities
Survey providers – to collect views from our staff and report on staff engagement within the organisation
Publications – NHS England publishes information about certain staff, including their name and job titles.

Specific information about recipients of personal data and the data shared can be found below.

Department of Health and Social Care (DHSC)

NHS England will share data with DHSC data relating to its organisational structure namely: names of senior individuals (salary band 9 and above), individual job titles, grade, directorate and sub-directorate.

The purpose of this is for:

Understanding the numbers of staff working in different areas and assurance that resources are being prioritised in line with ministerial priorities
Understanding the make-up of staffing in order to help shift resources flexibly and quickly when major events or new priorities emerge (e.g. Covid, Brexit)
Analysing where there are teams undertaking similar functions across different parts of the system (DHSC and individual ALBs) with a view to identifying opportunities for efficiencies.

The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controllers.

The personal data to be shared under this agreement will assist the Secretary of State in the discharge of their duties relating to the promotion and provision of the health service in England (including public health functions), as outlined in Part 1 of the NHS Act 2006 (as amended by the Health and Social Care Act 2012).

Recruitment, Employee Records and Contracts Administration (NHS Business Services Authority)

NHS England are working to establish integrated Human Resources services, and the components of this joint service will be designed and implemented during 2019/2020. The purposes related to employment for which we currently process personal data jointly are:

Staff recruitment

NHS England has established a joint recruitment service, and are responsible as a controller for the processing of personal data that you provide on your application, and from other sources. We have engaged the NHS Business Services Authority (NHSBSA) to process applications for employment on our behalf.

NHS BSA works with NHS England through each stage of the recruitment process using our end-to-end recruitment system TRAC, this includes pre- and post-interview activities up to confirming the offer of employment and issuing a contract. If you applied for a vacancy using NHS Jobs your application will be imported into the TRAC recruitment system and all information you receive about your application will be generated by TRAC. You may be invited to create a TRAC account if you are shortlisted to enable your application to be managed through the system.

We will use information you have provided to verify your identity when we speak to you, and at all stages of the application process.

For successful applicants

Before agreeing a contract, we will use the information you have provided to complete the following pre-employment checks in line with NHS Employers’ guidance:

Professional registration checks
Employment history and reference checks
Disclosure and Barring Service (DBS) check (if required)
Work health assessment: to check you are fit to work or confirm what reasonable adjustments are required, if applicable
Confirming Right to Work, identity, and eligibility for the vacancy
Meeting safeguarding law requirements where this is relevant to the vacancy role

NHS England are also required to monitor the diversity of candidates to ensure we comply with the Equality Act 2010.

Categories of recipients

We share your information with:

medical professionals, to assess your fitness to work and any reasonable adjustments that you need
the Disclosure and Barring Service (DBS), if your role requires a DBS check
with named referees to obtain a reference
any other organisation who has a legal right to it.

Your information will not be transferred outside the European Economic Area (EEA).

Keeping your personal information

For non- successful applications, personal information in the e-recruitment system will be deleted within 400 days of the advertised application closing date. This information is retained so that we can revisit vacancies and applications in case the vacancy needs re-advertising or to enable us to respond to any candidate queries.

Successful applications will remain in the system for 400 days, but only information relevant to the employment of successful candidates will be retained within staff employment records. This will be specified in your contract of employment. If you withdraw at offer stage, you will not receive any further information and your details may still be retained for 400 days securely outside of the e-recruitment system.

Equal opportunities monitoring

We have established a joint analytics team that is responsible for analysing data to enable reporting on compliance with equal opportunities requirements by NHS England. This supports workstreams such as the Workforce Race Equality Standard, the public sector Equality Duty and the Gender Pay Gap, which are mandatory for NHS employers.

Record level staff data is required to enable analysis by data items representing any characteristics relevant to equalities monitoring. Personal data including employee number is obtained from the Electronic Staff Record and other sources for example appointments to roles.

The dataset extracted includes employee number, data about role including grade and pay scale, position, type of contract, working hours, also protected characteristics including gender, ethnic origin, disability, marital status, sexual orientation, age band, religious belief.

The employee number is required to enable linkage between datasets.

Access to personal data including employee number is restricted to members of the joint analytics team.

Line management

Managers have access to the Electronic Staff Records of their staff and use this to keep employment details up-to-date and manage the development of their staff, training compliance, annual leave and other absence. Managers use personal data relating to the health of their staff for the following purposes:

Reimbursement of expenses
Maintenance of professional registration
Sickness absence management
Maternity and adoption
Occupational Health and accommodating special workplace needs.

Sickness absence management

As an employer, NHS England have legal duties to ensure the health and safety of their employees at work, and that their employees receive their sickness pay allowance entitlement. We must also ensure that we comply with employment rights legislation around sickness absence.

Managers need to know that that their staff are fit for work and be aware of adjustments that may be to necessary to support staff following a period of sickness. For these purposes they will receive GP fit notes from the staff that they manage. These indicate whether or not an individual is fit for work and may give advice on any support required to accommodate an illness or condition when returning to work.

Managers will also receive return to work forms completed by their staff, and conduct return to work interviews to agree on any adjustments required.

Managers must ensure that the Electronic Staff Record (ESR) for their staff is kept up to date with sickness absence records. This enables us to comply with employment rights legislation when managing sickness absence.

By analysing the data extracted from the ESR we are able to identify and address any inequalities and target health and wellbeing interventions.

Maternity, paternity and adoption

Managers are responsible for ensuring that the rights of their staff are respected when they are to become mothers or fathers.

They will receive completed MATB1 and matching certificates, which confirm details around a pregnancy or adoption. These forms are shared with HR and payroll ensuring communication with the employee about their entitlements and correct payment during periods of leave.

Occupational health and accommodating special workplace needs

Line managers may refer a member of staff, with their consent, for an occupational health assessment.

The NHS England Occupational Health Providers are external providers. Managers will share your contact details and referral with the providers as required.

Managers will receive occupational health reports to inform them of any adjustments that are required.

Workforce Race Equality Standard

The Workforce Race Equality Standard (WRES) was introduced to the NHS in April 2015 to ensure that employees from black and minority ethnic (BME) backgrounds have equal access to career opportunities and receive fair treatment in the workplace.

The WRES is an integral part of the NHS Long Term Plan (LTP) and NHS People Plan, with ambitions for NHS trusts to set aspirational targets for BME representation across their leadership team and broader workforce. A model employer; Increasing black and minority ethnic representation at senior levels across the NHS, sets out the ambitions for this criterion to be met.

The aspirational targets have been developed by analysts at NHS England and the Department of Health and Social Care; they are based upon a robust and fit for purpose methodology.

To support this NHS England receives aggregate data (numbers) that are collected by NHS Digital from trusts under directions from the Secretary of State for Health and Social Care.

Working with the seven NHS England regional directors and their respective HR directors, individual organisation targets will be shared for oversight on how trusts in each region are performing against their objectives.

Aspirational target data for NHS trusts will not be published by the WRES team or regional teams, however individual organisations could publish their data if they choose to.

Payroll and Pensions Administration (NHS Payroll Services (NHS PS))

The payroll of NHS England is managed by NHS Payroll Services (NHS PS). Your personal information will be made available to NHS PS through the Electronic Staff Record (ESR) (see below) in order to allow them to pay your salary, any associated expenses, to make appropriate deductions and to comply with our legal and statutory obligations. From time to time we may need to share additional information to that held in ESR with NHS PS in order to ensure that they deliver the services we require and continue meet statutory or contractual obligations. Data will also be shared with pensions providers, e.g. NHS Pensions and NEST.

Electronic Staff Record (ESR)

Your personal information may also be used to fulfil other employer responsibilities, for example, by to maintain appropriate occupational health records, comply with health and safety obligations, carry out any necessary security checks and all other employment related matters. In addition, the information held may be used in order to send to you, information which is relevant to our relationship with you. Your information will only be disclosed as required by law or to our appointed agents and/or service providers who may be used for a variety of services, for example, processing of payroll and provision of pensions administration or staff surveys.

IBM, who provide ESR, and its partners as service providers will be responsible for maintaining the system. This means that they may occasionally need to access your staff record, but only to ensure that the ESR works correctly. Where this happens, access will be very limited and is only to allow any problems with the computer system to be investigated and fixed as necessary. They will not have the right to use this data for their own purposes and contracts are in place with the Department of Health to ensure that the data is protected and that they only act on appropriate instructions. IBM and the ESR Central Team may access anonymised data about transactions on the ESR system to support the development and optimal use of the system.

Some of your personal information from ESR will be transferred to a separate database, known as the Data Warehouse. This will be used by various Government and other bodies (listed below) to meet their central and strategic reporting requirements. It will allow them to access certain personal information to generate the reports that they need and are entitled to. The Data Warehouse is intended to provide an efficient way of sharing information. Organisations currently granted access to the Data Warehouse are; NHS Digital, NHS Employers, Health Education England and its local committees (LETBs), Deaneries, Department of Health, Welsh Government, NHS Wales Shared Services Partnership, Care Quality Commission, NHS Trust Development Authority, and Monitor. The government may allow further organisations to have access in the future and therefore an exhaustive list cannot be provided, however any organisation having access to your data will have a legal justification for access.

Occupational health service provider

The NHS England Occupational Health Service is managed by an external provider. Your personal information will need to be shared with the provider as and when required to allow them to provide NHS England employees and managers with the services required.

Expenses system provider

To provide an efficient way for staff to claim expenses, we use a hosted third-party software. Staff data is transferred to and from this system from the ESR system to ensure staff are able to claim and be reimbursed for expenses and NHS England can be assured this is within the policy set. The provider meets the ISO27001 information security standard in respect of the security of the data it holds. The provider processes the data to advise accurate amounts for reimbursement. The company may also periodically analyse the data to review trends and suggest improvements to NHS England.

Internal audit

We provide information to our internal audit function, which is provided by an external service provider, to ensure NHS England has good processes and systems to manage and protect public funds.

Survey providers

We may provide limited information to third party survey providers, to collect views from our staff and report on staff engagement within the organisation.

Flexible working

We process personal data that is necessary to enable flexible working applications to be reviewed and progressed. This includes employee name, employee number, pay band, job title and the reason for requesting flexible working. This is received by the People and Organisational Development team who review the application.

Benefits system provider

We aim to provide our staff with employment benefits such as, gym opportunities, cycle to work scheme and other discounts to support staff personally and professionally whilst in employment with NHS England. NHS England’s benefits system is managed by an external provider and your personal information will need to be shared with the provider as and when required to allow them to support you with the services you wish to take.

Other bodies

NHS England is responsible for protecting the public funds it manages. To do this we may use the information we hold about you to detect and prevent crime or fraud. We may also share this information with other bodies that inspect and manage public funds. We may also share your personal information due to:

Our obligations to comply with current legislation
Our duty to comply with any Court Order which may be imposed.

Any disclosures of personal data are always made on case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place. Information is only shared with those agencies and bodies who have a “need to know” or where you have consented to the disclosure of your personal data to such persons.

We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation or other legal basis for disclosure .

We may obtain and share personal data with a variety of other bodies, which may include:

Her Majesty’s Revenue and Customs (HMRC)
Disclosure and Barring Service
Home Office
Child Support Agency
Internal Audit, service currently provided by Deloitte LLP
NHS Counter Fraud Authority
Department of Health
Central government, government agencies and departments
Other local authorities and public bodies
Ombudsman and other regulatory authorities
Courts/Prisons
Financial institutes for e.g. banks and building societies for approved mortgage references
Credit Reference Agencies
Utility providers
Educational, training and academic bodies
Law enforcement agencies including the Police, the Serious Organised Crime Agency
Emergency services for e.g. The Fire and Rescue Service
Auditors e.g. Audit Commissioner
Department for Work and Pensions (DWP)
The Assets Recovery Agency
Relatives or guardians of an employee where there is a legal duty to do so.

What if the data you hold about me is incorrect?

It is important that the information which we hold about you is up to date. If you believe that the information we hold is incorrect, in the first instance please check if the information can be updated on ESR through the Employee Self Service portal. Guidance is available on our internal intranet (nhsengland.sharepoint.com/TeamCentre/TCO/People/Pages/Workforce.aspx).

If you are unable to make the change in ESR then please let us know by contacting your line manager and/or the Workforce Systems team on [email protected].

Legal basis for processing

For entering into and managing contracts with the individuals concerned, for example our employees the legal basis is Article 6(1)(b) – ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

Where we have a specific legal obligation that requires the processing of personal data, the legal basis is Article 6(1)(c) – ‘processing is necessary for compliance with a legal obligation to which the controller is subject’.

For other processing of personal data about our employees, our legal basis is Article 6(1)(e) – ‘…exercise of official authority…’.

For the additional processing of personal data about our employees in relation to the FPPT, our processing is for the purposes of our legitimate interests. Further details around the FPPT can be found on our website and the significance of the information required which also helps align NHS England with other NHS bodies captured by the FPPT under Regulation 5 of the Health and Social Care Act 2008 (Regulated Activities) Regulations 2018.

Where we process special categories data for employment purposes the condition is: Article 9(2)(b) – ‘…processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’.

Additionally, under our obligations as an employer and public authority, in relation to the FPPT; special category data is processed under Article 9(2)(g) – ‘processing is necessary for reasons of substantial public interest…’

For the processing of information about the health of our workforce, the legal basis is: Article 9(2)(h) – ‘ …processing is necessary for the purposes of preventive or occupational medicine…assessment of the working capacity of the employee…the provision of health or social care…’.

How the NHS and care services use your information: the National Data Opt-Out

Find out about how your information may be used for purposes beyond your individual care and how to register your choice to opt out.

NHS England is one of many organisations working in the health and care system to improve care for patients and the public.

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services.

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt-out your confidential patient information will still be used to support your individual care.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this web page you will:

See what is meant by confidential patient information
Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
Find out more about the benefits of sharing data
Understand more about who uses the data
Find out how your data is protected
Be able to access the system to view, set or change your opt-out setting
Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
See the situations where the opt-out will not apply.

You can also find out more about how patient information is used at:

NHS Health Research Authority (which covers health and care research); and
Understanding Patient Data (which covers how and why patient information is used, the safeguards and how decisions are made).

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

The mandatory implementation of the National Data Opt-Out (NDOO), deadline of 31 March 2022, has been extended until 31 July 2022. We do not intend to extend implementation of the deadline any further.

As set out in the Operational Policy Guidance, the opt-out applies to the disclosure of confidential patient information for purposes beyond an individual’s direct care across the health and care system in England, unless an exemption has been granted.

Organisations will be expected to take note of this new deadline and ensure they are taking the relevant steps to prepare to implement the opt-out by this date,

The following processing for which NHS England is a data controller, are exempt from the national data opt-out:

Collection of personal data is required under s. 259 of the Health and Social Care Act 2012 following a Direction from NHS England or the Secretary of State. Information about the collections we have directed can be found on our website.
Collection of confidential patient information about people with learning disabilities and/or autism who are in hospital for mental and/or behavioural healthcare reasons which is disclosed under the following approval under the Control of Patient Information Regulations 2002: Assuring Transformation: Enhanced Quality Assurance Process Data flow (CAG 8-02 (a-c)/2014). These flows continue to operate a separate opt-out mechanism and details of how to opt-out of the Assuring Transformation data collection can be found on the NHS England webpages. This exemption is time limited until the end of the “Building the Right Support Programme”. The validation of invoices for non-contracted activities commissioned by NHS England or CCGs and for contract challenges where commissioners need to verify payment requests from care providers.
The NHS England National Cancer Patient Experience Survey, the Under 16 Cancer Patient Experience Survey, and the National Diabetes Experience Survey. These national surveys will continue to operate separate opt-out mechanisms and details of how to opt-out of these surveys are provided by the relevant organisations undertaking the surveys.

NHS England, NHS Digital and Health Education England merger

In November 2021 the then Secretary of State for Health and Social Care set out their intention to merge Health Education England with NHS England, and also accepted a recommendation from the Chair of NHS Digital to merge NHS Digital and NHSX with NHS England with an expected legal merger date of 1st April 2023.

To prepare for the merger with NHS England and Health Education England, personal data about our staff will need to be shared with the other organisations involved in the merger.

Purposes for processing

Organisational design work – to design the future shape and structure of the new NHS England.
Communications and engagement – your work email addresses will be shared so that you can receive important communications about the merger, including invitations to All Colleague Briefings.
Consultations – to meet legal requirements for staff consultation
Equality Impact Analysis – to conduct Equality Impact Analysis, only aggregate anonymous data related to protected characteristics will be used for this purpose. Small numbers will be suppressed so that no individual can be identified from this data.
Access to ICT systems – your work email address will be used to provide you with guest access to NHS England’s systems such as the Expressions of Interest (EIO) system to apply for vacancies, and the Creating the New NHS England Microsite to access key information and resources relating to the merger.
Provision of voluntary redundancy schemes – staff NHS employment history, length of service and salary information will be used as a resource for the provision of voluntary redundancy schemes.

Sources of data

All data originates from Health Education England, NHS Digital and NHS England.

Categories of personal data and recipients

The following categories of personal data will be shared from your Electronic Staff Record (ESR):

your contact information (eg your first name, surname, work email address)
your employment information (eg your employment number, assignment number, job title, office location, start date, contracted hours, details of previous NHS service)
your grade and salary information (eg your pay grade, salary, spinal value, pay step date)

In order to carry out equality impact analysis, in accordance with the Equality Act 2010, we will be sharing anonymous and aggregated information about our employees’ protected characteristics. Those characteristics include colleagues’ age, pregnancy and maternity, marriage and civil partnership, disability, race, religion or belief, sex and sexual orientation. This information will only be shared in an anonymous and aggregated form so none of our colleagues will be identifiable from the information which is shared. From the anonymous data small numbers, which relate to a small number of individuals, will be suppressed.

Your personal data will be shared with a limited number of individuals in NHS England, Health Education England and NHS Digital who require access to identifiable data to perform their role relating to the merger. Where the task they are performing does not require access to identifiable data, only access to aggregate anonymous data will be provided.

Personal data will be stored within the Foundry platform (Palantir acting as data processor) for the provision of the above purposes.

NHS England has also instructed the following organisations: KPMG, PA Consulting and McKinsey & Company, who will be acting as data processors to NHS England for this purpose, to provide support and assistance to the activities which are required to facilitate the merger. These organisations will only be given access to personal data which they require to complete the tasks assigned to them by NHS England. They cannot use the data they have been given access to for any other purposes.

Legal basis for processing

Under the UK General Data Protection Regulation (UK GDPR) our legal basis to share data from your ESR record is:

Contract – Article 6(1)(b) of UK GDPR in relation to your contract of employment
Legal obligation – Article 6(1)(c) of UK GDPR in relation to the Equality Act 2010, execution of the Public Sector Equality Duty and legal requirements for consultation
Public task – Article 6(1)(e) of UK GDPR in relation to carrying out the required activities and tasks needed to merge the three organisations to create the new NHS England.

We also need an additional legal basis in the UK GDPR and the Data Protection Act 2018 (DPA 2018) to use data which is particularly sensitive. NHS Digital will need to process sensitive data about employees’ protected characteristics to transform that data into aggregate and anonymous data before it is shared with NHS England and Health Education England for the purposes of equality impact analysis. Our legal basis to handle this sensitive data to make it anonymous is:

Employment purposes – Article 9(2)(b) of UK GDPR, plus Schedule 1, Part 1, Paragraph 1 “Employment, social security and social protection” of DPA 2018

Substantial public interest – Article 9(2)(g) of UK GDPR, plus Schedule 1, Part 2, Paragraph 8 “Equality of opportunity or treatment” of DPA 2018

NHS Federated Data Platform privacy notice

This privacy notice provides information about the processing of personal data in the NHS Federated Data Platform (FDP).

For more information about the FDP, please see the dedicated webpages about FDP and the frequently asked questions.

This privacy notice provides answers to the following questions about the processing of personal data in the FDP:

1. What is the NHS Federated Data Platform (“FDP”)?

Data is a core part of how the NHS delivers care, it’s at the heart of transforming services and improving outcomes for patients; using it well saves lives.

The NHS Long Term Plan highlights the importance of technology in the future NHS; setting out the critical priorities that will support digital transformation and provide a step change in the way the NHS cares for citizens.

People, data and technology are crucial to the ongoing evolution of the NHS. Working together in these key areas will support and enable local NHS organisations to:

work in more efficient ways,
improve diagnosis and treatment,
improve services.

A key enabler for this is the roll-out of the NHS Federated Data Platform.

The NHS uses data every day to manage patient care and plan services. Historically, it’s been held in different systems that don’t always speak to each other, creating burden for staff and delays to patient care. The Federated Data Platform is a solution to that problem. The FDP brings data together from existing IT systems to enable staff in an NHS organisation to access the information that their own IT systems already hold in a single, safe and secure place.

The NHS Federated Data Platform

The NHS Federated Data Platform is made up of a number of separate independent data platforms, each of which is called an “Instance” alongside transparency and privacy enhancing technology, which is called “PET”. Together, we call the different Instances and PET the “FDP” in this Privacy Notice.

Some Instances are operated by NHS England and are called “National Instances”. There are also separate Instances which are operated by an NHS trust or an integrated care board in a local area, which we call “Local Instances”.

We call each of these organisations “User Organisations” in this privacy notice.

Privacy Enhancing Technology or PET

The National and Local Instances work alongside PET. PET is transparency and privacy enhancing technology which has two functions:

Registering data flows – PET creates records of the types and uses of data which are used in every Instance of FDP. We call this “registering” the data. PET does not process the Personal Data to do this. From March 2024 when the FDP starts to be rolled out, PET will be integrated into all Instances and will register all data being used in the FDP.
Treating Personal Data – PET can also be used to de-identify Personal Data. This involves processing Personal Data. PET will not initially process Personal Data to de-identify it. This will however start to be done in phases from Summer 2024.

Products

Each Instance of the FDP uses the same underlying technology and software and has the same basic technical functionality. However, the FDP uses the technology, software and functionality in different ways for different purposes in specific “Products”.

Some Products are only designed to be used in the National Instances, some are only designed for the Local Instances, and some are designed to be used in both types of Instance.

A Product is a software solution for a particular NHS need. Each Product will process only the data which is the minimum necessary to meet that NHS need. Most Products that will be used in Local Instances will be designed to help clinicians to provide care and treatment to their patients. This means that information that identifies their patients who are receiving care and treatment will be used in the Local Instances.

Most Products that will be used in the National Instances will be designed to help NHS England, NHS Trusts and Integrated Care Boards to understand how the NHS is operating and to plan and manage how they deliver healthcare services safely and effectively. Where a Product that is used in the National Instances is also to be used by an NHS Trust or Integrated Care Board, then it will also be available in their Local Instance. Most Products in the National Instances will only need to use data that does not identify individuals, because NHS England doesn’t usually need data that identifies specific patients to help plan, commission and manage health care.

Although each Instance of the FDP is separate from other Instances, where it is agreed that data can be shared across Instances, the Products used in FDP can provide a safe and secure way to share relevant information. This is known as federation.

Sharing data across Instances will only happen within a Product where this is necessary for organisations to work together to provide care directly to patients or to manage and plan how care is delivered to patients. Data will only ever be shared where it is allowed under data protection laws. There is more about how data is shared in Section 7 below.

2. When will the FDP start being used?

The FDP is being rolled out to User Organisations in implementation Phases.

Transition Phase: March 2024 – May 2024

The first Phase is the “Transition Phase”, which involves NHS England, NHS Trusts and Integrated Care Boards who currently use Products, moving their existing Products onto the new version of the software that is in FDP. There is no change to the data that is being processed, the purposes for which it is processed or the User Organisations who are processing the data during the Transition Phase.

The Transition Phase will start in March 2024 and is expected to run until May 2024. It will consist of 5 Waves, starting with Wave 0 and finishing with Wave 4. Each Wave will consist of a number of existing User Organisations and existing Products which will transition to FDP. This is organised in Waves to manage the transition process.

Delivery Phase: May 2024 – March 2027

The Delivery Phase is expected to start in May 2024 and run through to March 2027. Following a successful transition of existing User Organisations and Products to FDP, FDP will be rolled out more widely in the NHS. This will involve rolling out:

Existing local Products to new User Organisations in Waves.
The use of PET to process Personal Data to de-identify it and to replace legacy NHS de-identification solutions.
- PET will be used to support Products which require Personal Data to be de-identified for them to be used for the purpose of the Product. This will apply to National Products. Currently there are no Local Products which require Personal Data to be de-identified for them to be used.
- This will be a staged process and is expected to commence from summer 2024 and continue until 2026.
New Products to User Organisations

During the implementation of FDP, this Privacy Notice and the Product Privacy Notices will be regularly updated to list the Products and User Organisations who are using FDP and also when PET starts to process Personal Data.

3. What type of data is processed in the FDP?

Types of data

Data means items of information. There are two main types of data that are processed in the FDP:

1. Personal Data

Personal Data is defined in data protection law and is information relating to a living individual that can directly or indirectly identify them. Personal Data can be either:

Directly Identifiable Data – this is Personal Data that can directly identify an individual, for example, a name.
De-Identified Data – this is Personal Data that has been de-identified, so that an individual can no longer be directly or indirectly identified in the data, but where the organisation holding the data does still have the means to identify the individual.

Individuals have a number of rights under data protection law in relation to their Personal Data. Please see Section 11 below.

Categories of Personal Data

Personal Data that is processed in the FDP will include information that identifies an individual, including basic information about such as a name, address, date of birth and contact details, and information about the individual’s health and treatment.

The items of Personal Data that may be processed vary depending on the Product and the purposes for which they are being processed. Each Product will process only the data which is the minimum necessary to meet the NHS need. There is more information about the categories of information that may be processed.

Personal Data will only be processed in FDP where it is strictly necessary for the specific purpose it is being used for. NHS staff who are using FDP are subject to strict confidentiality rules and FDP will only allow them to see the items of Personal Data which they need to see for the purposes for which they are using the data. Where they don’t need to know who an individual is, FDP will restrict their access to De-Identified Data or Anonymous Data (which is defined in the section below).

Each organisation using FDP will decide which members of staff can see specific types of information in line with data protection requirements, by using access control rules that are implemented within the FDP to strictly minimise access to only data that is necessary for a particular purpose.

2. Anonymous Data

This is data that does not relate directly to individuals. It can be either:

Anonymised Data – this is data which may have been Personal Data, but that has been de-identified so it no longer directly or indirectly identifies an individual. Data is anonymous when it is not reasonably possible for the organisation or the person using the data to re-identify the individual.
Aggregated Data and Operational Data – this is data that does not relate directly or indirectly to specific individuals.

For example, statistics about groups of individuals where no one can identify any specific individuals from the statistics eg, numbers describing the stocks of medicine, or the number of beds in a hospital.

Data protection law does not apply to Anonymous Data.

The type of data and categories of Personal Data that are processed in FDP vary in relation to each Product used on FDP. More information about each Product and the data that is processed in them is available in Section 5 below.

4. Who is responsible for processing data in the FDP?

NHS England, and a number of NHS Trusts and Integrated Care Boards, are using the FDP and each has their own data protection responsibilities for the data they process in FDP. Each of these organisations is a User Organisation.

What are the responsibilities of User Organisations under data protection law?

Under data protection law, each User Organisation is the ‘Controller’ for the Personal Data it processes in its Instance. As a Controller, each User Organisation makes decisions about how to use the FDP, which Products it wants to use in its own Instance, and what Personal Data it needs to put into the FDP, to use those Products.

NHS England is the Controller for the Personal Data which is processed within the National Instances.

Each NHS Trust or Integrated Care Board is the Controller of the Personal Data which is processed within its Local Instances.

NHS England, and each NHS Trust or Integrated Care Board, are also joint Controllers for some aspects of how the FDP operates. There is more about this here: NHS England » Joint controllers

5. What are the purposes for processing Personal Data in the FDP?

At present, all User Organisations have agreed only to use FDP for purposes that fall within five broad NHS priority purposes, which we call “Use Cases”. All Products which are used by the FDP therefore must also fall within one of these Use Cases. The five current Use Cases are:

Population Health and Person Insight – to help integrated care systems proactively plan services that meet the needs of their population
Vaccination and Immunisation – to continue to support the vaccination and immunisation of vulnerable people whilst ensuring fair and equal access and uptake across different communities
Elective Recovery – to address the backlog of people waiting for appointments or treatments which has resulted from the COVID-19 pandemic alongside Winter pressures on the NHS
Care Coordination – to enable the effective coordination of care between local health and care organisations and services, reducing the number of long stays in hospital
Supply Chain – to help the NHS put resources where they are need most and buy smarter so that we get the best value for money
Population Health and Person Insight – to help integrated care systems proactively plan services that meet the needs of their population

In future User Organisations may agree that FDP can be used to meet other Use Cases. NHS England has agreed to consult with patient groups and other organisations, including the National Data Guardian and the Information Commissioner’s Office, before any other Use Cases are agreed.

For example, one of the Products which will be used by NHS Trusts in Local Instances of the data platform from Wave 1 is called The Optimised Patient Tracking and Intelligent Choices Application (OPTICA).

The Product is integrated with a hospital’s electronic patient records and, combined with other local health and social care data systems, ensures that relevant information related to patient discharges is available to clinical teams and leaders, in one place, as a single version of the truth.

This is a Product that tracks all admitted patients and the tasks and blockages relating to their discharge in real-time through their hospital journey. The Product is helping ensure that patients who no longer need to be in hospital can go home, or into appropriate community services with relevant support, as quickly as possible.

This Product falls within the Care Co-ordination Use Case.

There is a video which provides more information about the benefits of using this Product for patients and staff.

6. Where does the data processed in the FDP come from?

The Personal Data processed in the FDP is Personal Data that is already held in local IT systems or is shared back with local IT systems and is processed by each User Organisation in accordance with data protection laws.

In the case of NHS Trusts, the Personal Data that is brought into the FDP will be Personal Data taken from other hospital systems, such as theatre scheduling systems and electronic patient record systems. In some cases, the Product will generate some new information, for example a hospital discharge summary, and that information will be shared back into the electronic patient record system by the local NHS Trust.

In the case of NHS England, the Personal Data processed in the FDP will be Personal Data that NHS England has already collected from NHS Trusts and currently processes in other NHS England data platforms, including the COVID-19 data platform.

7. Who has access to the data in the FDP?

Staff in a User Organisation

Staff who work for a User Organisation will only have access to the data in the FDP that they need to perform their specific job. In Local Instances, this will include doctors, nurses, administration staff supporting them, and administration staff and managers running the hospital.

Staff in other organisations

So that a hospital can provide you with the best care, it may need to share data about you that is processed in the FDP with other organisations. NHS England may also want to share Aggregated Data with your hospital or local Integrated Care Board to help them to plan and manage care they provide to their patients.

Any Personal Data that is shared with other organisations will be the minimum amount necessary. Individuals will only be identified if this is necessary for the purposes for which it is shared. For example, in a Product used in a Local Instance information about an individual may need to be shared with another organisation for the purposes of the individual’s care. Personal Data can only ever be shared if there are legal grounds under the data protection laws that allow this.

Where possible, if data needs to be shared, this will be done within the FDP. Data will be shared with other User Organisations through the FDP by providing members of staff from other User Organisations with access to the data across Instances of the FDP.

For some Products, including in the National Instances, dashboards are produced which may be viewed by other organisations, including NHS Trusts and the Department for Health and Social Care, who are not User Organisations. Providing access to these dashboards through FDP will help keep the data secure.

In some cases, data may need to be shared outside of FDP. If this happens, logs of the data sharing will be kept by the FDP. These logs will register who the data was shared with and for what purposes. Only certain authorised users in a User Organisation will be able to approve data sharing with other organisations.

If the data is not being shared for individual care, and is Personal Data or Confidential Data, the User Organisations will only share data or provide access to view it, where there is a data sharing agreement in place.

Information about how data is kept secure in FDP, and when it is shared, is in Section 8 below.

Processors – FDP Contractors

There are two companies that together provide the software for the FDP and who operate and maintain this software for each User Organisation. NHS England appointed these two companies following a public procurement. Together we call these companies the “FDP Contractors”.

They are:

Data Platform – Palantir Technologies UK, LTD.
PET – IQVIA LTD.

The FDP Contractors only process Personal Data in the FDP where it is necessary for them to operate and maintain the FDP (which we call “FDP Services”) for User Organisations. Under data protection law they are called “Processors”. This means that they can only process Personal Data on behalf of a User Organisation and for the purposes of providing these FDP Services. They must only act on the written instructions of the User Organisation. These written instructions are given under a data processing agreement between the FDP Contractor and each User Organisation for each Product that a User Organisation chooses to use.

If a Processor breaches the terms of its data processing agreement, or processes Personal Data outside of the instructions given by a Controller, this may breach data protection laws. This may lead to the Information Commissioner taking regulatory action, including issuing a fine to a Processor who has broken the law.

The FDP Contractors are not allowed to appoint other contractors (“Sub-processors”) to work for them to process Personal Data to provide the FDP Services unless those Sub-processors have first been approved by User Organisations. A list of Sub-Processors that have been approved by User Organisations is here: NHS England » Sub-processors

The FDP Contractors and their Sub-processors are not allowed to use any Personal Data in the FDP for their own purposes, except some limited data, such as contact details, concerning User Organisation’s staff which they need to provide the FDP Services.

8. How is data protected in the FDP?

The FDP has been developed with privacy at the centre of its design, ensuring that the protection and privacy of Personal Data has been considered through the design of FPD, into the implementation of the Products and in relation to the governance approach to using FPD.

Data is protected in a number of ways including:

Separation of Control – The FDP is designed to work as separate Instances controlled by each User Organisation. Governance and technical controls are in place to ensure that no individual organisation or user has access to all data. NHS user roles are separated to ensure no individual has access to all data.
Separation of the Data Platform from PET – PET is provided by a separate contractor from the supplier of the data platform. This means that where only De-Identified Data is needed for a particular Product, no Directly Identifiable Data needs to be shared into an Instance. It will be processed by the PET Contractor to remove identifiers before it is shared into the Instance. This service is expected to start from Summer 2024.
Role based access controls – NHS user roles are defined and separated to ensure that staff are only able to access data they need to do their work.
Staff training – All staff are required to complete mandatory data protection and security training in the NHS. In addition, staff will undergo training in the use of each Product, ensuring data is used appropriately and securely.
Data minimisation – The FDP will only process the minimum data that is necessary for the purposes of a Product. This is assessed as part of a Data Protection Impact Assessment (DPIA) which is required under data protection laws where Personal Data is processed within FDP and is carried out as part of a User Organisation deciding to use a Product.
Transparency of data access and use – PET will create records of all data entering and leaving the platform and its approved purposes of use.
Audit Logs – All access and use of data in the FDP will be logged so that User Organisations can audit and review who has accessed what data in their Instance.
User authentication – All user access to the FDP must be authenticated using multi-factor authentication.
Technical Security – All data stored in the FDP will be protected via industry good practice layers of protection, including encryption of data stored in FDP and in transit (when it comes to FPD and leaves FDP), regular penetration testing, firewalls, anti-virus and intrusion protection.
Security Monitoring – Cyber and security threats in FDP will be monitored by the FDP Contractors and by NHS England’s Cyber Security Operations Centre.
Privacy Treatment – PET will provide tools to de-identify Personal Data where Personal Data needs to be de-identified before it is used in a Product.

9. How long will the data in the FDP be kept for?

Data will be kept in the FDP for as long as it is necessary for a User Organisation to process it. This will depend on the Product the data is used in and the purposes for which the data is processed. The processing of all Personal Data, including the periods of time that data is kept, will be in accordance with the NHS Records Management Code of Practice 2021.

10. Where is data held in the FDP stored?

All data held in the FDP is securely stored on servers in the United Kingdom (UK).

11. What are my data protection rights in relation to Personal Data processed in the FDP?

Under data protection law, you have the following rights over your Personal Data:

Your right to be informed about how your Personal Data is used– You have the right to be told how and why a User Organisation is processing your Personal Data. This Privacy Notice has been published to explain how your Personal Data is being processed by all User Organisations. (“Right to be informed”)
Your right to get copies of your Personal Data – You have the right to ask a User Organisation that is processing your Personal Data in FDP for copies of your Personal Data (called a “Right of access”).
Your right to get your Personal Data corrected – You have the right to ask a User Organisation that is processing your Personal Data in FDP to correct (“Right to rectify”) your Personal Data if you think it is inaccurate or incomplete.
Your right to get your Personal Data deleted – You have a right to ask a User Organisation that is processing your Personal Data in FDP to delete (“Right to erase”) your Personal Data in certain circumstances.
Your right to restrict how your Personal Data is used – You have the right to ask a User Organisation that is processing your Personal Data in FDP to limit the way they use it (restrict processing) in certain circumstances (“Right to restrict”).
Your right to object to how your Personal Data is used – You have the right to object to a User Organisation about how your Personal Data is used in FDP in certain circumstances (“Right to object“).
Your right of data portability – You have the right to ask a User Organisation that is processing your Personal Data in FDP to transfer your Personal Data to another organisation or give it to you in certain very limited circumstances (“Right of data portability”).
Your right to not have ‘automated’ decisions made about you by a User Organisation, including profiling – You have the right not to have automated decisions made about you, including profiling, if the decision affects your legal rights or it has other significant effects on you.

To exercise your data protection rights, you should contact the Data Protection Officer for the User Organisation who is processing your Personal Data. A list of Data Protection Officer contact details for all FDP User Organisations is here.

You can find out which specific data protection rights apply in relation to Personal Data processed in each Product in the Product Privacy Notices.

12. What are the legal grounds to process Personal Data in the FDP under data protection law?

User Organisations must have legal grounds under data protection law before they can use your data in FDP.

The Privacy Notices for each Product provide specific information about the legal grounds that apply to the processing of data in each Product which you can access here: NHS England » FDP products and product privacy notices

Personal Data

In general, User Organisations will rely on one or more of the following legal grounds to process Personal Data in the FDP under data protection law:

Legal obligation – Article 6(1)(c) of UK GDPR.
Public task – Article 6(1)(e) of UK GDPR

Special Category Personal Data

User Organisations also need an additional legal ground to process special categories of Personal Data under data protection laws. “Special Category Data” is:

Personal Data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership,
the processing of genetic data,
biometric data for the purpose of uniquely identifying a natural person,
data concerning health, or
data concerning an individual’s sex life or sexual orientation.

The legal grounds for processing Special Category Data under data protection law include:

Substantial public interest – Article 9(2)(g) of UK GDPR, plus Schedule 1, Part 2, Paragraph 6 “statutory etc and government purposes” of the Data Protection Act 2018 (“DPA 2018”)
Health or social care – Article 9(2)(h) of UK GDPR, plus Schedule 1, Part 1, Paragraph 2 “Health or social care purposes” of DPA 2018
Public health – Article 9(2)(i) of UK GDPR, plus Schedule 1, Part 1, Paragraph 3 “Public health” of DPA 2018
Statistical purposes – Article 9(2)(j) of UK GDPR, plus Schedule 1, Part 1, Paragraph 4 “Research etc” of DPA 2018

Confidential Data

Personal information about an individual which has been provided in circumstances of confidence is called “Confidential Data”. This includes information that directly or indirectly identifies an individual and information about the health care and treatment of an identifiable individual. Additional rules apply when Confidential Data is processed by a User Organisation in the FDP and additional legal grounds will apply. More information about these rules and the legal grounds is here: NHS England » Legal grounds for processing confidential data

13. Do Opt-outs apply to data processed in the FDP?

Type 1 opt-outs – Do not currently apply to Products used in the FDP

A Type 1 opt-out registered with a GP Practice prevents an individual’s confidential patient information from being shared outside of their GP Practice except when it is being used for the purposes of their individual care.

Type 1 opt-outs do not apply to data processed in the FDP because:

No confidential patient information that has come from a GP Practice is being processed by a Product in the National Instances of FDP.
Confidential patient information that has come from a GP Practice which is being used in the FDP in a Product in a Local Instance is only being used for the purposes of individual care.

If this changes in the future because a new Product processes confidential patient information in a way which would mean that the Type 1 opt-out would apply, the relevant User Organisation would be responsible for ensuring that the Type 1 opt-out was applied and this Privacy Notice will be updated to make this clear.

National Data Opt-Out – Does not currently apply to Products used in the FDP

The National Data Opt-Out provides an individual with a right to opt out of their confidential patient information being used for purposes beyond their direct care, unless an exemption applies. More information about exemptions is available here: https://www.nhs.uk/your-nhs-data-matters/where-your-choice-does-not-apply/

The National Data Opt-Out does not apply to data processed in the FDP because:

National Instances – No confidential patient information is being processed by a Product in the National Instances of FDP to which the National Data Opt-Out would apply.
Local Instances – Confidential patient information that is being used in the FDP in a Product in a Local Instance is only being used for the purposes of direct care and therefore the National Data Opt-Out does not apply.

More information about why the National Data Opt-Out does not apply is set out in each Product Privacy Notice.

You can find out more about and register a National Data Opt-Out or change your choice on nhs.uk/your-nhs-data-matters

Local opt-outs

NHS Trusts and Integrated Care Boards may have provided their patients with the right to opt out of their Confidential Data or Personal Data being used for specific purposes within their local area, eg within local shared patient record systems, for particular purposes.

More information about those local rights to opt-out will be provided in the relevant NHS Trust or Integrated Care Board Privacy Notices, which should be available on their websites. It is the responsibility of the NHS Trust and Integrated Care Board to ensure that local opt-outs are implemented within the data that is shared into and processed in FDP where they apply.

14. Questions, feedback, concerns and your right to make a complaint

A lot of information is published about FDP on the NHS England website.

If you have any questions about the FDP that you can’t find the answer to on the website, or you want to leave feedback about any aspect of FDP, or you would like to register to take part in future FDP engagement activity, you can do this through the FDP Engagement Portal.

If you have any concerns about how a User Organisation is using your Personal Data, please contact its data protection officer. Details for each User Organisation’s data protection officer is here: NHS England » FDP User Organisations data protection officer

If you are not happy with the response from the data protection officer, you have the right to make a complaint about how your Personal Data is being used in the FDP to the Information Commissioner’s Office (“ICO”). You can do this by:

calling 0303 123 1113
using the ICO website: ico.org.uk/make-a-complaint/
writing to:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow
Cheshire, SK9 5AF

15. Changes to this Privacy Notice

We will make changes to this notice to reflect the roll out of the FDP across the NHS and as new Products are made available through FDP. When we do, the ‘last edited’ date on this page will also change. Any changes to this notice will apply immediately from the date of any change.

Last edited 12.16 25 March 2024

How to access your personal information

How to make a request for personal data that we hold about you and how to make a request about your other data protection rights.

Medical records

Find out how to get a copy of your medical records

Information held by NHS England

Requests may be made in writing, by email, or by speaking to us – see NHS England » NHS England as a data controller.

All requests will be recorded, and you may need to provide information to verify your identity and enable us to locate the information. Please provide:

Full name, address, date of birth, NHS number (requests for health records only)
An indication of what information you are requesting to enable us to locate this in an efficient manner.

Examples of acceptable identity evidence are listed below. We require, where applicable, two items from List A and one from List B.

List A: ID documents, examples are:

Birth certificate
Passport
Driving license
Staff ID badge (for NHS England employees only)

List B: Proof of address, examples are:

Bank statement
Utility bill
Tax certificate

How the NHS and care services use your information: the National Data Opt-Out

Find out about how your information may be used for purposes beyond your individual care and how to register your choice to opt out.

Find out about how your information may be used for purposes beyond your individual care and how to register your choice to opt out.

NHS England is one of many organisations working in the health and care system to improve care for patients and the public.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this web page you will:

See what is meant by confidential patient information
Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
Find out more about the benefits of sharing data
Understand more about who uses the data
Find out how your data is protected
Be able to access the system to view, set or change your opt-out setting
Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
See the situations where the opt-out will not apply.

You can also find out more about how patient information is used at:

NHS Health Research Authority (which covers health and care research); and
Understanding Patient Data (which covers how and why patient information is used, the safeguards and how decisions are made).

You can change your mind about your choice at any time.

Organisations will be expected to take note of this new deadline and ensure they are taking the relevant steps to prepare to implement the opt-out by this date,

The following processing for which NHS England is a data controller, are exempt from the national data opt-out:

Collection of personal data is required under s. 259 of the Health and Social Care Act 2012 following a Direction from NHS England or the Secretary of State. Information about the collections we have directed can be found on our website.
Collection of confidential patient information about people with learning disabilities and/or autism who are in hospital for mental and/or behavioural healthcare reasons which is disclosed under the following approval under the Control of Patient Information Regulations 2002: Assuring Transformation: Enhanced Quality Assurance Process Data flow (CAG 8-02 (a-c)/2014). These flows continue to operate a separate opt-out mechanism and details of how to opt-out of the Assuring Transformation data collection can be found on the NHS England webpages. This exemption is time limited until the end of the “Building the Right Support Programme”. The validation of invoices for non-contracted activities commissioned by NHS England or CCGs and for contract challenges where commissioners need to verify payment requests from care providers.
The NHS England National Cancer Patient Experience Survey, the Under 16 Cancer Patient Experience Survey, and the National Diabetes Experience Survey. These national surveys will continue to operate separate opt-out mechanisms and details of how to opt-out of these surveys are provided by the relevant organisations undertaking the surveys.

Former NHS Improvement functions

Information about the transfer of functions from Monitor and the NHS Trust Development Authority to NHS England.

Information about the transfer of functions from Monitor and the NHS Trust Development Authority to NHS England.

The 2022 Health and Care Act introduced new legislative measures that aim to make it easier for health and care organisations to deliver joined-up care for people who rely on multiple different services, building on earlier recommendations by NHS England and NHS Improvement.

The Health and Care Act 2022 created a single NHS organisation comprising what was previously Monitor and NHS Trust Development Authority (TDA), known as NHS Improvement. As of 1 July 2022, a number of the processes and functions formerly undertaken by Monitor and the NHS Trust Development Authority are transferred to NHS England.

We have set out below a description of all the ways we process your personal data for those processes and functions transferred to NHS England, and the legal bases we rely on to do so.

Ambulance Service records

Purposes for processing

To securely store ambulance service records which are unable to be repatriated due to closure of the service.

Type of data

(a) Identity (b) Contact (c) Special categories.

Lawful basis for processing including basis of legitimate interest

Necessary for our legitimate interests to ensure secure storage of unrepatriated ambulance service records. Necessary for reasons of substantial public interest.

Recruitment for NHS trusts and charities

Purposes for processing

To recruit, appoint, appraise and develop executives, chairs and non-executive directors to NHS trusts and trustees to NHS charities, and support NHS foundation trusts in recruiting executives, chairs and non-executive directors.

Type of data

(a) Identity (b) Contact (c) Special Categories (d) Other personal data related to recruitment.

Lawful basis for processing including basis of legitimate interest

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Necessary for the management of health or social care systems and services – health and social care purposes.

Capacity, capability and diversity monitoring

Purposes for processing

To improve the leadership of NHS trust and foundation trust boards by monitoring their capacity, capability and diversity.

Type of data

(a) Identity (b) Contact (c) Special Categories.

Lawful basis for processing including basis of legitimate interest

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Necessary for our legitimate interests to ensure diversity in recruitment.

Necessary for the management of health or social care systems and services — health and social care purposes.

Research programmes

Purposes for processing

To improve the leadership of NHS trust and foundation trust clinical staff through research programmes.

Type of data

(a) Identity (b) Contact.

Lawful basis for processing including basis of legitimate interest

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Compliance with NHS Provider Licence

Purposes for Processing

To monitor independent providers’ compliance with the NHS Provider Licence.

Type of data

(a) Identity (b) Contact.

Lawful basis for processing including basis of legitimate interest

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Applications for NHS Provider Licence

Purposes for processing

To process applications for the NHS providers’ licences and process requests for the revocation of an NHS provider licence.

Type of data

(a) Identity (b) Contact.

Lawful basis for processing including basis of legitimate interest

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Getting It Right First Time Programme

Purposes for processing

Information for Getting It Right First Time Programme.

Type of data

(a) Identity (b) Contact (c) Special Categories.

Lawful basis for processing including basis of legitimate interest

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Necessary for the management of health or social care systems and services – health and social care purposes.

NHS England Nurses’ Data

Type of data

(a) Contact.

Lawful basis for processing including basis of legitimate interest

Explicit consent.

Theatre Productivity Programme

Purposes for processing

Theatre productivity programme (clinician-level activity data).

Type of data

(a) Identity (b) Contact.

Lawful basis for processing including basis of legitimate interest

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Healthcare Safety Investigation Branch (HSIB)

Type of data

(a) Identity (b) Special Categories

Lawful basis for processing including basis of legitimate interest

Explicit consent.

Necessary for reasons for substantial public interest.

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Necessary for the management of health or social care systems and services — health and social care purpose.

National Clinical Improvement Programme

Purposes for processing

National Clinical Improvement Programme; to set up user accounts for consultants and create the database containing consultant level patient pseudonymised clinical activity data sourced from Hospital Episode Statistics (HES) provided by NHS Digital.

Type of data

(a) Identity (b) Contact (c) Special Categories.

Lawful basis for processing including basis of legitimate interest

Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in NHS England.

Necessary for delivering our statutory functions.

Necessary for the management of health or social care systems and services – health and social care purposes.

National Vaccination Programmes

How we use personal data to support the national COVID-19, Flu and MMR Vaccination Programmes.

How we use personal data to support the national vaccination programmes

NHS England has been given responsibility by the Secretary of State, for the delivery of a number of vaccination programmes provided by the NHS for England.

Information about the types of vaccinations that are available in the UK, those provided by the NHS and also when to have them can be found on nhs.uk.

NHS England is supported by a number of different agencies and other health organisations in order to deliver the different programmes.

This transparency notice provides information about the programmes where NHS England is providing a centralised national approach to:

the selection of citizens eligible for a particular vaccination
inviting eligible citizens for their vaccination
enabling citizens to book an appointment to receive their vaccine
monitoring and managing the delivery, efficacy and safety of immunisation programmes including adverse reactions to vaccines and medicines.

Purposes for which we process your data

NHS England will collect, process, and disseminate citizen data to:

Identify people who we are advised are eligible for a particular vaccination in line with the guidance provided by the Joint Committee on Vaccination and Immunisation (JCVI). Further details of their work can be found on gov.uk.
Send you national invitations where we feel that this will be of benefit to you and so we can support GP’s and other vaccination providers to contact you to tell you about any vaccination that you are eligible for.
Enable you to book your vaccination.
Send you reminders that encourage you to book a vaccination where they are needed.
Send your vaccination administration information to your GP so that your clinical records can be updated electronically, if you are registered to an English GP practice.
Ensure that you can access a vaccination at a suitable location and that there is vaccination available to give to you.
Check that people are receiving their vaccinations as we expect so that we can take measures to support our vaccination providers in areas of low uptake. In these cases, we do not need to know who you are, so we ask for the data to be altered so that your name and address is not visible to anyone apart from those responsible for your care.
Provide reports to support planning for the current and future vaccination programmes.
Support incorrect COVID-19 vaccination records to be corrected.
Ensure that systems used to record your vaccination are able to obtain and display a person’s relevant immunisation history to help clinicians administer your vaccination.
Enable you to view a full record of your vaccination history through your GP records or the NHS app.
Provide data to the UK Health Security Agency so that they can carry out their duties to protect the health of the population.
Provide data to the NHS Business Services Authority so that they can help us manage claims for payment from vaccination service providers and to ensure that any discrepancies are highlighted and dealt with appropriately.

The controller of your personal data

Under the UK General Data Protection Regulation 2016 (UK GDPR), NHS England is the controller of your personal data where we process it for national vaccination programme purposes. Our legal basis is set out in the table below:

Legal basis for all vaccination programmes	Processing condition
The processing is necessary for a task that is within our remit as a public authority.	UK GDPR Article 6(1) (e)
The processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services on the basis of domestic law	UK GDPR Article 9 (2) (h)
The processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats on the basis of domestic law	UK GDPR Article 9 (2) (i)
Health or social care purposes “Health or social care purposes” means the purposes of: (a) preventive or occupational medicine (b) the assessment of the working capacity of an employee (c) medical diagnosis (d) the provision of health care or treatment (e) the provision of social care (f) the management of health care systems or services or social care systems or services. Public health Processing is necessary for reasons of public interest in the area of public health and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.	Data Protection Act 2018, chapter 12, Schedule 1

Rationale and basis in domestic law

NHS Act 2006, Chapter 41, Part 1.

Section 2A:

(1) The Secretary of State must take such steps as the Secretary of State considers appropriate for the purpose of protecting the public in England from disease or other dangers to health.

(2) The steps that may be taken under subsection (1) include:

c. providing vaccination, immunisation or screening services.

Section 7A:

(1) The Secretary of State may arrange for any of the public health functions of the Secretary of State to be exercised by one or more relevant bodies.

(2) In this section “relevant body” includes:

(a) NHS England,

The annual NHS Public Health Functions agreement details how NHS England will exercise the NHS public health functions delegated by the Secretary of State; we refer to these as the ‘NHS public health functions’ provided under Section 7A or simply Section 7A services.

Processing of confidential patient information for the purposes of the national vaccination programmes under the Common Law Duty of Confidentiality

The Health Service (Control of Patient Information) Regulations 2002

Communicable disease and other risks to public health

3. (1) Subject to paragraphs (2) and (3) and regulation 7, confidential patient information may be processed with a view to (the purposes):

a. diagnosing communicable diseases and other risks to public health

b. recognising trends in such diseases and risks

c. controlling and preventing the spread of such diseases and risks

d. monitoring and managing:

(i) outbreaks of communicable disease

(ii) incidents of exposure to communicable disease

(iii) the delivery, efficacy and safety of immunisation programmes

(iv) adverse reactions to vaccines and medicines

(v) risks of infection acquired from food or the environment (including water supplies)

(vi) the giving of information to persons about the diagnosis of communicable disease and risks of acquiring such disease.

(2) For the purposes of this regulation, “processing” includes any operations, or set of operations which are undertaken for the purposes. These are (in addition to the use, disclosure or obtaining of information) any operations, or set of operations, which are undertaken in order to establish or maintain databases for the purposes, including:

a. the recording and holding of information

b. the retrieval, alignment and combination of information

c. the organisation, adaption or alteration of information

d. the blocking, erasure and destruction of information.

(3) The processing of confidential patient information for the purposes may be undertaken by:

a. the Public Health Laboratory Service

b. persons employed or engaged for the purposes of the health service

c. other persons employed or engaged by a government department or other public authority in communicable disease surveillance.

7. (1) Where a person is in possession of confidential patient information under these regulations, he shall not process that information more than is necessary to achieve the purposes for which he is permitted to process that information under these regulations and, in particular, he shall:

a. so far as it is practical to do so, remove from the information any particulars which identify the person to whom it relates which are not required for the purposes for which it is, or is to be, processed

b. not allow any person access to that information other than a person who, by virtue of his contract of employment or otherwise, is involved in processing the information for one or more of those purposes and is aware of the purpose or purposes for which the information may be processed

c. ensure that appropriate technical and organisational measures are taken to prevent unauthorised processing of that information

d. review at intervals not exceeding 12 months the need to process confidential patient information and the extent to which it is practicable to reduce the confidential patient information which is being processed

e. on request by any person or body, make available information on the steps taken to comply with these regulations.

(2) No person shall process confidential patient information under these Regulations unless he is a health professional or a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.

(3) For the purposes of paragraph (2) “health professional” has the same meaning as in section 69(1) of the Data Protection Act 1998(5).

COVID-19 only

To support the healthcare response to COVID-19, NHS England is directed under the COVID-19 Public Health Directions 2020, 17th March 2020 (as amended) [1] to:

establish information systems to collect and analyse data in connection with COVID-19; and
develop and operate IT systems to deliver services in connection with COVID-19.

[1] NHS England Directions – NHS Digital which updates the original direction in accordance with the Health and Social Care Information Centre (Transfer of Functions, Abolition and Transitional Provisions) Regulations 2023 (Transfer Regulations)

Where we are directed to process personal data for COVID-19 purposes, this is a legal obligation, and we are allowed to do this under Article 6 (1)(c) of UK GDPR.

We are also allowed to share your personal data under UK GDPR where it is necessary for us to do so for one of the COVID-19 purposes explained above.

Types of personal data we process (this will vary dependent on the vaccination programme)

	Programme
Data Item	COVID-19	Flu	Measles, Mumps and Rubella (MMR) vaccination	Human papilloma virus (HPV) vaccination	(this will be updated when additional vaccination programme data processing requirements are finalised)
NHS number	Yes	Yes	Yes	Yes
names	Yes	Yes	Yes	Yes
gender	Yes	Yes	Yes	Yes
date of birth	Yes	Yes	Yes	Yes
address	Yes	Yes	Yes	No
postcode	Yes	Yes	Yes	Yes
contact details such as an email address and mobile phone number	Yes	Yes	Yes	Yes
health related data in the form of condition codes held in central NHS records such as those held by your GP or a hospital where you have received healthcare	Yes	Yes	No	No
information about vaccinations received/refused/not given and details of any adverse reactions/doses/date/batch/type/body site/how administered/	Yes	Yes	Yes	Yes
if you are a carer	Yes	Yes	No	No
if you are a social care worker	Yes	Yes	No	No
if you are a Health care worker	Yes	Yes	No	No
if you are a care home worker or care home resident along with details of your care home	Yes	Yes	No	No
Ethnic category	Yes	Yes	No	No
Vaccination location (site code)	Yes	Yes	Yes	Yes
Consent to treatment information where we hold this a) the vaccination type requires this, b) due to the closure of a service or c) where the system holding the information in its original form is no longer available	Yes	Yes	No	Yes
Details of the person administering the vaccine including job role	No	No	No	Yes

How we obtain your personal data

Identifying citizens for eligibility for a vaccination is carried out using data we already collect or hold as the national safe haven for health and care data in England. More information is provided on NHS Digital’s website.

We also collect information about the vaccinations provided at the point of care; this data flows from the systems used to record when a vaccination is given so that we can ensure that we have up to date information about your vaccination history and also flow that data to those responsible for your health care, your GP.

How we process your data

Once it is agreed that a vaccination programme will be supported by a national invitation campaign or we need to process data in order to manage and monitor a vaccination programme, we use cohorting as a service to develop the cohorts that contain the data we need.

Where we decide to send a national vaccination invitation this is considered as contributing to your direct care. We will process your data through our Invitation Processing Service which will apply a number of business rules to the data so that we can prepare invitations using SMS text messages, emails, through the NHS App or where necessary, by letter. We use our Communications Management Service to undertake this part of the processing.

We will send information on who has been invited for a particular vaccination to our National Booking Service where the facility exists to use that system to book; this may not at present apply to all vaccinations.

If we are not intending to send invitations, we will send data directly to our processor, Arden and Gem Commissioning Support Unit, who will de-identify the data, add a pseudonym and then make that data available to our analysts through our analytics platform. They will use this platform to link datasets so that we can fulfil our obligations to manage and monitor the delivery, efficacy and safety of immunisation programmes along with identifying adverse reactions to vaccines and medicines.

In order to monitor and manage our programmes, we need to process two distinct elements of data; we need to understand the number of people that have been included in a particular cohort, so we have a baseline figure to work from – we call this our denominator. The data that is obtained from vaccination providers in relation to the vaccinations that they administer is then used to provide actual figures, we call this our numerator. In order to be able to report progress as accurately as possible, we need these two types of data to do that.

Sharing your data

We share relevant information with organisations who have responsibilities for delivering vaccinations or for monitoring their safety.

NHS England will share personal, identifiable and clinical information with or receive vaccination information from:

GP’s: We will flow the vaccination data that we have received from the organisation that gave you the vaccination, to your GP clinical record. Even though your GP may have provided your vaccination, they record it in a different system. This data can then flow to NHS England before being sent to the GP clinical system to become part of your GP record.

Pharmacies: We will only make this data available once you have decided to obtain your vaccination at a pharmacy and the pharmacy staff are administering your vaccination. They will use their point of care system to record your vaccination but they will link your data to information provided through our own advanced programming interface.

Other NHS, health, or social care organisations: We will make this data available in the same way that we do for pharmacies where an organisation needs to know your vaccination history to care for you. In addition to this, we make the data available in the summary care record.

NHS bodies in Scotland, Wales and Northern Ireland: Depending on the needs of each vaccination programme, if you obtain a vaccination in Scotland, Wales or Northern Ireland but are registered with a GP in England, vaccination event data is shared with us by the NHS body responsible for vaccinations in that country. If you live in one of those countries and are registered with a GP in that country, should you get vaccinated in England we will share this data with the NHS body responsible for your care in that country.

The UK Health Security Agency (UKHSA): We share data so that the UKHSA can fulfil their statutory public health duties – see Framework document between DHSC and the UK Health Security Agency. This includes a letter from Maggie Throup to Professor Dame Jenny Harries, UKHSA Chief Executive – see the gov.uk website for more information about the role of the UKHSA.

The NHS Business Services Authority (BSA): We share data with the BSA because we are permitted to do so as it is necessary for both NHS England and the NHS BSA to exercise certain functions in relation to the running and management of the NHS.

The legal basis for the processing of this data for the purpose stated is Article 6 (1) e, where, under the NHS Act 2006, Chapter A1, Section 13Z3, (e, and (f.

Specific directions relating to the functions of the NHS Business Services Authority are made in the NHS counter fraud authority directions, with supplemental directions to the NHS Business Services Authority (Awdurdod Gwasanaethau Busnes y GIG) 2017, schedule which includes intelligence, detection, and prevention functions (paragraph 5) and Investigation functions (paragraph 7). See NHS Counter Fraud Authority and supplemental directions 2017 for further information.

We do not flow confidential patient information to the NHS BSA apart from the fact that you have had a vaccination; this includes when, where and who administered it. We do not tell the NHS BSA any more about you apart from your NHS number and your date of birth. This enables them to consolidate claims for payment from vaccination providers and ensure that these claims are made accurately. Linking data in this way is the only way to achieve this obligation.

It should be recognised that we also process data that has been shared between systems by providers of local vaccination and immunisation services; these include school aged immunisation services, the Child Health Information Service, maternity services and primary care networks. They do not share data directly with us; we obtain it through GP clinical records once it has been sent by the originating system or provider.

What else do we use your data for?

In addition to the purposes described above, we need to undertake monitoring and analysis to support management of the various vaccination programmes. Data will be used for planning, commissioning, and where approved, could be used for research purposes, including relevant clinical trials. Ultimately, we need to understand whether vaccinations are effective and contributing to the improved health of the population in a way that is equitable.

The data we use for these purposes is pseudonymised to ensure that individual patients are not identifiable. Data is pseudonymised by changing identifiable data such as your NHS number into a random selection of characters. The data containing the random characters is then made available to analysts who are able to link any data with the same characters in it, but they will not know who you are.

Data will be processed at row level where necessary; this means that a table will contain different rows of data relating to unidentified people on each row. The majority of reporting uses anonymised and aggregated data; this is data relating to a number of unidentified people that has been grouped together and no longer contains the random characters used to pseudonymise it. This makes it anonymous, and we further minimise the risk of identifying anyone by suppressing low numbers, so for example, we may remove data where the analysis indicates there are less than 10 people to whom the data could relate to.

Further information about how we did this during the COVID-19 pandemic is available on our website. We use the same technology currently for processing data for other national vaccination programmes; it is known as Foundry as this is the name of the platform we currently use, provided by Palantir.

We also share your information with organisations who process personal data for us, on our behalf. They are called processors. Where we use processors, we have contracts and agreements in place with them which means that they can only process your personal data on our instructions. Our Processors must also comply with stringent security requirements when processing your personal data on our behalf.

How long we keep your personal data for

We will retain your personal data for as long as is necessary for the purposes outlined above in accordance with the Records Management Code of Practice 2021.

Other organisations with whom we share your personal data have obligations to keep it for no longer than is necessary for the purposes for which we have shared your personal data. Information about this will be provided in their transparency or privacy notices which are published on their websites.

Data relating to the COVID-19 pandemic

Due to legislation published to support the UK COVID-19 public inquiry, NHS England and other organisations who supported the service provided during the pandemic, are legally obliged to retain data relating to the pandemic until such time as the COVID inquiry deems it is no longer necessary to retain it for their purposes. At that point in time, we will review retention periods to ensure that we are fulfilling our obligations under the Records Management Code of Practice and therefore expect our retention periods to be longer than stated in the code.

Where we store the data

NHS England only stores and processes your personal data within the United Kingdom.

Fully anonymous data, for example, statistical data, which does not allow you to be identified, may be stored and processed outside of the UK.

Some of our processors may process your personal data outside of the UK. If they do, we will always ensure that the transfer outside of the UK complies with data protection laws.

Your rights over your personal data

As NHS England has recently merged with NHS Digital and Health Education England, additional transparency information about the data we are now the Controller for can be found at:

Type 1 opt outs and the National Data Opt Out

In most vaccination programmes, any Type 1 opt outs recorded within your GP record will not apply where the data obtained from GP systems is for a direct care purpose; NHS England is obliged to monitor uptake of the vaccination which, although a secondary purpose, is linked to direct care.

The National Data Opt Out will not apply in all cases where any disclosure is for the purposes of monitoring and control of communicable disease or other risks to public health which includes:

diagnosing communicable diseases
controlling or preventing their spread
delivering and monitoring vaccination programmes.

Where processing is in relation to planning and research, NHS England will adhere to the National Data Opt Out policy.

Who are our processors

UK Health Security Agency – manage our inbound 119 vaccine booking service capability.
Point of Care system providers
Palantir – providers of the Foundry analytics software

Choosing your COVID-19 vaccination invitation preference

We have set up a service for people to choose whether they receive invitations and reminders to attend for COVID vaccination. This is available on nhs.uk. The service is available to people aged 16 and over.

When you access this service, we need to verify your identity. You will need to provide your name, date of birth, and either your NHS Number or postcode. Once we find a match and verify this by using a security code sent to your registered mobile number or email address, we do not keep this information. There is a facility to find an NHS number if you do not know it.

You will also need to have an email address or mobile phone number that you have registered with your GP, and is available in the Personal Demographics Service. This is used to send you a security code (via the gov.uk Notify Service) which you enter into the system, before proceeding to choose whether or not to receive COVID-19 appointment invitations.

Once you have made your preference, your choice is saved against your NHS number. This is the minimum amount of information that we need to provide this service.

We also record and store audit data each time you use the service, including the date and time and internet protocol (IP) address. This is stored to help us monitor the service and protect the service from malicious use. This data is stored on secure servers in the European economic area.

Access to the service is also available by calling 119. The call handler talks you through the process, entering the data you provide into the online service. You provide your name, date of birth, and either your NHS number or postcode, to the call handler so they can verify your identity. You also need to have your registered mobile phone or email account available so you can receive the security code and provide it to the 119 call handler.

If you have difficulty communicating or are a British Sign Language (BSL) user, you can use textphone 18001 119 or the NHS BSL interpreter service.

Whilst you will no longer receive COVID-19 vaccine invites, your details will continue to be processed for the purposes of managing and monitoring the progress of the COVID-19 programme.

If circumstances were to change, for example should the impact of COVID-19 significantly worsen, we may consider whether we have compelling grounds to send vaccination invitations irrespective of any preference set.

Setting your COVID-19 contact preference using this central service will not stop other organisations such as your GP practice from sending you invitations for vaccination.

NHS Genomic Medicine Service: Whole Genome Sequencing

How we use personal data to provide genomic testing.

Purposes and controllers

NHS England is commissioning an NHS Genomic Medicine Service. This service is available to clinicians anywhere in England and it gives them a facility to order tests based on the analysis of their patients’ whole genome – their genetic makeup.

The service is provided by seven Genomic Lab Hubs each of which is made up of number of NHS Trusts or NHS Foundation Trusts (“GMS NHS Trusts”) which provide testing, interpretation and reporting services.

The GMS NHS Trusts together with NHS England are responsible as joint controllers under data protection legislation for the processing of personal data to provide the NHS Genomic Medicine Service. A list of the GMS NHS Trusts with links to their online privacy notices is presented below.

The labs use a computer system called the National Genomic Information System (NGIS), which NHS England has commissioned for them from Genomics England Ltd. Genomics England is a processor for the provision of the NGIS, acting on the instructions of NHS England for the Trusts that provide lab services.

How personal data is used for your genomic test

The human genome is made up of 3 billion letters of DNA (A, T, C and G). Whole genome sequencing is a technique that is used to ‘read’ these letters and finds their order one by one. The digital record of this sequence can be then analysed by computers to produce information to inform the diagnosis and treatment of rare conditions or cancer.

When a clinician orders a whole genome sequence test using the new service, he or she will send a blood or tissue sample with an order form to a pathology laboratory that has been designated to perform the type of test being requested in the local area. This lab will extract the DNA from the sample and send it to a specialist lab that puts the DNA into a tube or “well” in a rack or “plate” of other samples. In this way the samples are organised so that they are matched to the right patient when they are analysed, ensuring that the patient gets the result that relates to their test. As a double check the lab that extracted the DNA keeps a DNA signature from the sample, which is then compared to the sequenced DNA.

The plates of samples are sent to a company called Illumina that carries out the whole genome sequencing process. Illumina is contracted to Genomics England to provide this service.

A digital file is created with the unique 3 billion letters, and this is sent to Genomics England’s Bioinformatic Pipeline. This system analyses the DNA sequence, guided by the type of test that has been ordered, and creates an automatic interpretation of parts of the genome that are relevant to the patient’s condition. The facts that are presented in this automatic interpretation are further interpreted by clinical scientists in the Genomic Lab Hubs.

The NGIS is accessed by lab staff who have access permissions enabled that are appropriate to their role. As this is a national service, lab staff with access enabled can see the genomic records of any patient that has had a test requested for them. This enables clinical scientists that specialise in a particular condition to provide interpretation services for patients outside their area.

Genomics Multi-Disciplinary Teams

The GMS NHS Trusts host meetings of multi-disciplinary teams (MDTs) which review individual cases. Clinicians from the GMS Trusts and referring clinicians attend these meetings to collaborate in reviewing their cases.

The MDT meetings are supported a Genomics Management System that allows the display and annotation of genomic information from the National Genomic Information System. The system is accessed only by authorised individuals in NHS Trusts.

Managing and improving the service

Personal data is processed for the following purposes by the GMS NHS Trusts and NHS England

The improvement of delivery of direct care (clinical care), which includes supporting the development of knowledge of genomic variants as well as maintaining and improving the quality of the service;
The improvement of the service, driving improvements in access, effectiveness and efficiency.

Data that identifies patients directly is not disclosed outside the team providing care for these purposes. The data is de-identified or aggregate numbers.

NHS England receives a monthly Patient Level Contract Monitoring Dataset from each of the GMS NHS Trusts for its commissioning purposes. This is collected by NHS Digital and provided to NHS England in de-identified form – see Data Services for Commissioners.

Research

Every patient that is offered a whole genome test is asked if they want to donate your sample (blood / saliva / tissue, etc.), genome sequence and health data for research co-ordinated by Genomics England.

For patients who agree, NHS England, on behalf of the Trusts that provided that provided the genomic test will allow Genomics England to access personal data held in the NGIS for inclusion in the National Genomic Research Library. This is a secure national database of genomic and health data managed by Genomics England.

Genomics England Ltd is controller under data protection legislation for the purposes of the National Genomic Research Library. See the Genomics England website

Categories of personal data

The following types of personal data are processed:

Patient Identifiers including NHS Number
Demographics – name, address, date of birth, ethnicity, registered GP
Clinical pathway
Family identifiers – where relevant
Clinical Indicators – nature of condition, details of condition
Clinical measurements and observations relevant to condition specific to cancer or rare and heritable disease pathways
Clinical ethnicity and clinical sex details
Details of genomic testing and related procedures – e.g. the type of test performed
Link to previous requests and tests
Whole Genome Sequence
Special Categories of Personal Data include
- Racial or ethnic origin
- Genetic data
- Health data

Joint Controller Agreement

NHS England and the GMS NHS Trusts have entered into a Joint Controller Agreement which provides a framework for how they will work together to ensure that they comply with data protection requirements when they process personal data for the purposes of the Genomic Medicine Service. In this agreement they make the following commitments

They will make sure that they are transparent about their joint purposes for Processing Personal Data
They will make sure that anyone who wants access to their Personal Data, or to exercise other rights under Data Protection Law, have an easily accessible point of contact to make their request (see the GMS NHS Trusts privacy notices below)
They will make sure that their data protection policies and procedures properly govern their processing of personal data
They will make sure that personal data that they process, or is processed on their behalf by processors, is protected by appropriate technical and organisational security measures
They will make sure that their personnel have a confident understanding of their data protection responsibilities
They will not transfer personal data outside the European Economic Area unless appropriate legal safeguards are in place in accordance with data protection law.

The GMS NHS Trusts and privacy notices

North West Genomic Laboratory Hub

North East and Yorkshire Genomic Laboratory Hub

South West Genomic Laboratory Hub

Central and South Genomic Laboratory Hub

East Genomic Laboratory Hub

London North Genomic Laboratory Hub

South East Genomic Laboratory Hub

Legal basis for processing

For GDPR purposes NHS England’s and the GMS NHS Trusts’ lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’

For the processing of special categories (health) data the bases are

9(2)(h) – ‘…health or social care…’ – for the provision of the testing service

9(2)(g) – ‘…necessary for reasons of substantial public interest…’ Underpinned by paragraph 8 (Equality of opportunity or treatment) of Schedule 1 to the Data Protection Act 2018 – for processing of racial or ethnic origin

9(2)(j) – ‘…research purposes…’ – for dissemination to Genomics England Ltd. for inclusion in the National Genomic Research Library

Public health

Information about the transfer of public health functions from Public Health England to NHS England and how we use your information.

Transfer of Public Health functions to NHS England

On 1 October 2021, as part of the government’s strategy to transform the public health system in England, responsibility for a number of public health functions transferred from Public Health England (PHE) to NHS England. NHS England is now therefore the controller for personal data processed to support these functions under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Other than the change in Controller there was no changes to patients’ personal data to discharge these functions, how it is processed or the services received by patients as a result.

More information on NHS England’s public health functions and commissioning activities can be found on our website.

Information about how we process personal data for the purposes of our screening programmes can be found at National population screening programmes: the information we use and why, and your options – GOV.UK (www.gov.uk).

From January 2023 the responsibility for the management of the National Disease Registries, a collection of data on all cancers, rare diseases and congenital anomalies diagnosed each year in England from NHS Digital to NHS England the privacy information can be found here NHS Digital website: National Disease Registration Service: NHS Digital Transparency Notice.

Purposes for processing

We process personal information of staff transferring into NHS England for the purposes of staff employment. Please see Our Workforce section of our privacy notice to find out how we use personal data about our employees.

We use personal information to fulfil the Secretary of State for Health and Social Care’s duty to protect and improve public health and reduce health inequalities. We may process personal information in order to provide:

Regional and National Healthcare Public Health services
Regional and Local Screening functions and Immunisation Commissioning Support and Expert Advice
Screening Quality Assurance Services.

How we collect your personal information

We collect personal information from the following sources:

Directly from you
From the providers of health and care services
From other organisations supporting the health and care system in England.
From national data sources including

The information we collect

The types of personal information we may collect about you include:

Demographic information – for example, we may collect your name, date of birth, sex, ethnic group, NHS number, address and postcode, occupation, and contact details such as your phone number
Health information – for example, we may collect information about your physical health, mental wellbeing, symptoms and medical diagnoses, and health risk factors such as your height and weight, whether you smoke and what your occupation is
Treatment information – for example, we may collect information about your hospital admissions, clinic attendances, screening appointments, laboratory test results, prescriptions and vaccination history.

Who we share your information with

We may share your personal information with other organisations to provide you with individual care or for other purposes not directly related to your health and care.

Your doctor and hospital to help them provide you and other patients with better care by auditing and evaluating the safety and effectiveness of the service they provide
Data processors: We may share your personal information with organisations we have contracted to help us fulfil our remit
With other organisations, where such sharing is necessary, proportionate and allowed by law, which may include universities and other researchers.

Legal basis for processing

We process both personal data and special categories of personal data, including data about your health and ethnic group. Our legal basis to collect your personal information may vary according to the purpose we use it for. In most cases unless stated below Section 7A of the National Health Service Act 2006 satisfies the UK General Data Protection Regulation and the Data Protection Act 2018 that apply below:

GDPR Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller.
GDPR Article 6(1)(a) ‘consent’ where processing for surveys and public consultations for changes.

Where we need to use special categories of personal data, the lawful bases will be:

GDPR Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health’
GDPR Article 9(2)(h) ‘processing is necessary for the provision of health or social care or treatment or the management of health or social care systems and services’
GDPR Article 9(2)(a) ‘explicit consent’
Data Protection Act Schedule 1 Part 1 (3) ‘public health’.

NHS England merger with NHS Digital and Health Education England

Information about our organisations’ merger and links to privacy information.

Information about our organisations’ merger and links to privacy information

NHS Digital merged with NHS England on 1 February 2023, and Health Education England merged from 1 April 2023. For data protection purposes, from 1 February 2023 NHS England became the controller responsible for the processing of personal data for activities previously performed by NHS Digital prior to this date. Similarly, from 1 April 2023 NHS England became the controller responsible for the processing of personal data for activities previously performed by Health Education England prior to this date. As part of this merger the organisation is undergoing a transitionary process, and within that transition the organisation will be operating dual privacy notices to provide information about the new NHS England’s processing of personal data. From the respective merger dates, references to ‘NHS Digital’ and ‘Health Education England’ should be read as ‘NHS England’.

For subjects rights requests to your personal data, you can contact either of the given contact details on the NHS England and NHS Digital privacy notices.

Further information

Artificial Intelligence Deployment Platform Pilot

How we use personal data to evaluate the effectiveness of a centralised hub to provide AI diagnostic support for radiological imaging in trusts.

How we use personal data to evaluate the effectiveness of a centralised hub to provide Artificial Intelligence (AI) diagnostic support for radiological imaging in trusts.

Purposes for processing

NHS England and the Department of Health and Social Care (DHSC) are implementing a pilot NHS Artificial Intelligence Deployment Platform (AIDP) for medical imaging diagnostic technologies.

The AIDP will provide a hub to receive radiological images submitted by trusts, route them for diagnostic interpretation by an appropriate AI product, and (in live mode – see below) return them to trusts with marked-up diagnoses for onward transfer to local systems. Radiologists will then be able to view images with AI generated diagnoses, which they can use to inform their diagnoses.

The programme goals are to test whether having a centralised platform and deployment processes:

Accelerates the safe and ethical deployment of trusted AI products (class IIa and class IIb) at multiple hospital sites.
Provides a cost and time-effective standard deployment process of AI products for NHS organisations and AI innovators.
Provides reasonable access to post-market surveillance resources of AI vendors.
Provides the case study for accelerating the broader adoption of technologies across NHS organisations.

To test this approach, several mature AI products from leading vendors will be deployed into the two trust imaging networks initially in shadow (test) mode, before being potentially switched on live if deemed appropriate.

The AIDP programme is working with Trusts in East Midlands Radiology Consortium (EMRAD) and Thames Valley Radiology Network (TVRN) to facilitate the pilot.

How NHS England/DHSC uses personal data to provide AI diagnostics and for evaluation

Trusts will submit radiological images from their local systems to the AIDP. The AIDP will forward them to the AI diagnostic product appropriate to the type of image – disease, area of the body, type of image (X-ray, MRI). The AI product will then return diagnostically interpreted images to the AIDP.

This process will initially facilitate shadow mode testing, which may involve the comparison of diagnoses made by radiologists (also submitted to the AIDP) with AI generated diagnoses. In shadow mode, results will not be returned to trusts for clinical decision making. The purpose here is to test the pathway and verify the operation of AI products as accessed by the trust.

Subject to performance checks in shadow mode, a decision will be made in collaboration with the trusts to move to live mode, in which the results will be returned to trusts and transferred to hospital systems so they can be used by radiologists to support their clinical diagnoses.

Patient and imaging attributes will be analysed on the AIDP for the purposes of post-market surveillance – for presentation in user dashboards and for model validation reporting. This will include analysing by gender, weight and size, locality of residence, smoking status and ethnic group.

Images and associated data submitted by trusts will be pseudonymised before they are uploaded to the AIDP. In live mode the results will be re-identified by the trust when they are returned from the AIDP. Trusts will use a dedicated router to pseudonymise, transfer and re-identify the data.

Organisations and their roles

NHS England and DHSC will be responsible as joint controllers for the processing to deliver the AIDP.

Faculty Science Ltd. will act as a processor for the delivery of the AIDP and will instruct the following as sub-processors:

Cimar – for the provision of the core AI Deployment Platform, as well as maintenance and support
Royal Surrey NHS Foundation Trust (RSNFT) – for the development of the post market surveillance system
AI product vendors. For the provision of AI diagnostic services in support of the following disciplines:
- Lucida Medical Ltd. – for AI diagnostic interpretation of prostate MRI scans
- Lunit Inc. (implementing Radiobotics ApS) – for AI diagnostic interpretation of musculo-skeletal x-rays
- Lunit Inc. – for AI diagnostic interpretation of chest x-rays

Trusts will be responsible as controllers for processing to extract data from local radiology systems, to pseudonymise and submit images with associated data to the AIDP, and in live mode to receive and re-identify images with marked up diagnoses and associated data. RSNFT acts as a processor to provide and support the pseudonymisation and re-identification router that transfers data to and from the AIDP.

AI diagnostic products – procurement and assurance

AI products have been selected by a DHSC/NHS England-led tender process for the three disciplines.

As part of their tender submission, prospective AI vendors must complete the Digital Technology Assessment Criteria (DTAC). This includes compulsory requirements on clinical safety, data protection, technical security and interoperability. Bidders must pass all of these requirements to be considered further.

In order to be eligible for procurement, AI products must be approved class IIa or class IIb medical devices and CE/UKCA marked. AI product vendors can only place a UKCA mark on their product and place it on the market when they have received a certificate from the Approved Body. This means that AI products must conform with the relevant requirements in the Medical Devices Regulations 2002.

The procurement evaluation process requires bidders to respond to extensive questions that are assessed and given an evaluation score. These include questions on how the AI product was developed and trained, ensuring fairness and an ethical approach, risks of bias and how the algorithm’s fairness is tested over time.

Categories of personal data

The data processed on the AIDP and by AI vendors’ diagnostic products will be pseudonymised radiological images including x-rays, CT and MRI scans.

As the personal data processed on the AIDP and by connecting AI products will be pseudonymised by submitting trusts, it will be anonymous to NHS England, DHSC and their processor / sub-processors.

Data fields that directly identify individuals will be converted to pseudonyms which can only be reversed by trusts. Many fields other than direct identifiers are cleared or modified to reinforce anonymity.

Data fields that are retained for post-market surveillance purposes include gender, patient weight and size, locality of residence, smoking status and ethnic group.

Special Categories of Personal Data include health data and racial or ethnic origin.

Retention period

Pseudonymised images and results from the AI data will have a fixed retention period. Initially this will be no more than 30 days, though this may be subject to change depending on how the pilot scope evolves.

The following meta data related to studies will be retained for the duration of the pilot to monitor and validate the AI models as well as support post market surveillance activity:

Ground truth results – i.e. the radiologist verdict or patient outcome for each pseudonymised study
AI output results – i.e. a description of what the AI detected on the image and the location on the image
Aggregated AI product performance data e.g. sensitivity, specificity, recall rate etc.
Aggregated study processing data e.g. number of studies processed / failed / excluded etc.

Legal basis for processing

For UK GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’

For the processing of special categories data the bases are:

For health data

9(2)(h) – ‘…health or social care…’ – for the provision of the testing service

For racial or ethnic origin

9(2)(b) – ‘…necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’