Community Services Data Set information governance and fair processing guidance

It describes the CSDS and contains suggested fair processing information for including with existing patient information material.

This is to comply with the requirements of the common law duty of confidentiality, the Data Protection Act 2018, the General Data Protection Regulation (GDPR), NHS Constitution and the Department of Health and Social Care’s Directions to NHS Digital, formerly known as the HSCIC, issued in 2015, 2017 and 2018 on upholding patients’ national data opt out preferences

The suggested fair processing information should not be produced as a separate information leaflet for patients but should be incorporated into existing material wherever possible.

Please note that this fair processing information also applies to the Children and Young People’s Health Services (CYPHS) data set. The CYPHS data set collected the same community data as the CSDS, but for patients aged 0-19 only, and the CSDS has now replaced the CYPHS data set to allow data about adults to be submitted.

NHS Digital has been directed by the Department for Health and Social Care under section 254 of the Health and Social Care Act 2012 to establish and operate a system for the collection and analysis of the CSDS information. 

Under GDPR, our lawful basis for processing is Article 6 (1) (c), which relates to processing necessary to comply with a legal obligation to which we are subject. Our lawful basis for processing special category data is GDPR Article 9 (2) (h) and Schedule 1, Part 1 (2) (2) (f) of the Data Protection Act 2018.

A Data Provision Notice (DPN) for the CSDS has been published to enforce the data requirements as per NHS Digital statutory powers, under Section 259 (1) of the Act.

The Community Services Data Set (CSDS) expands the scope of the Children and Young People's Health Services Data Set (CYPHS) data set, by removing the 0-18 age restriction. The CSDS supersedes the CYPHS data set, to allow adult community data to be submitted. The structure and content of the CSDS remains the same as the CYPHS data set. The Community Information Data Set (CIDS) has been retired, to remove the need for a separate local collection and reduce burden on providers. It includes record level data on referrals and care contacts with publicly funded community services.

The data are submitted by providers to NHS Digital’s Bureau Services Portal. After processing at the end of the submission period, files are made available via the portal to both NHS Digital analysts and to DSCROs. NHS Digital has a central reporting system where an anonymised/pseudonymised version of the CSDS will be held for reporting purposes. This platform will support the analysis of CSDS data and serve the following purposes:

• anonymised/pseudonymised data will be published on the NHS Digital website and shared with national bodies, allowing the effective monitoring of service standards, including efficiency, equity and effectiveness of service, by policy makers
• extracts of data will be made available to care providers and their commissioners to allow the local monitoring of service provision, assist with allocating payments and help submitters to improve data quality
• anonymised/pseudonymised data will also be made available at provider level to help to inform a patient's care and treatment choices, such as via the NHS.UK website
• the data held in the CSDS may also be linked to other data sets, such as the Maternity Services Data Set (MSDS), Patient Level Information Costing System (PLICS) and Mental Health Services Data Set (MHSDS) in order to investigate the relationship between care in maternity services and subsequent health visiting and school nursing activity.

As the CSDS data is to be used for secondary uses rather than direct patient care, patients using the services covered by the CSDS must be made aware that their confidential data will be used for this beneficial, additional purpose i.e. to improve care. (The services covered by the CSDS, as well as the wider scope of the data set, are set out in the CSDS Requirements Specification. Acting fairly and transparently ensures compliance with the common law duty of confidentiality, the NHS Constitution and legislation e.g. the Data Protection Act 2018 and the General Data Protection Regulation (GDPR).

Ensuring fairness is the responsibility of the care provider from which the data will be collected (NHS Digital has provided some suggested wording later in this document).

Patients must also be informed of their right to set a national data opt-out preference to prevent their confidential patient information from being used for purposes beyond their own direct care and treatment (e.g. for research and planning purposes). This complies with the Department of Health and Social Care’s Directions, issued to NHS Digital in 2015, 2017 and 2018 on the upholding of patients’ national data opt out preferences.

Providers are legally required to submit full returns of CSDS data, as the Data Provision Notice (DPN) issued under section 259 (10) of the Health and Social Care Act 2012 sets aside the common law duty of confidence in respect of this data. However, providers may themselves exclude records where they are subject to any other restriction on disclosure, such as by other laws.

Patients however do have a right to set a national data opt-out preference to prevent their data being used for purposes beyond their direct care and treatment. Where an opt-out is received from a patient (or their parent or guardian in the case of a child), NHS Digital will exclude the relevant records from any onward dissemination of the data.

Patients using these services have the right to change their minds about a disclosure decision at any time before the disclosure is made and can do so afterwards to prevent further disclosures.

Read more about the national data opt out programme. 

This guidance document complies with the NHS Digital Code of practice on confidential information.

A key transparency requirement under the GDPR is that individuals have the ‘right to be informed’ about the collection and use of their personal data. The following suggested wording is intended to be incorporated into a hospital's existing information for patients. It does not need to be a separate leaflet.