Processing activities guidance

On behalf of the data controller Organisation X, data processor Organisation Y will transfer to NHS Digital the patient identifiers and (XXX) dataset data for approximately X thousand patients. The identifiers included will be NHS number, date of birth, gender and postcode, paired with a unique identifier to support pseudonymisation. The XXX data will contain clinical information about knee replacement operations and related patient outcomes. The data is identifiable and is not available in the public domain.

The GDPR lawful basis relied upon by Organisation X is Article 6(1)(e) – Task in the public interest and Article 9(2)(j) – Research.

Patients have given their explicit consent for data to be shared for the purpose of this processing, so the common law duty of confidentiality is addressed.

The patient identifiers and XXX data will be provided to NHS Digital so that this can be linked to the requested datasets. NHS Digital will use the patient identifiers to filter HES data for the identified patients over the last five years and provide back only the data for those X thousand patients thus minimising the total amount of data requested.

By combining information about knee replacement surgery with HES data on hospital stays, more detailed analysis can be carried out on patient outcomes. This will provide a clearer picture of patient care and the way that knee replacement surgery can impact other areas of health.

1. NHS Digital will send the pseudonymised, linked HES and Civil Registration (mortality) data to University X.
2. University X will create a subset copy of the linked dataset by removing patients that have not undergone a knee replacement surgery.
3. This smaller subset of pseudonymised data will be sent to the data processor University Y.
4. University Y will use this subset to carry out statistical analysis to support Objective 2 (Impact of knee replacement surgery).
5. Once sharing is complete University X will securely destroy the copy they hold of the smaller subset data, but will retain the full pseudonymised dataset.
6. University X will analyse the full pseudonymised dataset as part of Objective 1 (Impact of hip replacement surgery) and Objective 2 (Impact of knee replacement surgery).

Both organisations require record-level pseudonymised data in order to carry out statistical analysis, but no identifiable data will be received or shared therefore the common law duty of confidentiality does not apply.

As University Y only has a role in Objective 2, the data not relating to knee replacements will be removed prior to sharing so that only the minimum necessary data for this purpose is processed. Staff within University Y have specific expertise relating to post-surgery care following knee replacements that will form an important part of this analysis and support the overall objectives.

The example study is a clinical trial led by University of X, who are the sole data controller and the only organisation with decision-making responsibility about the purposes for which and the manner in which the data received from NHS Digital for this purpose will be processed. The trial has a patient safety oversight committee, which includes members from X University Hospitals NHS Trust and the University Y; this committee has an advisory role in monitoring patient safety, but decision-making responsibility will remain with the University of X. Separately there are local principal investigators based at University Z, N University Hospitals NHS Trust, and Q University Hospitals NHS Trust; these individuals will have local responsibility for participant recruitment but will not have any responsibilities relating to processing this NHS Digital data. Finally, a professor from the University L provided advice on the trial design and statistical analysis methods to use, but this individual will not access data and had a purely advisory role.

HES to NJR dataset linkage:

1. The dataset to be linked is the Dataset XXX which is under the data controllership of Organisation A. This data is record level and identifiable.
2. The dataset is not publicly available at record level, although aggregate summaries are published.
3. Linkage to this dataset will provide a clearer view of the patient care pathways and the way that previous knee replacement surgery may impact future hospital care outcomes. The Dataset XXX contains additional information on joint replacement surgeries that is not available in the HES dataset.
4. The linkage will be on a deterministic basis using NHS number, date of birth, gender and postcode. Fuzzy matching and probabilistic linkage will not be applied due to the risk of incorrectly including patients who have not consented.
5. Patients have given their explicit consent for their data to be linked; this was clearly described in both the patient information sheet and the consent form.
6. Data must be processed in a clear identifiably form in order to support linkage, but identifiers will be removed once linkage is completed so that the linked data provided back to University of X will instead contain pseudonyms.

1. In most circumstances the data will only be processed in a pseudonymised form, with the encryption key that would allow individuals to be re-identified stored separately to the clinical data under strict access control. Should it be necessary to re-identify an individual, this must be agreed by the data controller’s Senior Information Risk Owner (SIRO) before the encryption key is accessed and applied to that individual’s data.

2. Re-identification will only be considered in the event of patient safety concerns. If the data processing raises these concerns, the individual records will be reviewed following re-identification by a clinician involved in that patient’s care to identify the appropriate next steps.

3. If analysis raises concerns about patient safety, re-identification cannot be avoided as this could potentially lead to serious harm. This is considered proportionate processing as the possibility of reducing harm to an individual would likely outweigh privacy concerns, but this would be considered on a case by case basis by the SIRO prior to any re-identification.