Risk modelling in the critically ill

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[34 paragraphs unchanged] Babble Cloud (SUI) Limited is a processor acting under the instructions of ICNARC. Babble Cloud (SUI) Limited role is limited to providing external desktop and network managed services, including end user and infrastructure support. Employees at Babble Cloud (SUI) Limited have the ability to access NHS Digital England data for logistical reasons but will not access the data held under [5 words unchanged] have remote access to ICNARC servers (which are hosted by Exponential-E Ltd). [6 paragraphs unchanged]

Processing activities

[23 paragraphs unchanged] ICNARC stores Data on the Babble Cloud provided by Exponential-E Ltd. [12 paragraphs unchanged] Babble Cloud SUI Limited is not permitted to access the Data. [4 paragraphs unchanged]

Expected output

[13 paragraphs unchanged] January 2025 No new outputs have been produced. This DSA relates to a completed research project. The primary report of the project was published in December 2022 (available from:https://journalslibrary.nihr.ac.uk/hsdr/EQAB4594).

Expected measurable benefits

[22 paragraphs unchanged] January 2025: 1. Changes to dataset specification for the Case Mix Programme national clinical audit of adult critical care The new dataset informed by this project is in use in all critical care units participating in the audit. 2. Routine use of risk models for longer term outcomes following critical care developed in this project. Approvals for routine data linkage were obtained in October 2024 and the DARS application is in progress, we anticipate the initial analyses using these data will take place in late 2025 (subject to DARS timelines) 3. Routine use of risk models for longer term outcomes following critical care developed in this project 4. Changes to dataset specification for the National Cardiac Arrest Audit New data entry system went live in 2024 and new dataset informed by this project being prepared for release in April 2025 5. Routine use of risk models for longer term outcomes following in-hospital cardiac arrest

Benefits reported

[9 paragraphs unchanged] January 2025 1. Improved understanding of physiological consequences of critical illness. Reported through primary report – report has been cited in 3 relevant articles during 2024 2. Improved understanding of healthcare costs associated with rehospitalisation. Reported through primary report – report has been cited in 1 relevant article during 2024

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

The purpose of this agreement is to retain and process both Civil Registration Deaths and Hospital Episode Statistics Admitted Patient Care (HES APC) data to continue supporting a research study entitled “Risk modelling for quality improvement in the critically ill: making best use of available data”. The research study is being conducted by researchers from the Intensive Care National Audit & Research Centre (ICNARC), an independent registered charity (charity number: 1039417) which aims to improve critical care services in the UK through a programme of national clinical audits and research studies. ICNARC coordinates two national clinical audits: the Case Mix Programme (CMP) for adult critical care and the National Cardiac Arrest Audit (coordinated jointly with the Resuscitation Council UK) for in-hospital cardiac arrest. Intensive Care National Audit & Research Centre (ICNARC), requires access to NHS England data for the purpose of the following research project: The data held under this Agreement does not include patient names and addresses but does include identifiable fields including date of birth, postcode and date of death. Processing of identifiable data without consent is undertaken with approval from the Health Research Authority under section 251 of the National Health Service Act 2006 (approval number 15/CAG/0163). Under this iteration of the Agreement the study team will pseudonymise the study dataset, providing an exit strategy from Section 251 support. Risk Modelling For Quality Improvement In The Critically Ill: Making Best Use Of Routinely Available Data. High quality care is at the centre of the NHS. National clinical audit has a key role to play in ensuring high quality care, particularly in areas of health care, such as emergency and critical care, where patient choice does not, and cannot, play a significant part. Sophisticated and accurate risk prediction models are key in underpinning fair comparisons among health care providers. They can also enable risk-adjusted observational research and risk stratification in randomised controlled trials. The following is a summary of the aims of the research project provided by ICNARC: This study is a follow-on to a previous study conducted by ICNARC, entitled “Ensuring comparisons of health-care providers are fair: risk modelling for quality improvement in the critically ill”, that addressed risk prediction modelling in three clinical areas: “Sophisticated and accurate risk prediction models are key in underpinning fair comparisons among health care providers. They can also enable risk-adjusted observational research and risk stratification in randomised controlled trials. • adult general critical care; The underlying study follows a previous study conducted by ICNARC, entitled “Ensuring comparisons of health-care providers are fair: risk modelling for quality improvement in the critically ill”, that addressed risk prediction modelling in three clinical areas: • 1) adult cardiothoracic general critical care; and • in-hospital cardiac arrest. 2) adult cardiothoracic critical care; and The previous study referenced above did not access NHS Digital data and as such did not have a Data Sharing Agreement in place with NHS Digital. 3) in-hospital cardiac arrest. The previous study made substantial steps forward in enabling fair comparisons among health care providers in all three areas, with immediate translation of the research outputs into routine practice, but has also identified important and essential new directions for further epidemiological and methodological research. The initial study referenced above did not access NHS England data and as such did not have a Data Sharing Agreement in place with NHS England. This current study aims to better understand the following: the: 1. 1) epidemiology of critical illness, and 2. 2) risk factors for and consequences of critical illness. Increased understanding of these areas and using data linkage with other routinely collected data sources will may lead to improvements in the risk models used to underpin national clinical audits for: in the clinical areas listed above. 1. adult general critical care; ICNARC coordinates two national clinical audits: the Case Mix Programme (CMP) for adult critical care and the National Cardiac Arrest Audit (coordinated jointly with the Resuscitation Council UK) for in-hospital cardiac arrest. 2. cardiothoracic critical care; and The study linked data from these audits with HES and Civil Registration Mortality and with other national clinical audits – the UK Renal Registry (operated out of North Bristol NHS Trust), the National Diabetes Audit (operated out of NHS England) and the National Adult Cardiac Surgery Audit (operated out of NHS England). The analyses of the linked project datasets described the epidemiology of, and risk factors for, and developed and validated risk prediction models for outcomes of admissions to adult critical care units, admissions to cardiothoracic critical care units and patients experiencing in-hospital cardiac arrest. 3. in-hospital cardiac arrest. Proposed secondary analyses include a PhD project to better understand cardiovascular risks following critical care. The PhD project will describe the occurrence of major adverse cardiovascular events (“MACE”) – myocardial infarction, stroke, heart failure, arrhythmogenic cardiac death or vascular death – up to five years following discharge from an adult general critical care unit and develop a risk model to predict risk of MACE among critical care survivors”. The data subjects are patients admitted to an adult critical care unit or experiencing an in-hospital cardiac arrest and included in the ICNARC Case Mix Programme or National Cardiac Arrest Audit (NCAA). Patients are recruited to the national clinical audits without consent, as consent would be impossible to obtain in the urgent setting, and support for the use of confidential patient data without consent has been obtained for both audits from the Secretary of State under Section 251 of the National Health Service Act 2006. Both national clinical audits include patients and members of the public in their management structure (ICNARC Board of Trustees and NCAA Steering Group). The research study also has a Steering Group including independent patient and public representatives. They have reviewed emerging results from the study to ensure that the use of patient data is appropriate and in line with the expectations of patients and the general public, and that what is important to patients and the public is taken into consideration in the choice of outcome measures. The following NHS England Data will be accessed: ICNARC wish to continue processing HES APC, Civil Registration Deaths data and National Diabetes Audit data already held. The data fields requested have been selected to identify solely those items expected to improve risk prediction or to evaluate important health outcomes – these were predominantly diagnostic and procedure codes. Processing of identifiable data was necessary to conduct the data linkages. All linkages have now been completed and the next action under this Agreement will be to create a final pseudonymised study dataset. This will be completed by December 2022 in line with the extended HRA Section 251 support. • Hospital Episode Statistics (HES) Admitted Patient Care (APC) – necessary to assess chronic illness based on previous hospital admissions, to identify patients readmitted to hospital during follow up, and to evaluate the costs of care. Further processing of the final pseudonymised data will be secondary analyses that fall within the scope of the original overall purpose of this Agreement, of better understanding the epidemiology of and outcomes from, critical illness. Secondary analyses of the data from this project to date include: • Civil Registration Mortality – necessary to identify patients who died during follow up. 1. An NIHR Career Development Award on longer term outcomes of patients with sepsis in an intensive care setting (https://fundingawards.nihr.ac.uk/award/CS-2016-16-011) • National Diabetes Audit – necessary to identify patients who developed Type 2 diabetes following their critical illness. 2. An NIHR-funded secondary research project on treatments for atrial fibrillation in an intensive care setting (https://fundingawards.nihr.ac.uk/award/17/71/04) The level of the Data will be pseudonymised. Further proposed secondary analyses include a PhD project to better understand cardiovascular risks following critical care. The PhD project will describe the occurrence of major adverse cardiovascular events (“MACE”) – myocardial infarction, stroke, heart failure, arrhythmogenic cardiac death or vascular death – during up to five years following discharge from an adult general critical care unit and develop a risk model to predict risk of MACE among critical care survivors. The Data will be minimised as follows: The date range requested (2004 to 2016) included HES records from 5 years prior to the study cohort, to enable evaluation of patients’ past medical history, to one year after last admission into the study cohort to enable evaluation of longer-term outcomes including rehospitalisation and death. The geographical spread of the data reflected the national coverage of the clinical audits. • Limited to a study cohort identified by ICNARC – patients admitted to an adult critical care unit or experiencing an in-hospital cardiac arrest and included in the ICNARC Case Mix Programme or National Cardiac Arrest Audit (NCAA); ICNARC is the sole Data Controller for the data being requested from NHS Digital. • Limited to data between 2004 and 2016. The date range requested included HES records from 5 years prior to the study cohort, to enable evaluation of patients’ past medical history, to one year after last admission into the study cohort to enable evaluation of longer-term outcomes including rehospitalisation and death. The Data Processors for the data being requested from NHS Digital are ICNARC, Babble Cloud (SUI) Limited and Exponential-E Ltd. Exponential-E Ltd manage ICNARC’s secure virtual data centre; and Babble Cloud (SUI) Limited provide ICNARC’s end user IT support. • Limited to England. The geographical spread of the Data reflected the national coverage of the clinical audits. In addition to data linkage with HES and Civil Registration Deaths, the project includes data linkage with other national clinical audits – the UK Renal Registry (operated out of North Bristol NHS Trust), the National Diabetes Audit (operated out of NHS Digital) and the National Adult Cardiac Surgery Audit (operated out of Barts Health NHS Trust). North Bristol NHS Trust, NHS Digital and Barts Health NHS Trust do not determine the aims and objectives of the study and therefore are not considered a Data Controller under this Agreement. They do not process any NHS Digital data and therefore are not considered to be Data Processors under this Agreement. ICNARC is the controller as the organisation responsible for ensuring that the Data will only be processed for the purpose described above. These audits only supplied patient identifiers to NHS Digital for data linkage and did not receive any HES or Civil Registration Deaths data for linked patients. The lawful basis for processing personal data under the UK GDPR is: The project is funded by the NIHR Health Services & Delivery Research Programme; the funder has no role in the conduct of the research. NIHR do not determine the aims and objectives of the study and therefore are not considered a Data Controller under this Agreement. Article 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party. The lawful basis for processing special category data under Article 9 of the GDPR is 9(2)(j) as the data are being processed for the purpose of scientific research in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The purpose of processing provides public benefit by improving ICNARC's ability to provide quality assessment of NHS services through our national clinical audits. ICNARC, as part of their legitimate interests, will use the data to make better quality comparisons between healthcare providers and any subsequent effect on improved treatment and service. ICNARC aims to develop statistical models that can be reliably used to improve those services. This has the potential to substantially improve risk prediction and therefore make fairer comparisons among providers and to increase understanding of longer-term outcomes. The lawful basis for processing special category data under Article 6 of the UK GDPR is (f) Legitimate interests. is: ICNARC will process the data held under this agreement in line with its legitimate interests as a registered charity engaged in “the advancement of education in the organisation and practice of critical care (in particular through the promotion of audit research into critical care and the publication of the useful results of such audit and research)” Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. Purpose test: This processing is in the public interest because it adheres to the UK Policy Framework for Health and Social Care Research, which protects and promotes the interests of patients, service users and the public, and aims to produce generalisable and publicly available information to inform future decisions over patients’ treatments or care. The objective of the processing is to support a research study to better understand the epidemiology of, risk factors for, and consequences of critical illness. This objective is directly aligned with ICNARC’s charitable objects (above) and therefore represents a legitimate interest. The public (and, in particular, future critically ill patients) will receive the benefits of the processing through better quality comparisons between healthcare providers and any subsequent effect on improved treatment and service. The funding is provided by the National Institute for Health and Care Research (NIHR) Health Services & Delivery Research Programme. The funding is specifically for the study described. Necessity test: The funder will have no ability to suppress or otherwise limit the publication of findings. The processing is necessary to achieve the objective as it is essential to use data from patients experiencing NHS services to develop statistical models that can be reliably used to improve those services. No other viable alternative was identified. Babble Cloud (SUI) Limited is a processor acting under the instructions of ICNARC. Babble Cloud (SUI) Limited role is limited to providing external desktop and network managed services, including end user and infrastructure support. Employees at Babble Cloud (SUI) Limited have the ability to access NHS Digital data for logistical reasons but will not access the data held under this agreement, however, they will have remote access to ICNARC servers (which are hosted by Exponential-E Ltd). Balancing test: Exponential-E Ltd manage ICNARC’s secure virtual data centre. Exponential-E Ltd provides IT hosting services to ICNARC and will store the Data as contracted by ICNARC. All data subjects are patients included in national clinical audits. Patients that have used NHS services will have a reasonable expectation for their data to be used to improve those services. They have also had the opportunity to opt out of their data being used, both directly with the audits and via the National Data Opt-out. There is likely to be no impact of the processing on the data subject. Only minimal identifiable data will be processed (necessary to link the different data sources) and the data will be pseudonymised following linkage. In the unlikely situation where a data breach occurs, a data subject may be impacted. Appropriate safeguards are in place to minimise the chance of this occurring. North Bristol NHS Trust and NHS England (as Controllers of the audit data) do not determine the aims and objectives of the study and therefore are not considered a Data Controller under this Agreement. They do not process any NHS England Data disseminated under this Agreement and therefore are not considered to be Data Processors under this Agreement. These audits only supplied patient identifiers to NHS England for data linkage and did not receive any HES or Civil Registration Deaths data for linked patients. The processing is necessary to achieve the stated aims, as linking data from multiple sources has the potential to substantially improve risk prediction and therefore make fairer comparisons among providers and to increase our understanding of longer-term outcomes in ways that would not be possible using the directly collected data alone. Data will be accessed by: The processing is proportionate as ICNARC are only requesting those fields required to meet the stated aims. • A PhD student holding an honorary contract with ICNARC. The individual has completed mandatory data protection and confidentiality training and is subject to ICNARC’s policies on data protection and confidentiality. The individual accessing the data will do so under the supervision of a substantive employee of ICNARC. ICNARC would be responsible and liable for any work carried out by the individual. The PhD student would only work on the data for the purposes described in this Data Sharing Agreement (DSA) and only had access to the final pseudonymised study dataset. The processing is balanced as: • Substantive employees of ICNARC. (1) although processing special category data from vulnerable individuals (adults lacking capacity to consent) a the public benefit of improving quality assessment of healthcare outweighs the minor potential impact to individuals; The research study had a Steering Group including three independent patient and public representatives. The Steering Group reviewed emerging results from the study to ensure that the use of patient data was appropriate and in line with the expectations of patients and the general public, and that what was important to patients and the public was taken into consideration in the choice of outcome measures. The patient and public members particularly emphasised the importance to patients of long-term follow-up of patients following critical care, and of considering patients’ recovery from critical illness beyond assessment of mortality. The study addressed this through the inclusion of longer-term outcomes including development of Type 2 diabetes, development of end-stage kidney disease and rehospitalisation. (2) the processing meets reasonable expectations as it is fully in line with the charitable objectives of the organisation undertaking the research and consistent with the information available to the participants in the national clinical audits; (3) the project makes use of existing data and as such is not intrusive, and both the likelihood and severity of any negative impact to an individual are extremely low; and (4) participants have been given the opportunity to opt out of having their data processed (both through opt-out arrangements for the national clinical audits and the national data opt-out for data supplied by NHS Digital).

Processing activities

No new data will be provided by NHS Digital under this Agreement. No data will flow to NHS England for the purposes of this iteration of the Data Sharing Agreement (DSA). No new data will be provided by NHS England under this iteration of the DSA. NHS England originally provided the relevant records from the National Diabetes Audit, Civil Registrations Mortality and HES APC datasets to ICNARC. The Data contained no direct identifying data items but contained a unique person ID which could be used to link the Data with other record level data already held by the recipient. This was originally provided under s251 support from the Confidentiality Advisory Group. The linked dataset has now been pseudonymised and individuals cannot be reidentified through linkage with other data in the possession of the recipient. The s251 support is therefore no longer needed. [1 paragraph unchanged] NHS Digital England undertook a bespoke data linkage between the linked HES and Civil Registrations Deaths Mortality datasets and external datasets from five national clinical audits: the ICNARC Case Mix Programme (for adult critical care), the National Cardiac Arrest Audit, the UK Renal Registry, the National Diabetes Audit and the National Adult Cardiac Surgery Audit. The index datasets (defining inclusion in the final pseudonymised dataset for analysis) are the ICNARC Case Mix Programme and the National Cardiac Arrest Audit. 1. ICNARC Case Mix Programme (for adult critical care), 2. National Cardiac Arrest Audit, 3. UK Renal Registry, 4. National Diabetes Audit and; 5. National Adult Cardiac Surgery Audit. The index datasets (defining inclusion in the final pseudonymised dataset for analysis) are the ICNARC Case Mix Programme and the National Cardiac Arrest Audit. [1 paragraph unchanged] Each national clinical audit provider uploaded the available identifiers (NHS Number, date [17 words unchanged] permitting linkage back to locally held data for the audit, onto NHS Digital's England's secure file sharing platform. NHS Digital England then linked the datasets and returned to each national clinical audit provider a dataset consisting of the local key, a common key (also known as HES ID which is ID, a pseudonymised ID that is specific to this study but the same [23 words unchanged] in either the ICNARC Case Mix Programme or National Cardiac Arrest Audit. The local key was used by the individual audit providers to identify the relevant record within their individual audit systems when it was returned from NHS Digital England along with the HES ID. The national audit providers do did not receive any data other than the two keys (local key and HES ID) and the binary field. [1 paragraph unchanged] NHS Digital England disseminated to ICNARC (via the secure file sharing platform) a pseudonymised data extract of HES, Civil Registration Deaths Mortality data and National Diabetes Audit data together with the HES ID only for patients identified in either the ICNARC Case Mix Programme or National Cardiac Arrest Audit. Prior to linkage, ICNARC pseudonymised the data extracts from the ICNARC Case Mix Programme and National Cardiac Arrest Audit by: by replacing date of birth with age in years; years and replacing post code with area level deprivation measures. The original datasets do did not include patients’ names or full addresses. The clinical data extracted from [10 words unchanged] National Adult Cardiac Surgery Audit did not include any potentially identifiable fields. ICNARC used the HES ID to link the data extracts provided by the national audit providers and NHS Digital England with pseudonymised data extracts from the ICNARC Case Mix Programme and National [33 words unchanged] restricted to the relevant records and necessary fields for each specific analysis. The linked project datasets were analysed by statisticians at ICNARC. All those with access to the data were substantive employees of ICNARC. The analyses described the epidemiology of, and risk factors for, and develop and validate risk prediction models for, the following outcomes: Following the data linkage, ICNARC conducted a final pseudonymisation by replacing the date of admission to the critical care unit or date of in-hospital cardiac arrest with the month and year, replacing all other dates in the dataset (including date of death) with the number of days relative to these index dates, and replacing hospital/critical care unit names with anonymous identifiers. Consequently, this final pseudonymised dataset contains no patient identifiable data. For admissions to adult critical care units (from the ICNARC Case Mix Programme): mortality at 30 days, 90 days and 1 year (from Civil Registration Deaths); time to death (from Civil Registration Deaths); new diagnosis of diabetes post-critical care (from the National Diabetes Audit); new diagnosis of end-stage renal disease post-critical care (from the UK Renal Registry); hospital resource use and costs post-critical care (from HES). The Data will not be transferred to any other location. For admissions to cardiothoracic critical care units (from the ICNARC Case Mix Programme): mortality at discharge from acute hospital; mortality at 30 days, 90 days and 1 year (from Civil Registration Deaths); time to death (from Civil Registration Deaths); hospital resource use and costs post-critical care. For these analyses, additional risk factor data was obtained from the National Adult Cardiac Surgery Audit. ICNARC have extracted a subset of the Data containing clinical fields from the ICNARC Case Mix Programme, time to hospital readmission and diagnostic codes from HES, and time to death and cause of death from Civil Registration Deaths data and made this available to the PhD student via a separate secure location on ICNARC’s file system. For patients experiencing in-hospital cardiac arrest (from the National Cardiac Arrest Audit): return of spontaneous circulation (ROSC) for greater than 20 minutes; survival to hospital discharge; survival to 30 days, 90 days and 1 year (from Civil Registration Deaths); time to death (from Civil Registration Deaths); critical care resource use post-arrest (from the ICNARC Case Mix Programme); Hospital resource use and costs post-arrest (from HES). For these analyses, additional risk factor data will be obtained from HES. The Data will be stored on servers at Exponential-E Ltd. Now the data are linked, ICNARC will conduct a final pseudonymisation which will take place by replacing the date of admission to the critical care unit or date of in-hospital cardiac arrest with the month and year, replacing all other dates in the dataset (including date of death) with the number of days relative to these index dates, and replacing hospital/critical care unit names with anonymous identifiers. Consequently, this final pseudonymised dataset will contain no patient identifiable data. This will be completed by December 2022. ICNARC stores Data on the Cloud provided by Exponential-E Ltd. No attempt will be made at any stage to identify or re-identify individuals. The Data will be accessed by authorised personnel via remote access. All processing of identifiable data was undertaken by staff with substantive contracts with ICNARC, as will the final pseudonymisation detailed above. All ICNARC staff are required to undertake NHS Digital training in Data Security Awareness. At no stage did those processing the data have access to patient identifiers beyond those already recorded for the Case Mix Programme and National Cardiac Arrest Audit, and the additional clinical data received will make minimal difference to the identifiability of data. The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract. All ICNARC employees are trained in data protection and confidentiality and have signed a contract, which incorporates a confidentiality clause and the consequences of breaching confidentiality are covered by disciplinary procedures. For remote access: The NHS Digital data along with all study data will be stored on secure servers, managed by Exponential-E Ltd, on behalf of ICNARC. Exponential-E Ltd is a contractor authorised by ICNARC and has sufficient security assurances in place. The data will be analysed by a remote desktop connection via a virtual private network from ICNARC owned equipment to the server at Exponential-E Ltd, with all data remaining on the server at all times and no data downloaded to local machines. Employees of Exponential-E Ltd will not access the data held under this agreement, but will provide storage/back-up, and as such, are listed as processors. - Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA; Babble Cloud (SUI) Limited will provide external desktop and network managed services, including end user and infrastructure support. Employees at Babble Cloud (SUI) Limited have the ability to access NHS Digital data for logistical reasons but will not access the data held under this agreement, however, they will have remote access to ICNARC servers (which are hosted by Exponential-E Ltd). - Access controls granting users the minimum level of access required are in place; The final pseudonymised study dataset will be accessed and analysed by a PhD student who has an honorary contract with ICNARC. The honorary contract is signed by the individual’s substantive employer to confirm that any breaches of data security would be enforced through the substantive employer. Honorary ICNARC staff are required to either undertake the NHS Digital training or to provide evidence of equivalent training from their substantive employer. - Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data; The PhD student working under an Honorary Contract may only access pseudonymised data from this project where it is held at Exponential-e Ltd, i.e. there will ne no onward sharing of personal data. Processing is restricted to analysis that falls within the overall purpose of the project (to better understand the epidemiology of, and outcomes from, critical illness). - Multifactor authentication (MFA) is required for remote access; All outputs from analyses of the pseudonymised data set will be restricted to aggregate data with small numbers supressed in line with the HES analysis guide. - Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access; - All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy. The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose). Remote processing will be from secure locations within England. The data will not leave England at any time. Data will be accessed by an individual with an honorary contract with ICNARC. The individual will act as an agent of ICNARC at all times under supervision from employees of ICNARC. Aside from this individual, access is restricted to employees or agents of ICNARC who have authorisation from the Principal Investigator. Babble Cloud SUI Limited is not permitted to access the Data. Exponential-E Ltd is not permitted to access the Data. All personnel accessing the Data have been appropriately trained in data protection and confidentiality. All analyses will use the pseudonymised dataset. There will be no requirement and no attempt to reidentify individuals when using the pseudonymised dataset. Researchers from ICNARC will analyse the Data for the purposes described above.

Expected output

The planned expected outputs of the project are as follows: processing will be: 1. • A final report on the entire project to be published as a monograph (a biographical study) in the NIHR journal, Health Services and Delivery Research. This report has been submitted and peer reviewed and is with the NIHR production team. The report will include only aggregate level data with small numbers suppressed. was published in December 2022. 2. • Journal articles for peer-reviewed scientific journals. A minimum of three journal articles [48 words unchanged] article. Journal articles will be prepared following submission of the final report. Journal articles will include only aggregate level data with small numbers suppressed. Target date: Winter 2022/2023 December 2023 3. • Presentations at professional and scientific conferences. To date, presentations Presentations have taken place at the Annual Meeting of the Case Mix Programme, [7 words unchanged] Arrest Audit and the Intensive Care Society State of the Art Meeting. Further presentations will be considered in future. Presentations will include only aggregate level data with small numbers suppressed. Target date: Ongoing 4. • Information on project outputs will be made available to participants and the public through ICNARC’s website (https://www.icnarc.org/Publications). Target date: updated as and when results become available 5. • The final linked pseudonymised dataset will be retained and stored securely on ICNARC's ICNARCs servers for 10 years. No personal data will be onwardly shared. All outputs will be restricted to aggregate data with small numbers suppressed in line with the HES analysis guide. Once the study moves into archiving, this Agreement will be amended to reflect the archiving status. [1 paragraph unchanged] 1. An NIHR Career Development Award on longer term outcomes of patients with sepsis, leading to two publications: • A PhD project to better understand cardiovascular risks following critical care (ongoing). This will lead to a PhD thesis and publications. This is working only with the final pseudonymised dataset. The PhD study falls within the original purpose for processing this data. Shankar-Hari M et al. Risk factors at index hospitalization associated with longer-term mortality in adult sepsis survivors. JAMA Netw Open 2019; 2:e194900. The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived. Shankar-Hari M et al. Development, validation, and clinical utility assessment of a prognostic score for 1-year unplanned rehospitalization or death of adult sepsis survivors, JAMA Netw Open 2020; 3:e2013580. The outputs will be communicated to relevant recipients through the following dissemination channels: 2. An NIHR-funded secondary research project on treatments for atrial fibrillation, leading to two publications: • Journals Bedford J et al. Pharmacological and non-pharmacological treatments and outcomes for new-onset atrial fibrillation in ICU patients: the CAFE scoping review and database analyses. Health Technol Assess 2021;25(71) • Social media Bedford J et al. New-onset atrial fibrillation in intensive care: epidemiology and outcomes. Eur Heart J Acute Cardiovasc Care 2022; 11:620-8 • ICNARC website Further proposed secondary use includes a PhD project to better understand cardiovascular risks following critical care. This will lead to a PhD thesis and publications. This is working only with the final pseudonymised dataset and therefore following the exit from S251 support. The PhD study falls within the original purpose for processing this data. The PhD student holds an honorary contract with ICNARC. The outputs from the PhD study will only be released in aggregate or summary form with small numbers suppressed.

Expected measurable benefits

The findings of this research study are expected to contribute to evidence-based decision-making for policy-makers, local decision-makers such as doctors, and patients to inform best practice to improve the care, treatment and experience of health care users relevant to the subject matter of the study. The use of the data could: • help the system to better understand the health and care needs of populations. • lead to the identification or improvement of treatments or interventions, or health and care system design to improve health and care outcomes or experience. • provide a mechanism for checking the quality of care. This could include identifying areas of good practice to learn from, or areas of poorer practice which need to be addressed. • support knowledge creation or exploratory research (and the innovations and developments that might result from that exploratory work). Specific benefits to patients are expected as an outcome subject to the findings: [1 paragraph unchanged] The improved knowledge of risk factors hopes to inform changes to the [41 words unchanged] of a dataset including the new fields to participating critical care units. This work aims to be undertaken alongside the current project as information emerges, with Version 4 of the Case Mix Programme The linked pseudonymised dataset released is now used in 2021. all critical care units. [1 paragraph unchanged] Following the establishment of regular, routine data linkage, the risk models aim [66 words unchanged] routine data linkage will be undertaken following completion of this project (target December 2023). 3. Improved understanding of physiological consequences of critical illness including development of Type 2 diabetes and acute kidney injury, and risk models to predict these risks risks. [8 paragraphs unchanged] Following the establishment of regular, routine data linkage, the risk models aim [62 words unchanged] routine data linkage will be undertaken following completion of this project (target December 2023). [1 paragraph unchanged] iii. Yielded Benefits : Information from the models evaluating longer term outcomes for critically ill patients has been fed into the development of a new dataset for the Case Mix Programme, informing the expansion of data collected around conditions in the past medical history. This dataset was released to the first critical care units in April 2021 and is now being rolled out across the audit. A similar process is currently underway for the National Cardiac Arrest Audit. A business case is being prepared for regular routine linkage of the Case Mix Programme and National Cardiac Arrest Audit with death registrations to allow regular reporting of risk-adjusted longer-term outcomes alongside the current reports to participating hospitals and to the public. These yielded benefits align to ICNARC's Legitimate Interests as they show evidence of the benefits of linking data from multiple sources having the potential to substantially improve risk prediction and therefore make fairer comparisons among providers and to increase understanding of longer-term outcomes in ways that would not be possible using the directly collected data alone.

Benefits reported

Information from the models evaluating longer term outcomes for critically ill patients [30 words unchanged] was released to the first critical care units in April 2021 and is now being rolled roll out across to all critical care units participating in the audit. audit was completed in April 2023. A similar process is currently underway for the National Cardiac Arrest Audit. [30 words unchanged] outcomes alongside the current reports to participating hospitals and to the public. These yielded benefits align to ICNARC's Legitimate Interests as they show evidence of the benefits of linking data from multiple sources having the potential to substantially improve risk prediction and therefore make fairer comparisons among providers and to increase understanding of longer-term outcomes in ways that would not be possible using the directly collected data alone. The study has resulted in an NIHR Career Development Award on longer term outcomes of patients with sepsis, leading to two publications: Shankar-Hari M et al. Risk factors at index hospitalization associated with longer-term mortality in adult sepsis survivors. JAMA Netw Open 2019; 2:e194900. Shankar-Hari M et al. Development, validation, and clinical utility assessment of a prognostic score for 1-year unplanned rehospitalization or death of adult sepsis survivors, JAMA Netw Open 2020; 3:e2013580. This project led to improved understanding of longer-term mortality and rehospitalization in adult sepsis survivors. The information from the project informed the design of the VACIRiSS trial to evaluate pneumococcal vaccination among sepsis survivors, which has completed recruitment and is awaiting linked data from NHS England to undertake the final analysis. The prognostic score developed in this study will also be used within the trial analysis. The study has resulted in an NIHR-funded secondary research project on treatments for atrial fibrillation, leading to two publications: Bedford J et al. Pharmacological and non-pharmacological treatments and outcomes for new-onset atrial fibrillation in ICU patients: the CAFE scoping review and database analyses. Health Technol Assess 2021;25(71) Bedford J et al. New-onset atrial fibrillation in intensive care: epidemiology and outcomes. Eur Heart J Acute Cardiovasc Care 2022; 11:620-8 This project led to improved understanding of the interventions used to treat atrial fibrillation in critical care and the potential benefits of these treatments. This led to a commissioned call for a clinical trial to evaluate interventions for atrial fibrillation, which funded the ongoing ABBRUPT trial to identify the optimum intervention.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + National Diabetes Audit

Objective for processing

This Data Sharing Agreement permits the retention of the data provided under previous iterations of this Agreement for an interim period. This is a pragmatic approach to provide an active Agreement whilst enabling the Intensive Care National Audit and Research Centre (ICNARC) to complete the necessary actions to enable a subsequent application to extend the Agreement meeting all applicable data sharing standards as published in NHS Digital’s website The purpose of this agreement is to retain and process both Civil Registration Deaths and Hospital Episode Statistics Admitted Patient Care (HES APC) data to continue supporting a research study entitled “Risk modelling for quality improvement in the critically ill: making best use of available data”. The research study is being conducted by researchers from the Intensive Care National Audit & Research Centre (ICNARC), an independent registered charity (charity number: 1039417) which aims to improve critical care services in the UK through a programme of national clinical audits and research studies. ICNARC coordinates two national clinical audits: the Case Mix Programme (CMP) for adult critical care and the National Cardiac Arrest Audit (coordinated jointly with the Resuscitation Council UK) for in-hospital cardiac arrest. (see: https://digital.nhs.uk/services/data-access-request-service-dars/dars-guidance). The data held under this Agreement does not include patient names and addresses but does include identifiable fields including date of birth, postcode and date of death. Processing of identifiable data without consent is undertaken with approval from the Health Research Authority under section 251 of the National Health Service Act 2006 (approval number 15/CAG/0163). Under this iteration of the Agreement the study team will pseudonymise the study dataset, providing an exit strategy from Section 251 support. The following information provides background information on the purpose of the original study. No new data will be released under this version of the agreement, and this agreement allows the applicant to hold and not otherwise process any data that has already been disseminated. BACKGROUND: HES Admitted Patient Care and Civil Registration Mortality Data was supplied to Intensive Care National Audit & Research Centre (ICNARC) by the Health and Social Care Information Centre (which has since become NHS Digital) for the purpose of a research study referred to as "Risk modelling in the critically ill". [1 paragraph unchanged] This study is a follow-on to a previous study conducted by ICNARC, entitled “Ensuring comparisons of health-care providers are fair: risk modelling for quality improvement in the critically ill”, that addressed risk prediction modelling in three clinical areas: clinical areas: [3 paragraphs unchanged] The previous study referenced above did not access NHS Digital data and as such did not have a Data Sharing Agreement in place with NHS Digital. [1 paragraph unchanged] This agreement is in place to support a research current study funded by the NIHR Health Services and Delivery Research Programme in 2015 that aims to better understand the following: [6 paragraphs unchanged] The research study is being conducted by researchers from the Intensive Care National Audit & Research Centre (ICNARC), an independent registered charity (charity number: 1039417) which aims to improve critical care services in the UK through a programme of national clinical audits and research studies. ICNARC coordinates two national clinical audits: the Case Mix Programme for adult critical care and the National Cardiac Arrest Audit (coordinated jointly with the Resuscitation Council UK) for in-hospital cardiac arrest. In addition to data linkage with HES/Mortality data, the project includes data linkage with other national clinical audits – the UK Renal Registry, the National Diabetes Audit and the National Adult Cardiac Surgery Audit – and representatives from these audits are included in the study team. The data subjects are patients admitted to an adult critical care unit or experiencing an in-hospital cardiac arrest and included in the ICNARC Case Mix Programme or National Cardiac Arrest Audit (NCAA). Patients are recruited to the national clinical audits without consent, as consent would be impossible to obtain in the urgent setting, and support for the use of confidential patient data without consent has been obtained for both audits from the Secretary of State under Section 251 of the National Health Service Act 2006. Both national clinical audits include patients and members of the public in their management structure (ICNARC Board of Trustees and NCAA Steering Group). The research study also has a Steering Group including independent patient and public representatives. They have reviewed emerging results from the study to ensure that the use of patient data is appropriate and in line with the expectations of patients and the general public, and that what is important to patients and the public is taken into consideration in the choice of outcome measures. Once the project is completed, the feasibility and cost of establishing regular, routine data linkage between these data sources will be investigated. ICNARC wish to continue processing HES APC, Civil Registration Deaths data and National Diabetes Audit data already held. The data fields requested have been selected to identify solely those items expected to improve risk prediction or to evaluate important health outcomes – these were predominantly diagnostic and procedure codes. Processing of identifiable data was necessary to conduct the data linkages. All linkages have now been completed and the next action under this Agreement will be to create a final pseudonymised study dataset. This will be completed by December 2022 in line with the extended HRA Section 251 support. The legal bases for processing data under GDPR are Article 6(1)(f) - legitimate interest - and Article 9(2)(j) - Scientific research. The ICO checklist and a Legitimate Interest Assessment have been completed which confirm that the three tests are met and legitimate interest is the most appropriate legal basis as the organisation is a charity processing patient data to conduct scientific research in the public interest. Further processing of the final pseudonymised data will be secondary analyses that fall within the scope of the original overall purpose of this Agreement, of better understanding the epidemiology of and outcomes from, critical illness. Secondary analyses of the data from this project to date include: 1. An NIHR Career Development Award on longer term outcomes of patients with sepsis in an intensive care setting (https://fundingawards.nihr.ac.uk/award/CS-2016-16-011) 2. An NIHR-funded secondary research project on treatments for atrial fibrillation in an intensive care setting (https://fundingawards.nihr.ac.uk/award/17/71/04) Further proposed secondary analyses include a PhD project to better understand cardiovascular risks following critical care. The PhD project will describe the occurrence of major adverse cardiovascular events (“MACE”) – myocardial infarction, stroke, heart failure, arrhythmogenic cardiac death or vascular death – during up to five years following discharge from an adult general critical care unit and develop a risk model to predict risk of MACE among critical care survivors. The date range requested (2004 to 2016) included HES records from 5 years prior to the study cohort, to enable evaluation of patients’ past medical history, to one year after last admission into the study cohort to enable evaluation of longer-term outcomes including rehospitalisation and death. The geographical spread of the data reflected the national coverage of the clinical audits. ICNARC is the sole Data Controller for the data being requested from NHS Digital. The Data Processors for the data being requested from NHS Digital are ICNARC, Babble Cloud (SUI) Limited and Exponential-E Ltd. Exponential-E Ltd manage ICNARC’s secure virtual data centre; and Babble Cloud (SUI) Limited provide ICNARC’s end user IT support. In addition to data linkage with HES and Civil Registration Deaths, the project includes data linkage with other national clinical audits – the UK Renal Registry (operated out of North Bristol NHS Trust), the National Diabetes Audit (operated out of NHS Digital) and the National Adult Cardiac Surgery Audit (operated out of Barts Health NHS Trust). North Bristol NHS Trust, NHS Digital and Barts Health NHS Trust do not determine the aims and objectives of the study and therefore are not considered a Data Controller under this Agreement. They do not process any NHS Digital data and therefore are not considered to be Data Processors under this Agreement. These audits only supplied patient identifiers to NHS Digital for data linkage and did not receive any HES or Civil Registration Deaths data for linked patients. The project is funded by the NIHR Health Services & Delivery Research Programme; the funder has no role in the conduct of the research. NIHR do not determine the aims and objectives of the study and therefore are not considered a Data Controller under this Agreement. The lawful basis for processing special category data under Article 9 of the GDPR is 9(2)(j) as the data are being processed for the purpose of scientific research in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The purpose of processing provides public benefit by improving ICNARC's ability to provide quality assessment of NHS services through our national clinical audits. The lawful basis for processing data under Article 6 of the GDPR is (f) Legitimate interests. ICNARC will process the data held under this agreement in line with its legitimate interests as a registered charity engaged in “the advancement of education in the organisation and practice of critical care (in particular through the promotion of audit research into critical care and the publication of the useful results of such audit and research)” Purpose test: The objective of the processing is to support a research study to better understand the epidemiology of, risk factors for, and consequences of critical illness. This objective is directly aligned with ICNARC’s charitable objects (above) and therefore represents a legitimate interest. The public (and, in particular, future critically ill patients) will receive the benefits of the processing through better quality comparisons between healthcare providers and any subsequent effect on improved treatment and service. Necessity test: The processing is necessary to achieve the objective as it is essential to use data from patients experiencing NHS services to develop statistical models that can be reliably used to improve those services. No other viable alternative was identified. Balancing test: All data subjects are patients included in national clinical audits. Patients that have used NHS services will have a reasonable expectation for their data to be used to improve those services. They have also had the opportunity to opt out of their data being used, both directly with the audits and via the National Data Opt-out. There is likely to be no impact of the processing on the data subject. Only minimal identifiable data will be processed (necessary to link the different data sources) and the data will be pseudonymised following linkage. In the unlikely situation where a data breach occurs, a data subject may be impacted. Appropriate safeguards are in place to minimise the chance of this occurring. The processing is necessary to achieve the stated aims, as linking data from multiple sources has the potential to substantially improve risk prediction and therefore make fairer comparisons among providers and to increase our understanding of longer-term outcomes in ways that would not be possible using the directly collected data alone. The processing is proportionate as ICNARC are only requesting those fields required to meet the stated aims. The processing is balanced as: (1) although processing special category data from vulnerable individuals (adults lacking capacity to consent) a the public benefit of improving quality assessment of healthcare outweighs the minor potential impact to individuals; (2) the processing meets reasonable expectations as it is fully in line with the charitable objectives of the organisation undertaking the research and consistent with the information available to the participants in the national clinical audits; (3) the project makes use of existing data and as such is not intrusive, and both the likelihood and severity of any negative impact to an individual are extremely low; and (4) participants have been given the opportunity to opt out of having their data processed (both through opt-out arrangements for the national clinical audits and the national data opt-out for data supplied by NHS Digital).

Processing activities

Under this Agreement, the data may be securely stored but not otherwise processed. No new data will be provided by NHS Digital under this Agreement. The study data, including data provided by NHS Digital under previous agreements, are currently held by the Intensive Care National Audit and Research Centre (ICNARC). All data flows for the project have already taken place. These were as follows: All organisations party to this agreement must comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data). NHS Digital undertook a bespoke data linkage between the linked HES and Civil Registrations Deaths datasets and external datasets from five national clinical audits: the ICNARC Case Mix Programme (for adult critical care), the National Cardiac Arrest Audit, the UK Renal Registry, the National Diabetes Audit and the National Adult Cardiac Surgery Audit. The index datasets (defining inclusion in the final pseudonymised dataset for analysis) are the ICNARC Case Mix Programme and the National Cardiac Arrest Audit. The following provides background information on what was previously permitted under the processing activities. The data linkage process was as follows: All those with access to the data are substantive employees of ICNARC. Each national clinical audit provider uploaded the available identifiers (NHS Number, date of birth, sex, postcode) for patients included in each national clinical audit together with a local key, permitting linkage back to locally held data for the audit, onto NHS Digital's secure file sharing platform. All outputs will be restricted to aggregate data with small numbers supressed in line with the HES analysis guide. NHS Digital then linked the datasets and returned to each national clinical audit provider a dataset consisting of the local key, a common key (also known as HES ID which is a pseudonymised ID that is specific to this study but the same across the different data providers to enable the clinical data to be linked) and a binary field indicating whether that patient was identified in either the ICNARC Case Mix Programme or National Cardiac Arrest Audit. The data from NHS Digital will not be used for any other purpose other than that outlined in this Agreement. The local key was used by the individual audit providers to identify the relevant record within their individual audit systems when it was returned from NHS Digital along with the HES ID. The national audit providers do not receive any data other than the two keys (local key and HES ID) and the binary field. NHS Digital will undertake a bespoke data linkage between the linked HES/ONS dataset and external datasets from five national clinical audits: the ICNARC Case Mix Programme (for adult critical care), the National Cardiac Arrest Audit, the UK Renal Registry, the National Diabetes Audit and the National Adult Cardiac Surgery Audit. The index datasets (defining inclusion in the final pseudonymised dataset for analysis) will be the ICNARC Case Mix Programme and the National Cardiac Arrest Audit. Each national audit provider external to ICNARC then supplied directly to ICNARC a pseudonymised dataset of the clinical fields required for the project together with the HES ID only for those patients identified in either the ICNARC Case Mix Programme or National Cardiac Arrest Audit. The data linkage process will work as follows: each national clinical audit provider will upload to NHS Digital's secure file sharing platform datasets consisting of the available identifiers for patients included in each national clinical audit together with a local key permitting linkage back to locally held data for the audit. NHS Digital disseminated to ICNARC (via the secure file sharing platform) a pseudonymised data extract of HES, Civil Registration Deaths data and National Diabetes Audit data together with the HES ID only for patients identified in either the ICNARC Case Mix Programme or National Cardiac Arrest Audit. NHS Digital will link the datasets and return to each national clinical audit provider a dataset consisting of the local key, a common key (permitting linkage across all the datasets) and a binary field indicating whether that patient was identified in either the ICNARC Case Mix Programme or National Cardiac Arrest Audit. Prior to linkage, ICNARC pseudonymised the data extracts from the ICNARC Case Mix Programme and National Cardiac Arrest Audit by: replacing date of birth with age in years; and replacing post code with area level deprivation measures. The original datasets do not include patients’ names or full addresses. The clinical data extracted from the UK Renal Registry, the National Diabetes Audit and the National Adult Cardiac Surgery Audit did not include any potentially identifiable fields. The local key is used by the individual audit providers to identify the relevant record within their individual audit systems when it is retuned from NHS Digital along with a common key. The national audit providers do not receive any data other than the two keys and the binary field. ICNARC used the HES ID to link the data extracts provided by the national audit providers and NHS Digital with pseudonymised data extracts from the ICNARC Case Mix Programme and National Cardiac Arrest Audit. The data are now all linked as a series of datasets with a single pseudonymised identifier that identifies records of the same patient in the different datasets. The data is restricted to the relevant records and necessary fields for each specific analysis. Each national audit provider external to ICNARC will then supply direct to ICNARC a pseudonymised dataset of the clinical fields required for the project together with the common key only for those patients identified in either the ICNARC Case Mix Programme or National Cardiac Arrest Audit. NHS Digital will provide to ICNARC (via the secure file sharing platform) a pseudonymised data extract of HES/Mortality data together with the common key only for patients identified in either the ICNARC Case Mix Programme or National Cardiac Arrest Audit. The linked project datasets were analysed by statisticians at ICNARC. All those with access to the data were substantive employees of ICNARC. The analyses described the epidemiology of, and risk factors for, and develop and validate risk prediction models for, the following outcomes: ICNARC will use the common key to link the data extracts provided by the national audit providers and NHS Digital with pseudonymised data extracts from the ICNARC Case Mix Programme and National Cardiac Arrest Audit to create the final linked project dataset. Prior to linkage, ICNARC will pseudonymise the data extracts from the ICNARC Case Mix Programme and National Cardiac Arrest Audit by: replacing date of birth with age in years; and replacing post code with area level deprivation measures. The original datasets do not include patients’ names or full addresses. For admissions to adult critical care units (from the ICNARC Case Mix Programme): mortality at 30 days, 90 days and 1 year (from Civil Registration Deaths); time to death (from Civil Registration Deaths); new diagnosis of diabetes post-critical care (from the National Diabetes Audit); new diagnosis of end-stage renal disease post-critical care (from the UK Renal Registry); hospital resource use and costs post-critical care (from HES). Once the data are linked, ICNARC will conduct a final pseudonymisation which will take place by replacing date of birth with age in years, replacing the date of admission to the critical care unit or date of in-hospital cardiac arrest with the month and year, replacing all other dates in the dataset (including date of death) with the number of days relative to these index dates, replacing post code with area level deprivation measures and replacing hospital/critical care unit names with anonymous identifiers. Consequently, this final pseudonymised dataset will contain no patient identifiable data. For admissions to cardiothoracic critical care units (from the ICNARC Case Mix Programme): mortality at discharge from acute hospital; mortality at 30 days, 90 days and 1 year (from Civil Registration Deaths); time to death (from Civil Registration Deaths); hospital resource use and costs post-critical care. For these analyses, additional risk factor data was obtained from the National Adult Cardiac Surgery Audit. The final linked project dataset will be analysed by statisticians at ICNARC. All those with access to the data are substantive employees of ICNARC. The analyses will describe the epidemiology of, and risk factors for, and develop and validate risk prediction models for, the following outcomes: For patients experiencing in-hospital cardiac arrest (from the National Cardiac Arrest Audit): return of spontaneous circulation (ROSC) for greater than 20 minutes; survival to hospital discharge; survival to 30 days, 90 days and 1 year (from Civil Registration Deaths); time to death (from Civil Registration Deaths); critical care resource use post-arrest (from the ICNARC Case Mix Programme); Hospital resource use and costs post-arrest (from HES). For these analyses, additional risk factor data will be obtained from HES. For admissions to adult critical care units (from the ICNARC Case Mix Programme): mortality at 30 days, 90 days and 1 year ; time to death, new diagnosis of diabetes post-critical care (from the National Diabetes Audit); new diagnosis of end-stage renal disease post-critical care (from the UK Renal Registry); hospital resource use and costs post-critical care (from HES). Now the data are linked, ICNARC will conduct a final pseudonymisation which will take place by replacing the date of admission to the critical care unit or date of in-hospital cardiac arrest with the month and year, replacing all other dates in the dataset (including date of death) with the number of days relative to these index dates, and replacing hospital/critical care unit names with anonymous identifiers. Consequently, this final pseudonymised dataset will contain no patient identifiable data. This will be completed by December 2022. For admissions to cardiothoracic critical care units (from the ICNARC Case Mix Programme): mortality at discharge from acute hospital; mortality at 30 days, 90 days and 1 year; time to death; hospital resource use and costs post-critical care. For these analyses, additional risk factor data will be obtained from the National Adult Cardiac Surgery Audit. No attempt will be made at any stage to identify or re-identify individuals. For patients experiencing in-hospital cardiac arrest (from the National Cardiac Arrest Audit): return of spontaneous circulation (ROSC) for greater than 20 minutes; survival to hospital discharge; survival to 30 days, 90 days and 1 year mortality data; time to death mortality data; critical care resource use post-arrest (from the ICNARC Case Mix Programme); Hospital resource use and costs post-arrest (from HES). For these analyses, additional risk factor data will be obtained from HES. All processing of identifiable data was undertaken by staff with substantive contracts with ICNARC, as will the final pseudonymisation detailed above. All ICNARC staff are required to undertake NHS Digital training in Data Security Awareness. At no stage did those processing the data have access to patient identifiers beyond those already recorded for the Case Mix Programme and National Cardiac Arrest Audit, and the additional clinical data received will make minimal difference to the identifiability of data. Initial data linkage will be undertaken for data from 1 April 2009 to 31 March 2015. These data will be used to describe the epidemiology and develop the risk prediction models. The data linkage will be updated one year later for data from 1 April 2015 to 31 March 2016. These data will be used to validate the risk prediction model. All ICNARC employees are trained in data protection and confidentiality and have signed a contract, which incorporates a confidentiality clause and the consequences of breaching confidentiality are covered by disciplinary procedures. The reason for requesting historical data is for analysis of co-morbidity, to look back at previous admissions and prior use of healthcare, which is a predictor of subsequent use. The NHS Digital data along with all study data will be stored on secure servers, managed by Exponential-E Ltd, on behalf of ICNARC. Exponential-E Ltd is a contractor authorised by ICNARC and has sufficient security assurances in place. The data will be analysed by a remote desktop connection via a virtual private network from ICNARC owned equipment to the server at Exponential-E Ltd, with all data remaining on the server at all times and no data downloaded to local machines. Employees of Exponential-E Ltd will not access the data held under this agreement, but will provide storage/back-up, and as such, are listed as processors. Babble Cloud (SUI) Limited will provide external desktop and network managed services, including end user and infrastructure support. Employees at Babble Cloud (SUI) Limited have the ability to access NHS Digital data for logistical reasons but will not access the data held under this agreement, however, they will have remote access to ICNARC servers (which are hosted by Exponential-E Ltd). The final pseudonymised study dataset will be accessed and analysed by a PhD student who has an honorary contract with ICNARC. The honorary contract is signed by the individual’s substantive employer to confirm that any breaches of data security would be enforced through the substantive employer. Honorary ICNARC staff are required to either undertake the NHS Digital training or to provide evidence of equivalent training from their substantive employer. The PhD student working under an Honorary Contract may only access pseudonymised data from this project where it is held at Exponential-e Ltd, i.e. there will ne no onward sharing of personal data. Processing is restricted to analysis that falls within the overall purpose of the project (to better understand the epidemiology of, and outcomes from, critical illness). All outputs from analyses of the pseudonymised data set will be restricted to aggregate data with small numbers supressed in line with the HES analysis guide.

Expected output

This Agreement permits the secure retention of the data only and no other processing. The planned outputs of the project are as follows: No new outputs will be produced under this Data Sharing Agreement. 1. A final report on the entire project to be published as a monograph in the NIHR journal, Health Services and Delivery Research. This report has been submitted and peer reviewed and is with the NIHR production team. The report will include only aggregate level data with small numbers suppressed. The following information provides background information on the proposed outputs of the original study. 2. Journal articles for peer-reviewed scientific journals. A minimum of three journal articles are planned, reporting on the separate areas of the project (adult critical care, cardiothoracic critical care and in-hospital cardiac arrest. However, given the large amount of work planned within each of these areas, it may be appropriate to split one or more of these into more than one article. Journal articles will be prepared following submission of the final report. Journal articles will include only aggregate level data with small numbers suppressed. Target date: Winter 2022/2023 1. A final report on the entire project to be published as a monograph in the NIHR journal, Health Services and Delivery Research. Target date for submission: 31/05/2020. The report will include only aggregate level data on subgroups comprising thousands of patients and will not include any small numbers; therefore small sample suppression will therefore not be required. 3. Presentations at professional and scientific conferences. To date, presentations have taken place at the Annual Meeting of the Case Mix Programme, the Annual Meeting of the National Cardiac Arrest Audit and the Intensive Care Society State of the Art Meeting. Further presentations will be considered in future. Presentations will include only aggregate level data with small numbers suppressed. Target date: Ongoing 2. Journal articles for peer-reviewed scientific journals. A minimum of three journal articles are planned, reporting on the separate areas of the project (adult critical care, cardiothoracic critical care and in-hospital cardiac arrest). However, given the large amount of work planned within each of these areas, it may be appropriate to split one or more of these into more than one article. Target dates for submission: May to September 2020. Journal articles will include only aggregate level data on subgroups comprising thousands of patients and will not include any small numbers; therefore small sample suppression will therefore not be required. 4. Information on project outputs will be made available to participants and the public through ICNARC’s website (https://www.icnarc.org/Publications). Target date: updated as and when results become available 3. Presentations at professional and scientific conferences. To date, these have included the Case Mix Programme Annual Meeting (April 2018 and April 2019), the Annual Meeting of the National Cardiac Arrest Audit (November 2019) and the Intensive Care Society State of the Art Meeting (December 2019). Further presentations are planned. Presentations will include only aggregate level data on subgroups comprising thousands of patients and will not include any small numbers; therefore small sample suppression will therefore not be required. 5. The final linked pseudonymised dataset will be retained and stored securely on ICNARC's servers for 10 years. No personal data will be onwardly shared. All outputs will be restricted to aggregate data with small numbers suppressed in line with the HES analysis guide. Once the study moves into archiving, this Agreement will be amended to reflect the archiving status. 4. The final linked anonymised dataset will be retained and stored securely on ICNARC's servers for 10 years. Requests for additional analyses based on this dataset will be managed by ICNARC's independent Data Access Advisory Group in accordance with the MRC Good Practice Principles for Sharing Individual Participant Data from Publically Funded Clinical Trials. Any additional analyses will be restricted to the overall purpose of better understanding the epidemiology of and outcomes from, critical illness. All outputs will be restricted to aggregate data with small numbers supressed in line with the HES analysis guide. Secondary use of the data from this project to date include: 5. Each national clinical audit will retain and securely store the datasets linking each local key with the common key, enabling future studies of linked data to be undertaken subject to necessary REC/Section 251 approvals. 1. An NIHR Career Development Award on longer term outcomes of patients with sepsis, leading to two publications: Outputs will be shared with the relevant national audit providers. All outputs will be restricted to aggregate data with small numbers suppressed in line with the HES analysis guide. Shankar-Hari M et al. Risk factors at index hospitalization associated with longer-term mortality in adult sepsis survivors. JAMA Netw Open 2019; 2:e194900. Any requests to access data from this project are restricted to those that fall within the overall purpose of the project (to better understand the epidemiology of, and outcomes from, critical illness) and data will only be released in aggregate or summary form with small numbers suppressed unless with the express prior permission of NHS Digital. Any such permission for the onward sharing of record level data would be subject to a future application. Shankar-Hari M et al. Development, validation, and clinical utility assessment of a prognostic score for 1-year unplanned rehospitalization or death of adult sepsis survivors, JAMA Netw Open 2020; 3:e2013580. 2. An NIHR-funded secondary research project on treatments for atrial fibrillation, leading to two publications: Bedford J et al. Pharmacological and non-pharmacological treatments and outcomes for new-onset atrial fibrillation in ICU patients: the CAFE scoping review and database analyses. Health Technol Assess 2021;25(71) Bedford J et al. New-onset atrial fibrillation in intensive care: epidemiology and outcomes. Eur Heart J Acute Cardiovasc Care 2022; 11:620-8 Further proposed secondary use includes a PhD project to better understand cardiovascular risks following critical care. This will lead to a PhD thesis and publications. This is working only with the final pseudonymised dataset and therefore following the exit from S251 support. The PhD study falls within the original purpose for processing this data. The PhD student holds an honorary contract with ICNARC. The outputs from the PhD study will only be released in aggregate or summary form with small numbers suppressed.

Expected measurable benefits

This Agreement permits the secure retention of the data only and no other processing. 1. Improved understanding of longer-term outcomes following critical care and associated risk factors Benefits: The improved knowledge of risk factors hopes to inform changes to the dataset for the Case Mix Programme national clinical audit to ensure that important risk factors are incorporated. This aims to impact around 200,000 patients using NHS critical care services every year. The impact aims to be measured by the successful roll-out of a dataset including the new fields to participating critical care units. This work aims to be undertaken alongside the current project as information emerges, with Version 4 of the Case Mix Programme dataset released in 2021. Adult general critical care data linkage between the Case Mix Programme and death registrations will enable ICNARC to develop risk models to predict longer term mortality following an episode of critical illness. 2. Risk models which can be used to predict longer-term outcomes following critical care Data linkage between the Case Mix Programme and the National Diabetes Audit will enable ICNARC to establish whether acute severity of hyperglycaemia or other risk factors are associated with the likelihood of developing Type 2 diabetes. Following the establishment of regular, routine data linkage, the risk models aim be introduced into benchmarking of the performance of critical care units for longer-term patient outcomes alongside current, shorter-term outcomes, giving a more comprehensive picture of performance. This aims to impact around 200,000 patients using NHS critical care services every year. The impact aims to be measured by the successful delivery of reports to critical care units, and subsequently public reports, incorporating longer-term outcomes. The application for routine data linkage will be undertaken following completion of this project (target 2023). The occurrence of acute kidney injury (or acute renal failure) is common among critically ill patients and associated with high mortality, and has been strongly linked with subsequent end-stage renal disease. Data linkage between the Case Mix Programme and the UK Renal Registry will enable ICNARC to evaluate this relationship in the UK and develop risk models to predict the requirement for long-term renal replacement among survivors of critical illness in the UK. 3. Improved understanding of physiological consequences of critical illness including development of Type 2 diabetes and acute kidney injury, and risk models to predict these risks Data linkage with HES will enable ICNARC to estimate the cost of subsequent hospitalisations and its association with severity and/or duration of critical illness and other risk factors. Better understanding of the consequences of critical illness may enable clinicians in critical care to adjust their treatments to reduce the likelihood of these consequences. It may also improve post-critical care follow-up pathways by identifying patients at greater risk for targeted follow-up. Adult cardiothoracic critical care 4. Improved understanding of healthcare costs associated with subsequent rehospitalisation among critical care survivors Linkage to death registrations from Civil Registration Mortality Data will enable ICNARC to extend risk models for cardiothoracic critical care to predict longer term mortality. Better understanding of healthcare costs following critical illness hopes to inform future health economic evaluations of critical care. Data linkage with HES will enable ICNARC to estimate the cost of subsequent hospitalisations and its association with severity and/or duration of critical illness and other risk factors. 5. Improved understanding of longer-term outcomes following cardiothoracic critical care and associated risk models In-hospital cardiac arrest Risk models for longer-term outcomes following cardiothoracic critical care hope to be incorporated into the reports for ARCtIC (Assessment of Risk in Cardiothoracic Intensive Care), which is a sub-audit of the Case Mix Programme operating in cardiothoracic critical care units. This aims to impact around 30,000 patients admitted to NHS cardiothoracic critical care units each year. The impact may be measured by the successful delivery of reports to critical care units incorporating longer-term outcomes. This is dependent on establishing the routine data linkage for the Case Mix Programme which has a target date of late 2023/2024. Data linkage between National Cardiac Arrest Audit and the Case Mix Programme will allow ICNARC to better understand patterns of critical care, resource use and organ support following successful resuscitation and develop prediction models for likely resource use. 6. Improved understanding of risk factors for patient outcomes following in-hospital cardiac arrest Data linkage to Civil Registration Mortality Data will enable ICNARC to extend risk models to predict longer term mortality. The improved knowledge of risk factors hopes to inform changes to the dataset for the National Cardiac Arrest Audit (NCAA) to ensure that important risk factors are incorporated. This aims to impact around 12,000 patients experiencing in-hospital cardiac arrests every year. The impact aims to be measured by the successful roll-out of a dataset including the new fields to participating hospitals. This work is dependent on an upgrade to the NCAA data entry system, which is expected to be completed during 2023. Finally, data linkage with HES will enable ICNARC to estimate the cost of subsequent hospitalisations and its association with the measured risk factors. 7. Risk models which can be used to predict longer-term outcomes following in-hospital cardiac arrest If regular routine data linkage is established, this would permit the risk models and outcome measures developed in this project to be adopted into the national clinical audits to improve the benchmarking of adult critical care and in-hospital cardiac arrest in the UK. Following the establishment of regular, routine data linkage, the risk models aim to be introduced into benchmarking of the performance of hospitals for longer-term patient outcomes alongside current, shorter-term outcomes, giving a more comprehensive picture of performance. This aims to impact around 12,000 patients experiencing in-hospital cardiac arrests every year. The impact aims to be measured by the successful delivery of reports to hospitals, and subsequently public reports, incorporating longer-term outcomes. The application for routine data linkage will be undertaken following completion of this project (target 2023). These expected benefits align to ICNARC's Legitimate Interests as they show evidence of the benefits of linking data from multiple sources having the potential to substantially improve risk prediction and therefore make fairer comparisons among providers and to increase understanding of longer-term outcomes in ways that would not be possible using the directly collected data alone. iii. Yielded Benefits : Information from the models evaluating longer term outcomes for critically ill patients has been fed into the development of a new dataset for the Case Mix Programme, informing the expansion of data collected around conditions in the past medical history. This dataset was released to the first critical care units in April 2021 and is now being rolled out across the audit. A similar process is currently underway for the National Cardiac Arrest Audit. A business case is being prepared for regular routine linkage of the Case Mix Programme and National Cardiac Arrest Audit with death registrations to allow regular reporting of risk-adjusted longer-term outcomes alongside the current reports to participating hospitals and to the public. These yielded benefits align to ICNARC's Legitimate Interests as they show evidence of the benefits of linking data from multiple sources having the potential to substantially improve risk prediction and therefore make fairer comparisons among providers and to increase understanding of longer-term outcomes in ways that would not be possible using the directly collected data alone.

Benefits reported

In any future application, the applicant will be required to provide details of the actual benefits achieved as a result of the study. Information from the models evaluating longer term outcomes for critically ill patients has been fed into the development of a new dataset for the Case Mix Programme, informing the expansion of data collected around conditions in the past medical history. This dataset was released to the first critical care units in April 2021 and is now being rolled out across the audit. A similar process is currently underway for the National Cardiac Arrest Audit. A business case is being prepared for regular routine linkage of the Case Mix Programme and National Cardiac Arrest Audit with death registrations to allow regular reporting of risk-adjusted longer-term outcomes alongside the current reports to participating hospitals and to the public. Models have been developed for longer term mortality following critical care, use of critical care following an in-hospital cardiac arrest, requirement of renal support for end-stage renal disease following critical care and development of type 2 diabetes following critical care. These yielded benefits align to ICNARC's Legitimate Interests as they show evidence of the benefits of linking data from multiple sources having the potential to substantially improve risk prediction and therefore make fairer comparisons among providers and to increase understanding of longer-term outcomes in ways that would not be possible using the directly collected data alone. Modelling work is ongoing related to the cardiothoracic critical care workstreams.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

HES Admitted Patient Care and Civil Registration Mortality Data was supplied to Intensive Care National Audit & Research Centre (ICNARC) by the Health and Social Care Information Centre (which has since become NHS Digital) for the purpose of a research study referred to as "Risk modelling in the critically ill". This Data Sharing Agreement permits the retention of the data provided under previous iterations of this Agreement for an interim period. This is a pragmatic approach to provide an active Agreement whilst enabling the Intensive Care National Audit and Research Centre (ICNARC) to complete the necessary actions to enable a subsequent application to extend the Agreement meeting all applicable data sharing standards as published in NHS Digital’s website This Data Sharing Agreement permits the retention of the data for an interim period but no other processing of the data is permitted. (see: https://digital.nhs.uk/services/data-access-request-service-dars/dars-guidance). Permission to retain the data for the interim period is a practical step to enable the study to comply with the necessary legal and ethical requirements. If, for any reason, it is not possible for the study to meet the necessary requirements, this Agreement will be terminated, and destruction of the data will be required. [2 paragraphs unchanged] HES Admitted Patient Care and Civil Registration Mortality Data was supplied to Intensive Care National Audit & Research Centre (ICNARC) by the Health and Social Care Information Centre (which has since become NHS Digital) for the purpose of a research study referred to as "Risk modelling in the critically ill". [17 paragraphs unchanged]

Processing activities

Under this Agreement, the data may be securely stored but not otherwise processed. No new data will be provided by NHS Digital under this Agreement. The study data, including data provided by NHS Digital under previous agreements, are currently held by the Intensive Care National Audit and Research Centre (ICNARC). [1 paragraph unchanged] No new or further data will be provided under this version of the agreement. A short term extension is in place as a pragmatic approach to enable legal retention of already disseminated data. This agreement allows retention of data, but not permission to otherwise process it. [17 paragraphs unchanged]

Expected output

This Data Sharing Agreement permits the secure retention of the data for an interim period but only and no other processing of the data is permitted. processing. No further outputs of the data are permitted to be created under this version of the agreement. No new outputs will be produced under this Data Sharing Agreement. The below provides background on to what has already been produced, and what will be produced once data flow and permission to process resumes. The following information provides background information on the proposed outputs of the original study. 1. A final report on the entire project to be published as a monograph in the NIHR journal, Health Services and Delivery Research. Target date for submission: 15/01/2019. 31/05/2020. The report will include only aggregate level data on subgroups comprising thousands [6 words unchanged] any small numbers; therefore small sample suppression will therefore not be required. 2. Journal articles for peer-reviewed scientific journals. A minimum of three journal [8 words unchanged] of the project (adult critical care, cardiothoracic critical care and in-hospital cardiac arrest. arrest). However, given the large amount of work planned within each of these [9 words unchanged] more of these into more than one article. Target dates for submission: January May to March September 2020. Journal articles will include only aggregate level data on subgroups comprising [7 words unchanged] any small numbers; therefore small sample suppression will therefore not be required. 3. Presentations at professional and scientific conferences, to include conferences. To date, these have included the ICNARC Case Mix Programme Annual Conference Meeting (April 2018 and April 2019), the Annual Meeting of the National Cardiac Arrest Audit (November 2020) 2019) and the Annual Congress Intensive Care Society State of the European Society of Intensive Care Medicine (October 2020). Art Meeting (December 2019). Further presentations are planned. Presentations will include only aggregate level data on subgroups comprising thousands of [5 words unchanged] any small numbers; therefore small sample suppression will therefore not be required. [4 paragraphs unchanged]

Expected measurable benefits

HES Admitted Patient Care and Civil Registration Mortality Data was supplied to Intensive Care National Audit & Research Centre (ICNARC)by the Health and Social Care Information Centre (which has since become NHS Digital) for the purpose of a research study referred to as "Risk modelling in the critically ill". This Agreement permits the secure retention of the data only and no other processing. This Data Sharing Agreement permits the retention of the data for an interim period but no other processing of the data is permitted. Permission to retain the data for the interim period is a practical step to enable the study to comply with the necessary legal and ethical requirements. If, for any reason, it is not possible for the study to meet the necessary requirements, this Agreement will be terminated, and destruction of the data will be required. The following information provides background information on the benefits of the original dissemination. No new data will be released under this version of the agreement, and this agreement allows the applicant to hold and not otherwise process any data that has already been disseminated. [6 paragraphs unchanged] Linkage to death registrations from Civil Registration Mortality Data will enable ICNARC to extend risk models for cardiothoracic critical care to predict longer term mortality. cardiothoracic critical care to predict longer term mortality. [2 paragraphs unchanged] Data linkage between National Cardiac Arrest Audit and the Case Mix Programme [10 words unchanged] resource use and organ support following successful resuscitation and develop prediction models for likely resource use. for likely resource use. [3 paragraphs unchanged]

Benefits reported

[1 paragraph unchanged] Models have been developed for longer term mortality following critical care, use of critical care following an in-hospital cardiac arrest and arrest, requirement of renal support for end-stage renal disease following critical care and development of type 2 diabetes following critical care. Modelling work is ongoing for development of type 2 diabetes following related to the cardiothoracic critical care. care workstreams.