Standard Extract Subscription

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

McKinsey & Company, Inc. United Kingdom (referred to as “McKinsey” hereafter) hereafter), which is the UK affiliate of McKinsey & Company (a US-based company). McKinsey company) aims to use data sets the Data provided under this agreement Data Sharing Agreement (DSA) to support NHS Clients (further referred to as “Client(s)” or “NHS” or [23 words unchanged] NHS services that they deliver or are responsible for overseeing and regulating. This project is designed to harness large-scale NHS health data to generate actionable insights that improve patient care, operational efficiency, and resource planning across the healthcare system. The initiative will enable NHS stakeholders to understand patterns in service utilisation, forecast future demand, and identify opportunities for productivity gains. The lawful basis of this processing is UK GDPR Article 6(1)(f) “Legitimate interests” the use of this lawful basis is justified below. The legal basis for processing pseudonymized special category data is UK GDPR Article 9(2)(j) because processing is necessary for scientific research purposes in accordance with Article 89(1) UK General Data Protection Regulation and Section 19(4)(b)(ii) UK Data Protection Act 2018, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject, as provided for under this Agreement. McKinsey has undertaken a Legitimate Interests Assessment (LIA) and determined that: The Data will be used for the following purposes: 1) Benchmarking and analysis of operational performance: McKinsey has a standardised tool which is created using the requested data sets. This tool is a "System Diagnostic" which compares all NHS acute Trusts and ICSs on a range of operational performance metrics (including case-mix adjusted average length of stay, day case and day of surgery admission rates by setting and specialty; proportion of A&E attendances resulting in admission by length of stay of that admission etc) against a peer group (tailored to each individual Trust and system). McKinsey also conducts ad hoc analyses for the same measures to look in more detail at performance, for example at site level, or for specific types of patients (e.g. subgroups defined by age, gender and diagnosis cluster). Ad hoc analysis is conducted in statistical software packages/programmes. (2) Benchmarking and analysis of variation in utilisation rates and tariff spending: McKinsey has standardised approaches to measure variation in utilisation rates (by setting, patient type or demographic sub-group, specialty, and different activity clusters) and associated tariff expenditure both within (at GP practice level) and between Integrated Care Board (ICB) commissioner peer groups (defined using Civil Registration cluster groupings). Utilisation is measured as an activity rate (or associated tariff value) per 1,000 age-needs weighted population (or most appropriate population measure) and compared to ICB / Place / PCN / GP practice peer group median, quartiles and deciles. This analysis is conducted in excel or tableau using subsets of data extracted using subsets of data extracted using standardised data queries or in ad-hoc basis using statistical software packages/programmes. (3) Analysis of historic trends in rates of activity and spending: Operational performance and utilisation rates are measured over time at different frequencies, including yearly, monthly, and weekly, and daily to understand cyclical patterns and directional performance trends. This analysis is conducted in standard appropriate analytical tools (e.g. Excel or Tableau) using subsets of data extracted using standardised data queries or in ad-hoc basis using database queries. (4) Analysis of future capacity requirements and service configuration impacts: The requested data sets are used to develop best estimates of baseline activity and capacity (defined as bed days for admitted patient care) for commissioners and providers, aggregated at service line level (defined by specialty and point of delivery). This is then forecasted forward using a range of sources of insight, data and triangulation methods (including, but not limited to, local and national historic trends described above), to develop growth assumptions and scenarios. A simulation is created, industry-standard appropriate analytical tools (e.g. Excel or Tableau), to analyse how these baseline levels would change over time if service configuration changed. With the addition of the critical care data set, McKinsey expects to be able improve the granularity of this analysis not break out critical care bed capacity from General and Acute (G&A) bed capacity. McKinsey are currently only able to run this analysis with individual Trusts, which does not allow McKinsey to understand national trends of variation in service utilisation and growth. 5) Population Health Management analysis: The requested data sets are used to understand how local patient populations break down and cluster, how well they are served, and their service utilisation patterns. McKinsey run this analysis to investigate population needs, health inequalities, and potential opportunities to improve services (e.g. elective pathway improvement, proactive management of high-risk population). This analysis would be enhanced with addition of the ethnicity field to add a further dimension to population segmentation, understand health inequalities in more granularity and analyse the potential impact of targeted interventions. The following NHS England Data will be accessed: - Hospital Episode Statistics (HES) - Admitted Patient Care (APC) - Outpatients (OP) - Critical Care (CC) - Emergency Care Data Set (ECDS) - Community Services Data Set (CSDS) - Diagnostic Imaging Data Set (DID) These datasets are essential for building a comprehensive view of patient activity and healthcare system performance. These datasets enable detailed analysis of service utilisation, waiting times, and resource allocation across inpatient, outpatient, emergency, community, and diagnostic services. By combining these data sources, the project can identify trends, forecast future demand, and benchmark operational efficiency, supporting strategic priorities such as elective care recovery, health inequality reduction, and population health management. Ultimately, these insights will help NHS organisations optimise capacity, improve patient outcomes, and enhance overall system resilience. The level of the Data will be: - Pseudonymised The Data will be minimised as follows: - Limited to rolling retention of 3 full years of data, plus current year-to-date - Limited to the following geographic areas ( England and Wales) McKinsey is the controller as the organisation responsible for ensuring that the Data will only be processed for the purposes described above. The lawful basis for processing personal data under the UK GDPR is: Article 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. McKinsey has determined the processing is necessary for its legitimate interests in being able to provide tools and services that will benefit healthcare organisations: [7 paragraphs unchanged] iv. iv The interests of the individual data subjects do not override the legitimate interest [4 paragraphs unchanged] Where an organisation has commissioned McKinsey to carry out some work, McKinsey is permitted to use NHS England DARS data only where the commissioning organisation is one of the following: [11 paragraphs unchanged] Public sector projects in England typically originate from Clients sending McKinsey (and other potential bidders) a formal Invitation to Tender. Most of these tenders are competitively procured via framework agreements (for instance Management Consultancy Framework 1&2 or Health Trust Europe etc) which McKinsey has been awarded a place on through a prior competition. Partners and the Proposal Coordinator or Practice Operations Specialist take responsibility for deciding which projects to bid for. McKinsey typically writes a proposal for each project which sets out: its understanding of the Client's requirements; McKinsey’s credentials for supporting them; the proposed approach for supporting them; a work plan for the project (including key phases of work and their timings, major progress reviews, milestones, key activities, and end products), McKinsey’s team for the project, and commercial arrangements. The lawful basis for processing special category data under the UK GDPR is: In drafting the proposal for each project McKinsey would, internally, decide whether NHS England data pertaining to this agreement, would be useful for each engagement at the stage of writing the proposal (before services are tendered). Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. It is of course a matter for the public body to ensure it abides by public procurement rules and guidance issued by the UK Government on best practice for public sector procurement. McKinsey does not advise public bodies on their procurement options and decisions but always takes care to note that the public body is complying with the procurement rules and guidance. This processing is in the public interest because it adheres to the UK Policy Framework for Health and Social Care Research, which protects and promotes the interests of patients, service users and the public, and aims to produce generalisable and publicly available information to inform future decisions over patients’ treatments or care. Once a project has been awarded, the Engagement Director (usually a Partner) works with a member of McKinsey Legal (which has lawyers dedicated to public sector work) and other non-legal McKinsey colleagues as necessary to ensure a contract is agreed before a project commences. Amazon Web Services provides IT hosting services to McKinsey and will store the Data as contracted by McKinsey. It is an internal requirement a contract is in place before work begins on public sector projects. This is in the interests of all parties. The specific analyses are often relatively bespoke although take common themes (e.g. benchmarking service utilisation or costs across different NHS organisations) – though there are some standard analyses that McKinsey runs as part of initial provider, commissioner or whole health economy diagnostics. The specific analyses that are required to meet the Client’s need are agreed between the partner leading the project and the Client lead. The specific purposes and types of analysis that McKinsey performs are the following: (1) Benchmarking and analysis of operational performance (2) Benchmarking and analysis of variation in utilisation rates and tariff spending (3) Analysis of historic trends in rates of activity and spending (4) Analysis of the impact of different service configuration options The data sets requested will only be used in the context of services by McKinsey in England and will not be used for non-NHS/social care organisations or for organisations outside of England. Data processing and storage will take place within McKinsey's secure cloud platform (details below), which is based on an AWS UK environment. The servers that store and process HES, ECDS, DID, CSDS will be within UK sovereignty (London). McKinsey is the sole data controller who also processes the data for the purposes described within this document. Amazon Web Services supply Cloud Services for McKinsey and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. [2 paragraphs unchanged]

Processing activities

There is no flow of data from McKinsey to NHS England. Under a previous version of this Agreement McKinsey received pseudonymised HES OP, HES APC, HES CC, ECDS, DID and CSDS data via Secure Electronic File Transfer (SEFT). No data will flow to NHS England for the purposes of this Data Sharing Agreement (DSA). McKinsey process NHS England data for several purposes: NHS England will provide the relevant records from the listed datasets in 5a to McKinsey. (1) Benchmarking and analysis of operational performance McKinsey has a standardised tool which is created using the requested data sets. This tool is a "System Diagnostic" which compares all NHS acute Trusts and ICSs on a range of operational performance metrics (including case-mix adjusted average length of stay, day case and day of surgery admission rates by setting and specialty; proportion of A&E attendances resulting in admission by length of stay of that admission etc) against a peer group (tailored to each individual Trust and system). McKinsey also conducts ad hoc analyses for the same measures to look in more detail at performance, for example at site level, or for specific types of patients (e.g. subgroups defined by age, gender and diagnosis cluster). Ad hoc analysis is conducted in statistical software packages/programmes. The Data will contain no direct identifying data items. The Data will be pseudonymised and individuals cannot be reidentified through linkage with other data in the possession of the McKinsey. (2) Benchmarking and analysis of variation in utilisation rates and tariff spending McKinsey has standardised approaches to measure variation in utilisation rates (by setting, patient type or demographic sub-group, specialty, and different activity clusters) and associated tariff expenditure both within (at GP practice level) and between Integrated Care Board (ICB) commissioner peer groups (defined using Civil Registration cluster groupings). Utilisation is measured as an activity rate (or associated tariff value) per 1,000 age-needs weighted population (or most appropriate population measure) and compared to ICB / Place / PCN / GP practice peer group median, quartiles and deciles. This analysis is conducted in excel or tableau using subsets of data extracted using subsets of data extracted using standardised data queries or in ad-hoc basis using statistical software packages/programmes. (3) Analysis of historic trends in rates of activity and spending. Operational performance and utilisation rates are measured over time at different frequencies, including yearly, monthly, and weekly, and daily to understand cyclical patterns and directional performance trends. This analysis is conducted in standard appropriate analytical tools (e.g. Excel or Tableau) using subsets of data extracted using standardised data queries or in ad-hoc basis using database queries. The Data will not be transferred to any other location. (4) Analysis of future capacity requirements and the impact of different potential service configuration options. The requested data sets are used to develop best estimates of baseline activity and capacity (defined as bed days for admitted patient care) for commissioners and providers, aggregated at service line level (defined by specialty and point of delivery). This is then forecasted forward using a range of sources of insight, data and triangulation methods (including, but not limited to, local and national historic trends described above), to develop growth assumptions and scenarios. A simulation is created, industry-standard appropriate analytical tools (e.g. Excel or Tableau), to analyse how these baseline levels would change over time if service configuration changed. With the addition of the critical care data set, McKinsey expects to be able improve the granularity of this analysis not break out critical care bed capacity from General and Acute (G&A) bed capacity. McKinsey are currently only able to run this analysis with individual Trusts, which does not allow McKinsey to understand national trends of variation in service utilisation and growth. The Data will be stored on servers at MicKinsey. (5) Population Health Management analysis The requested data sets are used to understand how local patient populations break down and cluster, how well they are served, and their service utilisation patterns. McKinsey run this analysis to investigate population needs, health inequalities, and potential opportunities to improve services (e.g. elective pathway improvement, proactive management of high-risk population). This analysis would be enhanced with addition of the ethnicity field to add a further dimension to population segmentation, understand health inequalities in more granularity and analyse the potential impact of targeted interventions. The Data will be accessed by authorised personnel via remote access. When Processing data, McKinsey commits to the following: McKinsey must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract. • McKinsey will not link NHS England data to other data sets without amending this agreement. For remote access: • McKinsey will be no attempt or requirement to identify individual from the pseudonymised data. - Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA; • McKinsey will store, processed, and transmitted NHS data within McKinsey’s secure UK cloud environment. The underlying cloud infrastructure is provided by Amazon Web Services UK (AWS) hosted in London. - Access controls granting users the minimum level of access required are in place; McKinsey’s secure UK cloud environment has strict access controls based on a 'need to know' basis. Access to NHS England data sets is restricted to a small subset of users. These are specific team members, substantively employed by McKinsey, who are currently engaged on NHS Client work and need the requested data sets to complete this work. All users must sign an acceptable use policy before getting access to the platform. All users complete mandatory training on information governance and data protection ("Professional Standards and Risk: Working with Personal Data") that are required annually for all employees of McKinsey & Company. In addition, all users who need access to sensitive healthcare data must first complete an additional specific training (“Healthcare Data Risk Training”). The data environment actively logs and monitors user access and behaviour and uses industry-leading security tools. - Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data; The data environment provides users with variety of secure applications for processing the requested data sets within the cloud platform including a set of statistical software packages. - Multifactor authentication (MFA) is required for remote access; Amazon Web Services is, strictly, data (sub)processors in the sense that the data are hosted and manipulated on their infrastructure. By design, AWS themselves cannot access or read any of the NHS England data pertaining to this agreement in database that are hosted on their infrastructure, nor can anyone else who is not specifically granted individual access to the requested data sets (including McKinsey employees). - Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access; - All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy. The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose). Remote processing will be from secure locations within England and Wales Access is restricted to employees or agents of McKinsey who have authorisation from the Principal Investigator. Amazon Web Services and Databricks UK Limited are not permitted to access the Data. All personnel accessing the Data have been appropriately trained in data protection and confidentiality The Data will not be linked with any other data. There will be no requirement and no attempt to reidentify individuals when using the Data. Analysts/researchers from McKinsey will process/analyse the Data for the purposes described above.

Benefits reported

[1 paragraph unchanged] Ref.1: Acute sector productivity analysis (2023 ongoing) Ref.1: Performance diagnostic and development of holistic productivity improvement program and organization (2025) Client: Trust McKinsey supported one of the largest Trusts in addressing significant productivity challenges. The Trust sought to take a proactive approach by building internal capabilities to drive sustained performance improvement over the next 3-5 years. McKinsey collaborated with the Trust to shape the program, define key initiatives and targets, and establish a client organization to ensure successful delivery. What we did Our approach was grounded in building sustained performance improvement capabilities within the organisation. This required a holistic approach, covering: • Defining the metrics, targets and setting the performance improvement agenda with the board • Developing the specific productivity improvement targets for the organisation that cascade through each division, specialty and area • Defining the governance arrangements to ensure accountability through the org in delivering performance objectives • Developing the data and tech roadmap, including the data products / tools to measure performance and understand underlying drivers • Establishing a new team inside the organisation to support the performance improvement agenda, and equipping them with the skills, tools, methodologies and embedding the routines to drive ongoing improvement and transformation • Developing an improvement roadmap covering £100m+ initiatives, worked up with detailed implementation plans side-by-side with the new team Data pertaining to this Data Sharing Agreement were instrumental to carry out critical analytics to support this work including sizing opportunities of the initiatives and setting targets for the defined metrics by running benchmarking on case mix adjusted LoS and cost weighted activity. Examples of benefits captured: • Organisation on track to deliver 6% productivity improvement in next 12 months • Initiatives identified and worked up to meet financial and productivity targets for next 2 years • Established single ‘language’ for org to use to understand productivity Ref.2: Performance diagnostic and sizing of productivity improvement initiatives (2025) Client: ICB In a focussed piece of work with an ICB in the East of England McKinsey used HES data to understand: • Potential productivity improvements based on comparing historic and current activity for acute providers in the system • Opportunities to better target out-of-hospital care on cohorts that drive the majority of acute activity • Health inequalities across the system, including analysis at the level of GP practices of acute admissions and correlation with primary care spend Ref.3: Acute sector productivity analysis (2023 ongoing) [2 paragraphs unchanged] McKinsey also supported individual ICBs and Trust with similar targeted assessments. [1 paragraph unchanged] • Quantifying annual changes in cost weighted activity between 19/20 and 2022/23, and 2023/24, and YTD 2023/24, 2024/25 at national level, Trust level, and Trust and Specialty levels [5 paragraphs unchanged] All analysis was carried out at the trust and speciality specialty level [3 paragraphs unchanged] Ref#2: Ref#4: Supporting NHS England on National Hospital Program (2022-2023 (2022-2023) [8 paragraphs unchanged] Ref.#3 Ref.#5 Supporting multiple large ICS on its elective care recovery programme (2020-2023) [8 paragraphs unchanged] Ref.#4 Ref.#6 Performance diagnostics for three leading ICS (2022) [4 paragraphs unchanged] Ref.#5 Ref.#7 Supporting a large ICS on its elective care recovery programme (2020-2021) [2 paragraphs unchanged] McKinsey used HES data to understand the typical current and pre-pandemic activity mix. Elective inpatient and outpatient activity was grouped into pathways to help size the impact from interventions aimed at addressing specific patient types. This analysis took place at a specialty and Trust level, with specific logic applied on individual HRG codes and variation analysed by GP practice. McKinsey used HES data to understand the typical current and pre-pandemic activ This analysis supported development of interventions that enable 30% more outpatient activity to be delivered with no increase in secondary care capacity across the top 5 specialties. This is estimated to cut the projected backlog by 50% by 2024.

Unchanged: Expected output, Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[38 paragraphs unchanged] Data processing and storage will take place within McKinsey's secure cloud platform [6 words unchanged] an AWS UK environment. The servers that store and process HES, ECDS, DID and DID, CSDS data will be within UK sovereignty (London). McKinsey is the sole data controller who also processes the data for the purposes described within this document. Amazon Web Services supply Cloud Services for McKinsey and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. Amazon Web Services supply Cloud Services for McKinsey and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. Databricks U.K. Limited provides IT support to McKinsey. [1 paragraph unchanged]

Unchanged: Processing activities, Expected output, Expected measurable benefits, Benefits reported.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

McKinsey & Company, Inc. United Kingdom (referred to as “McKinsey” hereafter) is [12 words unchanged] to use data sets provided under this agreement to support NHS Clients (further referred to as “Client(s)” or “NHS” or “NHS Client”) with fact-based answers to clients' Clients' questions regarding identification, assessment assessment, and quantification of opportunities to improve the quality and efficiency of the NHS services that they deliver or are responsible for overseeing and regulating. Under this application, McKinsey requests to renew, amend and extend access to the data sets received under previous Agreements (HES Admitted Patient Care, A&E, Outpatients and ECDS) and switch from quarterly to monthly disseminations to provide more up-to-date data when serving its client. The applicant has also requested a full refresh of data from 2019/2020 due to additional fields being added to the agreement. Fields to be additional include -HES OP. • extra diagnosis and operational code columns, to help with more efficient data processing. • extra General Practice, Primary Care Trusts, Strategic Health Authority, Regional and Local area description columns for more holistic and historic information on the primary care settings. • extra columns i.e. marital or carer status on appointment attendees classification to help better segment these patients. -HES APC . • extra alcohol, general diagnosis and operational code columns, to help with more efficient data processing. -ECDS. • the sensitive column ethnic category and spoken language, in order to better create patient cohorts for this dataset. Ethnicity fields into Emergency Care Data Set (ECDS). In addition, McKinsey requests access to the following new data sets with monthly refresh process: HES Critical Care (HES CC), Diagnostic Imaging (DID), Community Services data sets (CSDS). These datasets are requested for the purpose of supporting NHS work and more specifically perform Integrated Care System (ICS) diagnostic work, mapping service usage and planning accordingly. The impact of these datasets could help attain a much granular view on how ICS’s are serving various needs within their catchment area. This would allow to spot trends in current usage and project demand of these services, missed diagnosis. The combination of HES demographic, diagnostic, procedure and these datasets could be helpful in baselining better performing ICS’s . [2 paragraphs unchanged] Without the processing of patient data, detailed statistical evaluations of improvements to patient care cannot take place. Models, forecasts, benchmarks benchmarks, and recommendations based on summary statistics cannot be as accurate as those built on detailed patient records. [1 paragraph unchanged] The processing of records covering all NHS patients in the HES and ECDS datasets, NHS England data pertaining to this agreement, with the addition of HES Critical Care, DID, Community Services data sets [5 words unchanged] enables national benchmarking, and the development of recommendations informed by nationwide best-practice. The negative impact on individual patients is minimal. Instead, the impact on [52 words unchanged] data processing is not used to target any specific individual in any way. way [1 paragraph unchanged] Not if NHS clients Clients and the health system seek to make the most accurate decisions for the improvement of patient care, given the data that are available. Using summary data, or smaller datasets, data sets, provides substantially less information and less detail. The more detailed the data, the more nuance and accurate the analyses, recommendation and models that can be built from them. built from them. [3 paragraphs unchanged] Until now most if not all work for which McKinsey have has leveraged HES data sets (as defined in this DSA) has been commissioned [36 words unchanged] by the NHS organisation within and outside of specific procurement framework agreements. McKinsey have has been serving various Academic Health Science Networks as well as UK Health [16 words unchanged] public or population health, for which the HES data would be necessary. [12 paragraphs unchanged] Public sector projects in England typically originate from clients Clients sending McKinsey (and other potential bidders) a formal Invitation to Tender. Most [10 words unchanged] instance Management Consultancy Framework 1&2 or Health Trust Europe etc) which McKinsey have has been awarded a place on through a prior competition. Partners and the [18 words unchanged] a proposal for each project which sets out: its understanding of the client's Client's requirements; McKinsey’s credentials for supporting them; the proposed approach for supporting them; [19 words unchanged] activities, and end products), McKinsey’s team for the project, and commercial arrangements. In drafting the proposal for each project McKinsey would, internally, decide whether HES and ECDS data, as well as of HES Critical Care, DID and Community Services NHS England data sets and associated HES bridge files, pertaining to this agreement, would be useful for each engagement at the stage of writing the proposal (before services are tendered). [4 paragraphs unchanged] McKinsey has had access to HES (OP, APC and A&E) and ECDS data for several years (with a rolling retention of 3 full years of data, plus current year-to-date). In addition, McKinsey also requests access to the following new data sets (also with monthly refresh process, a rolling retention of 3 full years of data, plus current year-to-date): HES Critical Care (HES CC), Diagnostic Imaging (DID) and Community Services data sets (CSDS) and the Emergency Care Data Set (ECDS). This will allow McKinsey to look at trends in performance, expenditure, utilisation and demand. To address the UK GDPR principle of minimisation only fields that have been deemed necessary for the purpose of this work have been requested. [8 paragraphs unchanged] McKinsey’s NHS consulting work is a commercial business for which McKinsey charge fees. McKinsey’s NHS consulting work is a commercial business for which McKinsey charge fees. McKinsey competes for contracts under framework agreements that set limitations for their fees and the use of HES data is set out for the NHS Client in that bid. While McKinsey do not bid for or accept work where they do not believe they can provide substantial value for money, it is ultimately the NHS Client that balances the cost of the work against the public benefit. McKinsey's work is undertaken under NHS and public sector framework contracts, that set boundaries for McKinsey's fees, and the nature and outcomes of the work are set by McKinsey's Clients in the NHS. In all the work with HES data, the Client will balance the costs of this work against the public benefits that are expected to arise. McKinsey compete for contracts under framework agreements that set limitations for their fees and the use of HES data is set out for the NHS client in that bid. While McKinsey do not bid for or accept work where they do not believe they can provide substantial value for money, it is ultimately the NHS client that balances the cost of the work against the public benefit. McKinsey's work is undertaken under NHS and public sector framework contracts, that set boundaries for McKinsey's fees, and the nature and outcomes of the work are set by McKinsey's clients in the NHS. In all of the work with HES data, the client will balance the costs of this work against the public benefits that are expected to arise.

Processing activities

There is no flow of data from McKinsey to NHS England. Under a previous version of this Agreement McKinsey received pseudonymised HES (OP, APC OP, HES APC, HES CC, ECDS, DID and A&E) and ECDS CSDS data via Secure Electronic File Transfer (SEFT). McKinsey is expecting to receive the additional data sets listed in the same fashion: HES Critical Care (HES CC), Diagnostic Imaging (DID), Community Services and the Ethnicity field only within the Emergency Care Data Set (ECDS). McKinsey is also changing from quarterly to monthly data disseminations. Until now, McKinsey was receiving quarterly disseminations of NHS Data. In this Data Sharing agreement amendment, McKinsey is requesting to receive monthly data refresh instead of quarterly for three purposes: • A shorter data refresh will provide more effective and accurate decision making when serving the NHS, to improve insights • McKinsey can track performance trends of NHS services with much more agility, to react to sudden healthcare demand fluctuations such as the impact on the health service of the Covid pandemic. • To rapidly detect and address any data issues, assumptions, pipelines and visualisation in a timely manner in order to minimize risk for the NHS clients we serve. [1 paragraph unchanged] (1) Benchmarking and analysis of operational performance (1) Benchmarking and analysis of operational performance McKinsey has a standardised tool which is created using the requested data sets. This tool is a "System Diagnostic" which compares all NHS acute Trusts and ICSs on a range of operational performance metrics (including case-mix adjusted average length of stay, day case and day of surgery admission rates by setting and specialty; proportion of A&E attendances resulting in admission by length of stay of that admission etc) against a peer group (tailored to each individual Trust and system). McKinsey also conducts ad hoc analyses for the same measures to look in more detail at performance, for example at site level, or for specific types of patients (e.g. subgroups defined by age, gender and diagnosis cluster). Ad hoc analysis is conducted in statistical software packages/programmes. McKinsey has a standardised tool which is created using the requested data sets. This tool is a "System Diagnostic" which compares all NHS acute Trusts and ICSs on a range of operational performance metrics (including case-mix adjusted average length of stay, day case and day of surgery admission rates by setting and specialty; proportion of A&E attendances resulting in admission by length of stay of that admission etc) against a peer group (tailored to each individual Trust and system). McKinsey also conducts ad hoc analyses for the same measures to look in more detail at performance, for example at site level, or for specific types of patients (e.g. sub-groups defined by age, gender and diagnosis cluster). Ad hoc analysis is conducted in statistical software packages/programmes. (2) Benchmarking and analysis of variation in utilisation rates and tariff spending McKinsey has standardised approaches to measure variation in utilisation rates (by setting, patient type or demographic sub-group, specialty, and different activity clusters) and associated tariff expenditure both within (at GP practice level) and between Integrated Care Board (ICB) commissioner peer groups (defined using Civil Registration cluster groupings). Utilisation is measured as an activity rate (or associated tariff value) per 1,000 age-needs weighted population (or most appropriate population measure) and compared to ICB / Place / PCN / GP practice peer group median, quartiles and deciles. This analysis is conducted in excel or tableau using subsets of data extracted using subsets of data extracted using standardised data queries or in ad-hoc basis using statistical software packages/programmes. (3) Analysis of historic trends in rates of activity and spending. Operational performance and utilisation rates are measured over time at different frequencies, including yearly, monthly, and weekly, and daily to understand cyclical patterns and directional performance trends. This analysis is conducted in standard appropriate analytical tools (e.g. Excel or Tableau) using subsets of data extracted using standardised data queries or in ad-hoc basis using database queries. (2) Benchmarking and analysis of variation in utilisation rates and tariff spending (4) Analysis of future capacity requirements and the impact of different potential service configuration options. The requested data sets are used to develop best estimates of baseline activity and capacity (defined as bed days for admitted patient care) for commissioners and providers, aggregated at service line level (defined by specialty and point of delivery). This is then forecasted forward using a range of sources of insight, data and triangulation methods (including, but not limited to, local and national historic trends described above), to develop growth assumptions and scenarios. A simulation is created, industry-standard appropriate analytical tools (e.g. Excel or Tableau), to analyse how these baseline levels would change over time if service configuration changed. With the addition of the critical care data set, McKinsey expects to be able improve the granularity of this analysis not break out critical care bed capacity from General and Acute (G&A) bed capacity. McKinsey are currently only able to run this analysis with individual Trusts, which does not allow McKinsey to understand national trends of variation in service utilisation and growth. McKinsey has standardised approaches to measure variation in utilisation rates (by setting, patient type or demographic sub-group, specialty, and different activity clusters) and associated tariff expenditure both within (at GP practice level) and between Integrated Care Board (ICB) commissioner peer groups (defined using Civil Registration cluster groupings). Utilisation is measured as an activity rate (or associated tariff value) per 1,000 age-needs weighted population (or most appropriate population measure) and compared to ICB / Place / PCN / GP practice peer group median, quartiles and deciles. This analysis is conducted in excel or tableau using subsets of data extracted using subsets of data extracted using standardised data queries or in ad-hoc basis using statistical software packages/programmes. (5) Population Health Management analysis The requested data sets are used to understand how local patient populations break down and cluster, how well they are served, and their service utilisation patterns. McKinsey run this analysis to investigate population needs, health inequalities, and potential opportunities to improve services (e.g. elective pathway improvement, proactive management of high-risk population). This analysis would be enhanced with addition of the ethnicity field to add a further dimension to population segmentation, understand health inequalities in more granularity and analyse the potential impact of targeted interventions. (3) Analysis of historic trends in rates of activity and spending. When Processing data, McKinsey commits to the following: Operational performance and utilisation rates are measured over time at different frequencies, including yearly, monthly, and weekly, and daily in order to understand cyclical patterns and directional performance trends. This analysis is conducted in standard appropriate analytical tools (e.g. Excel or Tableau) using subsets of data extracted using standardised data queries or in ad-hoc basis using database queries. • McKinsey will not link NHS England data to other data sets without amending this agreement. (4) Analysis of future capacity requirements and the impact of different potential service configuration options • McKinsey will be no attempt or requirement to identify individual from the pseudonymised data. The requested data sets are used to develop best estimates of baseline activity and capacity (defined as bed days for admitted patient care) for commissioners and providers, aggregated at service line level (defined by specialty and point of delivery). This is then forecasted forward using a range of sources of insight, data and triangulation methods (including, but not limited to, local and national historic trends described above), to develop growth assumptions and scenarios. A simulation is created, industry-standard appropriate analytical tools (e.g. Excel or Tableau), to analyse how these baseline levels would change over time if service configuration changed. With the addition of the critical care data set, McKinsey expect to be able improve the granularity of this analysis not break out critical care bed capacity from General and Acute (G&A) bed capacity. McKinsey are currently only able to run this analysis with individual Trusts, which does not allow McKinsey to understand national trends of variation in service utilisation and growth. • McKinsey will store, processed, and transmitted NHS data within McKinsey’s secure UK cloud environment. The underlying cloud infrastructure is provided by Amazon Web Services UK (AWS) hosted in London. (5) Population Health Management analysis McKinsey’s secure UK cloud environment has strict access controls based on a 'need to know' basis. Access to NHS England data sets is restricted to a small subset of users. These are specific team members, substantively employed by McKinsey, who are currently engaged on NHS Client work and need the requested data sets to complete this work. All users must sign an acceptable use policy before getting access to the platform. All users complete mandatory training on information governance and data protection ("Professional Standards and Risk: Working with Personal Data") that are required annually for all employees of McKinsey & Company. In addition, all users who need access to sensitive healthcare data must first complete an additional specific training (“Healthcare Data Risk Training”). The data environment actively logs and monitors user access and behaviour and uses industry-leading security tools. The requested data sets are used to understand how local patient populations break down and cluster, how well they are served, and their service utilisation patterns. McKinsey run this analysis to look into population needs, health inequalities, and potential opportunities to improve services (e.g. elective pathway improvement, proactive management of high risk population). This analysis would be enhanced with addition of the ethnicity field to add a further dimension to population segmentation, understand health inequalities in more granularity and analyse the potential impact of targeted interventions. McKinsey will not link NHS England data to other data sets without amending this agreement. There will be no attempt or requirement to identify individual from the pseudonymised data. All NHS data will be stored, processed, and transmitted within McKinsey’s secure UK cloud environment. The underlying cloud infrastructure is provided by Amazon Web Services UK (AWS) hosted in London. The data environment has strict access controls based on a 'need to know' basis. Access to NHS England data sets is restricted to a small subset of users. These are specific team members, substantively employed by McKinsey, who are currently engaged on NHS client work and need the requested data sets to complete this work. All users must sign an acceptable use policy before getting access to the platform. All users complete mandatory training on information governance and data protection ("Professional Standards and Risk: Working with Personal Data") that are required annually for all employees of McKinsey & Company. In addition, all users who need access to sensitive healthcare data must first complete an additional specific training (“Healthcare Data Risk Training”). The data environment actively logs and monitors user access and behaviour and uses industry-leading security tools. [1 paragraph unchanged] Amazon Web Services is, strictly, a data (sub)processor (sub)processors in the sense that the data are hosted and manipulated on their infrastructure. By design, AWS themselves cannot access or read any of the HES NHS England data pertaining to this agreement in database that are hosted on their infrastructure, nor can anyone else who is not specifically granted individual access to the requested data sets (including McKinsey employees).

Expected output

[1 paragraph unchanged] During the course of the projects that McKinsey do with NHS organisations, McKinsey tests the data and analysis with its clients, NHS Clients, and where necessary updates and replaces the data with summary data provided by the clients. NHS Clients. This is the case with commissioners and providers but is not always [7 words unchanged] resources, and their own access to data. Data are exclusively shared with clients NHS Clients in aggregated, non-patient nonpatient identifiable formats with small numbers suppressed as per the HES Analysis Guide. [2 paragraphs unchanged] Most of the work done in 2020 and 2021 were COVID related, and involved the following analysis on HES and ECDS datasets: NHS England data pertaining to this agreement: [4 paragraphs unchanged] • Engagement with a local health system to analyse historical emergency activity to help identify initiatives to improve emergency pathway performance performance. In 2022, 2022 and 2023, many engagements have been related to tackling Elective Backlogs resulting from the Covid-19 pandemic. pandemic and work on productivity improvement. McKinsey have has also supported the set-up of newly created Integrated Care Systems and leveraged HES and ECDS datasets NHS England data pertaining to this agreement to provide detailed diagnostics of health system performance and to identify the future demand for healthcare services services. McKinsey have has been also performed more traditional engagements leveraging HES and ECDS datasets NHS England data pertaining to this agreement for the following analysis [4 paragraphs unchanged] McKinsey shares outputs in the following ways with clients: NHS Client(s): • McKinsey includes aggregated data with small number suppression ,as suppression, as per the HES Analysis Guide, into PowerPoint, Excel and Tableau models which, McKinsey hands over to the NHS client Client [2 paragraphs unchanged] Clients (NHS) may communicate the findings of McKinsey’s work internally, typically through workshops or internal newsletters. McKinsey does not publish the outputs in any journal articles or other public documents (e.g., white papers) nor does McKinsey directly present any data outputs in the public domain. McKinsey does not publish the outputs in any journal articles or other public documents (e.g., white papers) nor does McKinsey directly present any data outputs in the public domain. McKinsey will only share aggregated analysis with its NHS clients in Excel, Tableau or PowerPoint charts, and is fully compliant with the small numbers guidance in the HES Analysis Guide.

Benefits reported

McKinsey has used HES data to support its work with NHS clients Clients for the past 10 years. The benefits of some of this past [37 words unchanged] recommended actions. The actual benefit would need to be confirmed by the client Client based on actual data. Below are some examples of projects illustrating the ways in which McKinsey uses NHS England data pertaining to this agreement, and the benefits this work has yielded. Below are some examples of projects illustrating the ways in which McKinsey uses HES and ECDS data, and the benefits this work has yielded. Ref.1: Acute sector productivity analysis (2023 ongoing) Ref.#1 Supporting multiple large ICS on its elective care recovery programme (2020 ongoing) Client: NHS England Client: NHSE McKinsey supported the NHS England Productivity and Efficiency team (reporting into the CFO office) to establish the scale, drivers, and root causes of the perceived productivity drop in the acute sector between 19/20 and now. Data pertaining to this Data Sharing Agreement were instrumental to carry out critical analytics to support this work including: • Quantifying annual changes in cost weighted activity between 19/20 and 2022/23, and YTD 2023/24, at national level, Trust level, and Trust and Specialty levels • Quantifying the financial impact of changes in 1) volume of activity overall 2) distribution of activity-by-activity type (POD mix) 3) case mix and complexity shift at the HRG 4- and 5-character levels • Quantifying the financial impact of changes in average length of stay (adjusted for case mix) • Quantifying the financial impact of changes in models of care (including evidence for ‘left shift’ where a larger proportion of care is delivered in lower intensity settings, adjusted for case mix) • Creating an integrated model, allowing Trusts to identify the drivers of productivity change (at Trust and Specialty levels) aligned to an opportunity map of improvement initiatives and expected impact (based on peer-group and historic benchmarking) • Creating a set of productivity metrics at Trust level with the potential for Trusts to cascade these to theatre and ward levels to inform and guide internal improvement priorities. All analysis was carried out at the trust and speciality level The benefit of this analysis (which is still ongoing at time of writing), is a: • Clear, data-driven, nationally aligned methodology and metrics to quantify changes in productivity from an agreed baseline (2019/20) at national, Trust, and sub-Trust (e.g. Trust and Specialty) levels, enabling a clear national narrative and better decision making by senior NHS England leaders • Detailed, quantitative opportunity map to recover productivity, with opportunities linked directly to operational processes, creating an improvement roadmap for Trusts Ref#2: Supporting NHS England on National Hospital Program (2022-2023 Client: NHS England McKinsey supported National Hospital Program in modelling capacity and capital investment required and preparing programme business case to secure central government funding. We notably utilized HES data sets and ECDS data sets as key input data to build a forecasting engine that could predict capacity requirements and capital investment: • understand hospital activity baseline at pre-pandemic level of 2019/2020 for hospitals within the programme • calculate current utilization rate • calculate historical non-demographic growth rate By conducting this analysis, McKinsey was able to develop a consistent and clear methodology for modelling capacity and capital expenditure requirements for over 40 new hospitals. This methodology allowed to forecast capacity requirements and capital investment accurately. The prepared program business case, which was based on this methodology, successfully secured program funding from the central government. In fact, it was the largest capital allocation in over 75 years Ref.#3 Supporting multiple large ICS on its elective care recovery programme (2020-2023) Client: NHS England [3 paragraphs unchanged] • Identifying interventions to bridge the gap between available capacity and NHSE NHS England targets (e.g., 130% increase in completed integrated care pathways by 2024/25) • Modelling the impact of these initiatives on the backlog, and the resources required to deliver them them. [1 paragraph unchanged] This analysis supported executive decision-making that enabled healthcare providers to develop additional completed pathways, meet NHSE NHS England targets, and identify intervention with greatest future potential. In one example, McKinsey identified a series of interventions that would allow a large ICS to deliver over 60,000 additional completed pathways by 2024/5, effectively exceeding NHS England targets, and reducing backlogs by over 20,000. greatest future potential. In one example, McKinsey identified a series of interventions that would allow a large ICS to deliver over 60,000 additional completed pathways by 2024/5, effectively exceeding NHSE targets, and reducing backlogs by over 20,000. Ref.#4 Performance diagnostics for three leading ICS (2022) Ref.#2 Performance diagnostics for three leading ICS (2022) [3 paragraphs unchanged] The benchmarking analyses identified potential efficiencies opportunities which, if achieved, would be [18 words unchanged] to benchmark in one, and a 5-9% opportunity to reduce re-admissions in another another. Ref.#3 Ref.#5 Supporting a large ICS on its elective care recovery programme (2020-2021) [4 paragraphs unchanged] Ref. #4 – Benchmarking specialised care demand (2022) Client: DHSC McKinsey performed benchmarking analysis to understand demand for specialised activities and project capacity limitations for hospital wards, theatres and critical care units. McKinsey used HES data to identify baseline operating activity and critical care implications for three NHS trusts. This analysis provided a robust fact base of demand and capacity across the system and, once validated, will form the starting point for a piece of work that encourages partnership across ICS to collectively shape strategy and prepare for commissioning changes. Ref.#5 Modelling Bed Capacity (2022 ongoing) Client: NHSE McKinsey completed a national 6 week performance diagnostic; and used HES data to identify opportunities that tackle high bed occupancy rates, which if successfully implemented, would achieve a 5-10% reduction within 4-5 months, effectively alleviating the pressure on non-elective and elective healthcare services in winter 2022. Ref.#6 Supporting urgent and emergency care transformations (2022 ongoing) Client: NHS Trust McKinsey supported a leading ICS in transforming its urgent and emergency care pathway. HES data was instrumental in understanding key predictors of bed occupancy and identifying opportunities to reallocate resources, which could potentially reduce bed occupancy by up to 14% for non-elective cases in the acute sector Ref, 7 Developing vision and business case for digitally enabled service model transformation for a large Health and Social Care Partnership including Trust and commissioner. Client: AHSN McKinsey supported NHS organisations across a city conurbation of around 500,000 people, including NHS Trusts and commissioners, to prepare the Outline Business Case for redevelopment of an acute hospital site to create a new health and wellbeing campus serving the needs of the community over the next twenty years and beyond. McKinsey’s role was to map selected citizen cohort journeys through the health and care system, to identify and quantify opportunities to improve patient experience, population health outcomes and health system efficiency. Working with patients and staff, McKinsey then reimagined these journeys deploying digital and data technologies to improve patient experience and outcomes and improve system efficiency. This work was used to inform the Outline Business Case, setting out the digital vision for the future health service in the locality, and the investments in technology, training, and digital inclusion, and the changes to operating processes, care delivery models and culture, that would be required to deliver this vision. Hospital Episode Statistics were used to understand the baseline of activity and trends at the site, across admitted patient care, outpatients, and A&E, and to benchmark this pattern of demand against comparable areas. This intelligence was used to inform and test inputs to estimate the space and capacity requirements for the redeveloped site (in terms of beds, space for urgent care, space for outpatient care, space for primary care and wellbeing services) arising from changes to the model of service delivery.

Changed only in punctuation, spacing or capitalisation: Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + Community Services Data Set (CSDS); + Diagnostic Imaging Data Set (DID); + Hospital Episode Statistics Critical Care (HES Critical Care) · − HES-ID to MPS-ID HES Accident and Emergency; − Hospital Episode Statistics Accident and Emergency (HES A and E)

Objective for processing

McKinsey & Company, Inc. United Kingdom (referred to as “McKinsey” hereafter) is the UK affiliate of McKinsey & Company (a US-based company). McKinsey aims to use the HES and ECDS data sets provided by NHS Digital under this agreement to support NHS Clients with fact-based answers to clients clients' questions regarding identification, assessment and quantification of opportunities to improve the quality and efficiency of the NHS services that they deliver or are responsible for overseeing and regulating. Under this application, McKinsey request continued access to the data received under previous Agreements, in addition to the receipt of quarterly disseminations of HES OP, HES APC and ECDS data. The lawful basis of this processing is GDPR Article 6(1)(f) “Legitimate interests” the use of this lawful basis is justified below. The legal basis for processing pseudonymized special category data is GDPR Article 9(2)(j) because processing is necessary for scientific research purposes in accordance with Article 89(1) UK General Data Protection Regulation and Section 19(4)(b)(ii) UK Data Protection Act 2018, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject, as provided for under this Agreement. McKinsey has undertaken a Legitimate Interests Assessment (LIA) and determined that: Under this application, McKinsey requests to renew, amend and extend access to the data sets received under previous Agreements (HES Admitted Patient Care, A&E, Outpatients and ECDS) and switch from quarterly to monthly disseminations to provide more up-to-date data when serving its client. The applicant has also requested a full refresh of data from 2019/2020 due to additional fields being added to the agreement. Fields to be additional include -HES OP. • extra diagnosis and operational code columns, to help with more efficient data processing. • extra General Practice, Primary Care Trusts, Strategic Health Authority, Regional and Local area description columns for more holistic and historic information on the primary care settings. • extra columns i.e. marital or carer status on appointment attendees classification to help better segment these patients. -HES APC . • extra alcohol, general diagnosis and operational code columns, to help with more efficient data processing. -ECDS. • the sensitive column ethnic category and spoken language, in order to better create patient cohorts for this dataset. Ethnicity fields into Emergency Care Data Set (ECDS). In addition, McKinsey requests access to the following new data sets with monthly refresh process: HES Critical Care (HES CC), Diagnostic Imaging (DID), Community Services data sets (CSDS). These datasets are requested for the purpose of supporting NHS work and more specifically perform Integrated Care System (ICS) diagnostic work, mapping service usage and planning accordingly. The impact of these datasets could help attain a much granular view on how ICS’s are serving various needs within their catchment area. This would allow to spot trends in current usage and project demand of these services, missed diagnosis. The combination of HES demographic, diagnostic, procedure and these datasets could be helpful in baselining better performing ICS’s . The lawful basis of this processing is UK GDPR Article 6(1)(f) “Legitimate interests” the use of this lawful basis is justified below. The legal basis for processing pseudonymized special category data is UK GDPR Article 9(2)(j) because processing is necessary for scientific research purposes in accordance with Article 89(1) UK General Data Protection Regulation and Section 19(4)(b)(ii) UK Data Protection Act 2018, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject, as provided for under this Agreement. McKinsey has undertaken a Legitimate Interests Assessment (LIA) and determined that: [3 paragraphs unchanged] The processing of records covering all NHS patients in the HES and ECDS datasets datasets, with the addition of HES Critical Care, DID, Community Services data sets and associated HES bridge files, enables sensitive national benchmarking, and the development of recommendations informed by nationwide best-practice. [5 paragraphs unchanged] McKinsey has considered that the data is health data, including data about [34 words unchanged] the data sets are pseudonymised and therefore, McKinsey considers the possible impacts on people's privacy of the processing to be minimal. McKinsey has put in place safeguards [5 words unchanged] severity of impact on patients, beyond improvement to health and care services. [1 paragraph unchanged] Until now most if not all work for which McKinsey have leveraged HES data sets (as defined in this DSA) has been commissioned by the NHS organisations, including (including Integrated Care Board, NHS Trusts and Trust, NHS Foundation Trusts, ICSs, CCGs, CSUs, Trust, NHS England, NHS Improvement and Public Health England (including Transformation Directorate, Regional teams, Commissioning Support Units)) or by DHSC. These organisations commission McKinsey to work on projects which are procured by the NHS organisation within and outside of specific procurement framework agreements. Where an organisation has commissioned McKinsey to carry out some work, McKinsey is permitted to use NHS Digital data only where the commissioning organisation is one of the following: McKinsey have been serving various Academic Health Science Networks as well as UK Health Security Agency for many years and believe that there are potential future projects, for example in public or population health, for which the HES data would be necessary. • Clinical Commissioning Groups (CCG) and Integrated Care Systems (ICS) Where an organisation has commissioned McKinsey to carry out some work, McKinsey is permitted to use NHS England DARS data only where the commissioning organisation is one of the following: • Integrated Care Board (ICB) and delegated authorities [2 paragraphs unchanged] • NHS England (including Commissioning Support Units, CSUs) Transformation Directorate, Regional teams) • NHS Improvement (Monitor, NHS Trust Development Agency) • Commissioning Support Units • Public Health England • UKHSA [2 paragraphs unchanged] McKinsey will not use the NHS Digital data held under this agreement for any work carried out for any other organisation, including: • Sustainability and Transformation Partnerships [2 paragraphs unchanged] Public sector projects in England typically originate from clients sending McKinsey (and [18 words unchanged] (for instance Management Consultancy Framework 1&2 or Health Trust Europe etc) which we McKinsey have been awarded a place on through a prior competition. Partners and [63 words unchanged] activities, and end products), McKinsey’s team for the project, and commercial arrangements. In drafting the proposal for each project McKinsey would, internally, decide whether HES and ECDS data, as well as of HES Critical Care, DID and Community Services data sets and associated HES bridge files, would be useful for each engagement at the stage of writing the proposal (before services are tendered). [4 paragraphs unchanged] McKinsey has had access to HES (OP, APC and A&E) and ECDS data for a number of years, and wish to receive data on an on-going basis several years (with a rolling retention of 3 full years of data, plus current year-to-date) in order year-to-date). In addition, McKinsey also requests access to be able the following new data sets (also with monthly refresh process, a rolling retention of 3 full years of data, plus current year-to-date): HES Critical Care (HES CC), Diagnostic Imaging (DID) and Community Services data sets (CSDS) and the Emergency Care Data Set (ECDS). This will allow McKinsey to look at trends in performance, expenditure, utilisation and demand. To address the UK GDPR principle of minimisation only fields that have been deemed necessary for the purpose of this work have been requested. [5 paragraphs unchanged] HES and ECDS The data sets requested will only be used in the context of services by McKinsey in England and will not be used for non-NHS (or social care) non-NHS/social care organisations or for organisations outside of England. Data processing and storage will take place within McKinsey's secure cloud platform (details below), which is based on an AWS UK environment. The servers that store and process HES HES, ECDS, DID and ECDS CSDS data will be within UK sovereignty (London). McKinsey is the sole data controller who also processes the data for the purposes described within this Agreement. document. Amazon Web Services supply Cloud Services for McKinsey and are therefore listed [21 words unchanged] held under this agreement would be considered a breach of the agreement. McKinsey’s NHS consulting work is a commercial business for which McKinsey charge fees. McKinsey compete for contracts under framework agreements that set limitations for their fees and the use of HES data is set out for the NHS client in that bid. While McKinsey do not bid for or accept work where they do not believe they can provide substantial value for money, it is ultimately the NHS client that balances the cost of the work against the public benefit. McKinsey's work is undertaken under NHS and public sector framework contracts, that set boundaries for McKinsey's fees, and the nature and outcomes of the work are set by McKinsey's clients in the NHS. In all of the work with HES data, the client will balance the costs of this work against the public benefits that are expected to arise.

Processing activities

There is no flow of data from McKinsey to NHS Digital. England. Under a previous version of this Agreement McKinsey received pseudonymised HES (OP, APC and A&E) and ECDS data via Secure Electronic File Transfer (SEFT). McKinsey will continue to receive quarterly disseminations of HES OP, HES APC and ECDS. McKinsey will hold no more than three years of data at any time. McKinsey process NHS Digital for several purposes: McKinsey is expecting to receive the additional data sets listed in the same fashion: HES Critical Care (HES CC), Diagnostic Imaging (DID), Community Services and the Ethnicity field only within the Emergency Care Data Set (ECDS). McKinsey is also changing from quarterly to monthly data disseminations. Until now, McKinsey was receiving quarterly disseminations of NHS Data. In this Data Sharing agreement amendment, McKinsey is requesting to receive monthly data refresh instead of quarterly for three purposes: • A shorter data refresh will provide more effective and accurate decision making when serving the NHS, to improve insights • McKinsey can track performance trends of NHS services with much more agility, to react to sudden healthcare demand fluctuations such as the impact on the health service of the Covid pandemic. • To rapidly detect and address any data issues, assumptions, pipelines and visualisation in a timely manner in order to minimize risk for the NHS clients we serve. McKinsey process NHS England data for several purposes: [1 paragraph unchanged] McKinsey has a standardised tool which is created annually using HES data. the requested data sets. This tool is a "Hospital "System Diagnostic" which compares all NHS acute Trusts and ICSs on a range of operational performance metrics (including case-mix adjusted average length [25 words unchanged] of that admission etc) against a peer group (tailored to each individual Trust). This analytical tool is created in a standard analytical tool (Tableau). Trust and system). McKinsey also conducts ad hoc analyses for the same measures to look [19 words unchanged] by age, gender and diagnosis cluster). Ad hoc analysis is conducted in excel using subsets of data extracted using standardised data queries from the Statistical Analysis System (SAS) database. statistical software packages/programmes. [1 paragraph unchanged] McKinsey has standardised approaches to measure variation in utilisation rates (by setting, [10 words unchanged] and associated tariff expenditure both within (at GP practice level) and between CCG Integrated Care Board (ICB) commissioner peer groups (defined using Civil Registration cluster groupings). Utilisation is measured [9 words unchanged] 1,000 age-needs weighted population (or most appropriate population measure) and compared to CCG (or ICB / Place / PCN / GP practice) practice peer group median, quartiles and deciles. This analysis is conducted in excel or tableau using subsets of data extracted using subsets of data extracted using standardised data queries from the SAS database. or in ad-hoc basis using statistical software packages/programmes. [1 paragraph unchanged] Operational performance and utilisation rates are measured over time at different frequencies, including yearly, monthly, and weekly, and daily in order to understand cyclical patterns and directional performance trends. This analysis [8 words unchanged] Excel or Tableau) using subsets of data extracted using standardised data queries from SAS. or in ad-hoc basis using database queries. (4) Analysis of future capacity requirements and the impact of different potential service configuration options HES The requested data is sets are used to develop best estimates of baseline activity and capacity (defined as [70 words unchanged] how these baseline levels would change over time if service configuration changed. With the addition of the critical care data set, McKinsey expect to be able improve the granularity of this analysis not break out critical care bed capacity from General and Acute (G&A) bed capacity. McKinsey are currently only able to run this analysis with individual Trusts, which does not allow McKinsey to understand national trends of variation in service utilisation and growth. McKinsey will not link NHS Digital data to other datasets without prior authorisation. There will be no attempt or requirement to identify individual from the pseudonymised data. (5) Population Health Management analysis All NHS data will be stored, processed, and transmitted within McKinsey’s secure UK cloud environment, which McKinsey have called Nebula UK (ISO 27001 certified). The underlying cloud infrastructure is provided by Amazon Web Services UK (AWS) hosted in London. The requested data sets are used to understand how local patient populations break down and cluster, how well they are served, and their service utilisation patterns. McKinsey run this analysis to look into population needs, health inequalities, and potential opportunities to improve services (e.g. elective pathway improvement, proactive management of high risk population). This analysis would be enhanced with addition of the ethnicity field to add a further dimension to population segmentation, understand health inequalities in more granularity and analyse the potential impact of targeted interventions. Nebula has strict access controls based on a 'need to know' basis. Access to NHS HES data is restricted to a small subset of users. These are specific team members, substantively employed by McKinsey, who are currently engaged on NHS client work and need HES data to complete this work. All users must sign an acceptable use policy before getting access to the platform. All users complete mandatory training on information governance and data protection ("Professional Standards and Risk: Working with Personal Data") that are required annually for all employees of McKinsey & Company. In addition, all users who need access to sensitive healthcare data must first complete an additional specific training (“Healthcare Data Risk Training”). McKinsey will not link NHS England data to other data sets without amending this agreement. There will be no attempt or requirement to identify individual from the pseudonymised data. Nebula actively logs and monitors user access and behaviour and uses industry-leading security tools. All NHS data will be stored, processed, and transmitted within McKinsey’s secure UK cloud environment. The underlying cloud infrastructure is provided by Amazon Web Services UK (AWS) hosted in London. Nebula provides users with variety of secure applications for processing HES data within the cloud platform including Python and PySpark, Jupyter hub, Kedro, Redshift, Tableau The data environment has strict access controls based on a 'need to know' basis. Access to NHS England data sets is restricted to a small subset of users. These are specific team members, substantively employed by McKinsey, who are currently engaged on NHS client work and need the requested data sets to complete this work. All users must sign an acceptable use policy before getting access to the platform. All users complete mandatory training on information governance and data protection ("Professional Standards and Risk: Working with Personal Data") that are required annually for all employees of McKinsey & Company. In addition, all users who need access to sensitive healthcare data must first complete an additional specific training (“Healthcare Data Risk Training”). Amazon Web Services is, strictly, a data processor in the sense that the data are hosted and manipulated on their infrastructure. By design, AWS themselves cannot access or read any of the HES data in Nebula that are hosted on their infrastructure, nor can anyone else who is not specifically granted individual access to the HES data (including McKinsey employees). The data environment actively logs and monitors user access and behaviour and uses industry-leading security tools. All organisations party to this agreement must comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract - i.e.: employees, agents and contractors of the Data Recipient who may have access to that data). The data environment provides users with variety of secure applications for processing the requested data sets within the cloud platform including a set of statistical software packages. Amazon Web Services is, strictly, a data (sub)processor in the sense that the data are hosted and manipulated on their infrastructure. By design, AWS themselves cannot access or read any of the HES data in database that are hosted on their infrastructure, nor can anyone else who is not specifically granted individual access to the requested data sets (including McKinsey employees).

Expected output

It is not possible to provide full details of all specific outputs and timings because many of the projects on which McKinsey will use HES data within the year have not yet been tendered. McKinsey works on multiple projects, at short notice, for a large number of different national, regional and local organisations across the NHS, including providers, commissioners and regulators. It is, therefore, not possible to provide full details of all specific outputs and timings of analyses. There is a possibility of projects that have not yet been tendered requiring analyses of HES data and other data sets requested in this DSA. During the course of the projects that McKinsey do with NHS organisations, [40 words unchanged] in analytical capabilities, resources, and their own access to data. Data are only exclusively shared with clients, and only clients in aggregated, non-patient identifiable formats with small numbers suppressed in line with as per the HES Analysis Guide. [4 paragraphs unchanged] • Engagements with health system involving analysis of historic elective activity by specialty and patient type demographics [3 paragraphs unchanged] We expect that in In 2022, many engagements will be have been related with to tackling Elective Backlog Backlogs resulting from the COVID-19 situation as well as supporting Covid-19 pandemic. McKinsey have also supported the set-up of newly created Integrated Care Systems organisations. and leveraged HES and ECDS datasets will be instrumental to support these engagements. provide detailed diagnostics of health system performance and to identify the future demand for healthcare services We might McKinsey have been also support the NHS in performed more traditional engagements in the second part of 2022, leveraging HES and ECDS datasets for the following analysis [1 paragraph unchanged] • benchmarking and analysis of variation in utilisation rates and tariff spending [3 paragraphs unchanged] • McKinsey includes aggregated data with small number suppression in line with ,as per the HES Analysis Guide Guide, into PowerPoint, Excel and Tableau models which which, McKinsey hand hands over to the NHS client • McKinsey publishes visual analytics, based on the aggregated data with small number suppression in line with suppression, as per the HES Analysis Guide, of results of and quantitative analysis results in reports given to McKinsey’s NHS clients and in the future via secured links or on-line secured interactive dashboard. dashboard (new data sharing method for future projects). • McKinsey presents the aggregated data, with small number suppression in line with suppression, as per the HES Analysis Guide, at meetings with NHS client stakeholders. [1 paragraph unchanged] McKinsey does not publish the outputs in any journal articles or other [21 words unchanged] aggregated analysis with its NHS clients in Excel, Tableau or PowerPoint charts, in full compliance and is fully compliant with the small numbers guidance in the HES Analysis Guide.

Expected measurable benefits

[4 paragraphs unchanged] • improving the patient health of the population including by increasing access to appropriate care outcomes • improving the experience of patients receiving care • improving accessibility to healthcare services It is not possible to provide full details of all measurable benefits and timings because many of the projects on which McKinsey will use HES data within the coming year have not yet been tendered. Expected future benefits for Individual projects vary, but in almost all cases involve identification and quantification of opportunities to improve the quality of patient care and population health, and to deliver more effective, efficient care. Target dates (for expected improvements) also vary but in almost all cases are within 3 years and often include within year opportunities for service improvements and/or more effective allocation of resources. • improving patients’ experience with healthcare services Since March 2020, McKinsey have supported the NHS with its response to the COVID 19 crisis. HES data has been used to develop understanding of historic outpatient, inpatient and A&E activity to inform modelling such as of bed requirement and identify strategies to minimise impacts on patient health due to increasing waiting times. Expected future benefits for Individual projects vary, but in almost all cases identify opportunities that can bring measurable improvements to the quality of patient care, population health outcomes, and operational efficiency. Target dates (for expected improvements) also vary, but in almost all cases are within 3 years and often include within year opportunities for service improvements and/or more effective allocation of resources. Below is an example of a project illustrating the ways in which McKinsey uses HES data along with Expected Measurable Benefits to Health and/or Social Care: Ref.#1 Vision and business case for digitally enabled service model transformation for a large for a large Health and Social Care Partnership including Trust and commissioner (2020 ongoing) McKinsey supported NHS organisations across a city conurbation of around 500,000 people, including NHS Trusts and commissioners, to prepare the Outline Business Case for redevelopment of an acute hospital site to create a new health and wellbeing campus serving the needs of the community over the next twenty years and beyond. McKinsey’s role was to map selected citizen cohort journeys through the health and care system, to identify and quantify opportunities to improve patient experience, population health outcomes and health system efficiency. Working with patients and staff, McKinsey then reimagined these journeys deploying digital and data technologies to improve patient experience and outcomes and improve system efficiency. This work was used to inform the Outline Business Case, setting out the digital vision for the future health service in the locality, and the investments in technology, training, and digital inclusion, and the changes to operating processes, care delivery models and culture, that would be required to deliver this vision. Hospital Episode Statistics were used to understand the baseline of activity and trends at the site, across admitted patient care, outpatients, and A&E, and to benchmark this pattern of demand against comparable areas. This intelligence was used to inform and test inputs to estimate the space and capacity requirements for the redeveloped site (in terms of beds, space for urgent care, space for outpatient care, space for primary care and wellbeing services) arising from changes to the model of service delivery. The modelling was used in the Outline Business Case, followed by the Full Business Case.

Benefits reported

McKinsey has used HES data to support its work with NHS clients [10 words unchanged] this past work is set out in a range of case studies below. below and specifies expected measurable benefits to healthcare services. Note that these are estimates based at the time of the engagement [11 words unchanged] would need to be confirmed by the client based on actual data. [1 paragraph unchanged] Ref.#2 Operational transformation of a high-performing acute provider (2019) Ref.#1 Supporting multiple large ICS on its elective care recovery programme (2020 ongoing) McKinsey has supported the operational transformation of an acute provider in 2019. The NHS trust is one of the leading acute providers in the country, rated as outstanding by the CQC, and is seeing to drive forward the care it provides at the leading edge of what is possible. Client: NHSE McKinsey approach has been to target three levers to ensure the transformation would be sustainable: McKinsey supported the 6 integrated care systems in the South-East region of England to develop elective care recovery plans following the Covid-19 pandemic. • Set-up strong governance structure with evaluation of plans and working groups and escalation of challenges • Baseline operational and financial position to identify areas for improvement McKinsey supported ICSs in a number of ways, including: • Continuously develop the skill sets of the staff McKinsey were working with and held larger training sessions on operational efficiency approaches. • Developing a baseline and forecast of elective care demand McKinsey leveraged HES data to identify and understand the major areas of opportunity and more specifically operational levers including length of stay, theatre productivity and outpatients, to get financial opportunities in pay, fixed costs and procurement £17m of initiatives were identified and worked alongside the staff in each directorate £10m of initiatives were in implementation after 2 months of work to move to “IL3 and above. • Identifying interventions to bridge the gap between available capacity and NHSE targets (e.g., 130% increase in completed integrated care pathways by 2024/25) All initiatives maintained or improved quality of care • Modelling the impact of these initiatives on the backlog, and the resources required to deliver them • Digital robots taking on repetitive tasks This analysis took place at an ICS level and included detailed resource implications for each proposed intervention. McKinsey used Hospital Episode statistics (HES) data to understand the typical pandemic and pre-pandemic activity mix; and to forecast the bounce-back of hidden referrals. Furthermore, HES data was analysed to determine the maximum opportunity to increase completed pathways per intervention and across 9 specialities. • 48% increase in cases per list in Dental This analysis supported executive decision-making that enabled healthcare providers to develop additional completed pathways, meet NHSE targets, and identify intervention with • 16% reduction in average change-over time between cases in cath labs theatres greatest future potential. In one example, McKinsey identified a series of interventions that would allow a large ICS to deliver over 60,000 additional completed pathways by 2024/5, effectively exceeding NHSE targets, and reducing backlogs by over 20,000. • High volume cataract lists enabling the trust to move from an average of 5 cataracts per list to 8 Ref.#2 Performance diagnostics for three leading ICS (2022) • Urology service is expecting to sustainably take 36% out of changeover time Client: ICSs • Improvement in the utilisation of lower limb theatres, contributing to 500 more surgeries pa McKinsey has undertaken three performance diagnostics for three leading ICS in 2022. In this work, McKinsey used Hospitals Episode Statistics data combined with data from 40+ additional public sources to provide the ICS with a factual baseline for expenditure, patient access and operations across all areas of the ICS. This informed benchmarking across ICSs to identify areas for improvement at the Trust, site, department and speciality level, and helped the ICS with their strategy and planning. For example, the data was used for cross-domain analysis of performance to show how efficiently healthcare resources are used. • Enhanced recovery protocols in Liver and Pancreatic resection, expected to lead to a sustained ~50% reduction in length of stay In two of the ICSs, the performance diagnostics were used to kick off a major strategy project to improve health and social care provision for a combined population of around 4 million people. This will transform the operations of 9 hospital Trusts, 9 local authorities and around 100 primary care networks. Ref.#3 Supporting the future model of hospitals in a South-West health system (2018-19) The benchmarking analyses identified potential efficiencies opportunities which, if achieved, would be worth £300 Mn to £480 Mn per ICS, and include a 6% opportunity to reduce non elective activity to benchmark in one, and a 5-9% opportunity to reduce re-admissions in another McKinsey supported a UK CCG to identify a sustainable model for one of England’s smallest hospitals. This work relied heavily on HES data to build a case for change for the system. This case for change outlined that the current hospital model is not safe and effective to maintain, largely because of the significant challenges recruiting and retaining workforce for all of the services on the hospital site. HES data were used to provide the fact-base for this case for change, to build activity projections for future hospital service requirements, and to benchmark the system’s performance against UK peers. Ref.#3 Supporting a large ICS on its elective care recovery programme (2020-2021) The local health economy will now consult the public on proposed changes to the hospital system. If implemented successfully, these changes will reduce hospital admissions from frail over-75s by 50%, and A&E attendance by 25% in the same group. Client: NHS Trust McKinsey supported the system in 2019 to develop a broader workforce strategy for the health system. This extended the work to understand the workforce challenges the system will face over the next 5 years, and the strategies it can take to continue to provide safe and effective care to patients. HES data has been a critical factor in developing accurate forecasts of required activity in the system, and for understanding how the existing and future workforce would need to be remodelled to cater for this future profile of demand. Ref.#4 Supporting a large ICS on its elective care recovery programme (2020-2021) [3 paragraphs unchanged] Ref. #4 – Benchmarking specialised care demand (2022) Client: DHSC McKinsey performed benchmarking analysis to understand demand for specialised activities and project capacity limitations for hospital wards, theatres and critical care units. McKinsey used HES data to identify baseline operating activity and critical care implications for three NHS trusts. This analysis provided a robust fact base of demand and capacity across the system and, once validated, will form the starting point for a piece of work that encourages partnership across ICS to collectively shape strategy and prepare for commissioning changes. Ref.#5 Modelling Bed Capacity (2022 ongoing) Client: NHSE McKinsey completed a national 6 week performance diagnostic; and used HES data to identify opportunities that tackle high bed occupancy rates, which if successfully implemented, would achieve a 5-10% reduction within 4-5 months, effectively alleviating the pressure on non-elective and elective healthcare services in winter 2022. Ref.#6 Supporting urgent and emergency care transformations (2022 ongoing) Client: NHS Trust McKinsey supported a leading ICS in transforming its urgent and emergency care pathway. HES data was instrumental in understanding key predictors of bed occupancy and identifying opportunities to reallocate resources, which could potentially reduce bed occupancy by up to 14% for non-elective cases in the acute sector Ref, 7 Developing vision and business case for digitally enabled service model transformation for a large Health and Social Care Partnership including Trust and commissioner. Client: AHSN McKinsey supported NHS organisations across a city conurbation of around 500,000 people, including NHS Trusts and commissioners, to prepare the Outline Business Case for redevelopment of an acute hospital site to create a new health and wellbeing campus serving the needs of the community over the next twenty years and beyond. McKinsey’s role was to map selected citizen cohort journeys through the health and care system, to identify and quantify opportunities to improve patient experience, population health outcomes and health system efficiency. Working with patients and staff, McKinsey then reimagined these journeys deploying digital and data technologies to improve patient experience and outcomes and improve system efficiency. This work was used to inform the Outline Business Case, setting out the digital vision for the future health service in the locality, and the investments in technology, training, and digital inclusion, and the changes to operating processes, care delivery models and culture, that would be required to deliver this vision. Hospital Episode Statistics were used to understand the baseline of activity and trends at the site, across admitted patient care, outpatients, and A&E, and to benchmark this pattern of demand against comparable areas. This intelligence was used to inform and test inputs to estimate the space and capacity requirements for the redeveloped site (in terms of beds, space for urgent care, space for outpatient care, space for primary care and wellbeing services) arising from changes to the model of service delivery.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[5 paragraphs unchanged] The processing of records covering all NHS patients in the HES database and ECDS datasets enables sensitive national benchmarking, and the development of recommendations informed by nationwide best-practice. [7 paragraphs unchanged] NHS organisations, including NHS Trusts and Foundation Trusts, ICSs, CCGs, CSUs, NHS England, NHS Improvement and Public Health England commission McKinsey [7 words unchanged] by the NHS organisation within and outside of specific procurement framework agreements. [1 paragraph unchanged] - • Clinical Commissioning Group Groups (CCG) and Integrated Care Systems (ICS) - • NHS Trust - • NHS Foundation Trust - • NHS England (including Commissioning Support Units, CSUs) - • NHS Improvement (Monitor, NHS Trust Development Agency) - • Public Health England - Department of Health and Social Care • Academic Health Science Networks • Department of Health and Social Care [1 paragraph unchanged] - Accountable Care Organisations • Sustainability and Transformation Partnerships - Sustainability and Transformation Partnerships • Private healthcare providers - Academic Health Science Networks - Private healthcare providers [1 paragraph unchanged] Public sector projects in England typically originate from clients sending McKinsey (and other potential bidders) a formal Invitation to Tender. The majority Most of these tenders are competitively procured via framework agreements (for instance Management [73 words unchanged] key phases of work and their timings, major progress reviews, milestones, key activities activities, and end products), McKinsey’s team for the project, and commercial arrangements. In drafting the proposal for each project McKinsey would, internally, decide whether HES and ECDS data would be useful for each engagement at the stage of writing the proposal (before services are tendered). [11 paragraphs unchanged] Data processing and storage will take place within McKinsey's secure cloud platform [5 words unchanged] on an AWS UK environment. The servers that store and process HES and ECDS data will be within UK sovereignty (London). McKinsey is the sole data controller who also processes the data for the purposes described within this Agreement. Amazon Webservices Web Services supply Cloud Services for McKinsey and are therefore listed as a data [18 words unchanged] held under this agreement would be considered a breach of the agreement.

Processing activities

There is no flow of data from McKinsey to NHS Digital. Under a subsequent previous version of this Agreement McKinsey received pseudonymised HES (OP, APC and A&E) and ECDS data via Secure Electronic File Transfer (SEFT). McKinsey are now requesting the receipt of will continue to receive quarterly disseminations of HES OP, HES APC and ECDS. There are McKinsey will hold no subsequent flows more than three years of data. data at any time. [2 paragraphs unchanged] McKinsey have has a standardised tool which is created annually using HES data. This tool [61 words unchanged] analytical tool is created in a standard analytical tool (Tableau). McKinsey also conduct conducts ad hoc analyses for the same measures to look in more detail [33 words unchanged] extracted using standardised data queries from the Statistical Analysis System (SAS) database. [1 paragraph unchanged] McKinsey have has standardised approaches to measure variation in utilisation rates (by setting, patient type or demographic sub-group, specialty specialty, and different activity clusters) and associated tariff expenditure both within (at GP [55 words unchanged] subsets of data extracted using standardised data queries from the SAS database. [1 paragraph unchanged] Operational performance and utilisation rates are measured over time at different frequencies, including yearly, monthly monthly, and weekly, in order to understand cyclical patterns and directional performance trends. [12 words unchanged] Tableau) using subsets of data extracted using standardised data queries from SAS. [2 paragraphs unchanged] McKinsey will not link NHS Digital data to other datasets. datasets without prior authorisation. There will be no attempt or requirement to identify individual from the pseudonymised data. All NHS data will be stored, processed processed, and transmitted within McKinsey’s secure UK cloud environment, which McKinsey have called Nebula UK (ISO 27001 certified). The underlying cloud infrastructure is provided by Amazon Web Services UK (AWS). (AWS) hosted in London. Nebula has strict access controls based on a 'need to know' basis. Access to NHS HES data will be is restricted to a small subset of users. These will be are specific team members, substantively employed by McKinsey, who are currently engaged on [12 words unchanged] users must sign an acceptable use policy before getting access to the platform, all platform. All users will complete mandatory training on information governance and data protection ("Professional Standards and Risk: Working with Personal Data") that are required annually for all employees of McKinsey & Company, and Company. In addition, all users must complete Health Insurance Portability and Accountability (HIPAA) training prior to getting who need access to sensitive healthcare data. data must first complete an additional specific training (“Healthcare Data Risk Training”). [1 paragraph unchanged] Nebula provides users with variety of secure applications for processing HES data within the cloud platform, platform including Ambari, RStudio, Tableau, MySQL, Imply, Jupyterhub. Python and PySpark, Jupyter hub, Kedro, Redshift, Tableau [1 paragraph unchanged] All organisations party to this agreement must comply with the Data Sharing [12 words unchanged] use) by “Personnel” (as defined within the Data Sharing Framework Contract - i.e: i.e.: employees, agents and contractors of the Data Recipient who may have access to that data).

Expected output

[4 paragraphs unchanged] Most of the work done in 2020 was and 2021 were COVID related: related, and involved the following analysis on HES and ECDS datasets: •4 engagements • Engagements with health system involving analysis of historic inpatient and outpatient activity in NHS hospitals •1 engagement • Engagements with health system involving analysis of historic elective activity by specialty and patient type •1 engagement • Engagements with health system involving analysis of historic activity to test demand and supply planning forecasts It is expected that more standard activity will resume in the second part of 2021. As a reference point, in 2019, McKinsey used the data under this Agreement for: • Engagement with several local health systems to analyse historical elective activity to help prioritise initiatives for backlog reduction •5 engagements involving Benchmarking and analysis of operational performance • Engagement with a local health system to analyse historical emergency activity to help identify initiatives to improve emergency pathway performance •5 engagements involving Benchmarking and analysis of variation in utilisation rates and tariff spending We expect that in 2022, many engagements will be related with tackling Elective Backlog resulting from the COVID-19 situation as well as supporting the set-up of Integrated Care Systems organisations. HES and ECDS datasets will be instrumental to support these engagements. •5 engagements involving Analysis of historic trends in rates of activity and spending, 5 engagements, and We might also support the NHS in more traditional engagements in the second part of 2022, leveraging HES and ECDS datasets for •3 engagements involving Analysis of the impact of different service configuration options • benchmarking and analysis of operational performance • benchmarking and analysis of variation in utilisation rates and tariff spending • analysis of historic trends in rates of activity and spending • analysis of the impact of different service configuration options [1 paragraph unchanged] •McKinsey include • McKinsey includes aggregated data with small number suppression in line with the HES Analysis Guide into PowerPoint, Excel and Tableau/PowerBI Tableau models which McKinsey hand over to the NHS client •McKinsey • McKinsey publishes graphs, visual analytics, based on the aggregated data with small number suppression in line with [13 words unchanged] McKinsey’s NHS clients and in the future via on-line secured interactive dashboard. •McKinsey • McKinsey presents the aggregated data, with small number suppression in line with the HES Analysis Guide, at meetings with NHS client stakeholders. [2 paragraphs unchanged]

Expected measurable benefits

McKinsey undertakes a broad range of work with NHS clients. All of this project work is ultimately directed towards the triple aim of: •improving • improving the quality of care •improving • improving system efficiency and capacity •reducing • reducing the costs of healthcare •improving • improving the health of the population including by increasing access to appropriate care •improving • improving the experience of patients receiving care [3 paragraphs unchanged] #1. Ref.#1 Vision and business case for digitally enabled service model transformation for a large for a large Health and Social Care Partnership including Trust and commissioner (2020 ongoing) [1 paragraph unchanged] Hospital Episode Statistics and ECDS were used to understand the baseline of activity and trends at the [56 words unchanged] services) arising from changes to the model of service delivery. The modelling will be was used in the Outline Business Case which is due for submission in mid-2021, and will be Case, followed by the Full Business Case in due course. Case.

Benefits reported

[2 paragraphs unchanged] #1. Ref.#2 Operational transformation of a high-performing acute provider (2019) [2 paragraphs unchanged] •Set-up • Set-up strong governance structure with evaluation of plans and working groups and escalation of challenges • Baseline operational and financial position to identify areas for improvement •Baseline operational and financial position to identify areas for improvement • Continuously develop the skill sets of the staff McKinsey were working with and held larger training sessions on operational efficiency approaches. •Continuously develop the skill sets of the staff McKinsey were working with and held larger training sessions on operational efficiency approaches. McKinsey leveraged HES data to identify and understand the major areas of opportunity and more specifically operational levers including length of stay, theatre productivity and outpatients, to get financial opportunities in pay, fixed costs and procurement £17m of initiatives were identified and worked alongside the staff in each directorate £10m of initiatives were in implementation after 2 months of work to move to “IL3 and above. McKinsey leveraged HES data to identify and understand the major areas of opportunity and more specifically operational levers including length of stay, theatre productivity and outpatients, to get financial opportunities in pay, fixed costs and procurement £17m of initiatives were identified and worked alongside the staff in each directorate £10m of initiatives were in implementation after 2 months of work to move to “IL3 and above. [1 paragraph unchanged] •Digital • Digital robots taking on repetitive tasks •48% • 48% increase in cases per list in Dental •16% • 16% reduction in average change-over time between cases in cath labs theatres •High • High volume cataract lists enabling the trust to move from an average of 5 cataracts per list to 8 •Urology • Urology service is expecting to sustainably take 36% out of changeover time •Improvement • Improvement in the utilisation of lower limb theatres, contributing to 500 more surgeries pa •Enhanced • Enhanced recovery protocols in Liver and Pancreatic resection, expected to lead to a sustained ~50% reduction in length of stay #2 Ref.#3 Supporting the future model of hospitals in a South-West health system (2018-19) [1 paragraph unchanged] The local health economy will now consult the public on proposed changes to the hospital system. If implemented successfully, these changes could will reduce hospital admissions from frail over-75s by 50%, and A&E attendance by 25% in the same group. [1 paragraph unchanged] Ref.#4 Supporting a large ICS on its elective care recovery programme (2020-2021) McKinsey supported the providers across a large ICS on their elective care recovery programme, specifically looking at demand-side interventions to reduce the backlog and reduce inappropriate referrals being seen in secondary care with better use of existing community-based pathways. McKinsey used HES data to understand the typical current and pre-pandemic activity mix. Elective inpatient and outpatient activity was grouped into pathways to help size the impact from interventions aimed at addressing specific patient types. This analysis took place at a specialty and Trust level, with specific logic applied on individual HRG codes and variation analysed by GP practice. This analysis supported development of interventions that enable 30% more outpatient activity to be delivered with no increase in secondary care capacity across the top 5 specialties. This is estimated to cut the projected backlog by 50% by 2024.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + HES-ID to MPS-ID HES Accident and Emergency; + HES-ID to MPS-ID HES Admitted Patient Care; + HES-ID to MPS-ID HES Outpatients

Objective for processing

McKinsey & Company, Inc. United Kingdom (referred to as “McKinsey” hereafter) is the UK affiliate of McKinsey & Company (as (a US-based company). McKinsey uses aims to use the HES and ECDS data in order provided by NHS Digital to provide support NHS Clients with fact-based answers to its NHS clients questions regarding identification, assessment and quantification of opportunities to improve the quality and efficiency of the NHS services that they deliver, deliver or are responsible for overseeing and regulating. Under this application, McKinsey uses request continued access to the data from NHS Digital for received under previous Agreements, in addition to the purposes receipt of these legitimate interests. quarterly disseminations of HES OP, HES APC and ECDS data. To determine the lawfulness of processing the data for these legitimate interests, McKinsey has undertaken a Legitimate Interests Assessment (LIA) and determined that: The lawful basis of this processing is GDPR Article 6(1)(f) “Legitimate interests” the use of this lawful basis is justified below. The legal basis for processing pseudonymized special category data is GDPR Article 9(2)(j) because processing is necessary for scientific research purposes in accordance with Article 89(1) UK General Data Protection Regulation and Section 19(4)(b)(ii) UK Data Protection Act 2018, which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject, as provided for under this Agreement. McKinsey has undertaken a Legitimate Interests Assessment (LIA) and determined that: [4 paragraphs unchanged] The negative impact on individual patients is minimal. Instead, the impact on [53 words unchanged] processing is not used to target any specific individual in any way. For more detail, see the section on impact below. [5 paragraphs unchanged] On balance, McKinsey has concluded that there is a significant wider public [8 words unchanged] clients following the processing of this data. This is especially the case in light of the minimal impact the processing has on individuals considering, the pseudonymisation of considering that the data sets prior to their processing received by McKinsey. McKinsey is pseudonymised. [21 paragraphs unchanged] McKinsey has had access to HES (OP, APC and A&E) and ECDS data for a number of years, and wish to receive data on an on-going basis (with a rolling retention of 3 [10 words unchanged] be able to look at trends in performance, expenditure, utilisation and demand. To address the GDPR principle of minimisation only fields that have been deemed necessary for the purpose of this work have been requested. [5 paragraphs unchanged] HES and ECDS data will only be used in the context of services by McKinsey [7 words unchanged] for non-NHS (or social care) organisations or for organisations outside of England. [1 paragraph unchanged] McKinsey is requesting to maintain access to three years of historical data in order to monitor trends in performance, expenditure, utilisation and demand. Access to three years of data allows for the analysis of trends to identify cyclical patterns in utilisation as well as directional trends in performance, while also allowing for the identification of anomalies in activity. Furthermore, this permits the measurement of the effectiveness of performance and cost improvement initiatives such as in tracking activity and expenditure following implementation of a cost improvement plan or QIPP initiative. McKinsey is the sole data controller who also processes the data for the purposes described within this Agreement. Amazon Webservices supply Cloud Services for McKinsey and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement.

Processing activities

PROCESSING ACTIVITIES There is no flow of data from McKinsey to NHS Digital. Under a subsequent version of this Agreement McKinsey received pseudonymised HES (OP, APC and A&E) and ECDS data via Secure Electronic File Transfer (SEFT). McKinsey are now requesting the receipt of quarterly disseminations of HES OP, HES APC and ECDS. There are no subsequent flows of data. McKinsey process NHS Digital for several purposes: [1 paragraph unchanged] McKinsey have a standardised tool which is created annually using HES data. [116 words unchanged] excel using subsets of data extracted using standardised data queries from the SAS Statistical Analysis System (SAS) database. [6 paragraphs unchanged] DATA PROCESSING ON THE CLOUD McKinsey will not link NHS Digital data to other datasets. There will be no attempt or requirement to identify individual from the pseudonymised data. All NHS data will be stored, processed and transmitted within McKinsey’s secure UK cloud environment, which McKinsey have called Nebula UK. UK (ISO 27001 certified). The underlying cloud infrastructure is provided by Amazon Web Services UK (AWS). The AWS data centre, on which all processing and storage is performed, is in London. Nebula has strict access controls based on a 'need to know' basis. [7 words unchanged] restricted to a small subset of users. These will be specific team members members, substantively employed by McKinsey, who are currently engaged on NHS client work, who work and need HES data to complete this work, and who are trained in the use of HES data. work. All users must sign an acceptable use policy before getting access to [18 words unchanged] for all employees of McKinsey & Company, and all users must complete HIPAA Health Insurance Portability and Accountability (HIPAA) training prior to getting access to sensitive healthcare data. Nebula actively logs and monitors user access and behaviour, behaviour and uses industry-leading security tools. Nebula UK is closely aligned to the ISO 27001, ISO 27017 and ISO 27018 frameworks. Nebula UK has been recently audited, and is expected to be ISO 27001 certified by mid-2019. The wider Healthcare Analytics practice within McKinsey, including at London, is already ISO 27001 certified. [1 paragraph unchanged] AWS AS A DATA PROCESSOR [1 paragraph unchanged] Amazon Web Services UK are compliant with many standard security frameworks, including ISO 9001, 27001, 27017, 27018; the Cloud Security Alliance certification and UK Cyber Essentials Plus. COMPLIANCE WITH CONTRACT [1 paragraph unchanged]

Expected output

[1 paragraph unchanged] During the course of the projects that McKinsey do with NHS organisations, [19 words unchanged] data provided by the clients. This is the case with commissioners and providers, providers but is not always possible due to limitations in analytical capabilities, resources, [18 words unchanged] formats with small numbers suppressed in line with the HES Analysis Guide. [2 paragraphs unchanged] In 2019, McKinsey used the data under this Agreement for: Most of the work done in 2020 was COVID related: • 5 •4 engagements involving Benchmarking and analysis of operational performance; historic inpatient and outpatient activity in NHS hospitals • 5 engagements involving Benchmarking and analysis of variation in utilisation rates and tariff spending; •1 engagement involving analysis of historic elective activity by specialty and patient type • 5 engagements involving Analysis of historic trends in rates of activity and spending, 5 engagements, and •1 engagement involving analysis of historic activity to test demand and supply planning forecasts • 3 engagements involving Analysis of the impact of different service configuration options) It is expected that more standard activity will resume in the second part of 2021. As a reference point, in 2019, McKinsey used the data under this Agreement for: Examples include: •5 engagements involving Benchmarking and analysis of operational performance • Health Innovation Manchester, July 2019 - an analysis of cardiology and respiratory events in the Greater Manchester region to estimate the value to the local health and care system of different digital pathway innovations. •5 engagements involving Benchmarking and analysis of variation in utilisation rates and tariff spending • Cambridgeshire, Sept-Oct 2019, Jan-Feb 2020 - benchmarking of activity and financial performance of all services across Cambridgeshire & Peterborough STP to understand and quantify drivers of deficit and inform a financial improvement strategy •5 engagements involving Analysis of historic trends in rates of activity and spending, 5 engagements, and EXAMPLE OUTPUTS •3 engagements involving Analysis of the impact of different service configuration options (1) Benchmarking and analysis of operational performance McKinsey have a standardised tool which is created annually using HES data. This tool is a "Hospital Diagnostic" which compares all NHS acute Trusts on a range of operational performance metrics (including case-mix adjusted average length of stay, day case and day of surgery admission rates by setting and specialty; proportion of A&E attendances resulting in admission by length of stay of that admission etc) against a peer group (tailored to each individual Trust). McKinsey also conduct ad-hoc analyses for the same measures to look in more detail at performance, for example at site level, or for specific types of patients (e.g. sub-groups defined by age, gender and diagnosis cluster). (2) Benchmarking and analysis of variation in utilisation rates and tariff spending McKinsey have standardised approaches to measure variation in utilisation rates (by setting, patient type or demographic sub-group, specialty and different activity clusters) and associated tariff expenditure both within (at GP practice level) and between CCG commissioner peer groups (defined using Civil Registrations cluster groupings). Utilisation is measured as an activity rate (or associated tariff value) per 1,000 age-needs weighted population (or most appropriate population measure) and compared to CCG (or GP practice) peer group median, quartiles and deciles. (3) Analysis of historic trends in rates of activity and spending. Operational performance and utilisation rates are m easured over time at different frequencies, including yearly, monthly and weekly, in order to understand cyclical patterns and directional performance trends. (4) Analysis of the impact of different service configuration options To inform reconfiguration models, HES data are used to develop best estimates of baseline activity and capacity (defined as bed days for admitted patient care) for commissioners and providers, aggregated at service line level (defined by specialty and point of delivery). This is then forecasted forward using a range of methods (including, but not limited to, local and national historic trends), to develop growth assumptions and scenarios. Simulations for different scenarios are created to analyse how these baseline levels would change over time if service configuration changed. WAYS IN WHICH OUTPUTS ARE SHARED [1 paragraph unchanged] • McKinsey •McKinsey include aggregated data with small number suppression in line with the HES Analysis Guide into PowerPoint, Excel and Tableau Tableau/PowerBI models which McKinsey hand over to the NHS client • McKinsey •McKinsey publishes graphs, based on the aggregated data with small number suppression in [6 words unchanged] of results of quantitative analysis in reports given to McKinsey’s NHS clients and in the future via on-line secured interactive dashboard. • McKinsey •McKinsey presents the aggregated data, with small number suppression in line with the HES Analysis Guide, at meetings with NHS client stakeholders stakeholders. McKinsey does not directly publish the outputs in any journal articles or other public documents (e.g., white papers) nor does McKinsey directly present any data outputs in the public domain. McKinsey will only share aggregated analysis with its NHS clients in Excel, Tableau or PowerPoint charts, in full compliance with the small numbers guidance in the HES Analysis Guide. Clients (NHS) may communicate the findings of McKinsey’s work internally, typically through workshops or internal newsletters. McKinsey does not publish the outputs in any journal articles or other public documents (e.g., white papers) nor does McKinsey directly present any data outputs in the public domain. McKinsey will only share aggregated analysis with its NHS clients in Excel, Tableau or PowerPoint charts, in full compliance with the small numbers guidance in the HES Analysis Guide.

Expected measurable benefits

McKinsey undertakes a broad range of work with NHS clients. All of this project work is ultimately directed towards the triple aim of: reducing the costs of healthcare; improving the health of the population including by increasing access to appropriate care and improving the quality of care; and improving the experience of patients receiving care. It is not possible to provide full details of all measurable benefits and timings because many of the projects on which McKinsey will use HES data within the coming year have not yet been tendered. Expected future benefits for individual projects vary, but in almost all cases involve identification and quantification of opportunities to improve the quality of patient care and population health, and to deliver more effective, efficient care. Target dates (for expected improvements) also vary but in almost all cases are within 3 years and often include within year opportunities for service improvements and/or savings. •improving the quality of care A set of benefits for ongoing projects, or projects where McKinsey has submitted proposals, are described below to illustrate the ways in which McKinsey will use HES data over the year. More detailed case studies of past projects using HES data are given in the ‘Yielded benefits’ section, following this one. •improving system efficiency and capacity 1. A national review of specialist commissioning of paediatrics, critical care and specialist surgery for children (2018, restarting in 2019). •reducing the costs of healthcare McKinsey is working with a national specialist commissioning body and two test sites to set up local networks to solve some of the challenging strategic and operational issues with paediatric critical care and specialised surgery, and then help to roll out this approach for other regions in the country. •improving the health of the population including by increasing access to appropriate care HES data are used to develop a detailed understanding of the existing activity in this area across 14 NHS trusts, and to provide the fact base for a detailed case for change to the existing service model. Taking specialist paediatric surgery as an example, the case for change sets out that care is fragmented across 14 trusts, many having very low volumes of activity. This presents a major workforce and quality of care concern. Additionally, specialist elective care for the under-5s is done in all acute locations, although it would be safer and more effective if concentrated in specialist sites; while many activities that could be performed closer to patients in DGHs are only performed at the largest hospital sites. •improving the experience of patients receiving care The test sites now have the fact base on which to decide how to remodel care, and with which to convince clinicians and patients that change is required. As these changes are implemented, patients should expect to see improvements in the quality and cost of paediatric care, and the development of a clinically and financially sustainable service that can overcome the existing workforce challenges. It is not possible to provide full details of all measurable benefits and timings because many of the projects on which McKinsey will use HES data within the coming year have not yet been tendered. Expected future benefits for Individual projects vary, but in almost all cases involve identification and quantification of opportunities to improve the quality of patient care and population health, and to deliver more effective, efficient care. Target dates (for expected improvements) also vary but in almost all cases are within 3 years and often include within year opportunities for service improvements and/or more effective allocation of resources. 2. Acute services strategy for a northern UK health system (2018-19) Since March 2020, McKinsey have supported the NHS with its response to the COVID 19 crisis. HES data has been used to develop understanding of historic outpatient, inpatient and A&E activity to inform modelling such as of bed requirement and identify strategies to minimise impacts on patient health due to increasing waiting times. McKinsey is supporting a large northern UK health system to develop its acute services strategy. The current service configuration is not sustainable from a quality, operational or financial perspective. Below is an example of a project illustrating the ways in which McKinsey uses HES data along with Expected Measurable Benefits to Health and/or Social Care: McKinsey has supported the system to develop an evidence base supporting the case for change, relying heavily on HES data to benchmark operational performance and activity levels against other similar Trusts across the country, e.g. average length of stay analysis, A&E, paediatric, maternity volumes. #1. Vision and business case for digitally enabled service model transformation for a large for a large Health and Social Care Partnership including Trust and commissioner (2020 ongoing) McKinsey then worked with local clinicians to develop a set of potential clinical models to address local challenges and used HES data at a specialty level to understand current activity levels and case mix at each site, and what activity could be delivered from each site in future under each of the new clinical models. This led to the development of a set of potential service configuration options, and a financial model to assess the impact of each of the options. HES data was integral in understanding local activity growth trends over the past three years, and how this related to similar national trends. McKinsey supported NHS organisations across a city conurbation of around 500,000 people, including NHS Trusts and commissioners, to prepare the Outline Business Case for redevelopment of an acute hospital site to create a new health and wellbeing campus serving the needs of the community over the next twenty years and beyond. McKinsey’s role was to map selected citizen cohort journeys through the health and care system, to identify and quantify opportunities to improve patient experience, population health outcomes and health system efficiency. Working with patients and staff, McKinsey then reimagined these journeys deploying digital and data technologies to improve patient experience and outcomes and improve system efficiency. This work was used to inform the Outline Business Case, setting out the digital vision for the future health service in the locality, and the investments in technology, training, and digital inclusion, and the changes to operating processes, care delivery models and culture, that would be required to deliver this vision. McKinsey continues to support the system in making this case for change, and starting to implement its strategy. Longer term, outcomes for patients could be improved with sites more consistently being able to fill consultant rotas, and improving patients’ access to specialists. Ultimately, the proposed service reconfiguration could reduce the numbers of preventable deaths each year by 2,000 in specific service areas. Hospital Episode Statistics and ECDS were used to understand the baseline of activity and trends at the site, across admitted patient care, outpatients, and A&E, and to benchmark this pattern of demand against comparable areas. This intelligence was used to inform and test inputs to estimate the space and capacity requirements for the redeveloped site (in terms of beds, space for urgent care, space for outpatient care, space for primary care and wellbeing services) arising from changes to the model of service delivery. The modelling will be used in the Outline Business Case which is due for submission in mid-2021, and will be followed by the Full Business Case in due course. 3. Acute services review for a remote district general hospital (2018-19) McKinsey is supporting a small, remote, district general hospital (DGH) to review existing acute services, and to decide how best to deliver high quality, sustainable services in the future. The local system is struggling to deliver financially sustainable services with its existing workforce. McKinsey is helping to develop a fact-based analysis of the potential different reconfigurations of acute care in the region. HES data are used to benchmark hospital clinical performance against comparable peers, and to form the forecasts of future acute activity that underpin the analysis of different service configurations. The immediate benefits for the DGH and health system are a detailed fact-based analysis of current hospital performance, and a clinical, operational and financial evaluation of their potential new clinical models. Longer-term, the decisions that the system makes based on this analysis will affect a population of about 200,000 patients, helping them have access to more clinically, financially and operationally sustainable acute care services. 4. Supporting the future model of hospitals in a South-West health system (2018-19) McKinsey supported a UK CCG to identify a sustainable model for one of England’s smallest hospitals. This work relied heavily on HES data to build a case for change for the system. This case for change outlined that the current hospital model is not safe and effective to maintain, largely because of the significant challenges recruiting and retaining workforce for all of the services on the hospital site. HES data were used to provide the fact-base for this case for change, to build activity projections for future hospital service requirements, and to benchmark the system’s performance against UK peers. The local health economy will now consult the public on proposed changes to the hospital system. If implemented successfully, these changes could reduce hospital admissions from frail over-75s by 50%, and A&E attendance by 25% in the same group. McKinsey will support the same system in 2019 to develop a broader workforce strategy for the health system. This will extend the work so far to understand the workforce challenges the system will face over the next 5 years, and the strategies it can take to continue to provide safe and effective care to patients. HES data will be a critical factor in developing accurate forecasts of required activity in the system, and for understanding how the existing and future workforce would need to be remodelled to cater for this future profile of demand. 5. Analysis of the workforce requirements for an integrated care system in the North of England (2018). McKinsey is supporting CCGs in the North of England to develop their plans for changes to out-of-hospital care. Changes to the acute hospital services in the area are planned, in order to maintain a safe and effective service for patients. However, these changes are dependent on the development of enhanced community and primary care services, that can support patients outside of acute hospitals, closer to their homes. McKinsey provided an analysis of the current proposals for the out-of-hospital model in the area. Additionally, a workforce plan was created for the development of a full integrated care system in the region, and an assessment conducted of its impact on the acute hospital requirements. HES data was used to understand the current acute service usage, to forecast future acute service requirements, to benchmark the system against peers, and to understand the workforce requirements of a redesigned out-of-hospital care model. To maintain current services in the face of rising patient demand, the CCGs would need to reduce acute hospital service usage by 5% over the next 5 years. The proposed integrated care model has the potential to reduce hospital service usage by 30% over the same time-frame, by substantially reducing admissions and length of stay for patients in the area, by providing appropriate access to primary and specialist care close to home, and by better managing population health. 6. Development of a bedded capacity and urgent and emergency care strategy for a southern UK health economy (2018). McKinsey is supporting a southern health economy to (i) identify current bed usage across the system, and how this could be made more efficient, and (ii) to develop an urgent and emergency care strategy for the system. HES data were used to perform bottom-up modelling of activity, informing the analysis of current bed usage, and to benchmark the system against other areas of the UK, to identify what optimal bed usage is and how that would impact the area. As a result of this work, the system now understands how services could be reorganised to provide more equal access to services for all patients, enabling a more efficient and effective usage of resources. In particular, if the proposed strategy were implemented successfully, it would reduce the number of additional required beds in the system, over 5 years, from 280 to 120. This change could enable the resources that would have been required for the full 280 beds to be partly redirected to other areas of patient care – while maintaining or improving quality of care for patients within this service. 7. Operational transformation of a high-performing acute provider (2019). McKinsey is bidding to support the operational transformation of an acute provider in 2019. The NHS trust is one of the leading acute providers in the country, rated as outstanding by the CQC, and is seeing to drive forward the care it provides at the leading edge of what is possible. McKinsey would, using HES data, support the trust to understand the major areas of opportunity. For example, identifying areas where nursing productivity or medical productivity are not highly-performing. Finding detailed clinical and operational challenges relies on HES data: for example, if the length of stay (LoS) for certain operations were longer than national best-practice, senior clinical conversations would be held to decide how best to adjust the current clinical pathway in that area. The improvements enabled by this type of work would be a reduction in variation in quality and cost of care for patients, and reductions in hospital stays where appropriate for patients. In addition, the trust is expecting this programme of work to create £15m in financial savings on top of a £15m existing set of cost improvement plans, followed by an additional £30m in savings each year for a further 5 years. Achieving these financial savings will allow the trust to more effectively provide quality care to patients with its existing resources, and to meet the continual growth in demand for acute services. 8. Evaluation of an NHS England Vanguard site (2019) McKinsey is bidding to support a UK integrated care system (ICS) to understand the impact on acute hospital length of stay that the introduction of its integrated care model may have made. This is part of a programme of evaluations of the Vanguard sites that NHS England introduced, to lead the implementation of the recommendations in the NHS Five Year Forward View. HES data would underpin the quantitative assessment of current initiatives within the system, and where the greatest impact on length of stay was created. This involves analyses of bed occupancy, A&E attendance and re-admission rates, how these metrics have changed over time, and how they compare to the best-performing providers in the NHS. The use of a detailed, quantitative evidence base to understand the most important features of the Vanguard site’s integrated care model will enable detailed, evidence-based recommendations for systems in the rest of the country. This work will therefore support the NHS’s ambition to effectively roll out the successful Vanguard models across the country. An accurate evaluation of this Vanguard site, built on a quantitative analysis of HES data, will therefore be used to drive changes that will reduce patients’ lengths of stay in hospital services, where appropriate, as much as possible and in a cost-effective manner, across health systems nationwide.

Benefits reported

McKinsey has used HES data to support its work with NHS clients [11 words unchanged] past work is set out in a range of case studies below. Note that these are estimates based at the time of the engagement assuming the successful implementation of the recommended actions. The actual benefit would need to be confirmed by the client based on actual data. 1. Addressing a London health economy deficit of £40m (2017) Below are some examples of projects illustrating the ways in which McKinsey uses HES and ECDS data, and the benefits this work has yielded. McKinsey & Company completed a 5 week project in July 2017, working with a London health economy to address a system deficit of £40m. The project team used HES data to drive benchmarking of the CCG and trust’s historic performance against comparators and review internal activity trends such as A&E and ambulatory care sensitive condition attendance rates by GP practice across the borough. The team used these benchmarks to align the different health economy partners (including CCG and trust) around a shared understanding about the drivers of deficit, and identify opportunities to drive improvements to care quality and access. #1. Operational transformation of a high-performing acute provider (2019) The benchmarking exercise using HES data has helped the local health economy identify geographic areas in need of short-term resource investments to improve access to urgent care. In particular, detailed historic benchmarking indicated that the health system had significantly higher than extended spending on acute care, and non-elective admissions in particular. Both the CCG and the trust agreed that an investment in community services would dramatically improve healthcare access and quality, as well as their deficit. The CCG and trust are now in ongoing discussions to move towards joint ways of working towards improving care and reducing the system deficit. McKinsey has supported the operational transformation of an acute provider in 2019. The NHS trust is one of the leading acute providers in the country, rated as outstanding by the CQC, and is seeing to drive forward the care it provides at the leading edge of what is possible. 2. Financial recovery and improvement planning in the Midlands (2017). McKinsey approach has been to target three levers to ensure the transformation would be sustainable: McKinsey & Company completed a 4 week study in June 2017 to provide financial recovery, improvement and sustainability support to a health economy in the Midlands. The health system had delivered their lowest level of QIPP savings since 2013, and were seeking to develop recurrent and transformational QIPP plans for the current fiscal year. The project team used HES data to benchmark the CCG’s historic performance against comparator CCGs, as well as to compare internal variability in secondary care activity by GP practice. These benchmarks were used to assess the size of the improvement opportunity in the region, evaluate the ambition of current QIPP schemes, and support the development of detailed delivery plans to implement the schemes. •Set-up strong governance structure with evaluation of plans and working groups and escalation of challenges The outputs of the financial review, including the use of HES-derived outside-in productivity benchmarks, supported the delivery plans of 15 QIPP initiatives with an expected savings of c. £30m at the end of the fiscal year. •Baseline operational and financial position to identify areas for improvement 3. Access improvement for elective care at a teaching trust (2017) •Continuously develop the skill sets of the staff McKinsey were working with and held larger training sessions on operational efficiency approaches. McKinsey completed an 8-week study in July 2017 to support access improvement to elective care for an NHS teaching trust serving a catchment population of 650,000. The project team used HES data to develop a single version of the truth on planned care performance to align stakeholders to a common understanding on changes in demand and their drivers over time. Analyses included an historical review of elective care activity volumes across inpatient and outpatient settings, compared volume increases to patterns in referral to treatment waiting times, and peer benchmarking on performance measures with other trusts. The analysis revealed that increases in volumes were driven by referrals from out of area CCGs, and by faster than average rise in consultant to consultant referrals. This analysis also supported subsequent prioritisation of improvement initiatives and the quantification of their impact. McKinsey leveraged HES data to identify and understand the major areas of opportunity and more specifically operational levers including length of stay, theatre productivity and outpatients, to get financial opportunities in pay, fixed costs and procurement The anticipated impact of the planned interventions, once fully implemented, include: £17m of initiatives were identified and worked alongside the staff in each directorate £10m of initiatives were in implementation after 2 months of work to move to “IL3 and above. - Removed outpatient waiting list backlogs across five priority specialities within 12 months All initiatives maintained or improved quality of care - Reversed deterioration in inpatient backlogs across five priority specialities within 12 months •Digital robots taking on repetitive tasks - Streamlined and more convenient services, such as faster email and telephone advice, one-stop shops to reduce patient visits, and greater use of patient decision aids and decision making in their treatment •48% increase in cases per list in Dental 4. Productivity of an ambulance trust (2014) •16% reduction in average change-over time between cases in cath labs theatres McKinsey has been engaged in ongoing work since 2014 with an ambulance trust to review productivity opportunities across their operations. The client was facing deteriorating operational performance and was looking to implement a new operational approach. The project team performed detailed analysis and modelling of patient demand, service capacity and service efficiency. HES data were used to model historic trends in conveyances to A&E. Insights derived from HES analysis formed the basis for discussions with stakeholders and experts to diagnosis drivers of deteriorating performance. HES data was also used to compare historic performance prior to the adoption of a new operational pilot, with trust-supplied data following implementation. •High volume cataract lists enabling the trust to move from an average of 5 cataracts per list to 8 Impact of the new operating model was validated using actual observed pilot data. This included a 10% improvement in the proportion of ambulances arriving on scene within 8 minutes. •Urology service is expecting to sustainably take 36% out of changeover time 5. Financial improvement for an acute trust in the North of England (2016) •Improvement in the utilisation of lower limb theatres, contributing to 500 more surgeries pa McKinsey completed a 12 week project in July 2016 leading a large acute trust in the North of England through a large-scale financial improvement programme. The client faced an underlying financial challenge of £90m, having historically achieved ~£45m in annual financial improvements. McKinsey worked in consortium with MoorHouse and Four Eyes to review financial improvement opportunities across the whole of the hospital system. The project ran across two phases, with the first 2 weeks dedicated to a rapid baseline assessment to identify top-down opportunities. During this period the McKinsey team used HES data to benchmark productivity KPIs such as case-mix adjusted ALOS and historic changes to activity within key specialties against comparator trust peers to size the overall productivity potential. In the second 10-week delivery phase, the consortium supported hospital divisions to develop and strengthen plans for delivery around the nursing workforce, medical workforce, theatres, outpatients, length of stay and admin and clerical workforce. The team’s work, supported by peer benchmarks using HES data, helped to strengthen 300 existing financial turnaround initiatives and identify an additional 100 plans, for a total achieved in-year savings of £79m (or £100m in annualised savings). •Enhanced recovery protocols in Liver and Pancreatic resection, expected to lead to a sustained ~50% reduction in length of stay 6. Clinical service redesign for an NHS trust (2016) #2 Supporting the future model of hospitals in a South-West health system (2018-19) McKinsey completed an 18 week project in clean sheet redesign across six functional and clinical service lines in November 2016. The team used HES data to conduct a diagnostic of orthopaedic productivity metrics including length of stay, operations per consultant, DNA rates and activity rates. The trust’s performance was benchmarked internally across the hospital sites, and nationally against comparable trusts. Metrics were designed to align with national best practice. Analyses of case-mix adjusted length of stay were conducted to confirm that the trust’s higher length of stay post-surgery was related to productivity rather than complexity of cases. McKinsey worked with a triumvirate of consultant, nurse and manager from the service line to develop aspiration targets derived from the benchmarking. HES outputs were presented to a broad range of staff in large design workshops in terms of aggregated PowerPoint tables. The result of the work has been an end to end pathway redesign built around the aspirational productivity metrics and agreed upon by the hospital’s clinicians and non-clinical leads, and a modelled impact of the redesign on the people and infrastructure requirements. . The end to end pathway redesign is expected to improve patient care by improving quality of care in line with national best practice guidelines, reducing variation in clinical quality, and reducing referral to treatment times. Referral to treatment times are expected to fall from the current median of >36 weeks to 5 weeks. McKinsey supported a UK CCG to identify a sustainable model for one of England’s smallest hospitals. This work relied heavily on HES data to build a case for change for the system. This case for change outlined that the current hospital model is not safe and effective to maintain, largely because of the significant challenges recruiting and retaining workforce for all of the services on the hospital site. HES data were used to provide the fact-base for this case for change, to build activity projections for future hospital service requirements, and to benchmark the system’s performance against UK peers. The local health economy will now consult the public on proposed changes to the hospital system. If implemented successfully, these changes could reduce hospital admissions from frail over-75s by 50%, and A&E attendance by 25% in the same group. McKinsey supported the system in 2019 to develop a broader workforce strategy for the health system. This extended the work to understand the workforce challenges the system will face over the next 5 years, and the strategies it can take to continue to provide safe and effective care to patients. HES data has been a critical factor in developing accurate forecasts of required activity in the system, and for understanding how the existing and future workforce would need to be remodelled to cater for this future profile of demand.