Skip to main content

Data protection impact assessment support for Information Asset Owners (IAOs)

Information Asset Owners (IAOs) can use the information in this section to help them complete the data protection impact assessments (DPIAs) for the assets they own.

Hospital Episode Statistics (HES) is not a new asset and stakeholder engagement has taken place at numerous points through the life of these statistics. 

HES is the statistical name for the Commissioning Data Sets (CDS) data processed through the Secondary Uses Service (SUS). Changes to CDS and SUS are also extensively consulted on.

We followed best practice guidance of the consultation in the Hospital Episode Statistics (HES) privacy assessment.

The Information Commissioner’s Office (ICO) code of practice sets out the main steps to follow:

  • identify the need for a PIA
  • describe the information flows
  • identify the privacy and related risks
  • identify and evaluate the privacy solutions
  • sign off and record the PIA outcomes
  • integrate the outcomes into the project plan
  • consult with internal and external stakeholders throughout the process

We carried all these steps as part of this project, except the second to last step, which will be carried out once the project is finished. We may need significant resources and the involvement of a variety of the Health and Social Care Information Centre (HSCIC) staff.

Consultation allows an organisation to:

  • understand the concerns of those affected by the project
  • improves transparency by making people aware of how we use information about them
  • provides an organisation with the opportunity to benefit from wider views and expertise that may not exist in the organisation

Consultation in the HES PIA project is in 3 phases:

  • a narrow, targeted set of interviews and meetings with people in the Health and Social Care Information Centre interested and/or responsibility for the governance of Hospital Episode Statistics
  • a wider, targeted stakeholder engagement to seek the involvement and feedback of people or bodies who can be expected to be interested and/or affected by the governance of Hospital Episode Statistics

To show a clear legal basis for processing, collecting, analysing or disclosing your personal data, the Secretary of State for Health directed us to:

  • collect the Commissioning Data Sets (CDS)
  • process this data in the Secondary Uses Services (SUS)
  • publish it as the Hospital Episode Statistics (HES)

Find out more information from the spine services direction 2.

Find out how we use your personal data from the HES and information governance pages of our website.

This table explains why we collect and process all data.

Data categories

Information relating to the individual's

Yes N/A

Justifications

There must be justification for collecting the data items. Consider which items you could remove, without compromising the needs of the project. 

Personal data      
Name   X May be flowed by the provider to SUS if the NHS number is not known; never received in HES

Address

  X

May be flowed by the provider to SUS if the NHS number is not known; never received in HES

Postcode

X   Postcode is required for various geographical analyses; these derivations are performed during processing and only the postcode area and derived geographies are available for analysis, not the full postcode
DOB X  

It is important to know the age of people accessing NHS services for planning and commissioning purposes.  Various “age at” derivations are performed during processing and it is those derivations which are made available for analysis, not the date of birth

Age X  

 

Derived, not flowed. (see note on DOB)

Sex   X  

Marital status

  X  
Gender X  

It is important to know the gender of people accessing NHS Services for planning and commissioning purposes

Living habits

  X  

Professional training / awards

  X  

Income / financial / tax situation

  X  

Email address

  X  

Physical description

  X  

General identifier for example NHS number

x  

The NHS number is collected by SUS but is converted into a consistent, anonymised identifier which is then used for analytical purposes.  Data containing NHS number is available for analysis but access is for specific purposes e.g. linkage to other data, only

Home phone number

  X  

Data categories 

information relating to the individual's

Yes

N/A

Justifications

There must be justification for collecting the data items. Consider which items you could remove, without compromising the needs of the project. 

Online identifier, such as IP address and event logs

  X  

Website cookies

  X  

Mobile phone or device number

  X  

Mobile phone or device IMEI number

  X  

Location data (travel, GPS or GSM data)

  X  

Device MAC address (Wireless Network Interface)

  X  

Sensitive personal data

     

Physical or mental health or condition

X  

The purpose of HES is to help the public, patients, staff, policy makers and other commentators to understand the demands placed on the NHS and use made of those services. This could not be done without some information on physical or mental health conditions. This information is provided in the form of a diagnostic or operative procedure code or code

Sexual Life / orientation

  X

A limited amount of information may be gleaned from some of the data, such as birth data

Family / lifestyle / social circumstance

  X

A limited amount of information may be gleaned from some of the data, such as diagnosis of cirrhosis of the liver

Offences committed or alleged to have committed 

  X  

Criminal proceedings, outcomes or sentences

  X  
Education or professional training   X  
Employment history   X  
Financial affairs   X  

Religion or other beliefs

  X  

Trade union membership

  X  

Racial or ethnic origin

X  

It's important to understand the ethnicity of people using NHS services to guard against institutional racism.

Biometric data (fingerprints / facial recognition)

  X  

Genetic data

  X  

HES is routinely linked with other data sets to reduce the data burden on the NHS of submitting the same data several times. It's linked with the ONS, mortality data, Diagnostic Imaging Data Set, Patient Reported Outcomes Monitoring data and Patient Level Information Costing System data on a routine basis. 

Linkage is either directed by NHS England or the Department of Health, or performed under the terms of the Health and Social Care Information Centre Commencement Order. It can be linked with other data for external customers. Details of these disseminations can be found in the data release register.

How long we retain personal data

Data retention is in line with NHS guidance (30 years) and reviewed annually.

Overview of the HES cleansing process

Graphic showing overview of the HES cleansing process

Full information about HES data quality can be found at the processing cycle.

HES data quality note

When Hospital Episode Statistics (HES) is published, additional data quality information and explanatory notes are also made available. For HES system users and those requesting extracts, data quality notes are published highlighting any specific known issues with the data to be considered when analysing the data.

HES data quality note content

The HES data quality notes are updated for each extract published and are available from 2007-08 data year onwards.

A typical note will contain:

  • issues with specific fields
  • issue with fields for a specific provider
  • coverage issues
  • processing errors
  • mapping issues / duplicates missed / Auto clean error
  • errors at SUS Ops stage / XML
  • anything else that is considered useful for users to be made aware of

Where possible each entry will highlight the impact on analysis of the area it relates to and give a timescale of when this issue will be resolved.

Each note records the issues that are found at the time of publication. If additional issues are found post-publication, the note will be updated to reflect this.

Making people aware of their rights

NHS opt out – how it has been considered

Patients can either opt out with their health care provider (up to 10) and is recognised using the withheld identity reason code or using the opt out available through their GP practice.  All identifiable disseminations of data have objections recorded at a GP Practice applied.  Information about that process is found here.

How individual rights are upheld

Patients can either opt out with their health care provider (up to 10) and is recognised using the withheld identity reason code.  All identifiable disseminations of data have objections recorded at a GP Practice applied.  Information about that process is found at opting out of sharing your confidential patient information webpage.

Technical and organisational controls for “information security”

HES is housed in a corporate data centre with an approved System Level Security policy.  All internal access to HES is controlled via the internal Electronic Clear Data Access (eCDA) system.  External access is controlled via the Data Access Request Service (DARS) process and Information Group Advising on the release of data (IGARD).

Personal data will not be transferred outside the EEA.

Completed DPIA’s must be revisited during the lifecycle of the project / programme to ensure:

  • outcomes and measures identified are still relevant
  • actions recommended to mitigate risks are implemented
  • mitigating actions are successful
  • upload the approved DPIA to the Unified Register
Last edited: 19 November 2020 4:26 pm