Isle of Man Manx Care - Commissioning purposes

Isle of Man Department of Health & Social Care · Agency/Public Body

Expired The latest version ended on 9 April 2026. The September 2026 register still lists the agreement, but its term has passed.

Reference: DARS-NIC-173508-F4X6P
Latest version: v7.6
Term of latest version: 10 April 2023 to 9 April 2026
Start date: Before 1 February 2019
Data controller: Sole Data Controller
Commercial purposes: No
Sublicensing: No
Files released to date: 0

Why the data was released

Objective for processing

Patients on the Isle of Man who require treatment from services not available on the Isle of Man (IM) have to undertake travel to England/Wales to receive treatment. Isle of Man Department for Health and Social Care (IM DHSC) wish to understand the rate of patients being sent to the mainland to assist in understanding what services require commissioning locally.

Manx Care was established under the Manx Care Act (2021). Enacted to discharge functions aimed at providing a comprehensive health and social care service. Manx Care has the statutory function of providing and arranging for the provision of health and social care service in the IM.

Section 14 of the Manx Care Act (2021) describes the mandate of Manx Care as mandated by IM DHSC. Manx Care must seek to achieve the objectives specified in the mandate, and comply with any requirements specified in it.

Under this agreement, Isle of Man Department for Health and Social Care is the sole data controller. Both Manx Care and NHS Midlands and Lancashire Commissioning Support Unit will process the data and therefore are listed as data processors. Manx Telecom and Netcetera provide the building for Manx Care and do not access the data. Isle of Man Cabinet office supply IT infrastructure for Manx Care and do not have access to the data. The data will be processed under GDPR Article 6(1)(e) and Article 9(2)(h).

The IM is a crown-dependency but is not part of the UK and not a part of the EU or EEA. Therefore, for the Isle of Man to receive data an Adequacy Decision must be made.

The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection, whether by its domestic legislation or the international commitments it has entered into.

The European Commission has recognised the Isle of Man as providing adequate protection.

The IM received the European Commissions decision on adequacy before the UK left the EU. Adequacy is entirely unconnected to the UK/EU relationship or the UK/IM crown dependency relationship. Transfers can still be made on the basis of an adequacy decision under the UK Data Protection Act (DPA) 2018 after the UK’s departure date from the EU Provisions relating to international transfers are set out in Article 45 – “Transfers on the basis of an adequacy decision”.

The UK government has confirmed adequacy for IM as well since adopting UK GDPR. Whilst the adequacy decisions remain in place, the UK GDPR applies.

The government's statement on EU adequacy decisions being sufficient post Brexit can be found here:

https://www.gov.uk/guidance/using-personal-data-in-your-business-or-other-organisation-after-the-transition-period

That position is also reflected in the ICO guidance here:

https://ico.org.uk/for-organisations/data-protection-at-the-end-of-the-transition-period/data-protection-at-the-end-of-the-transition-period/the-gdpr/international-data-transfers/

https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/

The Manx Care team will use pseudonymised Secondary Users Service (SUS) data to provide intelligence to support the commissioning of health services. The data (containing both clinical and financial information) is analysed, so that health care provision can be planned to support the needs of the population within the Isle of Man area and put the patient at the centre of future redesign decisions.

The Manx Care team commission services from a range of providers covering a wide array of services. Each of the data flow categories requested supports the commissioned activity of one or more providers. The SUS data are required to provide intelligence to support commissioning of health services, and look at ways to minimise the use of UK mainland services to raise the following benefits.

• The minimisation of travel for ill patients travelling back and forth from IM to UK mainland, by designing improved services on IM shores.

• By reducing demand on the UK providers, this will create capacity within UK providers, to support other services, in a currently over stretched environment.

• Review current methods of support, and look to embrace telephone/Video capability to reduce the need for travelling long times for ill patients especially around follow up consultations.

In addition, the Manx Care team require access to pseudonymised Secondary Uses Service (SUS) data for the following purposes

Population health management:

- Understanding the interdependency of care services

- Targeting care more effectively

- Data Quality and Validation ʹallowing data quality checks on the submitted data

- Thoroughly investigating the needs of the population, to ensure the right services are available for individuals when and where they need them

- Understanding cohorts of residents who are at risk of becoming users of some of the more expensive services, to better understand and manage those needs

- Monitoring population health and care interactions to understand where people may slip through the net, or where the provision of care may be being duplicated

- Modelling activity across all data sets to understand how services interact with each other, and to understand how changes in one service may affect flows through another Service redesign

- Health Needs Assessment ʹidentification of underlying disease prevalence within the local population

- Patient stratification and predictive modelling - to identify specific patients at risk of requiring hospital admission and other avoidable factors such as risk of falls, computed using algorithms executed against linked de-identified data, and identification of future service delivery models

- Reviewing patient pathways to improve patient experience whilst reducing costs e.g. reduce the number of standard tests a patient may have and only have the ones, they need

The pseudonymised data is required to ensure that analysis of health care provision can be completed to support the needs of the health profile of the population within the Isle of Man area based on the full analysis of multiple pseudonymised datasets.

There will be no re-identification of individuals, although characteristics that define particular cohorts will be identified. An example of this would be a cohort of patients who have age related macular degeneration (ARMD) or at risk of developing ARMD, analysis of the pseudonymised data might lead to the establishment of a new specific service or redesign of the existing patient pathway to avoid excessive travel to the UK and use of NHS services.

Processing for commissioning will be conducted by Midlands and Lancashire Commissioning Support Unit and Manx Care.

DIRECT CARE

In the development of cohorts of pseudonymised patients considered to be at risk, the data controllers may need the facility to provide identifiable results back to direct health or care professionals for the purpose of direct care. Additionally clinicians, made aware of a number of cases that they believe would need intervention may request re-identification for that direct care purpose. These instances of re-identification will generally be carried out as programmes of work or, separately, on an individual/small group basis as a result of coincidental findings. The ICB does not have a statutory function to provide direct care and as such, does not see the identifiable data.

NHS Digital provides a re-identification service for this process. All re-id requests will be processed and authorised by NHS Digital on a case by case basis, including requests under a sub-licence. National data opt outs are not applied in these cases as they are for the purposes of direct care which follows the legal basis of implied consent. It is anticipated that this re-id ability in the future will allow risk stratification to be conducted under a single flow of pseudonymised data.

The following is a typical example of an instance where an ICB might want to use the re-identification process:

A&E High Attendance usage

The ICB can filter data to show for example the number of A&E attendances in a given period for each patient. The ICB can then flag to the relevant GP of the patient any patients who require intervention. An outcome of this is earlier intervention in the patient(s) care thus potentially reducing future costs and minimising future risk.

Processing activities

Data must only be used for the purposes stipulated within this Data Sharing Agreement. Any additional disclosure / publication will require further approval from NHS England.

Data Processors must only act upon specific instructions from the Data Controller.

Data can only be stored at addresses restricted to England/Wales and the Isle of Man.

All access to data is managed under Role-Based Access Controls. Users can only access data authorised by their role and the tasks that they are required to undertake.

Patient level data will not be linked other than as specifically detailed within this Data Sharing Agreement. Data released will only be shared with those parties listed and will only be used for the purposes laid out in the application/agreement.

NHS England reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data).

The users on the Isle of Man are limited to those public organisations that are legally part of Manx Care.

ONWARD SHARING:

Patient level data will not be shared outside of Manx Care unless it is for the purpose of Direct Care, where it may be shared only with those health professionals who have a legitimate relationship with the patient and a legitimate reason to access the data.

Aggregated reports only with small number suppression can be shared externally as set out within NHS England guidance applicable to each data set.

Segregation

Where the Data Processor and/or the Data Controller hold both identifiable and pseudonymised data, the data will be held separately so data cannot be linked.

Where the Data Processor and/or the Data Controller hold identifiable data with opt outs applied and identifiable data with opt outs not applied, the data will be held separately so data cannot be linked.

All access to data is audited

DATA MINIMISATION:

Data Minimisation in relation to the data sets listed within the application are listed below. This also includes the purpose on which they would be applied -

For the purpose of Commissioning:

• The Data Controller and any Data Processor will only have access to records of patients of residence and registration within the Isle of Man.

• Data will only be shared with those parties listed and will only be used for the purposes laid out in the application/agreement. The data to be released from NHS England will not be national data, but only that data relating patients who are resident in the Isle of Man and who have received treatment in England.

Microsoft Limited provide Cloud Services for NHS Midlands and Lancashire Commissioning Support Unit and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the Agreement. This includes granting of access to the database[s] containing the data.

Lima Networks Ltd supply IT infrastructure for NHS Midlands and Lancashire Commissioning Support Unit and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Government Technology Services a department of the Isle of Man Cabinet office supply IT infrastructure for Manx Care and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Netcetera and Manx Telecom do not access data held under this agreement as they only supply the building. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Commissioning

The Data Services for Commissioners Regional Office (DSCRO) obtains the following data sets:

1. SUS

Data quality management and pseudonymisation is completed within the DSCRO and is then disseminated as follows:

Data Processor 1 – Midlands and Lancashire Commissioning Support Unit

1) Pseudonymised SUS only is securely transferred from the DSCRO to Midlands and Lancashire Commissioning Support Unit.

2) Midlands and Lancashire Commissioning Support Unit add derived fields, link data and provide analysis to:

o See patient journeys for pathways or service design, re-design and de-commissioning

o Check recorded activity against contracts or invoices and facilitate discussions with providers.

o Undertake population health management

o Undertake data quality and validation checks

o Thoroughly investigate the needs of the population

o Understand cohorts of residents who are at risk

o Conduct Health Needs Assessments

3) Midlands and Lancashire Commissioning Support Unit then pass the processed, pseudonymised data to Manx Care.

4) Aggregation of required data for Manx Care management use will be completed by Midlands and Lancashire Commissioning Support Unit as instructed by Manx Care.

5) Patient level data will not be shared outside of Manx Care and will only be shared within Manx Care on a need to know basis, as per the purposes stipulated within the Data Sharing Agreement. External aggregated reports only with small number suppression can be shared.

DIRECT CARE

The Re-identification process for direct care is as follows:

1. The ICB identifies a patient cohort to be re-identified for the purpose of direct care.

2. The ICB sends a re-id request to the DSCRO. This may be done through the ICB or CSU’s Business Intelligence (BI) Tool, or through a manual form.

3. The DSCRO assesses as to whether the request passes the specified re-identification process checks. Checks include if the requester is authorised to access identifiable data, if the number of patients in the cohort is appropriate, and that the request does not seem inappropriate or outside of expected parameters, including for example around timings and the requestor’s relationship with patients in the data. These checks are carried out either by DSCRO staff using pre-approved information (timing’s, requester’s identity etc) or via an automated system.

4. For automated systems, steps 1 - 3 wouldn’t apply in most cases as it would be the direct care professional who identifies the cohort and as long as they are an approved re-id user and have gone through security checks initially, they will be able to re-id without further checks.

5. If successful/approved, the DSCRO re-identifies the relevant data item(s) for the appropriate patients and returns the identifiable fields to Health or Care professional(s) with a legitimate relationship to the patient. The ICB does not see the identifiable record.

6. DSCROs retain an audit trail of all re-id requests.

Expected output

Commissioning

The running of the data through the NHS Midlands and Lancashire Commissioning Support Unit standard tools was one of the major benefits that the NHS Midlands and Lancashire Commissioning Support Unit offered in terms of providing Manx Care with the assurance that payments made are valid (public accountability).

Ideally this dataset would be used by the CSU to analyse and monitor the current financial and activity positions

1. Commissioner reporting:

a. Summary by provider view - plan & actuals year to date (YTD).

b. Summary by Patient Outcome Data (POD) view - plan & actuals YTD.

c. Summary by provider view - activity & finance variance by POD.

d. Planned care by provider view - activity & finance plan & actuals YTD.

e. Planned care by POD view - activity plan & actuals YTD.

f. Provider reporting.

g. Delayed discharges.

h. Quality & performance referral to treatment reporting.

2. Readmissions analysis.

3. Production of aggregate reports for Business Intelligence.

4. Production of project / programme level dashboards.

5. Monitoring of acute / community / mental health quality matrix.

6. Clinical coding reviews / audits.

7. Budget reporting down to individual GP Practice level (IOM GPs only).

8. GP Practice level dashboard reports (IOM GPs only).

9. Data Quality and Validation measures allowing data quality checks on the submitted data

10. Contract Management and Modelling

11. Patient Stratification, such as:

o Patients at highest risk of admission

o Frail and elderly

o Patients who are currently in hospital

o Patients with most referrals to secondary care

o Patients with most emergency activity

o Patients with most expensive prescriptions

o Patients recently moving from one care setting to another

i. Discharged from hospital

ii. Discharged from community

Expected measurable benefits

Commissioning

1. Supporting Quality Innovation Productivity and Prevention (QIPP) to review demand management, integrated care and pathways.

a. Analysis to support full business cases.

b. Develop business models.

c. Monitor In year projects.

2. Supporting Joint Strategic Needs Assessment (JSNA) for specific disease types.

3. Health economic modelling using:

a. Analysis on provider performance against 18 weeks wait targets.

b. Learning from and predicting likely patient pathways for certain conditions, in order to influence early interventions and other treatments for patients.

c. Analysis of outcome measures for differential treatments, accounting for the full patient pathway.

d. Analysis to understand emergency care and linking A&E and Emergency Urgent Care Flows (EUCC).

4. Commissioning cycle support for grouping and re-costing previous activity.

5. Enables monitoring of:

a. Manx Care outcome indicators.

b. Financial and Non-financial validation of activity.

c. Successful delivery of integrated care within Manx Care.

d. Checking frequent or multiple attendances to improve early intervention and avoid admissions.

e. Case management.

f. Care service planning.

g. Commissioning and performance management.

h. List size verification by GP practices.

i. Understanding the care of patients in nursing homes.

6. Feedback to NHS service providers on data quality at an aggregate and individual record level – only on data initially provided by the service providers.

7. Improved planning capabilities. By better understanding patient flows through the healthcare system, commissioners will be able to design appropriate pathways to improve patient flow and identify priorities and identify plans to address these. For example reviews will be under taken at Speciality and Practice level to evaluate if certain practices are referring more patients for certain specialities that others to understand if this is genuine request or due to lack of expertise in that locality which may be supported by other GP practices.

8. The data allows the GP practices to better understand the needs of the locality and resources required to best support the patients within their practice list. This better understanding is expected to improve the quality of services including reducing the numbers of emergency readmissions, especially avoidable emergency admissions. This is achieved through mapping of frequent users of emergency services and incorporating early intervention of appropriate care into the patient pathway.

9. Improved access to services by identifying which services may be in demand but have poor access, and from this identify areas where improvement is required.

10. Better understanding of the health of and the variations in health outcomes within the population to help understand local population characteristics.

11. Better understanding of contract requirements, contract execution, and required services for management of existing contracts, and to assist with identification and planning of future contracts

12. Insights into patient outcomes, and identification of the possible efficacy of outcomes-based contracting opportunities.

13. Repatriation of patients – ensuring that patients receive the most appropriate service on island enhancing the patient experience.

14. Predicative modelling to reduce IOM residents receiving off island care to reduce UK NHS patient waiting lists, benefit to IOM and UK citizens.

15. The data will support the analysis of provision and effective commissioning of services in both the Isle of Man and England. Manx Care work with the NHS through cross border arrangements and commissioning of certain services in England that are not available in the Isle of Man.

Benefits reported so far

The use of the data has been limited to date as the expertise to gain better insight and understanding is still growing within the IOM team, as time progress’s more trending and analytics will be generated to support future reporting needs to gain greater benefits to both health economies.

One of the benefits of the data, it has highlighted the need for a full time plastics consultant to enhance the dermatology provision on the island, which has and will continue to reduce the patients from the IOM within the main UK system, only via the use of this data has this decision to support been possible. Another example, is the Age Related Macular Degeneration (ARMD) service which again is now predominately held on island – again improving the patient experience and reducing UK activity freeing up appointment slots etc.

The following are only a few examples of the specialties supported for Outpatient activity on UK mainland, there are a plethora of specialities which have benefitted from the use of the data to date:

· The IoM has identified a number of patients through the data travelling off Island for radiology scans. The IoM has recently invested in new CT scanners in the Islands main hospital, Noble’s Hospital, allowing all radiology scans bar PET scans to be delivered on Island. This has improved the patient experience by avoiding unnecessary travel off Island.

· Throughout the COVID-19 pandemic, the team have been closely looking at the data to repatriate as much IoM activity back to the Island which is safe to do so in order to reduce the risk of COVID-19 transmission through unnecessary travel off Island. This has enabled repatriation of some chemotherapy and neurological activity back to Island services. This has improved the patient experience by avoiding unnecessary travel off Island and also risk of exposure to COVID-19.

· The IoM has recently employed a substantive cardiologist. As the IoM has not had a substantive cardiologist for approximately 2 years, the cardiology department need to use the data to identify what activity could be safely repatriated back to the Island with the new substantive cardiologist in post. The IoM will be focusing specifically on pacing which is a specialism of IoM's new cardiologist. This will enable improved services and patient experience.

· The data also aids to improve the public’s health and wellbeing through all stages of the life course and in all settings will help to reduce inequalities and protect the vulnerable. By focusing on prevention and early intervention, the Directorate prioritises initiatives that will achieve change (improvement in lifestyle or reduction in risk factors) for the greatest numbers.

· The GP practice level dashboard reporting is currently at an early stage of development, just reporting by practice, activity by practice along with specialty and admission type along with costs. The data has provided the GP practices with a better understand the needs of the locality and resources required to best support the patients within their practice list.

Datasets on the latest version

Legal basis for provision: Health and Social Care Act 2012 – s261(2)(b)(ii)

Datasets approved under DARS-NIC-173508-F4X6P-v7.6
Dataset	Type of data	Sensitivity	Frequency	Confidential data
SUS for Commissioners	Anonymised - ICO Code Compliant	Sensitive	Frequent Adhoc Flow	Does not include the flow of confidential data

Files released

Files released counts only files released externally by DARS. Access granted in NHS England's own systems, such as its Secure Data Environment, is not included.

No files recorded as released under this agreement.

Version history

The register lists each renewal of this agreement as a separate row. This site has 7 versions — earlier versions existed before this site's records begin.

DARS-NIC-173508-F4X6P-v7.6 10 April 2023 to 9 April 2026

Title: Isle of Man Manx Care - Commissioning purposes
Commercial: No
Sublicensing: No
Datasets: 1
Files released: 0

Datasets: SUS for Commissioners

What changed from DARS-NIC-173508-F4X6P-v6.1

Text removed is ~~struck through~~; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Fields changed from DARS-NIC-173508-F4X6P-v6.1
Field	Was	Became
Title	~~Isle of Man Department of Health and Social Care - Commissioning purposes~~	Isle of Man Manx Care - Commissioning purposes
Start date	~~2021-04-01~~	2023-04-10
End date	~~2022-03-31~~	2026-04-09
SUS for Commissioners: legal basis	~~Health and Social Care Act 2012 - s261 - 'Other dissemination of information'~~	Health and Social Care Act 2012 – s261(2)(b)(ii)

Objective for processing

~~Currently patients~~ Patients on the Isle of Man ~~that~~ who require treatment from services not available on the Isle of Man ~~(IOM)~~ (IM) have to undertake travel to England/Wales to receive treatment. ~~The~~ Isle of Man Department of for Health and Social Care ~~team (IOMHSC)~~ (IM DHSC) wish to understand the rate of patients being sent to the mainland to assist in understanding what services require commissioning locally. Under this agreement, IOMHSC is the sole data controller. Both IOMHSC and NHS Midlands and Lancashire Commissioning Support Unit will process the data and therefore are listed as data processors. Manx Telecom and Netcetera provide the building for IOMHSC and do not access the data. Isle of Man Cabinet office supply IT infrastructure for IOMHSC and do not have access to the data. The data will be processed under GDPR Article 6(1)(e) and Article 9(2)(h). Manx Care was established under the Manx Care Act (2021). Enacted to discharge functions aimed at providing a comprehensive health and social care service. Manx Care has the statutory function of providing and arranging for the provision of health and social care service in the IM. ~~The Isle of Man is a crown-dependency but is not part of the UK and not a part of the EU or EEA. Therefore, for the Isle of Man to receive data an Adequacy Decision must be made.~~ Section 14 of the Manx Care Act (2021) describes the mandate of Manx Care as mandated by IM DHSC. Manx Care must seek to achieve the objectives specified in the mandate, and comply with any requirements specified in it. Under this agreement, Isle of Man Department for Health and Social Care is the sole data controller. Both Manx Care and NHS Midlands and Lancashire Commissioning Support Unit will process the data and therefore are listed as data processors. Manx Telecom and Netcetera provide the building for Manx Care and do not access the data. Isle of Man Cabinet office supply IT infrastructure for Manx Care and do not have access to the data. The data will be processed under GDPR Article 6(1)(e) and Article 9(2)(h). The IM is a crown-dependency but is not part of the UK and not a part of the EU or EEA. Therefore, for the Isle of Man to receive data an Adequacy Decision must be made. [2 paragraphs unchanged] The ~~IOM had an~~ IM received the European Commissions decision on adequacy ~~decision~~ before the UK left the ~~EU and it remains in force – adequacy~~ EU. Adequacy is entirely unconnected to the UK/EU relationship or the ~~UK/IOM~~ UK/IM crown dependency relationship. Transfers can still be made on the basis of [6 words unchanged] Data Protection Act (DPA) 2018 after the UK’s departure date from the ~~EU. The UK government has made a statement that the~~ EU ~~GDPR continues to apply until after 01/01/2021 including the provisions relating to international transfers, as such the EU adequacy decision remains supported for the IOM.~~ Provisions relating to international transfers are set out in Article 45 – “Transfers on the basis of an adequacy decision”. The UK government has confirmed adequacy for IM as well since adopting UK GDPR. Whilst the adequacy decisions remain in place, the UK GDPR applies. [4 paragraphs unchanged] The IOMHSC team will use pseudonymised Secondary Users Service (SUS) data to provide intelligence to support the commissioning of health services. The data (containing both clinical and financial information) is analysed, so that health care provision can be planned to support the needs of the population within Isle of Man area and put the patient at the centre of future redesign decisions. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/international-transfers/ The IOMHSC team commission services from a range of providers covering a wide array of services. Each of the data flow categories requested supports the commissioned activity of one or more providers. The following pseudonymised datasets are required to provide intelligence to support commissioning of health services, and look at ways to minimise the use of UK mainland services to raise the following benefits. The Manx Care team will use pseudonymised Secondary Users Service (SUS) data to provide intelligence to support the commissioning of health services. The data (containing both clinical and financial information) is analysed, so that health care provision can be planned to support the needs of the population within the Isle of Man area and put the patient at the centre of future redesign decisions. ~~• The minimisation of travel for ill patients travelling back and forth from IOM to UK mainland, by designing improved services on IOM shores.~~ The Manx Care team commission services from a range of providers covering a wide array of services. Each of the data flow categories requested supports the commissioned activity of one or more providers. The SUS data are required to provide intelligence to support commissioning of health services, and look at ways to minimise the use of UK mainland services to raise the following benefits. • The minimisation of travel for ill patients travelling back and forth from IM to UK mainland, by designing improved services on IM shores. [2 paragraphs unchanged] In addition, the ~~IOMHSC~~ Manx Care team require access to pseudonymised Secondary Uses Service (SUS) data for the following purposes - Population health management: [11 paragraphs unchanged] ~~For the removal of doubt, there will be no re-identification of individuals, although characteristics that define particular cohorts will be identified.~~ There will be no re-identification of individuals, although characteristics that define particular cohorts will be identified. An example of this would be a cohort of patients who have age related macular degeneration (ARMD) or at risk of developing ARMD, analysis of the pseudonymised data might lead to the establishment of a new specific service or redesign of the existing patient pathway to avoid excessive travel to the UK and use of NHS services. Processing for commissioning will be conducted by Midlands and Lancashire Commissioning Support ~~Unit.~~ Unit and Manx Care. DIRECT CARE In the development of cohorts of pseudonymised patients considered to be at risk, the data controllers may need the facility to provide identifiable results back to direct health or care professionals for the purpose of direct care. Additionally clinicians, made aware of a number of cases that they believe would need intervention may request re-identification for that direct care purpose. These instances of re-identification will generally be carried out as programmes of work or, separately, on an individual/small group basis as a result of coincidental findings. The ICB does not have a statutory function to provide direct care and as such, does not see the identifiable data. NHS Digital provides a re-identification service for this process. All re-id requests will be processed and authorised by NHS Digital on a case by case basis, including requests under a sub-licence. National data opt outs are not applied in these cases as they are for the purposes of direct care which follows the legal basis of implied consent. It is anticipated that this re-id ability in the future will allow risk stratification to be conducted under a single flow of pseudonymised data. The following is a typical example of an instance where an ICB might want to use the re-identification process: A&E High Attendance usage The ICB can filter data to show for example the number of A&E attendances in a given period for each patient. The ICB can then flag to the relevant GP of the patient any patients who require intervention. An outcome of this is earlier intervention in the patient(s) care thus potentially reducing future costs and minimising future risk.

Processing activities

Data must only be used for the purposes stipulated within this Data Sharing Agreement. Any additional disclosure / publication will require further approval from NHS ~~Digital.~~ England. [1 paragraph unchanged] Data can only be stored at addresses restricted to England/Wales and the ~~addresses listed under storage addresses.~~ Isle of Man. [2 paragraphs unchanged] NHS ~~Digital~~ England reminds all organisations party to this agreement of the need to comply [31 words unchanged] contractors of the Data Recipient who may have access to that data). The users on the Isle of Man are limited to those public organisations that are legally part of ~~the Isle of Man Government Department of Health and Social~~ Manx Care. [1 paragraph unchanged] Patient level data will not be shared outside of ~~the Isle of Man Department of Health and Social~~ Manx Care unless it is for the purpose of Direct Care, where it [12 words unchanged] relationship with the patient and a legitimate reason to access the data. Aggregated reports only with small number suppression can be shared externally as set out within NHS ~~Digital~~ England guidance applicable to each data set. [8 paragraphs unchanged] • Data will only be shared with those parties listed and will [6 words unchanged] laid out in the application/agreement. The data to be released from NHS ~~Digital~~ England will not be national data, but only that data relating patients who are resident in the Isle of Man and who have received treatment in England. [2 paragraphs unchanged] Government Technology Services a department of the Isle of Man Cabinet office supply IT infrastructure for ~~the Department of Health and Social~~ Manx Care and are therefore listed as a data processor. They supply support [25 words unchanged] agreement. This includes granting of access to the database[s] containing the data. [15 paragraphs unchanged] 3) Midlands and Lancashire Commissioning Support Unit then pass the processed, pseudonymised data to ~~Isle of Man Department of Health and Social~~ Manx Care. 4) Aggregation of required data for ~~Isle of Man Department of Health and Social~~ Manx Care management use will be completed by Midlands and Lancashire Commissioning Support Unit as instructed by ~~Isle of Man Department of Health and Social Care~~ Manx Care. 5) Patient level data will not be shared outside of ~~Isle of Man Department of Health and Social~~ Manx Care and will only be shared within ~~Isle of Man Department of Health and Social~~ Manx Care on a need to know basis, as per the purposes stipulated within the Data Sharing Agreement. External aggregated reports only with small number suppression can be shared. DIRECT CARE The Re-identification process for direct care is as follows: 1. The ICB identifies a patient cohort to be re-identified for the purpose of direct care. 2. The ICB sends a re-id request to the DSCRO. This may be done through the ICB or CSU’s Business Intelligence (BI) Tool, or through a manual form. 3. The DSCRO assesses as to whether the request passes the specified re-identification process checks. Checks include if the requester is authorised to access identifiable data, if the number of patients in the cohort is appropriate, and that the request does not seem inappropriate or outside of expected parameters, including for example around timings and the requestor’s relationship with patients in the data. These checks are carried out either by DSCRO staff using pre-approved information (timing’s, requester’s identity etc) or via an automated system. 4. For automated systems, steps 1 - 3 wouldn’t apply in most cases as it would be the direct care professional who identifies the cohort and as long as they are an approved re-id user and have gone through security checks initially, they will be able to re-id without further checks. 5. If successful/approved, the DSCRO re-identifies the relevant data item(s) for the appropriate patients and returns the identifiable fields to Health or Care professional(s) with a legitimate relationship to the patient. The ICB does not see the identifiable record. 6. DSCROs retain an audit trail of all re-id requests.

Expected output

[1 paragraph unchanged] The running of the data through the NHS Midlands and Lancashire Commissioning [12 words unchanged] NHS Midlands and Lancashire Commissioning Support Unit offered in terms of providing ~~Isle of Man Department of Health and Social~~ Manx Care with the assurance that payments made are valid (public accountability). [21 paragraphs unchanged] ~~o High cost activity uses (top 15%)~~ [1 paragraph unchanged] o Patients ~~that~~ who are currently in hospital [6 paragraphs unchanged]

Expected measurable benefits

[13 paragraphs unchanged] a. ~~Isle of Man Department of Health and Social~~ Manx Care outcome indicators. [1 paragraph unchanged] c. Successful delivery of integrated care within ~~the Isle of Man Department of Health and Social~~ Manx Care. [15 paragraphs unchanged] 15. The data will support the analysis of provision and effective commissioning of services in both the Isle of Man and England. ~~The Isle of Man Department of Health and Social~~ Manx Care work with the NHS through cross border arrangements and commissioning of certain services in England that are not available in the Isle of Man.

Benefits reported

[5 paragraphs unchanged] · The IoM has recently employed a substantive ~~cardiologist who is due to start on Island shortly.~~ cardiologist. As the IoM has not had a substantive cardiologist for approximately 2 [40 words unchanged] of IoM's new cardiologist. This will enable improved services and patient experience. · The data also aids to improve the public’s health and wellbeing through [34 words unchanged] (improvement in lifestyle or reduction in risk factors) for the greatest numbers. · The GP practice level dashboard reporting is currently at an early stage [34 words unchanged] and resources required to best support the patients within their practice list.

DARS-NIC-173508-F4X6P-v6.1 1 April 2021 to 31 March 2022

Title: Isle of Man Department of Health and Social Care - Commissioning purposes
Commercial: No
Sublicensing: No
Datasets: 1
Files released: 0

Datasets: SUS for Commissioners

What changed from DARS-NIC-173508-F4X6P-v5.2

Text removed is ~~struck through~~; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Fields changed from DARS-NIC-173508-F4X6P-v5.2
Field	Was	Became
Start date	~~2021-01-01~~	2021-04-01
End date	~~2021-03-31~~	2022-03-31
Commercial purposes	~~Yes~~	No

Objective for processing

Currently patients on the Isle of Man that require treatment from services not available on the Isle of Man ~~(IOM)and~~ (IOM) have to undertake travel to England/Wales to receive treatment. The Isle of [18 words unchanged] to the mainland to assist in understanding what services require commissioning locally. Under this agreement, IOMHSC is the sole data controller. Both IOMHSC and [39 words unchanged] IT infrastructure for IOMHSC and do not have access to the data. IT The data will be processed under GDPR Article 6(1)(e) and Article 9(2)(h). The Isle of Man is a crown-dependency but is not part of the UK and not a part of the EU or EEA. Therefore, for the Isle of Man to receive data an Adequacy Decision must be made. The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection, whether by its domestic legislation or the international commitments it has entered into. The European Commission has recognised the Isle of Man as providing adequate protection. [10 paragraphs unchanged] In addition, the IOMHSC team require access to pseudonymised Secondary Uses Service (SUS) data ~~is required to~~ for the following purposes [3 paragraphs unchanged] ~~- Using value as the redesign principle~~ [11 paragraphs unchanged] ~~The Isle of Man is a crown-dependency but is not part of the UK and not a part of the EU or EEA. Therefore, for the Isle of Man to receive data an Adequacy Decision must be made.~~ The European Commission has the power to determine, on the basis of article 45 of Regulation (EU) 2016/679 whether a country outside the EU offers an adequate level of data protection, whether by its domestic legislation or the international commitments it has entered into. ~~The European Commission has recognised the Isle of Man as providing adequate protection.~~

Benefits reported

[2 paragraphs unchanged] The following are only a few examples of the specialties supported for Outpatient activity on UK ~~mainland:~~ mainland, there are a plethora of specialities which have benefitted from the use of the data to date: ~~Speciality~~ · The IoM has identified a number of patients through the data travelling off Island for radiology scans. The IoM has recently invested in new CT scanners in the Islands main hospital, Noble’s Hospital, allowing all radiology scans bar PET scans to be delivered on Island. This has improved the patient experience by avoiding unnecessary travel off Island. ~~100 - General Surgery Service~~ · Throughout the COVID-19 pandemic, the team have been closely looking at the data to repatriate as much IoM activity back to the Island which is safe to do so in order to reduce the risk of COVID-19 transmission through unnecessary travel off Island. This has enabled repatriation of some chemotherapy and neurological activity back to Island services. This has improved the patient experience by avoiding unnecessary travel off Island and also risk of exposure to COVID-19. ~~105 - Hepatobiliary and Pancreatic Surgery Service~~ · The IoM has recently employed a substantive cardiologist who is due to start on Island shortly. As the IoM has not had a substantive cardiologist for approximately 2 years, the cardiology department need to use the data to identify what activity could be safely repatriated back to the Island with the new substantive cardiologist in post. The IoM will be focusing specifically on pacing which is a specialism of IoM's new cardiologist. This will enable improved services and patient experience. ~~110 - Trauma and Orthopaedic Service~~ ~~120 - Ear Nose and Throat Service~~ ~~130 - Ophthalmology Service~~ ~~150 - Neurosurgical Service~~ ~~216 - Paediatric Ophthalmology Service~~ ~~262 - Paediatric Rheumatology Service~~ ~~301 - Gastroenterology Service~~ ~~302 - Endocrinology Service~~ ~~304 - Clinical Physiology Service~~ ~~306 - Hepatology Service~~ ~~309 - Haemophilia Service~~ ~~320 - Cardiology Service~~ ~~340 - Respiratory Medicine Service~~ ~~361 - Renal Medicine Service~~ ~~401 - Clinical Neurophysiology Service~~ ~~410 - Rheumatology Service~~ ~~501 - Obstetrics Service~~ ~~560 - Midwifery Service~~ ~~650 - Physiotherapy Service~~ ~~654 - Dietetics Service~~ ~~811 - Interventional Radiology Service~~ ~~812 - Diagnostic Imaging Service~~ [2 paragraphs unchanged]

Unchanged: Processing activities, Expected output, Expected measurable benefits.

Objective for processing

Currently patients on the Isle of Man that require treatment from services not available on the Isle of Man (IOM) have to undertake travel to England/Wales to receive treatment. The Isle of Man Department of Health and Social Care team (IOMHSC) wish to understand the rate of patients being sent to the mainland to assist in understanding what services require commissioning locally.

Under this agreement, IOMHSC is the sole data controller. Both IOMHSC and NHS Midlands and Lancashire Commissioning Support Unit will process the data and therefore are listed as data processors. Manx Telecom and Netcetera provide the building for IOMHSC and do not access the data. Isle of Man Cabinet office supply IT infrastructure for IOMHSC and do not have access to the data. The data will be processed under GDPR Article 6(1)(e) and Article 9(2)(h).

The Isle of Man is a crown-dependency but is not part of the UK and not a part of the EU or EEA. Therefore, for the Isle of Man to receive data an Adequacy Decision must be made.

The European Commission has recognised the Isle of Man as providing adequate protection.

The IOM had an adequacy decision before the UK left the EU and it remains in force – adequacy is entirely unconnected to the UK/EU relationship or the UK/IOM crown dependency relationship. Transfers can still be made on the basis of an adequacy decision under the UK Data Protection Act (DPA) 2018 after the UK’s departure date from the EU. The UK government has made a statement that the EU GDPR continues to apply until after 01/01/2021 including the provisions relating to international transfers, as such the EU adequacy decision remains supported for the IOM. Provisions relating to international transfers are set out in Article 45 – “Transfers on the basis of an adequacy decision”.

The government's statement on EU adequacy decisions being sufficient post Brexit can be found here:

https://www.gov.uk/guidance/using-personal-data-in-your-business-or-other-organisation-after-the-transition-period

That position is also reflected in the ICO guidance here:

https://ico.org.uk/for-organisations/data-protection-at-the-end-of-the-transition-period/data-protection-at-the-end-of-the-transition-period/the-gdpr/international-data-transfers/

The IOMHSC team will use pseudonymised Secondary Users Service (SUS) data to provide intelligence to support the commissioning of health services. The data (containing both clinical and financial information) is analysed, so that health care provision can be planned to support the needs of the population within Isle of Man area and put the patient at the centre of future redesign decisions.

The IOMHSC team commission services from a range of providers covering a wide array of services. Each of the data flow categories requested supports the commissioned activity of one or more providers. The following pseudonymised datasets are required to provide intelligence to support commissioning of health services, and look at ways to minimise the use of UK mainland services to raise the following benefits.

• The minimisation of travel for ill patients travelling back and forth from IOM to UK mainland, by designing improved services on IOM shores.

• By reducing demand on the UK providers, this will create capacity within UK providers, to support other services, in a currently over stretched environment.

• Review current methods of support, and look to embrace telephone/Video capability to reduce the need for travelling long times for ill patients especially around follow up consultations.

In addition, the IOMHSC team require access to pseudonymised Secondary Uses Service (SUS) data for the following purposes

- Population health management:

- Understanding the interdependency of care services

- Targeting care more effectively

- Data Quality and Validation ʹallowing data quality checks on the submitted data

- Thoroughly investigating the needs of the population, to ensure the right services are available for individuals when and where they need them

- Understanding cohorts of residents who are at risk of becoming users of some of the more expensive services, to better understand and manage those needs

- Monitoring population health and care interactions to understand where people may slip through the net, or where the provision of care may be being duplicated

- Modelling activity across all data sets to understand how services interact with each other, and to understand how changes in one service may affect flows through another Service redesign

- Health Needs Assessment ʹidentification of underlying disease prevalence within the local population

- Reviewing patient pathways to improve patient experience whilst reducing costs e.g. reduce the number of standard tests a patient may have and only have the ones, they need

For the removal of doubt, there will be no re-identification of individuals, although characteristics that define particular cohorts will be identified.

Processing for commissioning will be conducted by Midlands and Lancashire Commissioning Support Unit.

Expected output

Commissioning

The running of the data through the NHS Midlands and Lancashire Commissioning Support Unit standard tools was one of the major benefits that the NHS Midlands and Lancashire Commissioning Support Unit offered in terms of providing Isle of Man Department of Health and Social Care with the assurance that payments made are valid (public accountability).

Ideally this dataset would be used by the CSU to analyse and monitor the current financial and activity positions

1. Commissioner reporting:

a. Summary by provider view - plan & actuals year to date (YTD).

b. Summary by Patient Outcome Data (POD) view - plan & actuals YTD.

c. Summary by provider view - activity & finance variance by POD.

d. Planned care by provider view - activity & finance plan & actuals YTD.

e. Planned care by POD view - activity plan & actuals YTD.

f. Provider reporting.

g. Delayed discharges.

h. Quality & performance referral to treatment reporting.

2. Readmissions analysis.

3. Production of aggregate reports for Business Intelligence.

4. Production of project / programme level dashboards.

5. Monitoring of acute / community / mental health quality matrix.

6. Clinical coding reviews / audits.

7. Budget reporting down to individual GP Practice level (IOM GPs only).

8. GP Practice level dashboard reports (IOM GPs only).

9. Data Quality and Validation measures allowing data quality checks on the submitted data

10. Contract Management and Modelling

11. Patient Stratification, such as:

o Patients at highest risk of admission

o High cost activity uses (top 15%)

o Frail and elderly

o Patients that are currently in hospital

o Patients with most referrals to secondary care

o Patients with most emergency activity

o Patients with most expensive prescriptions

o Patients recently moving from one care setting to another

i. Discharged from hospital

ii. Discharged from community

Benefits reported

The following are only a few examples of the specialties supported for Outpatient activity on UK mainland, there are a plethora of specialities which have benefitted from the use of the data to date:

· The IoM has recently employed a substantive cardiologist who is due to start on Island shortly. As the IoM has not had a substantive cardiologist for approximately 2 years, the cardiology department need to use the data to identify what activity could be safely repatriated back to the Island with the new substantive cardiologist in post. The IoM will be focusing specifically on pacing which is a specialism of IoM's new cardiologist. This will enable improved services and patient experience.

The data also aids to improve the public’s health and wellbeing through all stages of the life course and in all settings will help to reduce inequalities and protect the vulnerable. By focusing on prevention and early intervention, the Directorate prioritises initiatives that will achieve change (improvement in lifestyle or reduction in risk factors) for the greatest numbers.

The GP practice level dashboard reporting is currently at an early stage of development, just reporting by practice, activity by practice along with specialty and admission type along with costs. The data has provided the GP practices with a better understand the needs of the locality and resources required to best support the patients within their practice list.

DARS-NIC-173508-F4X6P-v5.2 1 January 2021 to 31 March 2021

Title: Isle of Man Department of Health and Social Care - Commissioning purposes
Commercial: Yes
Sublicensing: No
Datasets: 1
Files released: 0

Datasets: SUS for Commissioners

What changed from DARS-NIC-173508-F4X6P-v4.2

Text removed is ~~struck through~~; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Fields changed from DARS-NIC-173508-F4X6P-v4.2
Field	Was	Became
Start date	~~2020-08-01~~	2021-01-01
End date	~~2020-12-31~~	2021-03-31
SUS for Commissioners: legal basis	~~Health and Social Care Act 2012 – s261(2)(b)(ii)~~	Health and Social Care Act 2012 - s261 - 'Other dissemination of information'

Objective for processing

Currently patients on the Isle of Man that require treatment from services not available on the Isle of Man ~~and~~ (IOM)and have to undertake travel to England/Wales to receive treatment. The Isle of [18 words unchanged] to the mainland to assist in understanding what services require commissioning locally. Under this agreement, IOMHSC is the sole data controller. Both IOMHSC and NHS Midlands and Lancashire Commissioning Support Unit will process the data and therefore [39 words unchanged] The data will be processed under GDPR Article 6(1)(e) and Article 9(2)(h). The ~~Isle of Man~~ IOM had an adequacy decision before the UK left the EU and it [21 words unchanged] be made on the basis of an adequacy decision under the UK ~~DPA2018 as prior to~~ Data Protection Act (DPA) 2018 after the UK’s departure date from the EU. The UK ~~DPA2018 remains in force, as is, until January 2021 (i.e. end of transition period). The~~ government has made a statement that the EU GDPR continues to apply until ~~that date,~~ after 01/01/2021 including the provisions relating to international ~~transfers. They~~ transfers, as such the EU adequacy decision remains supported for the IOM. Provisions relating to international transfers are set out in Article 45 – “Transfers on the basis of an adequacy decision”. The government's statement on EU adequacy decisions being sufficient post Brexit can be found here: https://www.gov.uk/guidance/using-personal-data-in-your-business-or-other-organisation-after-the-transition-period That position is also reflected in the ICO guidance here: https://ico.org.uk/for-organisations/data-protection-at-the-end-of-the-transition-period/data-protection-at-the-end-of-the-transition-period/the-gdpr/international-data-transfers/ [24 paragraphs unchanged]

Expected output

[1 paragraph unchanged] The running of the data through the NHS Midlands and Lancashire Commissioning Support Unit standard tools was one of the major benefits that the NHS Midlands and Lancashire Commissioning Support Unit offered in terms of providing Isle [6 words unchanged] Social Care with the assurance that payments made are valid (public accountability). [30 paragraphs unchanged]

Unchanged: Processing activities, Expected measurable benefits, Benefits reported.

Objective for processing

Currently patients on the Isle of Man that require treatment from services not available on the Isle of Man (IOM)and have to undertake travel to England/Wales to receive treatment. The Isle of Man Department of Health and Social Care team (IOMHSC) wish to understand the rate of patients being sent to the mainland to assist in understanding what services require commissioning locally.

Under this agreement, IOMHSC is the sole data controller. Both IOMHSC and NHS Midlands and Lancashire Commissioning Support Unit will process the data and therefore are listed as data processors. Manx Telecom and Netcetera provide the building for IOMHSC and do not access the data. Isle of Man Cabinet office supply IT infrastructure for IOMHSC and do not have access to the data. IT The data will be processed under GDPR Article 6(1)(e) and Article 9(2)(h).

The government's statement on EU adequacy decisions being sufficient post Brexit can be found here:

https://www.gov.uk/guidance/using-personal-data-in-your-business-or-other-organisation-after-the-transition-period

That position is also reflected in the ICO guidance here:

https://ico.org.uk/for-organisations/data-protection-at-the-end-of-the-transition-period/data-protection-at-the-end-of-the-transition-period/the-gdpr/international-data-transfers/

• The minimisation of travel for ill patients travelling back and forth from IOM to UK mainland, by designing improved services on IOM shores.

• By reducing demand on the UK providers, this will create capacity within UK providers, to support other services, in a currently over stretched environment.

• Review current methods of support, and look to embrace telephone/Video capability to reduce the need for travelling long times for ill patients especially around follow up consultations.

In addition, the IOMHSC team require access to pseudonymised Secondary Uses Service (SUS) data is required to for the following purposes

- Population health management:

- Understanding the interdependency of care services

- Targeting care more effectively

- Using value as the redesign principle