How NHS England makes decisions about data access

All external requests for data are considered in detail to ensure they meet the required standards. Applications undergo stringent review by our staff and by independent groups against published criteria. Applicants are required to demonstrate that they meet security standards and sign contracts that control how the data they access is used. We publish details of the data that we release and minutes from the meetings of our independent advisory group. And we commission audits to check that the data is managed and used appropriately.

We plan to reduce the amount of data being processed outside central secure data environments and increase the data we make available to be accessed via our secure data access environment.

Where there is a benefit to health and social care, we do allow access to data by commercial organisations. Commercial organisations conduct research, run clinical trials, develop products and services to meet clinical or patient needs, and support the planning and improvement of NHS services. Any application that has a commercial purpose must clearly demonstrate that there is a benefit to health and social care in England and Wales before its approval and this is reviewed carefully during the application process.

Data Sharing Agreements restrict the use of data to approved purposes. Our audits include checks that data being used in accordance with the agreed purpose and that the declared benefits are being achieved. When an agreement expires and is not renewed then all data must be securely destroyed and confirmation provided to NHS England.

We will not approve requests for data where the purpose is for marketing, including promoting or selling products or services, market research or advertising. And information is never passed to insurance companies without patient consent. We would reject an application from an insurance company to help set their premiums or for other commercial gain.

Data released by NHS England is subject to an overlapping series of safeguards. This process is managed by the Data Access Request Service (DARS) and is regularly reviewed to ensure it remains robust and transparent.

See full details of the DARS process -  Data Access Request Service (DARS) guidance.

All applications are reviewed by NHS England staff against our published standards for data access.

An independent review of applications is carried out by the Independent Group Advising on the Release of Data (IGARD) All minutes from IGARD meetings are published including their recommendations, and details of data releases through our Data Uses Register.

IGARD provide independent scrutiny of NHS England data distributions, as well as providing a voice for stakeholders and the public. The panel consists of independent specialist and lay members recruited through an open and transparent recruitment process. Find full details of the role of IGARD.

If GP data is included in the application an additional review is also completed by the Professional Advisory Group (PAG). PAG consists of members from RCGP and BMA and our Caldicott Guardian, Dr Arjun Dhillon.

Applications that meet the standards and where IGARD’s recommendations have been addressed are reviewed and approved by senior staff. Depending on the type of application it may require approval from the Head of Data Access, Director of Data Access, or Senior Information Risk Owner.

Data is never provided without a contract. The contract is critical in controlling the purposes for which data can be used.

The process of review and approval described above is key to the development of a legal contract.

All releases through the DARS process are covered by two contracts:

These two contracts provide safeguards by specifying how data may be used, the security and other controls that must be in place and the action that would be taken if the contracts are broken.

We commission independent data sharing audits to check that data recipients are meeting the obligations in their Data Sharing Framework Contracts and Data Sharing Agreements. This helps to ensure that organisations abide by the terms and conditions set by NHS England, the data supplied is kept safe and secure and is being used for the agreed purposes.

All the audit reports are in the public domain to ensure that the public can have full visibility. 

Data from NHS England is used by public sector bodies, charities and commercial organisations. All must have a legal basis and legitimate need to use the data, which will only be used for health and care planning and research purposes.

Examples of data from NHS England being used by commercial organisations to benefit health and social care include:

Information is never passed to marketing or insurance companies without patient consent.