COVID-19 – NHS England Application

NHS England, also known as the ‘National Commissioning Board’ leads the National Health Service (NHS) in England. NHS England are responsible for the budget, planning, delivery and day-to-day operation of the commissioning side of the NHS in England as set out in the Health and Social Care Act 2012.

NHS England has responsibility for a wide range of purposes and hold Statutory Duties, including commissioning specialised services, paying for primary care, public health services, offender healthcare and specific services for the armed forces. NHS England is also legally required to undertake a range of non-commissioning functions, including oversight of Clinical Commissioning Group (CCG) and new care models assurance, reviewing major service changes, development of policy and financial allocations.

NHS England’s statutory duties are set out in the NHS Act 2006 and by the Health and Social Care Act 2012 amendments. To enable NHS England to assess the value, quality and effectiveness of the services it commissions, the Health and Social Care Act 2012 (Section 254) empowers NHS England to direct NHS Digital to collect the data it requires. NHS Digital are required to process confidential patient-level data, transform it into an agreed anonymised format which NHS England can legally receive and safely use without impacting the privacy of service users.

The legal bases underpinning some of NHS England’s statutory commissioning and population health management duties are set out below:

Legal Basis

Ref Statute

A1 DUTY: Eliminate discrimination, harassment and victimisation and advance equality of opportunity

A2 DUTY: Have regard to impact on services in certain areas

A3 DUTY: Payment of sums

A4 DUTY: Performance of functions outside England

A5 DUTY: Prevent people from being drawn into terrorism

A6 DUTY: Process data for the prevention or detection of crime

A7 DUTY: Provide integrated services to improve outcomes and reduce inequalities

A8 DUTY: Safeguard and promote the welfare of children

A9 DUTY: Securing continuous improvement in quality of services provided to individuals

A10 DUTY: To arrange the provision of health services in England

A11 DUTY: To collect and analyse information relating to safety of services

A12 DUTY: To commission secondary dental, armed forces and health and justice health services

A13 DUTY: To consider the economic, social and environmental benefits to be achieved through commissioning

A14 DUTY: To ensure health services are provided in an integrated way

A15 DUTY: To exercise functions relating to primary dental services

A16 DUTY: To exercise relevant public health functions

A17 DUTY: To improve quality of services

A18 DUTY: To monitor and improve the quality of care

A19 DUTY: To pay CCGs to meet their expenditure

A20 DUTY: To promote a comprehensive health service

A21 DUTY: To provide certain specified services

A22 DUTY: To provide high secure psychiatric services

A23 DUTY: To provide pharmaceutical services

A24 DUTY: To provide primary medical services

A25 DUTY: To provide primary ophthalmic services

A26 DUTY: To provide secondary community ambulance mental health services or facilities

A27 DUTY: To put and keep in place arrangements to monitor and improve the quality of health care

A28 DUTY: To secure continuous improvement in the quality of services

A29 DUTY: Understand impact of commissioning decisions on provision of services to Welsh and Scottish residents

A30 POWER: Produce documents to support counter fraud and security management functions

A31 POWER: Reimbursement for pharmaceutical remuneration

A32 POWER: To assist SoS in providing health services and exercising public health functions

A33 POWER: To commission certain health services as requested by SoS

A34 POWER: To conduct research

A35 POWER: To make payments to CCGs in respect of quality of services

A36 POWER: To pay for community services

A37 POWER: To scrutinise or review areas of the health service with local authorities

A38 REGULATION: To ensure buying decisions are fair and improve quality and efficiency of healthcare services

A39 REGULATION: To enter into prescribed arrangements between NHSE, CCGs, providers and local authorities

A40 SECONDARY LEGISLATION: Carry out financial duties

A41 SECONDARY LEGISLATION: To provide community dental, health and justice, armed forces and specialised services

In order for NHS England to discharge its statutory duties, all elements of the contracting cycle, from assessing population health needs, through service planning and contract management, to service evaluation and redesign, requires access to high quality data within the appropriate legal framework. As part of its duties, NHS England also has responsibilities to respond to major incidents.

In general data access is required for the purposes of commissioning and underpinning system activities within the NHS England demographic area, including reducing health inequalities, identifying and managing preventable and existing conditions, managing demand, monitoring pathway compliance, comparison to peers, monitoring outcomes, understanding how services impact across the health economy and designing the future healthcare system.

With the pandemic of COVID-19, which began in the United Kingdom back in January 2020, NHSX (an organisation which operates as part of the legal entity of NHS England), NHS England and NHS Improvement (NHS E/I) have been tasked with leading the national data response to COVID-19. This required a Data Store (specific for COVID-19 data) to be created that ensures data can be used effectively to support the national response to protecting citizens against the COVID-19 virus. This response also includes the recovery and restoration of health services as the need for COVID-19 specific services reduce.

The NHS COVID-19 Data Store has been established under the provisions of the Control of patient information (COPI) notices issued by the Secretary of State for Health and Social Care using powers available to him under regulation 3 of the Health Service (Control of Patient Information) Regulations 2002, and is designed to support a range of activities, including:

● Understanding COVID-19 and impact to provision of NHS services and patient outcomes;

● Identifying and understanding information about patients or potential patients with or at risk of COVID-19;

● Delivering services to patients, clinicians, the health services;

● Planning in relation to COVID-19.

These powers give NHS England, an organisation which falls under regulation 3(3) of the COPI regulations, powers delegated by the Secretary of State to require the disclosure of confidential patient information.

The COVID-19 Data Store is a strictly controlled central point that brings together all data necessary to provide NHS England and NHS improvement analysts only, with the most comprehensive datasets related to COVID-19. There is however a requirement to ensure that all necessary data sets, required to support the national response are acquired, as this will provide a full picture of how the pandemic is impacting all areas of the National Health Service.

The Data Protection Impact Assessment (DPIA) and Privacy Notice for the use of NHS COVID-19 data can be found at https://www.england.nhs.uk/ourwork/tsd/data-info/

NHS England requires pseudonymised The General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (GDPPR) data under Regulation 3 the Control of Patient Information Regulations 2002 (COPI) Notice which was issued by the Secretary of State for Health in March 2020. The GDPPR data will be used to provide intelligence to support NHS England in their response to the COVID-19 pandemic as set out in the COPI notice and shown below:

NHS England and NHS Improvement is required to process confidential patient information in the manner set out below for purposes set out in Regulation 3(1) of COPI (insofar as those purposes relate to the current outbreak of COVID-19).

NHS England and NHS Improvement (under the legal entities of Monitor and NHS Trust Development Authority (TRA)) are joint data controllers in this agreement.

The data will be analysed so that health care provision can be planned to support the needs of the population for the COVID-19 purposes and to better understand and plan the impacts on NHS Services and patient outcomes.

Such uses cases of the data include but are not limited to:

• To help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives.

• NHS England will be monitoring and managing jointly with Public Health England (PHE);

(i) outbreaks of communicable disease to anticipate downstream impacts to NHS services and patient outcomes;

(ii) incidents of exposure to communicable disease;

(iii) the delivery, efficacy and safety of immunisation programmes;

(iv) adverse reactions to vaccines and medicines;

(v) risks of infection acquired from food or the environment (including water supplies);

(vi) the giving of information to persons about the diagnosis of communicable disease and risks of acquiring such disease.

• Provide comprehensive national pictures of COVID-19 care and outcomes in England (at National, Regional and Sub regional levels) which included understanding COVID-19 and risks to public health, trends in COVID-19 and risks, and controlling and preventing the spread of COVID-19 and its impact on NHS Services and patient outcomes.

• Understand the scope and scale of variation of COVID-19 identification, diagnoses, hospitalisation, treatments, deaths across the national, regional and sub-regional areas.

• Identifying and understanding information about patients or potential patients with or at risk of COVID-19 (for example Obese or Diabetic patients).

• Delivering through NHS services including primary care to patients, the provision of information, fit notes, immunisations, and vaccinations (including school vaccinations).

• Understand both the effectiveness of the NHS 111 First Programme in reducing the risk of nosocomial transmission of COVID-19 in Emergency Departments (EDs) and the potential impact the programme may have on the wider (Urgent and Emergency Care) system and primary care.

• Understanding impacts of patient access to health services for example reviewing the referrals rates to Cancer services a direct or indirect result of COVID-19 and the availability and capacity of those services or that care.

• Review and plan restoration of Health care services and providing funding where necessary to bring services back online, where COVID-19 has had an impact.

Research Ethics Committee (REC) approval is not appropriate under these conditions, as the data will be used to support analysis for policy, guidance and operational management of the NHS.

Poor management and control of COVID-19 will be associated with higher risk of hospitalisations (therefore increased demand and reduced capacity within hospitals) as well as death and long-term health complications of patients. Those who are from a minority ethnic background as well as those patients that have underlying health conditions are more vulnerable to adverse health outcomes from COVID-19.

To support these patients, NHS England will be looking to perform a system level risk stratification. This means NHS England will need to know the overall population and be able to understand the cohorts of patients that are more susceptible to COVID-19. This will be done nationally using Population Segmentation – identifying groups of patients based on diagnoses, ethnicity etc, where there is no requirement to re-identify patients. It is therefore not the same as ‘patient level risk stratification’ as known to be done within General Practitioner (GP) Practices, where re-identification of patients is needed for the provision of direct care.

Looking at the Primary care system as a whole, the 111 First programme is anticipating an increase in the use of NHS 111 so it is important to understand how any increase in 111 demand impacts on demand for primary care services and the wider urgent and emergency care (UEC) system.

Below are specific examples of how the data will be used and linked:

• Use Case 01 – 111 First Programme Evaluation

• Use Case 02 – Public health screening

• Use Case 03 – Flu Vaccination Programme

• Use Case 04 – Mortality increased risk in patients that are overweight

• Use Case 05 – Vaccinations & Immunisations

• Use Case 06 – Restoration of Health Care Services

Access to both GPES and 111 Pathways data, will allow robust analysis to be conducted to inform decision making and development of improved models of care in the UEC system and mitigate the risk of other parts of the health services becoming overburdened with additional demand. It would not be statistically valid to undertake the analysis only using an extract of the GPES data for the cohort who presented at 111, as this would not provide a robust comparison with baseline activities.

GDPPR data will be used for specific bespoke use cases such as the one illustrated above, it would not be feasible to utilise the Trusted Research Environment (TRE), and therefore a direct feed from NHS Digital to NHS England is required, in order for the Organisation to perform the additional duties in supporting with the COVID-19 efforts.

Under General Data Protection Regulation (GDPR), NHS England can rely on Article 6(1)(c) – Legal Obligation to receive and process the Disseminated data from NHS Digital for the Agreed Purposes under the Recipient COPI Notice. As this is health information and therefore special category personal data the Recipients can also rely on Article 9(2)(h) – processing is necessary for the purposes of preventative or occupational medicine and 9(2)(i) – processing is necessary for reasons of public interest in the area of public health.

With regard to the application of the Type 1 and national data opt outs to data processed under the COPI notice, our view is that as the COPI notice places a legal requirement on organisations to process Confidential Patient Information (CPI), opt outs will not apply to any data accessed by virtue of the notice. In any case, as set out in NHS Digital’s National Data Opt-Out operational policy guidance CPI processed under regulation 3 of the COPI regulations is not subject to the national data opt- out.

Data processor 2 - Palantir Technologies UK Limited

Palantir Technologies UK Limited is providing the software, Foundry platform, that powers the front-end data platform. Foundry platform, which has been primarily developed in the UK, enables disparate data to be integrated, cleaned, and harmonised in order to develop a more comprehensive view for NHSE/I staff that will support decision-making better. Foundry platform is built to protect data by design. Palantir is a data processor, not a data controller and will only process data as and when instructed by the joint data controllers in this DSA.

Palantir will have access to fully pseudonymised record level data held in the COVID-19 data store, and are operating under strict controls as set out by NHS England, NHSX and NHS Improvement. This also means that Palantir cannot have access to all the data held in the data store. There is no requirement for Palantir to access or process the GDPPR data, which NHS England and Improvement are in receipt of from NHS Digital.

Palantir, have built analytical dashboards for access by NHS England and Improvement staff, together with staff in the following organisations working under contract: Faculty AI, McKinsey and Deloittes. Faculty AI, McKinsey and Deloittes will not have access to data which is pseudonymised, they will only be able to see dashboards with aggregated data with small number suppression. Data from these dashboards is only available to staff working under contract with the organisations operating jointly under the NHSX banner.

Medicines dispensed in primary care

NHS England and NHS Improvement requires routine access to the Primary Care Medicines Data, which is collected from NHS Business Services Authority (NHSBSA) by NHS Digital. The request is to have access to this data set from April 2015 onwards.

NHS England and NHS Improvement have a large range of statutory duties, functions, powers and secondary legislation to support, monitor and make provision of health care services within the National Health Service.

As part of this role, NHS England and Improvement requires access to all patient level prescriptions issued by prescribers and dispensed or supplied in the community for England. There are many purposes this pseudonymised patient level data is required, and below are the main of examples of how the data will be used;

NHS 111 Pathway

- Use for COVID-19 purposes, in response to the significant demand for medicines data to support pandemic research and planning, which NHS England and NHS Improvement have been tasked with co-ordinating the national response. This includes reviewing the dispensation of medicines during the pandemic, for both COVID and Non COVID patients. Access to the data would inform whether there are shortages of medicines that patients are unable to access, and may have inadvertently suffered as a result. Does this have a further impact on support services i.e increase in 111 calls, emergency admissions to hospitals etc. This would allow NHS England and NHS Improvement to follow up outcomes, review current policies and put necessary interventions in place.

Shielded Patient list

Access to the shielded patient list will provide robust analysis to inform decision making based on those at most risk of severe illness from COVID-19. As such the use of the shielded patient list is integral to understand how the pandemic will effect those most vulnerable to COVID-19. This data set will inform a variety of analyses supporting the work in response to COVID-19 providing insight into shielding patients' healthcare usage and pathways.

The addition of this dataset will let the analytical teams take into account shielding patients when commissioning, analysing and reviewing services for patients. This dataset will add detail specifically regarding those most vulnerable to COVID-19.

NHSE will also review vaccination programme delivery methods to improve uptake of the most vulnerable in society, therefore ensuring that survival rates of this cohort can be higher with proper targeting and campaigns to increase uptake.

NHS 111 Dataset

As part of an evaluation of the NHS 111 First programme, which is being rolled out across England, NHSE/I want to understand both the effectiveness of the programme in reducing the risk of nosocomial transmission of Covid-19 in emergency departments (EDs) and the potential impact the programme may have on the wider UEC system and primary care.

Access to these data will allow robust analysis to be conducted to inform decision making and development of improved models of care in the UEC system and mitigate the risk of other parts of the health services becoming overburdened with additional demand.

Civil Registrations Data

Obesity is poorly recorded in secondary care data sources. There is emerging evidence that obesity increases the risk of mortality from COVID-19 however it is not possible to understand the magnitude of risk or adjust for obesity in addition to wider risk factors using existing data sources. There is a requirement for population level obesity data to understand the impact of obesity on COVID-19 risk and mortality.

This data will be used to understand the impact of Obesity, overweight patients and other co-morbidities on COVID-19 risk and mortality.

Secondary Uses Service (SUS) Data

Understand the impact of COVID-19 on all areas across the system – at a National, Regional and sub regional level. Identify key areas where demand is high for patients (with underlying Health conditions (ie Diabetics or cardiovascular complications) and getting these services back online. GDDPR is required to investigate certain cohorts of patients, to support the planning and restoration of acute services (Elective and outpatient appointments) where due to COVID-19 these services would have stopped to reduce the risk of infection and transmission. The waiting lists have expanded greatly, as a result.

The SUS data will be used to support strategic interventions to enable the restoration of acute services, as well as provide an evidence base for the transformation of services in the future.

Any outputs to 3rd parties not included as a Data Controller/Processor in this application/agreement must be aggregated

(with small number suppression applied in line with NHS Digital requirements).

Within 1 week of NHS England receiving the data from NHS Digital, it will be able to use the dataset to provide analysis that starts to respond to the following:

• Support the NHS response to COVID-19

• Analyse the spread of COVID-19 diagnoses geographically and demographically, to identify any trends. Appointment activity will also be analysed to better understand use of non-face to face consultation trends and potential differences across geographical areas.

• Operational planning to predict likely demand on primary, community and acute service for vulnerable patients.

• Analysis of resource allocation.

• Diagnosing and monitoring the effects of COVID-19 at a National, Regional and sub regional level.

• Ensuring NHS England has adequate data to inform that interventions and measures put in place to reduce the transmission of COVID-19 are being effective and impactful.

• Analyse factors that result in increased service utilisation for COVID-19 patients.

• Start building modelling and forecasting tools for COVID-19 from Primary care perspective. Learning from and predicting likely patient pathways in order to influence early interventions and other alternatives for patients.

Palantir Technologies UK Limited

• Analytical dashboards that focus on key decision making

Medicines dispensed in primary care

- Patient level prescribing will help inform policy and planning for CCG Prescribing Resource Allocations – 12% of core CCG programmes or circa £8.5 billion, by developing models using patient level data. This will enable deeper understanding of prescribing at a granularity which will ensure that outputs from the models and forward planning are more precise.

- Supporting reimbursement of funds from NHS England and NHS Improvement back to NHSBSA for Specialised medicines.

- Support the successful delivery of commitments laid out in the;

• NHS Long Term Plan

• Next Steps on the Five Year Forward View

• Antimicrobial Resistance (AMR) Strategy

• Life Sciences Industrial Strategy

• World Health Organisation’s 2017 3rd global challenge, ‘Medication without Harm’

- Secondary uses to inform and support prescribing behaviour, decision making and research. The recommendations published in the PHE Review will now be picked up by NHS England and NHS Improvement for implementation.

Shielded Patient List

• Assessing impact and projections for hospital admissions, particularly critical care bed capacity.

• Vaccination programme review.

• Operational planning reports for shielding patients.

• Further service utilisation analysis for COVID-19 patients.

NHS 111 Dataset

A range of analysis and reports to review NHS 111 First Programme focussing on:

• Potentially reducing patient face-to face contact within the UEC system

• The number and characteristics of patients contacting primary care following a 111 call

• The proportion of those directed from 111 to primary care or ED that attend these services

• Rates of compliance to 111 advice, and whether these rates differ between those callers that have an appointment booked via 111 and those that do not

Civil Registrations Data

• A variety of evaluations and risk impact reports looking at the relationship between obesity, overweight patients and other co-morbidities in relation to COVID-19

Secondary Uses Service Data

• Reports that focus on outcomes for strategic planning and organisation of the COVID-19 response

Examined the impact of Covid-19 on spirometry activity in general practice using GDPPR. It demonstrated that spirometry activity had fallen off a cliff due to Covid. This was previously suspected based on anecdote, but without access to GDPPR it could not have been verified it in data. In response to this discovery, a number of initiatives have been undertaken by NHSEI primary care and respiratory policy colleagues to support the safe recommencement of spirometry in general practice.

NHS England, also known as the ‘National Commissioning Board’ leads the National Health Service (NHS) in England. NHS England are responsible for the budget, planning, delivery and day-to-day operation of the commissioning side of the NHS in England as set out in the Health and Social Care Act 2012.

NHS England has responsibility for a wide range of purposes and hold Statutory Duties, including commissioning specialised services, paying for primary care, public health services, offender healthcare and specific services for the armed forces. NHS England is also legally required to undertake a range of non-commissioning functions, including oversight of Clinical Commissioning Group (CCG) and new care models assurance, reviewing major service changes, development of policy and financial allocations.

NHS England’s statutory duties are set out in the NHS Act 2006 and by the Health and Social Care Act 2012 amendments. To enable NHS England to assess the value, quality and effectiveness of the services it commissions, the Health and Social Care Act 2012 (Section 254) empowers NHS England to direct NHS Digital to collect the data it requires. NHS Digital are required to process confidential patient-level data, transform it into an agreed anonymised format which NHS England can legally receive and safely use without impacting the privacy of service users.

The legal bases underpinning some of NHS England’s statutory commissioning and population health management duties are set out below:

Legal Basis

Ref Statute

A1 DUTY: Eliminate discrimination, harassment and victimisation and advance equality of opportunity

A2 DUTY: Have regard to impact on services in certain areas

A3 DUTY: Payment of sums

A4 DUTY: Performance of functions outside England

A5 DUTY: Prevent people from being drawn into terrorism

A6 DUTY: Process data for the prevention or detection of crime

A7 DUTY: Provide integrated services to improve outcomes and reduce inequalities

A8 DUTY: Safeguard and promote the welfare of children

A9 DUTY: Securing continuous improvement in quality of services provided to individuals

A10 DUTY: To arrange the provision of health services in England

A11 DUTY: To collect and analyse information relating to safety of services

A12 DUTY: To commission secondary dental, armed forces and health and justice health services

A13 DUTY: To consider the economic, social and environmental benefits to be achieved through commissioning

A14 DUTY: To ensure health services are provided in an integrated way

A15 DUTY: To exercise functions relating to primary dental services

A16 DUTY: To exercise relevant public health functions

A17 DUTY: To improve quality of services

A18 DUTY: To monitor and improve the quality of care

A19 DUTY: To pay CCGs to meet their expenditure

A20 DUTY: To promote a comprehensive health service

A21 DUTY: To provide certain specified services

A22 DUTY: To provide high secure psychiatric services

A23 DUTY: To provide pharmaceutical services

A24 DUTY: To provide primary medical services

A25 DUTY: To provide primary ophthalmic services

A26 DUTY: To provide secondary community ambulance mental health services or facilities

A27 DUTY: To put and keep in place arrangements to monitor and improve the quality of health care

A28 DUTY: To secure continuous improvement in the quality of services

A29 DUTY: Understand impact of commissioning decisions on provision of services to Welsh and Scottish residents

A30 POWER: Produce documents to support counter fraud and security management functions

A31 POWER: Reimbursement for pharmaceutical remuneration

A32 POWER: To assist SoS in providing health services and exercising public health functions

A33 POWER: To commission certain health services as requested by SoS

A34 POWER: To conduct research

A35 POWER: To make payments to CCGs in respect of quality of services

A36 POWER: To pay for community services

A37 POWER: To scrutinise or review areas of the health service with local authorities

A38 REGULATION: To ensure buying decisions are fair and improve quality and efficiency of healthcare services

A39 REGULATION: To enter into prescribed arrangements between NHSE, CCGs, providers and local authorities

A40 SECONDARY LEGISLATION: Carry out financial duties

A41 SECONDARY LEGISLATION: To provide community dental, health and justice, armed forces and specialised services

In order for NHS England to discharge its statutory duties, all elements of the contracting cycle, from assessing population health needs, through service planning and contract management, to service evaluation and redesign, requires access to high quality data within the appropriate legal framework. As part of its duties, NHS England also has responsibilities to respond to major incidents.

In general data access is required for the purposes of commissioning and underpinning system activities within the NHS England demographic area, including reducing health inequalities, identifying and managing preventable and existing conditions, managing demand, monitoring pathway compliance, comparison to peers, monitoring outcomes, understanding how services impact across the health economy and designing the future healthcare system.

With the pandemic of COVID-19, which began in the United Kingdom back in January 2020, NHSX (an organisation which operates as part of the legal entity of NHS England), NHS England and NHS Improvement (NHS E/I) have been tasked with leading the national data response to COVID-19. This required a Data Store (specific for COVID-19 data) to be created that ensures data can be used effectively to support the national response to protecting citizens against the COVID-19 virus. This response also includes the recovery and restoration of health services as the need for COVID-19 specific services reduce.

The NHS COVID-19 Data Store has been established under the provisions of the Control of patient information (COPI) notices issued by the Secretary of State for Health and Social Care using powers available to him under regulation 3 of the Health Service (Control of Patient Information) Regulations 2002, and is designed to support a range of activities, including:

● Understanding COVID-19 and impact to provision of NHS services and patient outcomes;

● Identifying and understanding information about patients or potential patients with or at risk of COVID-19;

● Delivering services to patients, clinicians, the health services;

● Planning in relation to COVID-19.

These powers give NHS England, an organisation which falls under regulation 3(3) of the COPI regulations, powers delegated by the Secretary of State to require the disclosure of confidential patient information.

The COVID-19 Data Store is a strictly controlled central point that brings together all data necessary to provide NHS England and NHS improvement analysts only, with the most comprehensive datasets related to COVID-19. There is however a requirement to ensure that all necessary data sets, required to support the national response are acquired, as this will provide a full picture of how the pandemic is impacting all areas of the National Health Service.

The Data Protection Impact Assessment (DPIA) and Privacy Notice for the use of NHS COVID-19 data can be found at https://www.england.nhs.uk/ourwork/tsd/data-info/

NHS England requires pseudonymised The General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (GDPPR) data under Regulation 3 the Control of Patient Information Regulations 2002 (COPI) Notice which was issued by the Secretary of State for Health in March 2020. The GDPPR data will be used to provide intelligence to support NHS England in their response to the COVID-19 pandemic as set out in the COPI notice and shown below:

NHS England and NHS Improvement is required to process confidential patient information in the manner set out below for purposes set out in Regulation 3(1) of COPI (insofar as those purposes relate to the current outbreak of COVID-19).

NHS England and NHS Improvement (under the legal entities of Monitor and NHS Trust Development Authority (TRA)) are joint data controllers in this agreement.

The data will be analysed so that health care provision can be planned to support the needs of the population for the COVID-19 purposes and to better understand and plan the impacts on NHS Services and patient outcomes.

Such uses cases of the data include but are not limited to:

• To help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives.

• NHS England will be monitoring and managing jointly with Public Health England (PHE);

(i) outbreaks of communicable disease to anticipate downstream impacts to NHS services and patient outcomes;

(ii) incidents of exposure to communicable disease;

(iii) the delivery, efficacy and safety of immunisation programmes;

(iv) adverse reactions to vaccines and medicines;

(v) risks of infection acquired from food or the environment (including water supplies);

(vi) the giving of information to persons about the diagnosis of communicable disease and risks of acquiring such disease.

• Provide comprehensive national pictures of COVID-19 care and outcomes in England (at National, Regional and Sub regional levels) which included understanding COVID-19 and risks to public health, trends in COVID-19 and risks, and controlling and preventing the spread of COVID-19 and its impact on NHS Services and patient outcomes.

• Understand the scope and scale of variation of COVID-19 identification, diagnoses, hospitalisation, treatments, deaths across the national, regional and sub-regional areas.

• Identifying and understanding information about patients or potential patients with or at risk of COVID-19 (for example Obese or Diabetic patients).

• Delivering through NHS services including primary care to patients, the provision of information, fit notes, immunisations, and vaccinations (including school vaccinations).

• Understand both the effectiveness of the NHS 111 First Programme in reducing the risk of nosocomial transmission of COVID-19 in Emergency Departments (EDs) and the potential impact the programme may have on the wider (Urgent and Emergency Care) system and primary care.

• Understanding impacts of patient access to health services for example reviewing the referrals rates to Cancer services a direct or indirect result of COVID-19 and the availability and capacity of those services or that care.

• Review and plan restoration of Health care services and providing funding where necessary to bring services back online, where COVID-19 has had an impact.

Research Ethics Committee (REC) approval is not appropriate under these conditions, as the data will be used to support analysis for policy, guidance and operational management of the NHS.

Poor management and control of COVID-19 will be associated with higher risk of hospitalisations (therefore increased demand and reduced capacity within hospitals) as well as death and long-term health complications of patients. Those who are from a minority ethnic background as well as those patients that have underlying health conditions are more vulnerable to adverse health outcomes from COVID-19.

To support these patients, NHS England will be looking to perform a system level risk stratification. This means NHS England will need to know the overall population and be able to understand the cohorts of patients that are more susceptible to COVID-19. This will be done nationally using Population Segmentation – identifying groups of patients based on diagnoses, ethnicity etc, where there is no requirement to re-identify patients. It is therefore not the same as ‘patient level risk stratification’ as known to be done within General Practitioner (GP) Practices, where re-identification of patients is needed for the provision of direct care.

Looking at the Primary care system as a whole, the 111 First programme is anticipating an increase in the use of NHS 111 so it is important to understand how any increase in 111 demand impacts on demand for primary care services and the wider urgent and emergency care (UEC) system.

Below are specific examples of how the data will be used and linked:

• Use Case 01 – 111 First Programme Evaluation

• Use Case 02 – Public health screening

• Use Case 03 – Flu Vaccination Programme

• Use Case 04 – Mortality increased risk in patients that are overweight

• Use Case 05 – Vaccinations & Immunisations

• Use Case 06 – Restoration of Health Care Services

Access to both GPES and 111 Pathways data, will allow robust analysis to be conducted to inform decision making and development of improved models of care in the UEC system and mitigate the risk of other parts of the health services becoming overburdened with additional demand. It would not be statistically valid to undertake the analysis only using an extract of the GPES data for the cohort who presented at 111, as this would not provide a robust comparison with baseline activities.

GDPPR data will be used for specific bespoke use cases such as the one illustrated above, it would not be feasible to utilise the Trusted Research Environment (TRE), and therefore a direct feed from NHS Digital to NHS England is required, in order for the Organisation to perform the additional duties in supporting with the COVID-19 efforts.

Under General Data Protection Regulation (GDPR), NHS England can rely on Article 6(1)(c) – Legal Obligation to receive and process the Disseminated data from NHS Digital for the Agreed Purposes under the Recipient COPI Notice. As this is health information and therefore special category personal data the Recipients can also rely on Article 9(2)(h) – processing is necessary for the purposes of preventative or occupational medicine and 9(2)(i) – processing is necessary for reasons of public interest in the area of public health.

With regard to the application of the Type 1 and national data opt outs to data processed under the COPI notice, our view is that as the COPI notice places a legal requirement on organisations to process Confidential Patient Information (CPI), opt outs will not apply to any data accessed by virtue of the notice. In any case, as set out in NHS Digital’s National Data Opt-Out operational policy guidance CPI processed under regulation 3 of the COPI regulations is not subject to the national data opt- out.

Data processor 2 - Palantir Technologies UK Limited

Palantir Technologies UK Limited is providing the software, Foundry platform, that powers the front-end data platform. Foundry platform, which has been primarily developed in the UK, enables disparate data to be integrated, cleaned, and harmonised in order to develop a more comprehensive view for NHSE/I staff that will support decision-making better. Foundry platform is built to protect data by design. Palantir is a data processor, not a data controller and will only process data as and when instructed by the joint data controllers in this DSA.

Palantir will have access to fully pseudonymised record level data held in the COVID-19 data store, and are operating under strict controls as set out by NHS England, NHSX and NHS Improvement. This also means that Palantir cannot have access to all the data held in the data store. There is no requirement for Palantir to access or process the GDPPR data, which NHS England and Improvement are in receipt of from NHS Digital.

Palantir, have built analytical dashboards for access by NHS England and Improvement staff, together with staff in the following organisations working under contract: Faculty AI, McKinsey and Deloittes. Faculty AI, McKinsey and Deloittes will not have access to data which is pseudonymised, they will only be able to see dashboards with aggregated data with small number suppression. Data from these dashboards is only available to staff working under contract with the organisations operating jointly under the NHSX banner.

Medicines dispensed in primary care

NHS England and NHS Improvement requires routine access to the Primary Care Medicines Data, which is collected from NHS Business Services Authority (NHSBSA) by NHS Digital. The request is to have access to this data set from April 2015 onwards.

NHS England and NHS Improvement have a large range of statutory duties, functions, powers and secondary legislation to support, monitor and make provision of health care services within the National Health Service.

As part of this role, NHS England and Improvement requires access to all patient level prescriptions issued by prescribers and dispensed or supplied in the community for England. There are many purposes this pseudonymised patient level data is required, and below are the main of examples of how the data will be used;

NHS 111 Pathway

- Use for COVID-19 purposes, in response to the significant demand for medicines data to support pandemic research and planning, which NHS England and NHS Improvement have been tasked with co-ordinating the national response. This includes reviewing the dispensation of medicines during the pandemic, for both COVID and Non COVID patients. Access to the data would inform whether there are shortages of medicines that patients are unable to access, and may have inadvertently suffered as a result. Does this have a further impact on support services i.e increase in 111 calls, emergency admissions to hospitals etc. This would allow NHS England and NHS Improvement to follow up outcomes, review current policies and put necessary interventions in place.

Shielded Patient list

Access to the shielded patient list will provide robust analysis to inform decision making based on those at most risk of severe illness from COVID-19. As such the use of the shielded patient list is integral to understand how the pandemic will effect those most vulnerable to COVID-19. This data set will inform a variety of analyses supporting the work in response to COVID-19 providing insight into shielding patients' healthcare usage and pathways.

The addition of this dataset will let the analytical teams take into account shielding patients when commissioning, analysing and reviewing services for patients. This dataset will add detail specifically regarding those most vulnerable to COVID-19.

NHSE will also review vaccination programme delivery methods to improve uptake of the most vulnerable in society, therefore ensuring that survival rates of this cohort can be higher with proper targeting and campaigns to increase uptake.

NHS 111 Dataset

As part of an evaluation of the NHS 111 First programme, which is being rolled out across England, NHSE/I want to understand both the effectiveness of the programme in reducing the risk of nosocomial transmission of Covid-19 in emergency departments (EDs) and the potential impact the programme may have on the wider UEC system and primary care.

Access to these data will allow robust analysis to be conducted to inform decision making and development of improved models of care in the UEC system and mitigate the risk of other parts of the health services becoming overburdened with additional demand.

Civil Registrations Data

Obesity is poorly recorded in secondary care data sources. There is emerging evidence that obesity increases the risk of mortality from COVID-19 however it is not possible to understand the magnitude of risk or adjust for obesity in addition to wider risk factors using existing data sources. There is a requirement for population level obesity data to understand the impact of obesity on COVID-19 risk and mortality.

This data will be used to understand the impact of Obesity, overweight patients and other co-morbidities on COVID-19 risk and mortality.

Secondary Uses Service (SUS) Data

Understand the impact of COVID-19 on all areas across the system – at a National, Regional and sub regional level. Identify key areas where demand is high for patients (with underlying Health conditions (ie Diabetics or cardiovascular complications) and getting these services back online. GDDPR is required to investigate certain cohorts of patients, to support the planning and restoration of acute services (Elective and outpatient appointments) where due to COVID-19 these services would have stopped to reduce the risk of infection and transmission. The waiting lists have expanded greatly, as a result.

The SUS data will be used to support strategic interventions to enable the restoration of acute services, as well as provide an evidence base for the transformation of services in the future.

Any outputs to 3rd parties not included as a Data Controller/Processor in this application/agreement must be aggregated

(with small number suppression applied in line with NHS Digital requirements).

Within 1 week of NHS England receiving the data from NHS Digital, it will be able to use the dataset to provide analysis that starts to respond to the following:

• Support the NHS response to COVID-19

• Analyse the spread of COVID-19 diagnoses geographically and demographically, to identify any trends. Appointment activity will also be analysed to better understand use of non-face to face consultation trends and potential differences across geographical areas.

• Operational planning to predict likely demand on primary, community and acute service for vulnerable patients.

• Analysis of resource allocation.

• Diagnosing and monitoring the effects of COVID-19 at a National, Regional and sub regional level.

• Ensuring NHS England has adequate data to inform that interventions and measures put in place to reduce the transmission of COVID-19 are being effective and impactful.

• Analyse factors that result in increased service utilisation for COVID-19 patients.

• Start building modelling and forecasting tools for COVID-19 from Primary care perspective. Learning from and predicting likely patient pathways in order to influence early interventions and other alternatives for patients.

Palantir Technologies UK Limited

• Analytical dashboards that focus on key decision making

Medicines dispensed in primary care

- Patient level prescribing will help inform policy and planning for CCG Prescribing Resource Allocations – 12% of core CCG programmes or circa £8.5 billion, by developing models using patient level data. This will enable deeper understanding of prescribing at a granularity which will ensure that outputs from the models and forward planning are more precise.

- Supporting reimbursement of funds from NHS England and NHS Improvement back to NHSBSA for Specialised medicines.

- Support the successful delivery of commitments laid out in the;

• NHS Long Term Plan

• Next Steps on the Five Year Forward View

• Antimicrobial Resistance (AMR) Strategy

• Life Sciences Industrial Strategy

• World Health Organisation’s 2017 3rd global challenge, ‘Medication without Harm’

- Secondary uses to inform and support prescribing behaviour, decision making and research. The recommendations published in the PHE Review will now be picked up by NHS England and NHS Improvement for implementation.

Shielded Patient List

• Assessing impact and projections for hospital admissions, particularly critical care bed capacity.

• Vaccination programme review.

• Operational planning reports for shielding patients.

• Further service utilisation analysis for COVID-19 patients.

NHS 111 Dataset

A range of analysis and reports to review NHS 111 First Programme focussing on:

• Potentially reducing patient face-to face contact within the UEC system

• The number and characteristics of patients contacting primary care following a 111 call

• The proportion of those directed from 111 to primary care or ED that attend these services

• Rates of compliance to 111 advice, and whether these rates differ between those callers that have an appointment booked via 111 and those that do not

Civil Registrations Data

• A variety of evaluations and risk impact reports looking at the relationship between obesity, overweight patients and other co-morbidities in relation to COVID-19

Secondary Uses Service Data

• Reports that focus on outcomes for strategic planning and organisation of the COVID-19 response

Examined the impact of Covid-19 on spirometry activity in general practice using GDPPR. It demonstrated that spirometry activity had fallen off a cliff due to Covid. This was previously suspected based on anecdote, but without access to GDPPR it could not have been verified it in data. In response to this discovery, a number of initiatives have been undertaken by NHSEI primary care and respiratory policy colleagues to support the safe recommencement of spirometry in general practice.

NHS England, also known as the ‘National Commissioning Board’ leads the National Health Service (NHS) in England. NHS England are responsible for the budget, planning, delivery and day-to-day operation of the commissioning side of the NHS in England as set out in the Health and Social Care Act 2012.

NHS England has responsibility for a wide range of purposes and hold Statutory Duties, including commissioning specialised services, paying for primary care, public health services, offender healthcare and specific services for the armed forces. NHS England is also legally required to undertake a range of non-commissioning functions, including oversight of Clinical Commissioning Group (CCG) and new care models assurance, reviewing major service changes, development of policy and financial allocations.

NHS England’s statutory duties are set out in the NHS Act 2006 and by the Health and Social Care Act 2012 amendments. To enable NHS England to assess the value, quality and effectiveness of the services it commissions, the Health and Social Care Act 2012 (Section 254) empowers NHS England to direct NHS Digital to collect the data it requires. NHS Digital are required to process confidential patient-level data, transform it into an agreed anonymised format which NHS England can legally receive and safely use without impacting the privacy of service users.

The legal bases underpinning some of NHS England’s statutory commissioning and population health management duties are set out below:

Legal Basis

Ref Statute

A1 DUTY: Eliminate discrimination, harassment and victimisation and advance equality of opportunity

A2 DUTY: Have regard to impact on services in certain areas

A3 DUTY: Payment of sums

A4 DUTY: Performance of functions outside England

A5 DUTY: Prevent people from being drawn into terrorism

A6 DUTY: Process data for the prevention or detection of crime

A7 DUTY: Provide integrated services to improve outcomes and reduce inequalities

A8 DUTY: Safeguard and promote the welfare of children

A9 DUTY: Securing continuous improvement in quality of services provided to individuals

A10 DUTY: To arrange the provision of health services in England

A11 DUTY: To collect and analyse information relating to safety of services

A12 DUTY: To commission secondary dental, armed forces and health and justice health services

A13 DUTY: To consider the economic, social and environmental benefits to be achieved through commissioning

A14 DUTY: To ensure health services are provided in an integrated way

A15 DUTY: To exercise functions relating to primary dental services

A16 DUTY: To exercise relevant public health functions

A17 DUTY: To improve quality of services

A18 DUTY: To monitor and improve the quality of care

A19 DUTY: To pay CCGs to meet their expenditure

A20 DUTY: To promote a comprehensive health service

A21 DUTY: To provide certain specified services

A22 DUTY: To provide high secure psychiatric services

A23 DUTY: To provide pharmaceutical services

A24 DUTY: To provide primary medical services

A25 DUTY: To provide primary ophthalmic services

A26 DUTY: To provide secondary community ambulance mental health services or facilities

A27 DUTY: To put and keep in place arrangements to monitor and improve the quality of health care

A28 DUTY: To secure continuous improvement in the quality of services

A29 DUTY: Understand impact of commissioning decisions on provision of services to Welsh and Scottish residents

A30 POWER: Produce documents to support counter fraud and security management functions

A31 POWER: Reimbursement for pharmaceutical remuneration

A32 POWER: To assist SoS in providing health services and exercising public health functions

A33 POWER: To commission certain health services as requested by SoS

A34 POWER: To conduct research

A35 POWER: To make payments to CCGs in respect of quality of services

A36 POWER: To pay for community services

A37 POWER: To scrutinise or review areas of the health service with local authorities

A38 REGULATION: To ensure buying decisions are fair and improve quality and efficiency of healthcare services

A39 REGULATION: To enter into prescribed arrangements between NHSE, CCGs, providers and local authorities

A40 SECONDARY LEGISLATION: Carry out financial duties

A41 SECONDARY LEGISLATION: To provide community dental, health and justice, armed forces and specialised services

In order for NHS England to discharge its statutory duties, all elements of the contracting cycle, from assessing population health needs, through service planning and contract management, to service evaluation and redesign, requires access to high quality data within the appropriate legal framework. As part of its duties, NHS England also has responsibilities to respond to major incidents.

In general data access is required for the purposes of commissioning and underpinning system activities within the NHS England demographic area, including reducing health inequalities, identifying and managing preventable and existing conditions, managing demand, monitoring pathway compliance, comparison to peers, monitoring outcomes, understanding how services impact across the health economy and designing the future healthcare system.

With the pandemic of COVID-19, which began in the United Kingdom back in January 2020, NHSX (an organisation which operates as part of the legal entity of NHS England), NHS England and NHS Improvement (NHS E/I) have been tasked with leading the national data response to COVID-19. This required a Data Store (specific for COVID-19 data) to be created that ensures data can be used effectively to support the national response to protecting citizens against the COVID-19 virus. This response also includes the recovery and restoration of health services as the need for COVID-19 specific services reduce.

The NHS COVID-19 Data Store has been established under the provisions of the Control of patient information (COPI) notices issued by the Secretary of State for Health and Social Care using powers available to him under regulation 3 of the Health Service (Control of Patient Information) Regulations 2002, and is designed to support a range of activities, including:

● Understanding COVID-19 and impact to provision of NHS services and patient outcomes;

● Identifying and understanding information about patients or potential patients with or at risk of COVID-19;

● Delivering services to patients, clinicians, the health services;

● Planning in relation to COVID-19.

These powers give NHS England, an organisation which falls under regulation 3(3) of the COPI regulations, powers delegated by the Secretary of State to require the disclosure of confidential patient information.

The COVID-19 Data Store is a strictly controlled central point that brings together all data necessary to provide NHS England and NHS improvement analysts only, with the most comprehensive datasets related to COVID-19. There is however a requirement to ensure that all necessary data sets, required to support the national response are acquired, as this will provide a full picture of how the pandemic is impacting all areas of the National Health Service.

The Data Protection Impact Assessment (DPIA) and Privacy Notice for the use of NHS COVID-19 data can be found at https://www.england.nhs.uk/ourwork/tsd/data-info/

NHS England requires pseudonymised The General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (GDPPR) data under Regulation 3 the Control of Patient Information Regulations 2002 (COPI) Notice which was issued by the Secretary of State for Health in March 2020. The GDPPR data will be used to provide intelligence to support NHS England in their response to the COVID-19 pandemic as set out in the COPI notice and shown below:

NHS England and NHS Improvement is required to process confidential patient information in the manner set out below for purposes set out in Regulation 3(1) of COPI (insofar as those purposes relate to the current outbreak of COVID-19).

NHS England and NHS Improvement (under the legal entities of Monitor and NHS Trust Development Authority (TRA)) are joint data controllers in this agreement.

The data will be analysed so that health care provision can be planned to support the needs of the population for the COVID-19 purposes and to better understand and plan the impacts on NHS Services and patient outcomes.

Such uses cases of the data include but are not limited to:

• To help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives.

• NHS England will be monitoring and managing jointly with Public Health England (PHE);

(i) outbreaks of communicable disease to anticipate downstream impacts to NHS services and patient outcomes;

(ii) incidents of exposure to communicable disease;

(iii) the delivery, efficacy and safety of immunisation programmes;

(iv) adverse reactions to vaccines and medicines;

(v) risks of infection acquired from food or the environment (including water supplies);

(vi) the giving of information to persons about the diagnosis of communicable disease and risks of acquiring such disease.

• Provide comprehensive national pictures of COVID-19 care and outcomes in England (at National, Regional and Sub regional levels) which included understanding COVID-19 and risks to public health, trends in COVID-19 and risks, and controlling and preventing the spread of COVID-19 and its impact on NHS Services and patient outcomes.

• Understand the scope and scale of variation of COVID-19 identification, diagnoses, hospitalisation, treatments, deaths across the national, regional and sub-regional areas.

• Identifying and understanding information about patients or potential patients with or at risk of COVID-19 (for example Obese or Diabetic patients).

• Delivering through NHS services including primary care to patients, the provision of information, fit notes, immunisations, and vaccinations (including school vaccinations).

• Understand both the effectiveness of the NHS 111 First Programme in reducing the risk of nosocomial transmission of COVID-19 in Emergency Departments (EDs) and the potential impact the programme may have on the wider (Urgent and Emergency Care) system and primary care.

• Understanding impacts of patient access to health services for example reviewing the referrals rates to Cancer services a direct or indirect result of COVID-19 and the availability and capacity of those services or that care.

• Review and plan restoration of Health care services and providing funding where necessary to bring services back online, where COVID-19 has had an impact.

Research Ethics Committee (REC) approval is not appropriate under these conditions, as the data will be used to support analysis for policy, guidance and operational management of the NHS.

Poor management and control of COVID-19 will be associated with higher risk of hospitalisations (therefore increased demand and reduced capacity within hospitals) as well as death and long-term health complications of patients. Those who are from a minority ethnic background as well as those patients that have underlying health conditions are more vulnerable to adverse health outcomes from COVID-19.

To support these patients, NHS England will be looking to perform a system level risk stratification. This means NHS England will need to know the overall population and be able to understand the cohorts of patients that are more susceptible to COVID-19. This will be done nationally using Population Segmentation – identifying groups of patients based on diagnoses, ethnicity etc, where there is no requirement to re-identify patients. It is therefore not the same as ‘patient level risk stratification’ as known to be done within General Practitioner (GP) Practices, where re-identification of patients is needed for the provision of direct care.

Looking at the Primary care system as a whole, the 111 First programme is anticipating an increase in the use of NHS 111 so it is important to understand how any increase in 111 demand impacts on demand for primary care services and the wider urgent and emergency care (UEC) system.

Below are specific examples of how the data will be used and linked:

• Use Case 01 – 111 First Programme Evaluation

• Use Case 02 – Public health screening

• Use Case 03 – Flu Vaccination Programme

• Use Case 04 – Mortality increased risk in patients that are overweight

• Use Case 05 – Vaccinations & Immunisations

• Use Case 06 – Restoration of Health Care Services

Access to both GPES and 111 Pathways data, will allow robust analysis to be conducted to inform decision making and development of improved models of care in the UEC system and mitigate the risk of other parts of the health services becoming overburdened with additional demand. It would not be statistically valid to undertake the analysis only using an extract of the GPES data for the cohort who presented at 111, as this would not provide a robust comparison with baseline activities.

GDPPR data will be used for specific bespoke use cases such as the one illustrated above, it would not be feasible to utilise the Trusted Research Environment (TRE), and therefore a direct feed from NHS Digital to NHS England is required, in order for the Organisation to perform the additional duties in supporting with the COVID-19 efforts.

Under General Data Protection Regulation (GDPR), NHS England can rely on Article 6(1)(c) – Legal Obligation to receive and process the Disseminated data from NHS Digital for the Agreed Purposes under the Recipient COPI Notice. As this is health information and therefore special category personal data the Recipients can also rely on Article 9(2)(h) – processing is necessary for the purposes of preventative or occupational medicine and 9(2)(i) – processing is necessary for reasons of public interest in the area of public health.

With regard to the application of the Type 1 and national data opt outs to data processed under the COPI notice, our view is that as the COPI notice places a legal requirement on organisations to process Confidential Patient Information (CPI), opt outs will not apply to any data accessed by virtue of the notice. In any case, as set out in NHS Digital’s National Data Opt-Out operational policy guidance CPI processed under regulation 3 of the COPI regulations is not subject to the national data opt- out.

Data processor 2 - Palantir Technologies UK Limited

Palantir Technologies UK Limited is providing the software, Foundry platform, that powers the front-end data platform. Foundry platform, which has been primarily developed in the UK, enables disparate data to be integrated, cleaned, and harmonised in order to develop a more comprehensive view for NHSE/I staff that will support decision-making better. Foundry platform is built to protect data by design. Palantir is a data processor, not a data controller and will only process data as and when instructed by the joint data controllers in this DSA.

Palantir will have access to fully pseudonymised record level data held in the COVID-19 data store, and are operating under strict controls as set out by NHS England, NHSX and NHS Improvement. This also means that Palantir cannot have access to all the data held in the data store. There is no requirement for Palantir to access or process the GDPPR data, which NHS England and Improvement are in receipt of from NHS Digital.

Palantir, have built analytical dashboards for access by NHS England and Improvement staff, together with staff in the following organisations working under contract: Faculty AI, McKinsey and Deloittes. Faculty AI, McKinsey and Deloittes will not have access to data which is pseudonymised, they will only be able to see dashboards with aggregated data with small number suppression. Data from these dashboards is only available to staff working under contract with the organisations operating jointly under the NHSX banner.

Medicines dispensed in primary care

NHS England and NHS Improvement requires routine access to the Primary Care Medicines Data, which is collected from NHS Business Services Authority (NHSBSA) by NHS Digital. The request is to have access to this data set from April 2015 onwards.

NHS England and NHS Improvement have a large range of statutory duties, functions, powers and secondary legislation to support, monitor and make provision of health care services within the National Health Service.

As part of this role, NHS England and Improvement requires access to all patient level prescriptions issued by prescribers and dispensed or supplied in the community for England. There are many purposes this pseudonymised patient level data is required, and below are the main of examples of how the data will be used;

NHS 111 Pathway

- Use for COVID-19 purposes, in response to the significant demand for medicines data to support pandemic research and planning, which NHS England and NHS Improvement have been tasked with co-ordinating the national response. This includes reviewing the dispensation of medicines during the pandemic, for both COVID and Non COVID patients. Access to the data would inform whether there are shortages of medicines that patients are unable to access, and may have inadvertently suffered as a result. Does this have a further impact on support services i.e increase in 111 calls, emergency admissions to hospitals etc. This would allow NHS England and NHS Improvement to follow up outcomes, review current policies and put necessary interventions in place.

Shielded Patient list

Access to the shielded patient list will provide robust analysis to inform decision making based on those at most risk of severe illness from COVID-19. As such the use of the shielded patient list is integral to understand how the pandemic will effect those most vulnerable to COVID-19. This data set will inform a variety of analyses supporting the work in response to COVID-19 providing insight into shielding patients' healthcare usage and pathways.

The addition of this dataset will let the analytical teams take into account shielding patients when commissioning, analysing and reviewing services for patients. This dataset will add detail specifically regarding those most vulnerable to COVID-19.

NHSE will also review vaccination programme delivery methods to improve uptake of the most vulnerable in society, therefore ensuring that survival rates of this cohort can be higher with proper targeting and campaigns to increase uptake.

NHS 111 Dataset

As part of an evaluation of the NHS 111 First programme, which is being rolled out across England, NHSE/I want to understand both the effectiveness of the programme in reducing the risk of nosocomial transmission of Covid-19 in emergency departments (EDs) and the potential impact the programme may have on the wider UEC system and primary care.

Access to these data will allow robust analysis to be conducted to inform decision making and development of improved models of care in the UEC system and mitigate the risk of other parts of the health services becoming overburdened with additional demand.

Civil Registrations Data

Obesity is poorly recorded in secondary care data sources. There is emerging evidence that obesity increases the risk of mortality from COVID-19 however it is not possible to understand the magnitude of risk or adjust for obesity in addition to wider risk factors using existing data sources. There is a requirement for population level obesity data to understand the impact of obesity on COVID-19 risk and mortality.

This data will be used to understand the impact of Obesity, overweight patients and other co-morbidities on COVID-19 risk and mortality.

Secondary Uses Service (SUS) Data

Understand the impact of COVID-19 on all areas across the system – at a National, Regional and sub regional level. Identify key areas where demand is high for patients (with underlying Health conditions (ie Diabetics or cardiovascular complications) and getting these services back online. GDDPR is required to investigate certain cohorts of patients, to support the planning and restoration of acute services (Elective and outpatient appointments) where due to COVID-19 these services would have stopped to reduce the risk of infection and transmission. The waiting lists have expanded greatly, as a result.

The SUS data will be used to support strategic interventions to enable the restoration of acute services, as well as provide an evidence base for the transformation of services in the future.

Any outputs to 3rd parties not included as a Data Controller/Processor in this application/agreement must be aggregated

(with small number suppression applied in line with NHS Digital requirements).

Within 1 week of NHS England receiving the data from NHS Digital, it will be able to use the dataset to provide analysis that starts to respond to the following:

• Support the NHS response to COVID-19

• Analyse the spread of COVID-19 diagnoses geographically and demographically, to identify any trends. Appointment activity will also be analysed to better understand use of non-face to face consultation trends and potential differences across geographical areas.

• Operational planning to predict likely demand on primary, community and acute service for vulnerable patients.

• Analysis of resource allocation.

• Diagnosing and monitoring the effects of COVID-19 at a National, Regional and sub regional level.

• Ensuring NHS England has adequate data to inform that interventions and measures put in place to reduce the transmission of COVID-19 are being effective and impactful.

• Analyse factors that result in increased service utilisation for COVID-19 patients.

• Start building modelling and forecasting tools for COVID-19 from Primary care perspective. Learning from and predicting likely patient pathways in order to influence early interventions and other alternatives for patients.

Palantir Technologies UK Limited

• Analytical dashboards that focus on key decision making

Medicines dispensed in primary care

- Patient level prescribing will help inform policy and planning for CCG Prescribing Resource Allocations – 12% of core CCG programmes or circa £8.5 billion, by developing models using patient level data. This will enable deeper understanding of prescribing at a granularity which will ensure that outputs from the models and forward planning are more precise.

- Supporting reimbursement of funds from NHS England and NHS Improvement back to NHSBSA for Specialised medicines.

- Support the successful delivery of commitments laid out in the;

• NHS Long Term Plan

• Next Steps on the Five Year Forward View

• Antimicrobial Resistance (AMR) Strategy

• Life Sciences Industrial Strategy

• World Health Organisation’s 2017 3rd global challenge, ‘Medication without Harm’

- Secondary uses to inform and support prescribing behaviour, decision making and research. The recommendations published in the PHE Review will now be picked up by NHS England and NHS Improvement for implementation.

Shielded Patient List

• Assessing impact and projections for hospital admissions, particularly critical care bed capacity.

• Vaccination programme review.

• Operational planning reports for shielding patients.

• Further service utilisation analysis for COVID-19 patients.

NHS 111 Dataset

A range of analysis and reports to review NHS 111 First Programme focussing on:

• Potentially reducing patient face-to face contact within the UEC system

• The number and characteristics of patients contacting primary care following a 111 call

• The proportion of those directed from 111 to primary care or ED that attend these services

• Rates of compliance to 111 advice, and whether these rates differ between those callers that have an appointment booked via 111 and those that do not

Civil Registrations Data

• A variety of evaluations and risk impact reports looking at the relationship between obesity, overweight patients and other co-morbidities in relation to COVID-19

Secondary Uses Service Data

• Reports that focus on outcomes for strategic planning and organisation of the COVID-19 response

NHS 111 Dataset

NHS England, also known as the ‘National Commissioning Board’ leads the National Health Service (NHS) in England. NHS England are responsible for the budget, planning, delivery and day-to-day operation of the commissioning side of the NHS in England as set out in the Health and Social Care Act 2012.

NHS England has responsibility for a wide range of purposes and hold Statutory Duties, including commissioning specialised services, paying for primary care, public health services, offender healthcare and specific services for the armed forces. NHS England is also legally required to undertake a range of non-commissioning functions, including oversight of Clinical Commissioning Group (CCG) and new care models assurance, reviewing major service changes, development of policy and financial allocations.

NHS England’s statutory duties are set out in the NHS Act 2006 and by the Health and Social Care Act 2012 amendments. To enable NHS England to assess the value, quality and effectiveness of the services it commissions, the Health and Social Care Act 2012 (Section 254) empowers NHS England to direct NHS Digital to collect the data it requires. NHS Digital are required to process confidential patient-level data, transform it into an agreed anonymised format which NHS England can legally receive and safely use without impacting the privacy of service users.

The legal bases underpinning some of NHS England’s statutory commissioning and population health management duties are set out below:

Legal Basis

Ref Statute

A1 DUTY: Eliminate discrimination, harassment and victimisation and advance equality of opportunity

A2 DUTY: Have regard to impact on services in certain areas

A3 DUTY: Payment of sums

A4 DUTY: Performance of functions outside England

A5 DUTY: Prevent people from being drawn into terrorism

A6 DUTY: Process data for the prevention or detection of crime

A7 DUTY: Provide integrated services to improve outcomes and reduce inequalities

A8 DUTY: Safeguard and promote the welfare of children

A9 DUTY: Securing continuous improvement in quality of services provided to individuals

A10 DUTY: To arrange the provision of health services in England

A11 DUTY: To collect and analyse information relating to safety of services

A12 DUTY: To commission secondary dental, armed forces and health and justice health services

A13 DUTY: To consider the economic, social and environmental benefits to be achieved through commissioning

A14 DUTY: To ensure health services are provided in an integrated way

A15 DUTY: To exercise functions relating to primary dental services

A16 DUTY: To exercise relevant public health functions

A17 DUTY: To improve quality of services

A18 DUTY: To monitor and improve the quality of care

A19 DUTY: To pay CCGs to meet their expenditure

A20 DUTY: To promote a comprehensive health service

A21 DUTY: To provide certain specified services

A22 DUTY: To provide high secure psychiatric services

A23 DUTY: To provide pharmaceutical services

A24 DUTY: To provide primary medical services

A25 DUTY: To provide primary ophthalmic services

A26 DUTY: To provide secondary community ambulance mental health services or facilities

A27 DUTY: To put and keep in place arrangements to monitor and improve the quality of health care

A28 DUTY: To secure continuous improvement in the quality of services

A29 DUTY: Understand impact of commissioning decisions on provision of services to Welsh and Scottish residents

A30 POWER: Produce documents to support counter fraud and security management functions

A31 POWER: Reimbursement for pharmaceutical remuneration

A32 POWER: To assist SoS in providing health services and exercising public health functions

A33 POWER: To commission certain health services as requested by SoS

A34 POWER: To conduct research

A35 POWER: To make payments to CCGs in respect of quality of services

A36 POWER: To pay for community services

A37 POWER: To scrutinise or review areas of the health service with local authorities

A38 REGULATION: To ensure buying decisions are fair and improve quality and efficiency of healthcare services

A39 REGULATION: To enter into prescribed arrangements between NHSE, CCGs, providers and local authorities

A40 SECONDARY LEGISLATION: Carry out financial duties

A41 SECONDARY LEGISLATION: To provide community dental, health and justice, armed forces and specialised services

In order for NHS England to discharge its statutory duties, all elements of the contracting cycle, from assessing population health needs, through service planning and contract management, to service evaluation and redesign, requires access to high quality data within the appropriate legal framework. As part of its duties, NHS England also has responsibilities to respond to major incidents.

In general data access is required for the purposes of commissioning and underpinning system activities within the NHS England demographic area, including reducing health inequalities, identifying and managing preventable and existing conditions, managing demand, monitoring pathway compliance, comparison to peers, monitoring outcomes, understanding how services impact across the health economy and designing the future healthcare system.

With the pandemic of COVID-19, which began in the United Kingdom back in January 2020, NHSX (an organisation which operates as part of the legal entity of NHS England), NHS England and NHS Improvement have been tasked with leading the national data response to COVID-19. This required a Data Store (specific for COVID-19 data) to be created that ensures data can be used effectively to support the national response to protecting citizens against the COVID-19 virus. This response also includes the recovery and restoration of health services as the need for COVID-19 specific services reduce.

The NHS COVID-19 Data Store has been established under the provisions of the COPI (Control of Patient Information) notices issued by the Secretary of State for Health and Social Care using powers available to him under regulation 3 of the Health Service (Control of Patient Information) Regulations 2002, and is designed to support a range of activities, including:

● Understanding COVID-19 and impact to provision of NHS services and patient outcomes;

● Identifying and understanding information about patients or potential patients with or at risk of COVID-19;

● Delivering services to patients, clinicians, the health services;

● Planning in relation to COVID-19.

These powers give NHS England, an organisation which falls under regulation 3(3) of the COPI regulations, powers delegated by the Secretary of State to require the disclosure of confidential patient information.

The COVID-19 Data Store is a strictly controlled central point that brings together all data necessary to provide NHS England and NHS improvement analysts only, with the most comprehensive datasets related to COVID-19. There is however a requirement to ensure that all necessary data sets, required to support the national response are acquired, as this will provide a full picture of how the pandemic is impacting all areas of the National Health Service.

The Data Protection Impact Assessment (DPIA) and Privacy Notice for the use of NHS COVID-19 data can be found at https://www.england.nhs.uk/ourwork/tsd/data-info/

NHS England requires pseudonymised GDPPR data under Regulation 3 the Control of Patient Information Regulations 2002 (COPI) Notice which was issued by the Secretary of State for Health in March 2020. The GDPPR data will be used to provide intelligence to support NHS England in their response to the COVID-19 pandemic as set out in the COPI notice and shown below:

NHS England and NHS Improvement is required to process confidential patient information in the manner set out below for purposes set out in Regulation 3(1) of COPI (insofar as those purposes relate to the current outbreak of COVID-19).

NHS England and NHS Improvement (under the legal entities of Monitor and NHS Trust Development Authority (TRA)) are joint data controllers in this agreement.

The data will be analysed so that health care provision can be planned to support the needs of the population for the COVID-19 purposes and to better understand and plan the impacts on NHS Services and patient outcomes.

Such uses cases of the data include but are not limited to:

• To help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives.

• NHS England will be monitoring and managing jointly with PHE;

(i) outbreaks of communicable disease to anticipate downstream impacts to NHS services and patient outcomes;

(ii) incidents of exposure to communicable disease;

(iii) the delivery, efficacy and safety of immunisation programmes;

(iv) adverse reactions to vaccines and medicines;

(v) risks of infection acquired from food or the environment (including water supplies);

(vi) the giving of information to persons about the diagnosis of communicable disease and risks of acquiring such disease.

• Provide comprehensive national pictures of COVID-19 care and outcomes in England (at National, Regional and Sub regional levels) which included understanding COVID-19 and risks to public health, trends in COVID-19 and risks, and controlling and preventing the spread of COVID-19 and its impact on NHS Services and patient outcomes.

• Understand the scope and scale of variation of COVID-19 identification, diagnoses, hospitalisation, treatments, deaths across the national, regional and sub-regional areas.

• Identifying and understanding information about patients or potential patients with or at risk of COVID-19 (for example Obese or Diabetic patients).

• Delivering through NHS services including primary care to patients, the provision of information, fit notes, immunisations, and vaccinations (including school vaccinations).

• Understand both the effectiveness of the NHS 111 First Programme in reducing the risk of nosocomial transmission of COVID-19 in Emergency Departments (EDs) and the potential impact the programme may have on the wider UEC (Urgent and Emergency Care) system and primary care.

• Understanding impacts of patient access to health services for example reviewing the referrals rates to Cancer services a direct or indirect result of COVID-19 and the availability and capacity of those services or that care.

• Review and plan restoration of Health care services and providing funding where necessary to bring services back online, where COVID-19 has had an impact.

Research Ethics Committee (REC) approval is not appropriate under these conditions, as the data will be used to support analysis for policy, guidance and operational management of the NHS.

Poor management and control of COVID-19 will be associated with higher risk of hospitalisations (therefore increased demand and reduced capacity within hospitals) as well as death and long-term health complications of patients. Those who are from a minority ethnic background as well as those patients that have underlying health conditions are more vulnerable to adverse health outcomes from COVID-19.

To support these patients, NHS England will be looking to perform a system level risk stratification. This means NHS England will need to know the overall population and be able to understand the cohorts of patients that are more susceptible to COVID-19. This will be done nationally using Population Segmentation – identifying groups of patients based on diagnoses, ethnicity etc, where there is no requirement to re-identify patients. It is therefore not the same as ‘patient level risk stratification’ as known to be done within GP Practices, where re-identification of patients is needed for the provision of direct care.

Looking at the Primary care system as a whole, the 111 First programme is anticipating an increase in the use of NHS 111 so it is important to understand how any increase in 111 demand impacts on demand for primary care services and the wider urgent and emergency care (UEC) system.

Below is a specific example of how the data will be used and linked. There are other use case examples in a separate document provided alongside this application. These are:

• Use Case 01 – 111 First Programme Evaluation

• Use Case 02 – Public health screening

• Use Case 03 – Flu Vaccination Programme

• Use Case 04 – Mortality increased risk in patients that are overweight

• Use Case 05 – Vaccinations & Immunisations

• Use Case 06 – Restoration of Health Care Services

Access to both GPES and 111 Pathways data, will allow robust analysis to be conducted to inform decision making and development of improved models of care in the UEC system and mitigate the risk of other parts of the health services becoming overburdened with additional demand. It would not be statistically valid to undertake the analysis only using an extract of the GPES data for the cohort who presented at 111, as this would not provide a robust comparison with baseline activities.

The GDPPR data will be used for specific bespoke use cases such as the one illustrated above, it would not be feasible to utilise the Trusted Research Environment (TRE), and therefore a direct feed from NHS Digital to NHS England is required, in order for the Organisation to perform the additional duties in supporting with the COVID-19 efforts.

Under GDPR, NHS England can rely on Article 6(1)(c) – Legal Obligation to receive and process the Disseminated data from NHS Digital for the Agreed Purposes under the Recipient COPI Notice. As this is health information and therefore special category personal data the Recipients can also rely on Article 9(2)(h) – processing is necessary for the purposes of preventative or occupational medicine and 9(2)(i) – processing is necessary for reasons of public interest in the area of public health.

With regard to the application of the Type 1 and national data opt outs to data processed under the COPI notice, our view is that as the COPI notice places a legal requirement on organisations to process Confidential Patient Information (CPI), opt outs will not apply to any data accessed by virtue of the notice. In any case, as set out in NHS Digital’s National Data Opt-Out operational policy guidance CPI processed under regulation 3 of the COPI regulations is not subject to the national data opt- out.

The data received by the Joint Data Controllers is pseudonymised data which is processed under strict controls and therefore meets the ICO Anonymisation Code of Practice.

Any outputs to 3rd parties not included as a Data Controller/Processor in this application/agreement must be aggregated

(with small number suppression applied in line with NHS Digital requirements).

Within 1 week of NHS England receiving the data from NHS Digital, it will be able to use the dataset to provide analysis that starts to respond to the following:

• Support the NHS response to COVID-19

• Analyse the spread of COVID-19 diagnoses geographically and demographically, to identify any trends. Appointment activity will also be analysed to better understand use of non-face to face consultation trends and potential differences across geographical areas.

• Operational planning to predict likely demand on primary, community and acute service for vulnerable patients.

• Analysis of resource allocation.

• Diagnosing and monitoring the effects of COVID-19 at a National, Regional and sub regional level.

• Ensuring NHS England has adequate data to inform that interventions and measures put in place to reduce the transmission of COVID-19 are being effective and impactful.

• Analyse factors that result in increased service utilisation for COVID-19 patients.

• Start building modelling and forecasting tools for COVID-19 from Primary care perspective. Learning from and predicting likely patient pathways in order to influence early interventions and other alternatives for patients.

NHS England, also known as the ‘National Commissioning Board’ leads the National Health Service (NHS) in England. NHS England are responsible for the budget, planning, delivery and day-to-day operation of the commissioning side of the NHS in England as set out in the Health and Social Care Act 2012.

NHS England has responsibility for a wide range of purposes and hold Statutory Duties, including commissioning specialised services, paying for primary care, public health services, offender healthcare and specific services for the armed forces. NHS England is also legally required to undertake a range of non-commissioning functions, including oversight of Clinical Commissioning Group (CCG) and new care models assurance, reviewing major service changes, development of policy and financial allocations.

NHS England’s statutory duties are set out in the NHS Act 2006 and by the Health and Social Care Act 2012 amendments. To enable NHS England to assess the value, quality and effectiveness of the services it commissions, the Health and Social Care Act 2012 (Section 254) empowers NHS England to direct NHS Digital to collect the data it requires. NHS Digital are required to process confidential patient-level data, transform it into an agreed anonymised format which NHS England can legally receive and safely use without impacting the privacy of service users.

The legal bases underpinning some of NHS England’s statutory commissioning and population health management duties are set out below:

Legal Basis

Ref Statute

A1 DUTY: Eliminate discrimination, harassment and victimisation and advance equality of opportunity

A2 DUTY: Have regard to impact on services in certain areas

A3 DUTY: Payment of sums

A4 DUTY: Performance of functions outside England

A5 DUTY: Prevent people from being drawn into terrorism

A6 DUTY: Process data for the prevention or detection of crime

A7 DUTY: Provide integrated services to improve outcomes and reduce inequalities

A8 DUTY: Safeguard and promote the welfare of children

A9 DUTY: Securing continuous improvement in quality of services provided to individuals

A10 DUTY: To arrange the provision of health services in England

A11 DUTY: To collect and analyse information relating to safety of services

A12 DUTY: To commission secondary dental, armed forces and health and justice health services

A13 DUTY: To consider the economic, social and environmental benefits to be achieved through commissioning

A14 DUTY: To ensure health services are provided in an integrated way

A15 DUTY: To exercise functions relating to primary dental services

A16 DUTY: To exercise relevant public health functions

A17 DUTY: To improve quality of services

A18 DUTY: To monitor and improve the quality of care

A19 DUTY: To pay CCGs to meet their expenditure

A20 DUTY: To promote a comprehensive health service

A21 DUTY: To provide certain specified services

A22 DUTY: To provide high secure psychiatric services

A23 DUTY: To provide pharmaceutical services

A24 DUTY: To provide primary medical services

A25 DUTY: To provide primary ophthalmic services

A26 DUTY: To provide secondary community ambulance mental health services or facilities

A27 DUTY: To put and keep in place arrangements to monitor and improve the quality of health care

A28 DUTY: To secure continuous improvement in the quality of services

A29 DUTY: Understand impact of commissioning decisions on provision of services to Welsh and Scottish residents

A30 POWER: Produce documents to support counter fraud and security management functions

A31 POWER: Reimbursement for pharmaceutical remuneration

A32 POWER: To assist SoS in providing health services and exercising public health functions

A33 POWER: To commission certain health services as requested by SoS

A34 POWER: To conduct research

A35 POWER: To make payments to CCGs in respect of quality of services

A36 POWER: To pay for community services

A37 POWER: To scrutinise or review areas of the health service with local authorities

A38 REGULATION: To ensure buying decisions are fair and improve quality and efficiency of healthcare services

A39 REGULATION: To enter into prescribed arrangements between NHSE, CCGs, providers and local authorities

A40 SECONDARY LEGISLATION: Carry out financial duties

A41 SECONDARY LEGISLATION: To provide community dental, health and justice, armed forces and specialised services

In order for NHS England to discharge its statutory duties, all elements of the contracting cycle, from assessing population health needs, through service planning and contract management, to service evaluation and redesign, requires access to high quality data within the appropriate legal framework. As part of its duties, NHS England also has responsibilities to respond to major incidents.

In general data access is required for the purposes of commissioning and underpinning system activities within the NHS England demographic area, including reducing health inequalities, identifying and managing preventable and existing conditions, managing demand, monitoring pathway compliance, comparison to peers, monitoring outcomes, understanding how services impact across the health economy and designing the future healthcare system.

With the pandemic of COVID-19, which began in the United Kingdom back in January 2020, NHSX, NHS England and NHS Improvement have been tasked with leading the national data response to COVID-19. This required a Data Store (specific for COVID-19 data) to be created that ensures data can be used effectively to support the national response to protecting citizens against the COVID-19 virus. This response also includes the recovery and restoration of health services as the need for COVID-19 specific services reduce.

The NHS COVID-19 Data Store has been established under the provisions of the COPI (Control of Patient Information) notices issued by the Secretary of State for Health and Social Care using powers available to him under regulation 3 of the Health Service (Control of Patient Information) Regulations 2002, and is designed to support a range of activities, including:

● Understanding COVID-19 and impact to provision of NHS services and patient outcomes;

● Identifying and understanding information about patients or potential patients with or at risk of COVID-19;

● Delivering services to patients, clinicians, the health services;

● Planning in relation to COVID-19.

These powers give NHS England, an organisation which falls under regulation 3(3) of the COPI regulations, powers delegated by the Secretary of State to require the disclosure of confidential patient information.

The COVID-19 Data Store is a strictly controlled central point that brings together all data necessary to provide NHS England and NHS improvement analysts only, with the most comprehensive datasets related to COVID-19. There is however a requirement to ensure that all necessary data sets, required to support the national response are acquired, as this will provide a full picture of how the pandemic is impacting all areas of the National Health Service. One area of the service NHS England does not currently have data for, is Primary Care – specifically the GPES (General Practice Extraction Service) Data for Pandemic Planning and Research (GDPPR) data.

Data stored within the data store, including GDPPR, all share a common pseudo key. This means that GDPPR is linkable, however it must only be linked for purposes listed under this DSA.

The Data Protection Impact Assessment (DPIA) and Privacy Notice for the use of NHS COVID-19 data can be found at https://www.england.nhs.uk/ourwork/tsd/data-info/

NHS England requires pseudonymised GDPPR data under Regulation 3 the Control of Patient Information Regulations 2002 (COPI) Notice which was issued by the Secretary of State for Health in March 2020. The GDPPR data will be used to provide intelligence to support NHS England in their response to the COVID-19 pandemic as set out in the COPI notice and shown below:

NHS England and NHS Improvement is required to process confidential patient information in the manner set out below for purposes set out in Regulation 3(1) of COPI (insofar as those purposes relate to the current outbreak of COVID-19).

NHS England and NHS Improvement (under the legal entities of Monitor and NHS Trust Development Authority (TRA)) are joint data controllers in this agreement.

The data will be analysed so that health care provision can be planned to support the needs of the population for the COVID-19 purposes and to better understand and plan the impacts on NHS Services and patient outcomes.

Such uses cases of the data include but are not limited to:

• To help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives.

• NHS England will be monitoring and managing jointly with PHE;

(i) outbreaks of communicable disease to anticipate downstream impacts to NHS services and patient outcomes;

(ii) incidents of exposure to communicable disease;

(iii) the delivery, efficacy and safety of immunisation programmes;

(iv) adverse reactions to vaccines and medicines;

(v) risks of infection acquired from food or the environment (including water supplies);

(vi) the giving of information to persons about the diagnosis of communicable disease and risks of acquiring such disease.

• Provide comprehensive national pictures of COVID-19 care and outcomes in England (at National, Regional and Sub regional levels) which included understanding COVID-19 and risks to public health, trends in COVID-19 and risks, and controlling and preventing the spread of COVID-19 and its impact on NHS Services and patient outcomes.

• Understand the scope and scale of variation of COVID-19 identification, diagnoses, hospitalisation, treatments, deaths across the national, regional and sub-regional areas.

• Identifying and understanding information about patients or potential patients with or at risk of COVID-19 (for example Obese or Diabetic patients).

• Delivering through NHS services including primary care to patients, the provision of information, fit notes, immunisations, and vaccinations (including school vaccinations).

• Understand both the effectiveness of the NHS 111 First Programme in reducing the risk of nosocomial transmission of COVID-19 in Emergency Departments (EDs) and the potential impact the programme may have on the wider UEC (Urgent and Emergency Care) system and primary care.

• Understanding impacts of patient access to health services for example reviewing the referrals rates to Cancer services a direct or indirect result of COVID-19 and the availability and capacity of those services or that care.

• Review and plan restoration of Health care services and providing funding where necessary to bring services back online, where COVID-19 has had an impact.

Research Ethics Committee (REC) approval is not appropriate under these conditions, as the data will be used to support analysis for policy, guidance and operational management of the NHS.

Poor management and control of COVID-19 will be associated with higher risk of hospitalisations (therefore increased demand and reduced capacity within hospitals) as well as death and long-term health complications of patients. Those who are from a minority ethnic background as well as those patients that have underlying health conditions are more vulnerable to adverse health outcomes from COVID-19.

To support these patients, NHS England will be looking to perform a system level risk stratification. This means NHS England will need to know the overall population and be able to understand the cohorts of patients that are more susceptible to COVID-19. This will be done nationally using Population Segmentation – identifying groups of patients based on diagnoses, ethnicity etc, where there is no requirement to re-identify patients. It is therefore not the same as ‘patient level risk stratification’ as known to be done within GP Practices, where re-identification of patients is needed for the provision of direct care.

Looking at the Primary care system as a whole, the 111 First programme is anticipating an increase in the use of NHS 111 so it is important to understand how any increase in 111 demand impacts on demand for primary care services and the wider urgent and emergency care (UEC) system.

Below is a specific example of how the data will be used and linked. There are other use case examples in a separate document provided alongside this application. These are:

• Use Case 01 – 111 First Programme Evaluation

• Use Case 02 – Public health screening

• Use Case 03 – Flu Vaccination Programme

• Use Case 04 – Mortality increased risk in patients that are overweight

• Use Case 05 – Vaccinations & Immunisations

• Use Case 06 – Restoration of Health Care Services

Data will only be linked with other COVID-19 data where the analysis required has gone through an approval process. This ensures that it is clearly in line with the purposes of NHS England and the COPI Notice.

Access to both GPES and 111 Pathways data, will allow robust analysis to be conducted to inform decision making and development of improved models of care in the UEC system and mitigate the risk of other parts of the health services becoming overburdened with additional demand. It would not be statistically valid to undertake the analysis only using an extract of the GPES data for the cohort who presented at 111, as this would not provide a robust comparison with baseline activities.

The GDPPR data will be used for specific bespoke use cases such as the one illustrated above, it would not be feasible to utilise the Trusted Research Environment (TRE), and therefore a direct feed from NHS Digital to NHS England is required, in order for the Organisation to perform the additional duties in supporting with the COVID-19 efforts.

Under GDPR, NHS England can rely on Article 6(1)(c) – Legal Obligation to receive and process the Disseminated data from NHS Digital for the Agreed Purposes under the Recipient COPI Notice. As this is health information and therefore special category personal data the Recipients can also rely on Article 9(2)(h) – processing is necessary for the purposes of preventative or occupational medicine and 9(2)(i) – processing is necessary for reasons of public interest in the area of public health.

With regard to the application of the Type 1 and national data opt outs to data processed under the COPI notice, our view is that as the COPI notice places a legal requirement on organisations to process Confidential Patient Information (CPI), opt outs will not apply to any data accessed by virtue of the notice. In any case, as set out in NHS Digital’s National Data Opt-Out operational policy guidance CPI processed under regulation 3 of the COPI regulations is not subject to the national data opt- out.

The data received by the Joint Data Controllers is pseudonymised data which is processed under strict controls and therefore meets the ICO Anonymisation Code of Practice.

Any outputs to 3rd parties not included as a Data Controller/Processor in this application/agreement must be aggregated

(with small number suppression applied in line with NHS Digital requirements).

Within 1 week of NHS England receiving the data from NHS Digital, it will be able to use the dataset to provide analysis that starts to respond to the following:

• Support the NHS response to COVID-19

• Analyse the spread of COVID-19 diagnoses geographically and demographically, to identify any trends. Appointment activity will also be analysed to better understand use of non-face to face consultation trends and potential differences across geographical areas.

• Operational planning to predict likely demand on primary, community and acute service for vulnerable patients.

• Analysis of resource allocation.

• Diagnosing and monitoring the effects of COVID-19 at a National, Regional and sub regional level.

• Ensuring NHS England has adequate data to inform that interventions and measures put in place to reduce the transmission of COVID-19 are being effective and impactful.

• Analyse factors that result in increased service utilisation for COVID-19 patients.

• Start building modelling and forecasting tools for COVID-19 from Primary care perspective. Learning from and predicting likely patient pathways in order to influence early interventions and other alternatives for patients.

Yielded Benefits is not a requirement for new applications.