The Pesticide Users' Health Study (PUHS)

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

On 1 February 2023, NHS Digital merged with NHS England. NHS England has assumed responsibility for all activities previously undertaken by NHS Digital. The merger was completed by a statute change. Any reference made to NHS Digital within this Data Sharing Agreement is in reference to the merged organisation known as NHS England. [2 paragraphs unchanged] This research is being conducted as a task in the public interest (GDPR Article 6(1)(e)). Health data, which is a special category of data, is processed for archiving, research and statistical purposes (GDPR Article 9(2)(j)). This work is research in the public interest because it aims to inform government policy with respect to potential health risks linked to working with pesticides and thereby protect the health of the men and women who use pesticides as part of their employment. The lawful basis for processing personal data under the UK GDPR is: HSE has determined that there are unlikely to be any moral or ethical issues, or harm to the public from dissemination of data for this purpose. Once received from NHS Digital, the data being processed by HSE will be pseudonymised. Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; The lawful basis for processing special category data under the UK GDPR is: Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. This work is research in the public interest because it aims to inform government policy with respect to potential health risks linked to working with pesticides and thereby protect the health of the men and women who use pesticides as part of their employment. HSE has determined that there are unlikely to be any moral or ethical issues, or harm to the public from dissemination of data for this purpose. Once received from NHS England, the data being processed by HSE will be pseudonymised. [11 paragraphs unchanged] This is ongoing research with no set end date, and so data will be required into the foreseeable future. Participants are based in England, Wales and Scotland, and so the data [44 words unchanged] alternative, less intrusive ways of achieving the purpose of the data request. HSE is the sole data controller and data processor of the data supplied by NHS Digital England under this Agreement. Iron Mountain provides storage for backups, but does not access or process the data. Funding is provided internally by HSE. No other organisation has access to this data or are involved in this study in any way. Funding is provided internally by HSE. No other organisation has access to this data or are involved in this study in any way.

Processing activities

The electronic data are stored on servers at the Health and Safety Executive’s (HSE’s) Bootle location. The data are accessed via hardware in HSE’s Buxton location, Bootle location, onsite at the premises of HSE, or employees’ home address, connecting to the HSE network. Archived paper records are stored at the Buxton location. Data processing is only carried out by substantive employees of HSE who have been appropriately trained in data protection and confidentiality. Servers are backed-up to tape, which are stored at the Iron Mountain location. Iron Mountain provides storage for backups, but does not access or process the data. All data transfers between NHS Digital and HSE will be undertaken using NHS Digital's secure electronic file transfer system (SEFT). Any information received from NHS Digital will be downloaded onto a restricted access encrypted network drive for the study. Data processing is only carried out by substantive employees of HSE who have been appropriately trained in data protection and confidentiality. Servers are backed-up to tape, which are stored at the Iron Mountain location. Iron Mountain provides storage for backups, but does not access or process the data. All data transfers between NHS England and HSE will be undertaken using NHS England's secure electronic file transfer system (SEFT). Any information received from NHS England will be downloaded onto a restricted access encrypted network drive for the study. [2 paragraphs unchanged] 1) Linkage has already been undertaken by NHS Digital, England, with updates on cancer and death registrations, and embarkations and returns received [8 words unchanged] longer recruiting and so no new recruits will be sent to NHS Digital. England. This data flow has been approved by the National Research Ethics Committee and conditionally approved by the HRA Confidentiality Advisory Committee (HRA CAG). The condition on the approval from the HRA CAG is that equivalent approval is granted from Scotland's Public Benefit and Privacy Panel (pending). 2) NHS England will provide HSE with notifications of participant deaths (including date, cause and occupation), cancer registrations and exits from or re-entries to NHS registration (including Health Authority Cipher). This includes health data, which is a special category of personal data. 2) NHS Digital will provide HSE with notifications of participant deaths (including date, cause and occupation), cancer registrations and exits from or re-entries to NHS registration (including Health Authority Cipher). This includes health data, which is a special category of personal data. 3a) Historical data from NHS England (and its predecessors) were previously uploaded onto the study database. However, due to changing IT, the database is no longer in use. This historical data (up to 2015) has been extracted from the database and is being held in three csv files: one file contains details on the participants and includes NHS numbers and dates/causes of death (if relevant); one contains details on the certifications the individuals have undertaken; and one on cancer registrations that have been entered onto the database up to May 2015. These files are saved on the restricted access encrypted network drive for the study. Linkage of the different files is through the unique study ID number. Information provided by NHS England since May 2015 has been stored electronically on the restricted access encrypted network drive. 3a) Historical data from NHS Digital (and its predecessors) were previously uploaded onto the study database. However, due to changing IT, the database is no longer in use. This historical data (up to 2015) has been extracted from the database and is being held in three csv files: one file contains details on the participants and includes NHS numbers and dates/causes of death (if relevant); one contains details on the certifications the individuals have undertaken; and one on cancer registrations that have been entered onto the database up to May 2015. These files are saved on the restricted access encrypted network drive for the study. Linkage of the different files is through the unique study ID number. Information provided by NHS Digital since May 2015 has been stored electronically on the restricted access encrypted network drive. HSE are looking to update their data management system for the study (see 3b below). Until the data management system is finalised, the information provided by NHS England will be stored electronically on HSE’s restricted access encrypted network drive. HSE are looking to update their data management system for the study (see 3b below). Until the data management system is finalised, the information provided by NHS Digital will be stored electronically on HSE’s restricted access encrypted network drive. 3b) HSE are currently investigating the potential for using an off-the-shelf cloud-based clinical data management system to manage all study data, including data received from NHS England. HSE have already sought advice from NHS England on the acceptability of such a system and what security assurances would be needed. Once an appropriate system is identified, and before implementation, NHS England will be consulted to ensure its suitability to hold their data. Once complete, all information received from NHS England will be uploaded onto the data management system. 3b) HSE are currently investigating the potential for using an off-the-shelf cloud-based clinical data management system to manage all study data, including data received from NHS Digital. HSE have already sought advice from NHS Digital on the acceptability of such a system and what security assurances would be needed. Once an appropriate system is identified, and before implementation, NHS Digital will be consulted to ensure its suitability to hold their data. Once complete, all information received from NHS Digital will be uploaded onto the data management system. [2 paragraphs unchanged] 5) Analysis is conducted using appropriate software, such as Stata statistical software, [22 words unchanged] HSE plans to undertake will require linking the events received from NHS Digital England to the following information on study participants (held by HSE and linked, by HSE, through the study ID): [4 paragraphs unchanged] This linkage has already been undertaken by NHS Digital England and the extract has been received by HSE. Preliminary data cleaning, checking and analysis has been undertaken. [6 paragraphs unchanged] For the purpose of comparing hospital admissions among the study participants, and [7 words unchanged] will compare aggregated statistics with tabulated national statistics previously provided by NHS Digital. England. HSE will not link the data further and the only data linkages [60 words unchanged] reported in aggregate format and no individuals are identified in these reports.

Benefits reported

The data received from NHS Digital England has directly contributed to analyses of cancer incidence and mortality, which have [63 words unchanged] were able to contribute to this thanks to the information from NHS Digital England and its predecessors. This directly addresses the aim of the study, which is to monitor the long-term health of these workers. [2 paragraphs unchanged]

Unchanged: Expected output, Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

The Pesticide Users’ Health Study was established in the late 1990s, with the aim to monitor the long-term health of people who use pesticides as part of their work. Monitoring mortality and cancer incidence among study members is an important part of this. Mortality up until 2005 and cancer incidence up until 2004 have already been analysed and published in Health & Safety Executive Research Reports and a peer-reviewed publication (http://www.hsl.gov.uk/resources/major-projects/puhs). Additional follow-up will help to clarify some of the results observed, and will add to the literature on the potential link between pesticides and ill health. On 1 February 2023, NHS Digital merged with NHS England. NHS England has assumed responsibility for all activities previously undertaken by NHS Digital. The merger was completed by a statute change. Any reference made to NHS Digital within this Data Sharing Agreement is in reference to the merged organisation known as NHS England. The Pesticide Users’ Health Study was established in the late 1990s by the Health and Safety Executive (HSE). Its aim is to monitor the long-term health of people who use pesticides as part of their work. Participants are individuals who completed a Certificate of Competence in the safe use of pesticides with the National Proficiency Tests Council between 1994 and 2003, and gave permission for HSE to use their details. Monitoring mortality and cancer incidence among study participants is the main way HSE fulfils its aim. Mortality up until 2005 and cancer incidence up until 2004 have already been analysed and published in HSE Research Reports and a peer-reviewed publication (http://www.hsl.gov.uk/resources/major-projects/puhs). Additional follow-up will help to clarify some of the results observed, and will add to the literature on the potential link between pesticides and ill health. [1 paragraph unchanged] This research is being conducted as a task in the public interest (GDPR Article 6(1)(e)). Health data, which is a special category of data, is processed for archiving, research and statistical purposes (GDPR Article 9(2)(j)). This work is research in the public interest because it aims to [20 words unchanged] the men and women who use pesticides as part of their employment. The Health and Safety Executive has determined that there are unlikely to be any moral or ethical issues from dissemination of data for this purpose. HSE has determined that there are unlikely to be any moral or ethical issues, or harm to the public from dissemination of data for this purpose. Once received from NHS Digital, the data being processed by HSE will be pseudonymised. [3 paragraphs unchanged] HSE are therefore requesting the following to answer the two objectives above: A specific control group is not required for these types of analyses. 1) Objective 1: Individual-level data relating to cancers, deaths and emigrations, linked to study members. In the past, this has been received from NHS Digital (and its predecessors), and HSE wish this to continue into the foreseeable future. These data will be analysed on a regular basis. To meet these objectives, HSE requires latest available identifiable data from the following datasets for study participants: 2) Objective 2: Episode-level hospital admission data, linked to study members, was received as a one-off request under a previous Data Sharing Agreement. HSE would like to continue processing, analysing and reporting using these data under this Data Sharing Agreement (DSA). HSE has received ethical approval and Section 251 support to update these data to the latest available. This is not being requested in this DSA, but will be requested in a future amendment, when HSE is ready to finalise the analysis. - Demographics: Fact of death, death registration details, NHAIS posting, and identifiable information including the individual’s NHS number, name and date of birth. The Health and Safety Executive is the sole data controller of the data supplied by NHS Digital under this Agreement. Funding is provided internally by HSE. Sopra Steria are contracted data processors for HSE and maintains the system that holds NHS Digital information, but they do not directly access the data. No other organisation has access to this data or are involved in this study in any way. - Civil Registration Deaths: Death registration details such as date and cause of death, including identifiable information such as the individual’s NHS number, name and date of birth. - Cancer Registration Data: Cancer date, code, site and type, including identifiable information such as NHS number and cancer registration number. Previously received data: - Hospital Episode Statistics Admitted Patient Care: Episode-level data including information such as date and diagnosis code, only for episodes with certain diagnosis codes. These data were received as a one-off request under a previous Data Sharing Agreement. HSE would like to continue processing, analysing and reporting using these data under this Data Sharing Agreement (DSA). HSE has received ethical approval and Section 251 support to update these data to the latest available. This is not being requested in this DSA, but will be requested in a future amendment, when HSE is ready to finalise the analysis. Identifiable data such as name and date of birth are required because HSE are currently quality assuring their data and need to be able to check the study identifiers on their system. No identifiable data is shared with other researchers or organisations. In all cases, any findings from the study are reported in aggregate format and no individuals are identified in these reports. This is ongoing research with no set end date, and so data will be required into the foreseeable future. Participants are based in England, Wales and Scotland, and so the data request covers both England and Wales. Equivalent data will be received from NHSCR Scotland for participants based in Scotland (application renewal in progress). The aims of the project cannot be met without knowledge of deaths and cancer registrations for participants, and there are no alternative, less intrusive ways of achieving the purpose of the data request. HSE is the sole data controller and data processor of the data supplied by NHS Digital under this Agreement. Iron Mountain provides storage for backups, but does not access or process the data. Funding is provided internally by HSE. No other organisation has access to this data or are involved in this study in any way.

Processing activities

The electronic data are stored on servers at the Health and Safety Executive’s (HSE) (HSE’s) Bootle location. Servers are backed-up to tape, which are stored at the Iron Mountain location. The data are accessed via hardware in HSE’s Buxton location, Bootle location, or employees’ home address, connecting to the HSE network. Archived paper records are stored at the Buxton location. Data processing is only carried out by substantive employees of HSE who have been appropriately trained in data protection and confidentiality. Servers are backed-up to tape, which are stored at the Iron Mountain location. Iron Mountain provides storage for backups, but does not access or process the data. The data are accessed by authorised substantive employees of the HSE exclusively at the Buxton address. No other HSE employees will access the data at any other location. Sopra Steria are data processors for HSE and maintains the system that holds NHS Digital information. Sopra Steria do not access these data other than for backups and support. Sopra Steria staff with Domain Admin accounts will have the permission to access the data but this should not happen without explicit permission from the data owner (HSE) and should only be applicable in system upgrades and faults etc. There should be no reason as part of the live service that Sopra Steria would need to access live data. If they do need to access the data, then this will be using HSE devices (with explicit permission from HSE). All Sopra Steria staff with HSE accounts adhere to HSE policies. HSE’s contract with Sopra Steria is due to end in August 2021, after which HSE will in-source the management of their IT estate. [3 paragraphs unchanged] 1) Linkage has already been undertaken by NHS Digital, with updates on [18 words unchanged] recruiting and so no new recruits will be sent to NHS Digital. However, the study currently has participants flagged with NHSCR Scotland (application renewal in progress). If approved, NHSCR Scotland will provide HSE with NHS numbers for study participants flagged with them. When HSE is informed that a participant has exited Scotland to England or Wales, HSE will send identifiable participant information to NHS Digital so that the participant entering England/Wales can be flagged. It is proposed that this information will include the NHS number provided by NHSCR Scotland to HSE, to help successful flagging of participants in England/Wales. This data flow has been approved by the National Research Ethics Committee and conditionally approved by the HRA Confidentiality Advisory Committee. Committee (HRA CAG). The condition on the approval from the HRA CAG is that equivalent approval is granted from Scotland's Public Benefit and Privacy Panel (pending). 2) NHS Digital will provide HSE with notifications of participant deaths (including [6 words unchanged] and exits from or re-entries to NHS registration (including Health Authority Cipher). This includes health data, which is a special category of personal data. [1 paragraph unchanged] HSE are currently investigating the potential for using an off-the-shelf cloud-based clinical looking to update their data management system to manage all for the study data, including data received from NHS Digital. HSE have already sought advice from NHS Digital on the acceptability of such a system and what security assurances would be needed. Once an appropriate system is identified, and before implementation, NHS Digital will be consulted to ensure its suitability to hold their data. (see 3b below). Until the data management system is finalised, the information provided by NHS Digital will be stored electronically on the HSE’s restricted access encrypted network drive. It is expected that a new clinical data management system will be in place by Summer 2022. 3b) Once complete, all information received from NHS Digital will be uploaded onto the data management system. 3b) HSE are currently investigating the potential for using an off-the-shelf cloud-based clinical data management system to manage all study data, including data received from NHS Digital. HSE have already sought advice from NHS Digital on the acceptability of such a system and what security assurances would be needed. Once an appropriate system is identified, and before implementation, NHS Digital will be consulted to ensure its suitability to hold their data. Once complete, all information received from NHS Digital will be uploaded onto the data management system. [1 paragraph unchanged] 4b) After the data management system is in place: Data required for analysis will be extracted from the data management system by HSE study team members with the correct permissions. All study team members are [37 words unchanged] data processing will be conducted on the restricted access encrypted network drive. [1 paragraph unchanged] - Baseline information: date of birth, sex, address, post code, pesticide certificates held. Collected at the time of recruitment. [1 paragraph unchanged] 6) For the purpose of comparing cancer incidence and mortality among the study participants, and subcategories thereof, with the general population, HSE will compare aggregated statistics with publicly available National Statistics. HSE will not link the data further and the only data linkages are those permitted under this Agreement. Aggregated data can be shared with other researchers without additional permission, if it falls within the outlined processing activities of the agreement and adheres to small number suppression as outlined in the HES Analysis Guide. [4 paragraphs unchanged] - Baseline information: date of birth, sex, address, post code, pesticide certificates held. Collected at the time of recruitment. - Date of death, cause of death, emigration, loss to follow-up or Health Authority Cipher (if applicable). [1 paragraph unchanged] The identifying fields provide an additional check when using the individual ID numbers to match the members and postings list or cancer/death registrations with the individuals in the cohort database. In the past there have been cases where the identifying fields did not match anyone on the study database. Without the identifying fields we would not have been in a position to spot and investigate these cases. The study team would like to continue to receive identifying fields at least until such time as a full check is complete and the new data management system is established. The members and postings list from NHS Digital provides an additional check on the integrity of the study's data stored in the study database and at NHS Digital. Data is de-identified as much as possible before statistical analysis, removing names, [53 words unchanged] the files and de-identify the data as much as possible before analysis. No identifiable data is shared with other researchers or organisations. In all cases, any findings from the study are reported in aggregate format and There will be no individuals are identified in these reports. requirement/attempt to re-identify individuals. The analysis will be conducted using Stata statistical software, and all files relating to the analysis will be saved in the restricted access encrypted network drive for the study. For the purpose of comparing hospital admissions among the study participants, and subcategories thereof, with the general population, HSE will compare aggregated statistics with tabulated national statistics previously provided by NHS Digital. HSE will not link the data further and the only data linkages are those permitted under this Agreement. No identifiable data is shared with other researchers or organisations. Aggregated data can be shared with other researchers without additional permission, if it falls within the outlined processing activities of the agreement and adheres to small number suppression as outlined in the HES Analysis Guide. In all cases, any findings from the study are reported in aggregate format and no individuals are identified in these reports. NHS Digital reminds all organisations party to this Agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract - i.e. employees, agents and contractors of the Data Recipient who may have access to that data.

Expected output

Results of all analyses will be published in Health & Safety Executive (HSE) Research Reports (http://www.hse.gov.uk/research/rrhtm/), peer-reviewed journal publications, or presented at conferences where appropriate. [2 paragraphs unchanged] As a publicly funded research study, it is HSE policy to ensure [37 words unchanged] HSE are providing a list of possibilities based on HSE’s experience with this and similar studies. Outputs may be published in more than one format, for example as a research report and as a conference presentation. [1 paragraph unchanged] The data will not be used for commercial purposes. [1 paragraph unchanged] Previous analysis of mortality and cancer incidence included follow-up to 2005, and so it is expected that an updated analysis will be completed once we have an additional 15 20 years’ of follow-up data – so after 2020. 2025. This is an on-going study, and updated analyses will be undertaken periodically after this. [2 paragraphs unchanged] This analysis is expected to be completed and the results published by April 2022. 2025. The expected output timelines have been revised from the previous iteration of the agreement (v6.3). Initially Objective 1 was planned to be completed with 15 years worth of data (2020) and Objective 2 was expected to be completed and published by April 2022. The delay in analyses and outputs is due to reallocation of project resource onto COVID-19-related work. In addition, HSE has identified inconsistences in the questionnaire data required for the analyses, and so a full quality assurance exercise is currently underway. This needs to be completed before progress can be made. [1 paragraph unchanged] Apart from these traditional publication routes, HSE has developed a much wider dissemination program for its science and research based on electronic communications. HSE’s Science Information, Dissemination and Engagement Team prepares a regular Science e-Bulletin, which they send to over 80,000 subscribers; subscribers include a wide range of stakeholders including from Industry and the Press, and some members of the general public. Any new outputs from the study will be highlighted in the e-Bulletin, thereby substantially increasing the reach of the study. The HSE Annual Science Review is written in an easily understood accessible format and is very widely disseminated to all stakeholders, including the ‘interested public’. Tickets to HSE’s Chief Scientific Adviser’s seminars are available on Eventbite and, as an example, nearly 400 tickets were registered for the last seminar. Ticket holders came from all across the UK, and the majority of them also subscribed to HSE’s Science e-Bulletin. Targeted invitees to the seminars include the general press and Trade Unions. Findings from this study are within the scope of these seminars, and may be presented if appropriate. These seminars and new scientific outputs are also circulated using the Chief Scientific Adviser’s twitter account. The study also has a website, which provides information about the study, results and the study team’s contact details. Overall, the outputs from the study now reach a far larger audience than was possible previously. HSE policy advisers in the Chemical Regulations Division (CRD) are key stakeholders in the study. As such, they are involved in discussions about any developments in the study and they review all outputs. This ensures the relevance of the study and that outputs are communicated to those who influence, or are interested in, health and safety policy in this area. Using the networks and fora that CRD have, the policy advisers will disseminate study findings to policy makers further afield when appropriate. The data will not be used for commercial purposes.

Expected measurable benefits

The Pesticide Users’ Health Study is a large study of individuals potentially exposed to low levels of pesticides over a long period. It was established by the Health & Safety Executive (HSE) in order to monitor the long-term health of pesticide workers because other surveillance systems for pesticide exposures only cover acute health outcomes. The ability to assess the incidence of cancers, deaths, and other health outcomes potentially related to working with pesticides will be a key benefit that HSE achieves from this study. As such, it is a valuable resource that can make a worthwhile [40 words unchanged] collect more detailed information but on a smaller number of pesticide users. [2 paragraphs unchanged] This Health and Safety Executive (HSE) funded study is operationally carried out at the HSE Science and Research Centre in Buxton. The outputs from this study will contribute to the body of evidence about the safety of licensed pesticides, which the Health and Safety Executive will take into account in any decision process. Dissemination to as wide a reach of potential beneficiaries as possible is important to ensure transparency, to increase public understanding of how HSE develops its policies based on evidence, and to ensure that research findings become part of the knowledge base on pesticides in the workplace. Dissemination of the study findings is in the public interest because it shows that HSE is taking the health concerns associated with occupational exposure to pesticides seriously and is actively monitoring the health of these workers. Disseminating the study findings widely may help to promote greater understanding of the range of work that HSE undertakes in its role as the regulatory body and demonstrate that its policies are evidence based. The dissemination activities described in the 'Expected Outputs' section focus on disseminating outputs to the public. This Health and Safety Executive funded study is operationally carried out at the HSE Science and Research Centre in Buxton. The outputs from this study will contribute to the body of evidence about the safety of licensed pesticides, which the Health and Safety Executive will take into account in any decision process.

Benefits reported

The data received from NHS Digital has directly contributed to analyses of cancer incidence and mortality, which have been published as Health and Safety Executive Research Reports (RR956 and RR958 https://www.hse.gov.uk/research/rrhtm/901-1000.htm). A peer-reviewed article investigating mortality and cancer incidence, publication of the analyses, which was published in 2011, 2011 (https://doi.org/10.1093/occmed/kqr067), has been cited by over 30 articles looking at topics including testicular [30 words unchanged] to this thanks to the information from NHS Digital and its predecessors. This directly addresses the aim of the study, which is to monitor the long-term health of these workers. The proposed methodology underpinning the analysis of hospital admissions data was presented at the 12th UK & Ireland Occupational and Environmental Epidemiology meeting, Edinburgh, 2019; which is a meeting aimed at promoting occupational and environmental epidemiology in the UK and Ireland (https://epidemiologysociety.wordpress.com/meetings-and-events/). Provisional results of the analysis were due to be presented at the 2020 meeting, but the presentation was cancelled due to the emerging COVID-19 pandemic. This work has been on hold during the pandemic and while a full quality assurance of the study questionnaires is being undertaken. In 2018, the study also contributed to the Health and Safety Executive (HSE) Annual Science Review (https://solutions.hse.gov.uk/resources/hse-science-and-research-publications/annual-science-review-series). It was used as an example of how HSE’s volunteer studies are helping to develop the evidence base, and to ensure that risks are understood and can be effectively controlled.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[7 paragraphs unchanged] 1) Objective 1: Individual-level data relating to cancers, deaths and emigrations, linked to study members. In the past, this has been received from NHS Digital (and its predecessors) on a quarterly basis, predecessors), and HSE wish this to continue into the foreseeable future. These data will be analysed on a regular basis. 2) Objective 2: Episode-level hospital admission data, linked to study members, was [15 words unchanged] continue processing, analysing and reporting using these data under this Data Sharing Agreement. Agreement (DSA). HSE has received ethical approval and Section 251 support to update these data to the latest available. This is not being requested in this DSA, but will be requested in a future amendment, when HSE is ready to finalise the analysis. The Health and Safety Executive is the sole data controller and data processor of the data supplied by NHS Digital under this Agreement. Funding is provided internally by HSE. Sopra Steria are contracted data processors for HSE and maintains the system that holds NHS Digital information, but they do not directly access the data. No other organisation has access to this data or are involved in this study in any way.

Processing activities

The electronic data are stored on servers at the Health & and Safety Executive’s (HSE) Buxton, Derbyshire Bootle location. During Servers are backed-up to tape, which are stored at the period covered by this Agreement, the Iron Mountain location. The data will be transferred to HSE’s Bootle location where it will be stored on local servers and backed up in severs in HSE’s Basingstoke location for purposes of contingency, if and when, for whatever reason, the Bootle servers are unavailable. Once this transfer is complete, the data will be accessed via hardware in the HSE’s laboratory in Buxton location, connecting to the HSE network. Until the transfer takes place, the data will be stored and processed directly on the servers in Buxton. Archived paper records are stored at the Buxton location. All data transfers between NHS Digital and HSE will be undertaken using NHS Digital's secure file transfer system. Any information received from NHS Digital will be downloaded onto a restricted access encrypted network drive dedicated to the study. The data are accessed by authorised substantive employees of the HSE exclusively at the Buxton address. No other HSE employees will access the data at any other location. Sopra Steria are data processors for HSE and maintains the system that holds NHS Digital information. Sopra Steria do not access these data other than for backups and support. Sopra Steria staff with Domain Admin accounts will have the permission to access the data but this should not happen without explicit permission from the data owner (HSE) and should only be applicable in system upgrades and faults etc. There should be no reason as part of the live service that Sopra Steria would need to access live data. If they do need to access the data, then this will be using HSE devices (with explicit permission from HSE). All Sopra Steria staff with HSE accounts adhere to HSE policies. HSE’s contract with Sopra Steria is due to end in August 2021, after which HSE will in-source the management of their IT estate. Access to the data is limited to authorised substantive employees of the HSE exclusively at the Buxton site. No other HSE employees will access the data. No data will be accessible to third parties outside of HSE. The data will only be used for the purpose as stated. All data transfers between NHS Digital and HSE will be undertaken using NHS Digital's secure electronic file transfer system (SEFT). Any information received from NHS Digital will be downloaded onto a restricted access encrypted network drive for the study. [2 paragraphs unchanged] 1) Linkage has already been undertaken by NHS Digital, with updates on cancer and death registrations, and embarkations and returns received on a quarterly an annual basis. The study is no longer recruiting and so no new recruits [9 words unchanged] currently has participants flagged with NHSCR Scotland (application renewal in progress). If approved, NHSCR Scotland informs will provide HSE with NHS numbers for study participants flagged with them. When HSE is informed that a study member participant has moved exited Scotland to England or Wales, then HSE will request send identifiable participant information to NHS Digital so that the participant entering England/Wales can be flagged. It is flagged with proposed that this information will include the NHS Digital. The HSE study team will send NHS Digital the following information on number provided by NHSCR Scotland to HSE, to help successful flagging of participants who move into England or Wales: study ID; forename; middle name; surname; date of birth; sex and address (including postcode). This will enable linkage to be undertaken by NHS Digital. in England/Wales. This data flow has been approved by the National Research Ethics Committee and conditionally approved by the HRA Confidentiality Advisory Committee. The condition on the approval from the HRA CAG is that equivalent approval is granted from Scotland's Public Benefit and Privacy Panel (pending). [1 paragraph unchanged] 3a) Historical data from NHS Digital (and its predecessors) were previously uploaded [77 words unchanged] May 2015. These files are saved on the restricted access encrypted network drive, which is dedicated to this drive for the study. Linkage of the different files is through the unique study ID [8 words unchanged] 2015 has been stored electronically on the restricted access encrypted network drive. A new HSE are currently investigating the potential for using an off-the-shelf cloud-based clinical data management system to manage all study database data, including data received from NHS Digital. HSE have already sought advice from NHS Digital on the acceptability of such a system and what security assurances would be needed. Once an appropriate system is currently in development. identified, and before implementation, NHS Digital will be consulted to ensure its suitability to hold their data. Until this the data management system is finished, finalised, the information provided by NHS Digital will continue to be stored electronically on the restricted access encrypted network drive. It is expected that development a new clinical data management system will be complete in place by Summer 2022. When finished, the database will reside in the HSE data centre on an SQL server, which HSE control. The restricted access encrypted network drive is on an HSE network share within the HSE data centre with access only granted to authorised members of staff. 3b) Once complete, all information received from NHS Digital will be uploaded onto the data management system. 3b) Once complete, all information received from NHS Digital will be uploaded onto the study database. Identifiable information that HSE holds will initially be stored on the same database as the research data but partitioned/secured using SQL schema or a bespoke service API. It will be transitioned to separate databases for clinical and identifiable data. Restrictions will be in place so that only study team members with the correct permissions will be able to access data received from NHS Digital. In addition, all databases will be encrypted. 4a) Before the data management system is in place: Stata statistical software is used to link the files and de-identify the data as much as possible before analysis. Information such as name, address and NHS number is removed. Information such as date of death, cause of death, date of cancer registration, sex, postcode and study ID number remain for the analysis. Only the de-identified dataset is used during analysis. 4a) Before database completion: Stata statistical software is used to link the files and de-identify the data as much as possible before analysis. Information such as name, address and NHS number is removed. Information such as date of death, cause of death, date of cancer registration, sex, postcode and study ID number remain for the analysis. Only the de-identified dataset is used during analysis. 4b) After the data management system is in place: Data required for analysis will be extracted from the data management system by study team members with the correct permissions. All study team members are substantive employees of the data controller. Only the information required will be extracted. Extracted datasets will contain the minimum identifying fields required and will be saved on the restricted access encrypted network drive for the study. All data processing will be conducted on the restricted access encrypted network drive. 4b) After database completion: Data required for analysis will be extracted from the database by study team members with the correct permissions. All study team members are substantive employees of the data controller. Only the information required will be extracted. Extracted datasets will contain the minimum identifying fields required and will be saved on the restricted access encrypted network drive for the study. All data processing will be conducted on the restricted access encrypted network drive. 5) Analysis is conducted using appropriate software, such as Stata statistical software, and all files relating to the analysis are saved on the restricted access encrypted network drive for the study. The analysis that HSE plans to undertake will require linking the events received from NHS Digital to the following information on study participants (held by HSE and linked, by HSE, through the study ID): 5) Analysis is conducted using Stata statistical software, and all files relating to the analysis are saved on the restricted access encrypted network drive for the study. The analysis that HSE plans to undertake will require linking the events received from NHS Digital to the following information on study participants (held by HSE and linked, by HSE, through the study ID): [4 paragraphs unchanged] As this is a one-off analysis, in Objective 1, these data will not be are currently stored on the encrypted network drive for the study database but will be stored electronically on moved to the restricted access encrypted network drive. new data management system once in place. [4 paragraphs unchanged] The identifying fields provide an additional check when using the individual ID [68 words unchanged] until such time as a full check is complete and the new database data management system is established. The members and postings list from NHS Digital provides an [97 words unchanged] data is shared with other researchers or organisations. In all cases, any finding findings from the study are reported in aggregate format and no individuals are identified in these reports. [2 paragraphs unchanged]

Expected output

[10 paragraphs unchanged] This analysis is expected to be completed and the results published by April 2020. 2022. [1 paragraph unchanged]

Unchanged: Expected measurable benefits, Benefits reported.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + Cancer Registration Data; + Civil Registrations of Death; + Demographics

Unchanged: Objective for processing, Processing activities, Expected output, Expected measurable benefits, Benefits reported.