The relationship between education and health outcomes for children and young people across England: the value of using linked administrative data.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[2 paragraphs unchanged] The legal basis for processing personal data for this purpose data at UCL falls under Article 6(1)(e) of the General Data Protection Regulations (GDPR), i.e. a task carried out in the public interest. University College London (UCL) is a public authority and has a royal charter (see: https://www.ucl.ac.uk/governance-compliance/sites/governance_compliance/files/charter-and-statutes.pdf) which states that "The objects of the College shall be to provide education and courses of study in the fields of… Medicine and Medical Sciences, Social Sciences and Applied Sciences and… to encourage research in the said branches of knowledge and learning and to organise, encourage and stimulate postgraduate study in such branches.". The legal basis also falls under Article 9(2)(j), processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. This research is expected to have substantial public benefit by providing evidence on the quality of linkage between health and education data and by addressing relevant policy, healthcare and NHS systems questions on the association between child health and education. [9 paragraphs unchanged] For this programme of research, UCL are the sole Data Controller who also process data. The Office for National Statistics (ONS) are also data processors. This programme of research uses NPD attribute data from the DfE. Agreement DR190416.03 relates to the NPD attribute data that is accessed by University College London within the ONS Secure Research Services. A separate agreement DR150701.02 relates to the NPD identifiable data that are used by NHS Digital for the linkage that facilitates the analysis of the attribute data (this has now been completed). Further details are found in ‘5b. Processing activities’ [1 paragraph unchanged] Linkage will be conducted by NHS Digital using identifiers supplied by DfE (forename, surname, date of birth, sex and postcode) captured in each school year. Identifiers will be matched initially to PDS and then to HES and de-identified. UCL will then receive the pseudonymised HES data from NHS Digital together with a Study_ID supplied by DfE. DfE will supply de-identified NPD data together with a Study_ID. Research from DARS-NIC-27404 also forms a baseline for evaluation of the larger linkage used in DARS-NIC-381972 ‘Assessing the impact of the COVID-19 pandemic on vulnerable children: the ECHILD-COVID study’, which is producing scientific and statistical evidence on the impact of the Covid19 pandemic on vulnerable children and families. Linkage has been conducted by NHS Digital using identifiers supplied by DfE (forename, surname, date of birth, sex and postcode) captured in each school year. Identifiers were matched initially to PDS and then to HES and de-identified. UCL then received the pseudonymised HES data from NHS Digital together with a Study_ID supplied by DfE. DfE will supply de-identified NPD data together with a Study_ID. [18 paragraphs unchanged]

Processing activities

Analyses for RQ1: The HES data provided by NHS Digital and NPD data provided by DfE are for the one-year birth cohorts comprising records for all children specified in the following cohorts: The researcher will analyse outcomes for all CYP, and compare differences in health outcomes (e.g. emergency hospital contacts, deaths) between groups classified as vulnerable or not (stratified by age group), in the years before, compared with after, COVID-19 onset. Descriptive analyses will explore whether changes post-COVID-19 reflect increased risks of contacts related to infection, mental health, adversity, or acute complications of chronic or complex health conditions for all CYP, and according to whether they had indices for vulnerability or not. The researcher will use diagnostic and procedure codes, and types of hospital contact (eg emergency/elective admission), recorded in HES, to infer whether hospital contacts are related to underlying chronic conditions. Preliminary results October 2020. Cohort 1: Born between 01/09/90-31/08/91 Analyses for RQ2: Cohort 2: Born between 01/09/96-31/08/97 The researcher will model expected healthcare contacts for all CYP after the onset of the COVID-19 pandemic, based on observed trajectories of healthcare contact for CYP for periods prior to the start of COVID-19. The researcher will assess potential unmet healthcare need, according to age and vulnerability status, by comparing expected vs observed healthcare contacts after COVID-19 onset. Differences between expected and observed new diagnoses and interventions, will be used to infer potential unmet need. The researcher will vary their assumptions about whether and when these healthcare needs may manifest, and whether deferred presentation is likely to be more severe. The researcher will estimate how much deferred healthcare use could add to predicted rates of healthcare contacts in the post-COVID-19 period, and potential long-term outcomes of COVID-19 restrictions. Preliminary results in Jan 2021. Cohort 3: Born between 01/09/99-31/08/00 The researcher will also conduct analyses of all CYP to explore associations between inequalities (using index of multiple deprivation), ethnic group, and vulnerable vs other CYP, and outcomes measured in health care, NPD data (i.e. education and CiN/CLA) in periods before, during and after the COVID-19 pandemic. The researcher will refresh the linked NPD datasets annually in 2021 and 2022 to evaluate the longer-term impacts of COVID-19 infection and response on health, education and social care outcomes for vulnerable, compared with other CYP. Cohort 4: Born between 01/09/04-31/08/05 To address these research questions, HES (APC, A&E, OPD, ECDS, critical care) and death registration data (HES-mortality data) provided by NHS Digital will be linked to administrative data from the National Pupil Dataset (NPD) provided by the Department for Education (DfE) to the ONS SRS. Using a pseudonymised linkage key, these datasets will be linked for all children and young people (CYP) born in England on or after 1.9.1995. The linkage of identifiers was conducted separately from attribute data (clinical or education characteristics) by NHS Digital. NHS Digital transferred pseudonymised HES IDs for those who were successfully linked and were released, together with the match rank and anonymized Pupil Matching Reference (PMR) as permitted by DfE. The definition of pseudonymisation is where direct identifiers have been removed from the data extract; identifiers refer to fields such as names, sex, date of birth, full post code. UCL researchers will use the transferred HES IDs to append match status to linked records in pseudonymised HES data (previously approved as NIC-393510). Linkage of identifiers from HES-mortality data and NPD will be conducted at NHS Digital which will then only transfer the pseudonymised linkage key to the UCL Data Safe Haven to flag linked records in the UCL-curated HES extract for transfer to the ONS SRS. NPD attributable data will only be available in the ONS SRS. Using the pseudonymised linkage key, linkage of pseudonymised attribute data (clinical or education characteristics) will then occur separately, at the ONS Secure Research Service (SRS). The following outline describes the complete data flow and details how identifiable and non-identifiable data extracts will be handled: The HES pseudonymised attribute data for the four cohorts, with an indicator of match rank provided by NHS Digital, was transferred to the Office of National Statistics Secure Research Service (ONS SRS) with HES ID and anonymised PMR for linkage, including only the month and year of birth and death. 1) DfE will supply the Trusted Third Party (NHS Digital) with a list of NPD identifier variables, these identifiers include name, date of birth, full postcode and sex, alongside a study specific pseudonymised linkage key known as the anonymized Pupil Matching Reference (aPMR). The identifying variables will be used for linkage to the Personal Demographic Service (PDS) (as previously done for NIC 27404). DfE will transfer the variables for any CYP born on or after cohort inception (1.9.95). The following outline describes how identifiable and non-identifiable extracts from the data scheme were handled. 2) NHS Digital will match the identifiers from DfE to records held in the PDS using an algorithm that makes use of the chronology of postcodes in NPD and PDS. Matching to PDS data will be done internally within NHS Digital, no PDS data will be disseminated to ONS SRS or UCL Data Safe Haven. 1) DfE supplied the Trusted Third Party (NHS Digital) with a list of NPD identifier variables, including name and postcode histories, alongside a study specific pseudo-identifier number (Study_ID, known as the anonymized PMR) for children in PDS. 3) For those CYP whose NPD identifiers were matched to PDS, onward linkage to HES-mortality data will occur within NHS Digital to link aPMRs and HES-IDs. NHS Digital will then transfer encrypted HES-IDs, aPMRs, and indicators of match rank (denoting the step at which the match to HES and PDS was made) for these linked cases to the UCL Data Safe Haven for linkage to the existing HES-mortality extract held by UCL (NIC-393510). 2) NHS Digital matched the identifiers from DfE to records held in the PDS using an algorithm that prioritises the most recent post code in NPD (at the school census date). Matching to PDS data was done internally within NHS Digital, no PDS data will be disseminated to UCL. 4) UCL will extract the HES-mortality data for all CYP born on or after 1.9.1995, using the existing HES extract (NIC 393510), and link the aPMR and match rank statistics for those CYP that were linked by NHS Digital in step (3) from NPD. The de-identified HES-mortality extract will be transferred to the ONS SRS. Only month/year of birth and death will be transferred to the ONS SRS, in order to account for well-established effects of month of birth on school achievement (i.e. research consistently shows that children born in September do better than children born in July/August). The attribute data will also include high-level categorical maternal indicators relevant to birth (e.g. parity – 0, 1, 2+ prior births), which have an important bearing on child health. These derived health indicators are created by analysing variables in our analysis files, that are covered by this DSA (e.g. diagnosis codes and baby tail) and for which we have the appropriate permissions. 3) The PDS identifiers were linked to HES data. HES IDs for linked cases were then transferred to the UCL safe haven for identification within the existing HES extract held by UCL (NIC-393510). The anonymised PMR from the records that NHS Digital linked were also sent to UCL. 5) DfE will supply ONS SRS with requested de-identified attribute data extracts, with the aPMR for all CYP born on or after 1.9.1995. The deidentified attribute NPD and HES data will be linked within the ONS SRS by the research team, using the aPMR. Data will only be used by researchers authorised for the project, with strict output controls applied by ONS SRS staff. The identifiable data supplied to NHS Digital for steps 1-3 has since been destroyed as these steps have now been completed. 6) The final data set that will be used for analyses will remain within the ONS SRS. The files will not contain any identifiable data. No additional record level data will be gathered or linked to the dataset. The aPMR is the only variable supplied from NPD data that is supplied by NHS Digital to UCL Data Safe Haven and then to ONS SRS. 4) UCL created four cohorts of all HES records for children born in years of cohorts 1 to 4 (admissions, critical care, A&E and OPD) and fact and date of death from the existing HES data (NIC-393510). These cohorts were transferred for linkage to the NPD data held in the ONS SRS. The deidentified, linked data are used by researchers authorised only for this project. Only month/year of birth and death were transferred to the ONS SRS, in order to account for well-established effects of month of birth on school achievement (i.e. research consistently shows that children born in September do better than children born in July/August). The anonymized PMR and metrics of the match rank of linkage provided by NHS Digital were also transferred to enable linkage with the NPD data and assessment of linkage accuracy. 7) NHS Digital will retain the identifier file of all individuals linked in NPD-PDS and PDS-HES and all the postcodes used in linkage and postcode dates for 12 months to address data queries or potential linkage errors. This data set will not contain any attribute data and will be accessible only to NHS Digital staff. At the end of the 12 months, NHS Digital will confirm deletion of the data to DfE. NHS Digital will not send confidential data to DfE or UCL DSH. 5) DfE supplied ONS SRS with requested (attribute) data extracts, alongside the anonymised PMR for children in Cohorts 1 to 4. There was no identifiable information in the extract sent. This extract was placed in the ONS SRS for linkage using anonymized PMRs to the 4 HES cohorts and analyses by researchers authorized for this project. 6) The final data set that is being used for analyses within the ONS SRS. The files not contain any identifiable data. No additional record level data data will be gathered or linked to the dataset. The anonymised PMR is the only variable supplied from NPD data that is supplied by NHS Digital to UCL Data Safe Haven. 7) NHS Digital retained the identifier file of all individuals linked in NPD-PDS and PDS-HES and all the postcodes used in linkage and postcode dates for 12 months to address data queries. This data set will not contain any attribute data and will be accessible only to NHS Digital staff. This has now been destroyed. The following methodology was proposed for the linkage by NHS Digital: The current MIDAS algorithm will be modified to consider the 15 most recent postcodes in PDS, ranked according to distance from the date associated with the NPD postcode. For remaining unmatched NPD records, the second postcode in NPD will then be compared with PDS as above. This approach will be repeated up to a maximum of 5 postcodes in NPD or until a match is achieved with PDS. This is necessary because ignoring address changes in PDS after the school census date in NPD would increase the number of missed matches. For example, although NPD postcode might be correct in September, PDS postcode in the subsequent months until the next census is more likely to be the most recent postcode. NHS Digital will not send confidential data to DfE. DATA SECURITY To maintain the physical and technical security measures, the following safeguards will be in place: 1) Data linkage: Linkage between identifiers supplied for the NPD with PDS and HES will be carried out by a Trusted Third Party (NHS Digital) . The NHS Digital team undertaking the linkage will only have access to identifiers from PDS and HES for hospital administrative data and they will receive full identifiers from DfE for NPD data. These identifiers include name, date of birth, full postcode and sex. No additional attribute data will be provided. These identifiers will be removed and replaced with the pseudonymised Study ID (anonymized PMR) and HES ID assigned to each child in the cohort before release to the UCL Safe Haven. The original file was retained by the Trusted Third Party for 12 months to address queries about the linkage accuracy. This identifier data has now been deleted by NHS Digital. As a consequence, the UCL researchers will not have access to the identifiers and the NHS Digital team undertaking the linkage received full identifiers from DfE for NPD data (inc. name, date of birth, full post code and sex) but no additional attribute data was provided. 2) Minimising data disclosure: HES pseudonymised attribute data for the 4 cohorts was transferred into the ONS SRS for access only for the purposes of this project. De-identified linkage between HES and NPD was done by remote secure access to the SRS from the UCL safe room. UCL will minimise disclosure risks by transferring only year and month of death and birth, LSOA decile rather than rank, location defined only by area indicators (eg local authority) in the four HES cohorts transferred to the ONS SRS. During analyses, the UCL researchers will minimise the potential for deductive disclosure, by limiting the presentation of specific information that could potentially identify any individual in the cohort. Statistical disclosure control measures will be applied according to HES requirements by ONS data scientists operating within the SRS. 3) Limited access: The de-identified linked HES-NPD data will be held on the ONS SRS accessible remotely from the UCL safe haven which has restricted and monitored access. No record level data can be removed from the SRS and statistical disclosure controls are applied by ONS staff. The project has Administrative Data Research Network (ADRN) panel approval and Research Ethics Committee (REC) approval: 17/LO/1494. Access will be restricted to named users, who are part of the study team and are accessing the data for purposes outlined in this DSA. Access to the data is via the ONS SRS environment. 4) Limiting outputs: The data analyses are conducted on the ONS Secure Research Service. Detailed individual level child data cannot leave the ONS Secure Research Service. Results of analyses can be exported by a secure encrypted transfer system, which his audited. Any outputs from analyses that are published have to meet statistical disclosure controls that prevent small sizes in accordance with NHS Digital and DfE requirements. Tabulations of aggregate data are assessed for statistical disclosure control and authorized for export by an ONS data scientist not involved in the project. [16 paragraphs unchanged] DATA ANALYSIS Any outputs will contain only aggregated data that complies with the small number suppression rules in the HES Analysis Guide. The analyses of the linked data set will involve the following steps. These will be concurrent with the evaluation of linkage accuracy: i) Create inception cohorts of children (a) defined by births (Cohorts 3 and 4) (b) entry to primary school (Cohorts 1 and 2) ii) Examine characteristics of linked and unlinked cohorts to determine impact of linkage error. iii) Characterise children according to past admissions and history of chronic conditions in HES-mortality data. iv) Determine variation in school achievement taking into account health care history and chronic condition status (based on admissions in previous years). v) Determine association between school achievement and emergency use of hospital services taking into account individual characteristics (health care and chronic condition status, socioeconomic status) and type of school and local authority. School attainment will be used as a time dependent co-variate that is associated with, or mediates, unplanned hospital admissions. All organisations party to this agreement must comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purpose of that use) by Personnel (as defined within the Data Sharing Framework Contract i.e: employees, agents and contractors of the Data Recipient who may have access to that data).

Expected output

[1 paragraph unchanged] The data analyses are conducted on the ONS Secure Research Service. Individual level child data cannot leave the ONS Secure Research Service. All outputs will contain aggregate level data only and all small numbers [16 words unchanged] HES Analysis Guides. No potentially disclosive outputs will be shared or published. The project in this application/agreement is expected to finish three years after obtaining the data. -------------------------- EXTENSION REQUEST An extension is requested because: Initial outputs have recently been delivered, as described in the yielded benefits. It is commonplace that editorial queries and comments will arise subsequent to publication. In addition, further papers are being written. All follow up papers will fall under existing approvals and the agreed permitted uses. Research from DARS-NIC-27404 also forms a baseline for evaluation of the larger linkage used in DARS-NIC-381972 ‘Assessing the impact of the COVID-19 pandemic on vulnerable children: the ECHILD-COVID study’. Although DARS-NIC-381972 has initially used an identical linking methodology to DARS-NIC-27404, changes during 2021 and 2022 will include the use of NHSD’s Master Person Service (MPS) (https://digital.nhs.uk/services/master-person-service). The encrypted HESID (Study_ID) currently used in the linkage spine will also be replaced by Token Person Id (https://nhs-prod.global.ssl.fastly.net/binaries/content/assets/website-assets/publications/publications-admin-pages/methodological-changes/announcement-of-methodological-change-to-hes-v2.0.pdf). DARS-NIC-27404 is seen as essential to validate linkage and confirm methodology changes in DARS-NIC-381972 do not impact linkage results. This may involve a need to re-run analyses on the existing data in NIC-27404. -------------------------- [8 paragraphs unchanged]

Benefits reported

Not stated in the previous version; added here.

Initial yielded benefits include:

• Linkage evaluation results shared with NHS Digital and the DfE to inform their linkage methods;

• An evaluation of whether linkage error disproportionately affects certain ethnic or groups and methodological paper published in peer reviewed journal (September 2021, https://doi.org/10.23889/ijpds.v6i1.1671);

• Findings shared with policy makers, such as the DHSC through the Children and Families Policy Research Unit (CPRU) and ECHILD Advisory Group to inform services;

• Findings shared with clinicians/health professionals, educators, such as the letter on ethnic bias in data linkage published in The Lancet Digital Health (https://doi.org/10.1016/S2589-7500(21)00081-9) and several knowledge sharing events with DHSC, DfE and research institutions:

• Findings shared more widely in accessible formats, such as the lay summary of research https://ijpds.org/news/relationships-health-education-and-social-care and the ECHILD project website (https://www.ucl.ac.uk/child-health/echild).

Unchanged: Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[2 paragraphs unchanged] This study has two purposes. Firstly, to address the methodology for linking HES and national pupil data (NPD) from the Department for Education and to address important policy and health service questions about the interrelationship of health and education for children with and without underlying chronic conditions. As part of the methodology programme of the ADRC-E, the aim is to assess the feasibility of using linked health and education administrative data to carry out such research. The research will benefit the data providers, and thereby, indirectly benefit NHS systems, by undertaking an assessment of data quality and consistency between sources and by assessing the accuracy of linkage. The results will be published to inform others (government departments and researchers) of match rates and factors associated with linkage error. This study has two purposes: Firstly, to address the methodology for linking HES and National Pupil Data (NPD) from the Department for Education (DfE) and to address important policy and health service questions about the interrelationship of health and education for children with and without underlying chronic conditions. As part of the methodology programme of the ADRC-E, the aim is to assess the feasibility of using linked health and education administrative data to carry out such research. The research will benefit the data providers, and thereby, indirectly benefit NHS systems, by undertaking an assessment of data quality and consistency between sources and by assessing the accuracy of linkage. The results will be published to inform others (government departments and researchers) of match rates and factors associated with linkage error. [3 paragraphs unchanged] 1. Evaluate linkage success between National Pupil Database (NPD), Personal Demographic Service (PDS), Hospital Episode Statistics (HES) hospital admissions data (HES) data, and mortality data. [2 paragraphs unchanged] Methods METHOD [4 paragraphs unchanged] UCL will examine whether low school achievement is associated with subsequent emergency [109 words unchanged] whole country and for all children (within the age restriction) in both datasets. data sets. Both datasets data sets contain longitudinal data of a child’s routinely captured information in the NPD [116 words unchanged] UCL have demonstrated the added value of using the whole longitudinal record. [1 paragraph unchanged] In order to minimise the amount of data, UCL have restricted the data requested to four one-year cohorts. The four cohorts are: The four cohorts are: [12 paragraphs unchanged]

Processing activities

Data Flows Analyses for RQ1: The HES data to be provided by NHS Digital and NPD data provided by DfE are for the one-year birth cohorts comprising records for all children specified in the following cohorts: The researcher will analyse outcomes for all CYP, and compare differences in health outcomes (e.g. emergency hospital contacts, deaths) between groups classified as vulnerable or not (stratified by age group), in the years before, compared with after, COVID-19 onset. Descriptive analyses will explore whether changes post-COVID-19 reflect increased risks of contacts related to infection, mental health, adversity, or acute complications of chronic or complex health conditions for all CYP, and according to whether they had indices for vulnerability or not. The researcher will use diagnostic and procedure codes, and types of hospital contact (eg emergency/elective admission), recorded in HES, to infer whether hospital contacts are related to underlying chronic conditions. Preliminary results October 2020. Cohort 1: Born between 01/09/90-31/08/91 Analyses for RQ2: Cohort 2: Born between 01/09/96-31/08/97 The researcher will model expected healthcare contacts for all CYP after the onset of the COVID-19 pandemic, based on observed trajectories of healthcare contact for CYP for periods prior to the start of COVID-19. The researcher will assess potential unmet healthcare need, according to age and vulnerability status, by comparing expected vs observed healthcare contacts after COVID-19 onset. Differences between expected and observed new diagnoses and interventions, will be used to infer potential unmet need. The researcher will vary their assumptions about whether and when these healthcare needs may manifest, and whether deferred presentation is likely to be more severe. The researcher will estimate how much deferred healthcare use could add to predicted rates of healthcare contacts in the post-COVID-19 period, and potential long-term outcomes of COVID-19 restrictions. Preliminary results in Jan 2021. Cohort 3: Born between 01/09/99-31/08/00 The researcher will also conduct analyses of all CYP to explore associations between inequalities (using index of multiple deprivation), ethnic group, and vulnerable vs other CYP, and outcomes measured in health care, NPD data (i.e. education and CiN/CLA) in periods before, during and after the COVID-19 pandemic. The researcher will refresh the linked NPD datasets annually in 2021 and 2022 to evaluate the longer-term impacts of COVID-19 infection and response on health, education and social care outcomes for vulnerable, compared with other CYP. Cohort 4: Born between 01/09/04-31/08/05 To address these research questions, HES (APC, A&E, OPD, ECDS, critical care) and death registration data (HES-mortality data) provided by NHS Digital will be linked to administrative data from the National Pupil Dataset (NPD) provided by the Department for Education (DfE) to the ONS SRS. Using a pseudonymised linkage key, these datasets will be linked for all children and young people (CYP) born in England on or after 1.9.1995. The linkage Linkage of identifiers from HES-mortality data and NPD will be conducted separately from at NHS Digital which will then only transfer the pseudonymised linkage key to the UCL Data Safe Haven to flag linked records in the UCL-curated HES extract for transfer to the ONS SRS. NPD attributable data will only be available in the ONS SRS. Using the pseudonymised linkage key, linkage of pseudonymised attribute data (clinical or education characteristics) by NHS Digital will then occur separately, at the ONS Secure Research Service (SRS). The following outline describes the complete data flow and pseudonymised before release to the UCL Safe Haven for analyses (the definition of pseudonymisation is where direct identifiers have been removed from the details how identifiable and non-identifiable data extract; identifiers refer to fields such as names, sex, date of birth, full post code). UCL researchers extracts will receive only pseudonymised HES data and pseudonymised NPD data (without sensitive variables, ie no date of birth or date of death). be handled: The following outline describes how identifiable and non-identifiable extracts from the data scheme will be handled. 1) DfE will supply the Trusted Third Party (NHS Digital) with a list of NPD identifier variables, these identifiers include name, date of birth, full postcode and sex, alongside a study specific pseudonymised linkage key known as the anonymized Pupil Matching Reference (aPMR). The identifying variables will be used for linkage to the Personal Demographic Service (PDS) (as previously done for NIC 27404). DfE will transfer the variables for any CYP born on or after cohort inception (1.9.95). 1) NHS Digital will create four cohorts of all HES records for children born in years of cohorts 1 to 4 (admissions, critical care, A&E and OPD and fact and date of death. Only month/year of death will be released to UCL, not full date of death. UCL request month of birth for each child in order to account for well-established effects of month of birth on school achievement (ie research consistently shows that children born in September do better than children born in July/August). 2) NHS Digital will match the identifiers from DfE to records held in the PDS using an algorithm that makes use of the chronology of postcodes in NPD and PDS. Matching to PDS data will be done internally within NHS Digital, no PDS data will be disseminated to ONS SRS or UCL Data Safe Haven. 2) DfE will supply UCL Safe Haven with requested (attribute) data extracts, alongside the study specific pseudo-identifier number (Study_ID) for children in Cohort 1 – 4. There will be no identifiable information on the extract sent to UCL. 3) For those CYP whose NPD identifiers were matched to PDS, onward linkage to HES-mortality data will occur within NHS Digital to link aPMRs and HES-IDs. NHS Digital will then transfer encrypted HES-IDs, aPMRs, and indicators of match rank (denoting the step at which the match to HES and PDS was made) for these linked cases to the UCL Data Safe Haven for linkage to the existing HES-mortality extract held by UCL (NIC-393510). 3) DfE will supply the Trusted Third Party (NHS Digital) with a list of NPD identifier variables, including name and postcode histories, alongside a study specific pseudo-identifier number (Study_ID) for children in Cohort 1 – 4. 4) UCL will extract the HES-mortality data for all CYP born on or after 1.9.1995, using the existing HES extract (NIC 393510), and link the aPMR and match rank statistics for those CYP that were linked by NHS Digital in step (3) from NPD. The de-identified HES-mortality extract will be transferred to the ONS SRS. Only month/year of birth and death will be transferred to the ONS SRS, in order to account for well-established effects of month of birth on school achievement (i.e. research consistently shows that children born in September do better than children born in July/August). The attribute data will also include high-level categorical maternal indicators relevant to birth (e.g. parity – 0, 1, 2+ prior births), which have an important bearing on child health. These derived health indicators are created by analysing variables in our analysis files, that are covered by this DSA (e.g. diagnosis codes and baby tail) and for which we have the appropriate permissions. 4) NHS Digital will match the identifiers from DfE to records held in the PDS using an algorithm that prioritises the most recent post code in NPD (at the school census date). Matching to PDS data will be done internally within NHS Digital, no PDS data will be disseminated to UCL. 5) DfE will supply ONS SRS with requested de-identified attribute data extracts, with the aPMR for all CYP born on or after 1.9.1995. The deidentified attribute NPD and HES data will be linked within the ONS SRS by the research team, using the aPMR. Data will only be used by researchers authorised for the project, with strict output controls applied by ONS SRS staff. The following methodology is proposed for the linkage by NHS Digital: 6) The final data set that will be used for analyses will remain within the ONS SRS. The files will not contain any identifiable data. No additional record level data will be gathered or linked to the dataset. The aPMR is the only variable supplied from NPD data that is supplied by NHS Digital to UCL Data Safe Haven and then to ONS SRS. The current MIDAS algorithm will be modified to consider the 15 most recent postcodes in PDS, ranked according to distance from the date associated with the NPD postcode. For remaining unmatched NPD records, the second postcode in NPD will then be compared with PDS as above. This approach will be repeated up to a maximum of 5 postcodes in NPD or until a match is achieved with PDS. This is necessary because ignoring address changes in PDS after the school census date in NPD would increase the number of missed matches. For example, although NPD postcode might be correct in September, PDS postcode in the subsequent months until the next census is more likely to be the most recent postcode. 7) NHS Digital will retain the identifier file of all individuals linked in NPD-PDS and PDS-HES and all the postcodes used in linkage and postcode dates for 12 months to address data queries or potential linkage errors. This data set will not contain any attribute data and will be accessible only to NHS Digital staff. At the end of the 12 months, NHS Digital will confirm deletion of the data to DfE. NHS Digital will not send confidential data to DfE or UCL DSH. NHS Digital will not send confidential data to DfE. The de-identified linked HES-NPD attribute data will be held on the ONS SRS and will only be accessible remotely from the UCL Data Safe Room which has restricted and monitored access. No record level data can be removed from the ONS SRS and statistical disclosure controls are applied by ONS staff. Access will be restricted to named users, who are part of the study team and are accessing the data for the purposes outlined in this DSA. Access to the data is via the ONS SRS environment. 5) NHS Digital will create two HES – NPD data files. Each file will contain the pseudo-id provided by NPD (Study_ID) and pseudo-id provided by HES (HESID). All individuals within the relevant cohorts 1-4 age range, whether they are linked or unlinked (i.e. appear in both HES and NPD or just one dataset) will be assigned a HESID, and those matched to NPD will be assigned the study-ID transferred from DfE. These pseudo- anonymised files will be transferred to the UCL Safe Haven to be accessed by the researcher. These files will not be provided to DfE. Office of National Statistics (ONS) and UCL have signed and maintain an organisational agreement to use the ONS Secure Research Statistics (SRS) service for the purposes of secure statistical research, signed on 21/03/2019 with an indefinite expiry date [SD10]. The only HES data stored in the ONS SRS are the 4 one-year cohorts of HES, plus the anonymised PMRs for those records that link to NPD. The HES data will include month of death and month of birth so no identifying data. The HES-Mortality/PDS-NPD Matched Assessment File will contain linkage details of the matches between NPD and PDS using the pseudo-study id for each of the data sets i.e. HESID and Study_ID. It will indicate the match rank at linkage with NPD (i.e. the first, second or third etc. running of the modified MIDAS algorithm). The file will not contain any postcodes or other identifiers. For security and resource reasons the SRS is a Managed Service. Equiniti Ltd (based in Belfast) maintains the system, on behalf of the ONS SRS. They do so through encrypted (TLS1.2) VPN tunnel and Remotely Access (RA) the SRS. All Equiniti Ltd administrators are SC cleared and have no access to any data. ONS SRS Research Support “Admin” staff only have permissions to carry out such tasks as creating users, updating patches, testing and installing software applications, arranging DR, ITHC for the SRS environment, closing SRS sessions down, i.e. all the SRS environment Admin maintenance - essentially they are “power users”. There have been no data infractions by Equiniti Ltd staff in the last 5 years of them maintaining the environment, they have been very professional. The second file will contain attribute data. This contains the HES records for the matched HES-Mortality/PDS - NPD records and the unmatched HES records for patients in cohorts 1-4. All records will contain a HESID and those matched to NPD will also contain a Study-ID. The high level security document that Equiniti Ltd provided [SD13] states: 6.3. Service Management support for the SRS Service is provided from Equiniti offices in Belfast, all staff are SC cleared. The office hosting the SRS Desk is IS0/IEC27001 2018 certified. Equiniti Ltd nor any their staff process the data. Therefore Equinity Ltd is not considered to be a Data Processor. 6) NHS Digital will retain the identifier file of all individuals linked in NPD-PDS and PDS-HES and all the postcodes used in linkage and postcode dates for 12 months to address data queries. This data set will not contain any attribute data and will be accessible only to NHS Digital staff. The ONS SRS environment is an isolated system. It has no connectivity to the internet other than using it as a bearer to pass TLS1.2 encrypted image packages for a virtual desktop infrastructure (VDI), hosted on an accredited cloud server hosted by UKCloud Ltd on the mainland UK. A High Level Security report is available in supporting documents [SD13]. UKCloud Ltd merely host the environment, they have no access to data. Therefore CloudUK Ltd is not considered to be a Data Processor. 7) The two HES-NPD files will be transferred to the UCL Data Safe Haven from NHS Digital for analysis by the UCL team. The pseudo Study IDs attached to NPD data supplied by DfE, attached to the matched HES-NPD records assessment file supplied by NHSD, and attached to the unmatched and matched HES attribute records, will be used to create the final dataset that will be used for analyses within the UCL Safe Haven. The files will not contain any identifiable data. No additional record level data data will be gathered or linked to the dataset. CLOUD SECURITY Data security NHS Digital security has provided assurance regarding the use of the Office of National Statistics' Secure Research Statistics service (ONS SRS), hosted by CloudUK Ltd in this application. The Office of National Statistics has submitted a selection of security documentation to support the use of cloud storage. NHS Digital Security have reviewed the documentation and provided relevant feedback, where necessary. NHS Digital are satisfied that the documentation demonstrates the level of security and governance in place. To maintain the physical and technical security measures, the following safeguards will be in place: The Office of National Statistics have supplied evidence to support: 1) Data linkage: Linkage will be carried out by a Trusted Third Party (NHS Digital) following the separation principle. The NHS Digital team undertaking the linkage will only have access to identifiers from the HES team for hospital administrative data and receive full identifiers from DfE for NPD data. These identifiers include name, date of birth, full postcode and sex. No additional attribute data will be provided. These identifiers will be removed and replaced with the pseudonymised Study ID and HESID assigned to each child in the cohort before release to the UCL Safe Haven for access by the researchers. The original file will be retained by the Trusted Third Party for 12 months to address queries about the linkage accuracy. • The use of the Data Risk Model to assess the Risk Profile Class. As a consequence, the UCL researcher will not have access to the identifiers and NHS Digital will at no point have access to NPD attribute data. • Risk Management of the use of the Cloud for this data, taking into consideration Confidentiality, Integrity and Availability. 2) Minimising data disclosure: During analyses, the UCL researchers will minimise the potential for deductive disclosure, by limiting the presentation of specific information that could potentially identify any individual in the cohort. Statistical disclosure control measures will be applied according to HES requirements. UCL have minimised disclosure risks by requesting: only month of death and month of birth, LSOA decile rather than rank, location defined only by area indicators (eg local authority), and UCL will allocate a pseudo-id for school. • The use of Pseudonymisation. 3) Limited access: The data will be held on a secure server at University College London. The project has ADRN panel approval and REC approval: 17/LO/1494. Access will be restricted to named users, who are notified to the i) data providers, the ii) secure server operators, and who are contractually part of iii) the study team and have signed a data user agreement with all three parties. The users must also be accredited as data users (meaning they have been trained in governance and confidentiality) by the UK Administrative Data Research Network (ADRN adrn.ac.uk). All users have university contracts that stipulate compliance with data governance. This means that the researcher can be dismissed from their post if they fail to comply with data governance requirements. Access to the data is via a remote login that requires a physical authentication system as well as a password (i.e. double authentication). • Board level involvement in the Risk Management Process evidenced through Minutes of these meetings. 4) Limiting outputs: The data analyses are conducted on the UCL data safe haven. Detailed individual level child data cannot leave the UCL Safe Haven (i.e. secure server) except by a secure encrypted transfer system, as that would be in breach of data sharing agreements. It is used to export results of analyses and can be audited. Any outputs from analyses that are published have to meet statistical disclosure controls that prevent small cell sizes in accordance with NHSD requirements. Tabulations of aggregate data are assessed for statistical disclosure control and authorised for export by a data scientist not involved with the analysis who has delegated exporting rights authorised by the Principal Investigator of the project. No de-identified death registration data will leave the UCL safe setting. • Understanding of the Shared Responsibility Model Data Analysis The Office of National Statistics have a very good understanding of the security controls available to them to provide the appropriate controls to secure data in the Cloud. The record-level HES-mortality data will only be accessed by staff with contracts at UCL who have been trained and authorised to access the UCL safe haven. Any outputs will contain only aggregated data that complies with the small number suppression rules in the HES Analysis Guide. Using the Cloud, benefits from the inherited controls that cannot practically be replicated locally such as Physical Controls, Resilience of Systems, Power Supplies, Communications and Geographically dispersed Data Centres within a region. The analyses of the linked dataset will involve the following steps. These will be concurrent with the evaluation of linkage accuracy: Elasticity in provisioning is also a consideration that benefits organisations in managing workloads. The Cloud provider, CloudUK, will use UK Data Centres only. i) Create inception cohorts of children: (a) defined by birth (Cohorts 3 and 4) (b) entry to primary school (Cohorts 1 and 2) ii) Examine characteristics of linked and unlinked cohorts to determine impact of linkage error. iii) Characterise children according to past admissions and history of chronic conditions in HES-mortality data. iv) Determine variation in school achievement taking into account health care history and chronic condition status (based on admissions in previous years). v) Determine association between school achievement and emergency use of hospital services taking into account individual characteristics (health care and chronic condition status, socioeconomic status) and type of school and local authority. School attainment will be used as a time dependent covariate that is associated with, or mediates, unplanned hospital admissions. All organisations party to this agreement must comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data).

Unchanged: Expected output, Expected measurable benefits.