Understanding COVID-19, its trends and risks to public health, and controlling and preventing the spread of COVID-19. (Retention of selected manipulated data to facilitate response to challenge from the UK COVID inquiry or from other readers of the published papers)

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

This Agreement amends the former Public Health England (PHE) DARS-NIC-390154-Z4M0F-v1.2 Data Sharing Agreement to note the disestablishment of PHE at the end of September 2021 and the transfer of responsibility for its health improvement and health inequalities reduction functions to the Office for Health Improvement and Disparities (OHID) that sits under the Department of Health and Social Care (DHSC). OHID is a new directorate in the (DHSC) and therefore the DHSC is the data controller for the personal data processed by OHID to fulfil its remit. The data under this Agreement are hosted in the Porton and Colindale UK Health Security Agency (UKHSA) data centres, processing for the purpose of maintenance, backup and user administration is done by UKHSA staff on instruction from OHID, while processing for the purpose of analysis is done by DHSC staff remotely, from DHSC offices or from home. This Data Sharing Agreement (DSA) permits the Department of Health and Social Care (DHSC) to retain the Data to respond to challenges to publications if needed. The General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (GDPPR) data set shared by NHS England under this Agreement DARS-NIC-390154-Z4M0F will continue to be managed by the Data Lake service. This corporate-wide service was set up by PHE to manage the receipt, processing and internal access to a range of data sets received by PHE from NHS England and other partner organisations. Following the closure of PHE, the Data Lake is now hosted on the IT network managed by the (UKHSA). The UKHSA is the new executive agency of the DHSC that has taken on responsibility for the health protection functions of PHE. As an executive agency of DHSC, UKHSA is included under the Department’s data controller registration with the ICO – in other words, it is under the same data controller as DHSC. The operating procedures for controlling access to the data contained in the Data Lake remain as they were in PHE to ensure there is no disruption to the supply of business-critical data to the health improvement functions transferring to DHSC. As was the case in PHE previously, the GPES data supplied by NHS England under DARS-NIC-390154-Z4M0F will continue to be used only by specific staff based in DHSC for the purposes described in this DSA. All staff accessing the GPES data hosted within the Data Lake are required to complete the mandatory training - Civil Service-Learning Responsible for Information (2018) and confirm the e-learning for healthcare Data Security Awareness Level 1 has been completed. The Data Lake user access agreements contains additional conditions under which the data should be accessed and processed. This Data Sharing Agreement (DSA) has been amended to identify DHSC and OHID as the recipient and processor of the data shared by NHS England under this Agreement. The previous references in the DSA to PHE have been replaced with references to DHSC. No additional data will be requested from NHS England. This agreement with the Data Controller is to continue to obtain record-level patient identifiable GPES Data for Pandemic Planning and Research (GDPPR) data extracts on a quarterly basis from NHS England. This DSA permits processing of the Data for the purpose of secure storage and back up. This DSA does not permit any further processing that involves analysis or linkage other than for the purpose of verifying findings in line with the original objectives of the study by repeating previous analyses described in this DSA. Following publication of the study findings, it is possible that the findings will be questioned or challenged by third parties through direct contact with DHSC, contact via the publishing journal or an open letter. In such circumstances, DHSC may repeat the previous analyses undertaken to verify that the published results were accurate and may write a response to be issued directly to the challenger or published. DHSC may not undertake different analyses to those undertaken during the original analysis. This DSA does not permit any onward sharing of the Data. This DSA permits the necessary processing of the Data for the purposes of permanently destroying, deleting or erasing the Data once it is no longer required for the purpose for which it was collected. Once destroyed/deleted or erased, DHSC must confirm destruction to NHS England. If any further data processing is required in addition to the above purposes or if the data needs to be moved to a different location/organisation, DHSC must submit an Amendment request to NHS England before Data is accessed. DARS-NIC-390154-Z4M0F-v1.2 amended the Data Sharing Agreement to note the disestablishment of Public Health England (PHE) at the end of September 2021 and the transfer of responsibility for its health improvement and health inequalities reduction functions to the Office for Health Improvement and Disparities (OHID) that sits under DHSC. OHID is a new directorate in the (DHSC) and therefore the DHSC is the data controller for the personal data processed by OHID to fulfil its remit. The Data under this Agreement are hosted in the Porton and Colindale UK Health Security Agency (UKHSA) data centres, processing for the purpose of maintenance, backup and user administration is done by UKHSA staff on instruction from OHID, while processing for the purpose of analysis is done by DHSC staff remotely, from DHSC offices or from home. The General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (GDPPR) data set shared by NHS England under this DSA will continue to be managed by the Data Lake service. This corporate-wide service was set up by PHE to manage the receipt, processing and internal access to a range of data sets received by PHE from NHS England and other partner organisations. Following the closure of PHE, the Data Lake is now hosted on the IT network managed by the (UKHSA). The UKHSA is the new executive agency of the DHSC that has taken on responsibility for the health protection functions of PHE. As an executive agency of DHSC, UKHSA is included under the Department’s data controller registration with the ICO – in other words, it is under the same data controller as DHSC. The operating procedures for controlling access to the data contained in the Data Lake remain as they were in PHE to ensure there is no disruption to the supply of business-critical data to the health improvement functions transferring to DHSC. As was the case in PHE previously, the GPES data supplied by NHS England under DARS-NIC-390154-Z4M0F will continue to be used only by specific staff based in DHSC for the purposes described in this DSA. All staff accessing the GPES data hosted within the Data Lake are required to complete the mandatory training - Civil Service-Learning Responsible for Information (2018) and confirm the e-learning for healthcare Data Security Awareness Level 1 has been completed. The Data Lake user access agreements contains additional conditions under which the data should be accessed and processed. [23 paragraphs unchanged] LEGAL BASIS The lawful basis for processing personal data under the UK GDPR is: The lawful basis for processing data under GDPR has been reviewed against the guidance provided by IGARD and been assessed as acceptable. Article 6(1)(e) ‘Public Task processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller)’. The Office for Health Improvement and Disparities exists to protect and improve the nation's health and wellbeing, and reduce health inequalities and is an executive agency, sponsored by part of the Department of Health & Social Care. And because health data is a special category of data under the GDPR, Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services’ and Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices’. Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; The lawful basis for processing special category data under the UK GDPR is: Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services’ and: Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices’. The Office for Health Improvement and Disparities exists to protect and improve the nation's health and wellbeing, and reduce health inequalities and is an executive agency, sponsored by part of the Department of Health & Social Care. [2 paragraphs unchanged]

Processing activities

[31 paragraphs unchanged] All organisations party to this agreement must comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract i.e.: employees, agents and contractors of the Data Recipient who may have access to that data). [25 paragraphs unchanged]

Benefits reported

[1 paragraph unchanged] Processing, including linkage to other relevant datasets, has facilitated understanding COVID-19, its trends and risks to public health, and controlling and preventing the spread of COVID-19. Retention of selected manipulated data will facilitate response to challenge from the UK COVID inquiry or from other readers of the published papers.

Unchanged: Expected output, Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Data controllers: + DEPARTMENT OF HEALTH AND SOCIAL CARE · − PUBLIC HEALTH ENGLAND (PHE)

Objective for processing

**** This renewal of the original agreement with the Data Controller is to continue to obtain record-level patient identifiable PID-level GPES Data for Pandemic Planning and Research (GDPPR) data extracts on a fortnightly basis from NHS digital until the end of the current Control of Patient Information Regulations) 2002 (COPI) notice, which at the time of this renewal is set at 30/09/2021 **** This Agreement amends the former Public Health England (PHE) DARS-NIC-390154-Z4M0F-v1.2 Data Sharing Agreement to note the disestablishment of PHE at the end of September 2021 and the transfer of responsibility for its health improvement and health inequalities reduction functions to the Office for Health Improvement and Disparities (OHID) that sits under the Department of Health and Social Care (DHSC). OHID is a new directorate in the (DHSC) and therefore the DHSC is the data controller for the personal data processed by OHID to fulfil its remit. The data under this Agreement are hosted in the Porton and Colindale UK Health Security Agency (UKHSA) data centres, processing for the purpose of maintenance, backup and user administration is done by UKHSA staff on instruction from OHID, while processing for the purpose of analysis is done by DHSC staff remotely, from DHSC offices or from home. The General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (GDPPR) data set shared by NHS England under this Agreement DARS-NIC-390154-Z4M0F will continue to be managed by the Data Lake service. This corporate-wide service was set up by PHE to manage the receipt, processing and internal access to a range of data sets received by PHE from NHS England and other partner organisations. Following the closure of PHE, the Data Lake is now hosted on the IT network managed by the (UKHSA). The UKHSA is the new executive agency of the DHSC that has taken on responsibility for the health protection functions of PHE. As an executive agency of DHSC, UKHSA is included under the Department’s data controller registration with the ICO – in other words, it is under the same data controller as DHSC. The operating procedures for controlling access to the data contained in the Data Lake remain as they were in PHE to ensure there is no disruption to the supply of business-critical data to the health improvement functions transferring to DHSC. As was the case in PHE previously, the GPES data supplied by NHS England under DARS-NIC-390154-Z4M0F will continue to be used only by specific staff based in DHSC for the purposes described in this DSA. All staff accessing the GPES data hosted within the Data Lake are required to complete the mandatory training - Civil Service-Learning Responsible for Information (2018) and confirm the e-learning for healthcare Data Security Awareness Level 1 has been completed. The Data Lake user access agreements contains additional conditions under which the data should be accessed and processed. This Data Sharing Agreement (DSA) has been amended to identify DHSC and OHID as the recipient and processor of the data shared by NHS England under this Agreement. The previous references in the DSA to PHE have been replaced with references to DHSC. This agreement with the Data Controller is to continue to obtain record-level patient identifiable GPES Data for Pandemic Planning and Research (GDPPR) data extracts on a quarterly basis from NHS England. At the start of the pandemic, the government set out a remit letter, dated April 2020, which sets out Public Health England’s role across the health and care system, how PHE should perform that role, and the Government’s priorities of PHE from April 2020 to March 2021: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/882570/PHE_Remit_Letter_from_Jo_Churchill_to_Duncan_Selbie.pdf A further letter was issued for 2021 to 2022: https://www.gov.uk/government/publications/public-health-england-priorities-in-2021/letter-from-jo-churchill-to-michael-brodie-phe-chief-executive [1 paragraph unchanged] The broad aim underpinning this request is understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks, for monitoring and planning purposes. COVID-19 presents a significant threat to the population in terms of increased morbidity and mortality, particularly among vulnerable groups such as those with pre-existing disease. PHE will undertake analysis to assess the relationship between COVID-19 and potential risk factors including pre-existing medical conditions such as diabetes, heart disease, etc. behaviours such as smoking, obesity, etc. The results will contribute to future policy decisions regarding those most at risk of contracting COVID-19. The letter for 2021/22 expected a continuation of PHE’s response to the wider health impacts of COVID-19. On the basis of data currently accessible, Public Health England is developing a reasonably detailed understanding of what happens at secondary care level. Patients can be assessed on the basis of age, gender, underlying conditions, ethnicity and so on, but are however a subset of the broader general population which provides the basis. To complete the epidemiological understanding of the epidemic a more granular view of determinants, pathways and outcomes at population level, as opposed to hospital level, is required. PHE therefore wish to address a number of questions for both monitoring and planning purposes, e.g: Following the disestablishment of PHE in September 2021, this responsibility now falls to OHID (within DHSC). The broad aim underpinning this request is understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks, for monitoring and planning purposes. COVID-19 presents a significant threat to the population in terms of increased morbidity and mortality, particularly among vulnerable groups such as those with pre-existing disease. DHSC will undertake analysis to assess the relationship between COVID-19 and potential risk factors including pre-existing medical conditions such as diabetes, heart disease, etc. behaviours such as smoking, obesity, etc. The results will contribute to future policy decisions regarding those most at risk of contracting COVID-19. On the basis of data currently accessible, DHSC is developing a reasonably detailed understanding of what happens at secondary care level. Patients can be assessed on the basis of age, gender, underlying conditions, ethnicity and so on, but are however a subset of the broader general population which provides the basis. To complete the epidemiological understanding of the epidemic a more granular view of determinants, pathways and outcomes at population level, as opposed to hospital level, is required. DHSC therefore wish to address a number of questions for both monitoring and planning purposes, e.g: [3 paragraphs unchanged] The incident uses a series of daily line-lists – lists of cases and COVID related deaths – to manage the outbreak. The line lists underpin PHE’s DHSC’s understanding of the epidemiology of the disease, drive disease surveillance, feed disease [17 words unchanged] The lists are enriched through linkage to other datasets – for example PHE DHSC link to HES data sets to improve ethnicity coding of cases and link to daily mortality data to estimate survival and recovery. PHE DHSC aim to further gain an understanding of the pathway of the COVID19 infection and the risk factors which affect this at each stage. In order to deliver the outputs above PHE DHSC will link the GPES Data for Pandemic Planning and Research (GDPPR) to the following datasets: • Second Generation Surveillance System (SGSS) - PHE UKHSA - this produces the line list for cases • Covid-19 Hospitalisation in England Surveillance System (CHESS) - PHE UKSHA • Hospital Episode Statistics (HES) - NHS Digital • Secondary Use Service Data (SUS+) - NHS Digital • Emergency Care Dataset (ECDS) – NHS Digital [3 paragraphs unchanged] This linked identifiable data set will be analysed by PHE DHSC to identify the epidemiological characteristics of patients with Covid-19, including their demographic [7 words unchanged] risk factors, as detailed above. The data will also be used by PHE DHSC to monitor changes over time in these patients’ epidemiological characteristics, and to monitor their clinical outcomes from Covid-19 and any other health problems such as healthcare associated infections. PHE DHSC has the remit to investigate the impact of multi-morbidity, ethnicity and deprivation, [22 words unchanged] assess and monitor the wider impact of COVID on outcomes and inequalities. According to analysis from PHE, the risk of dying among those diagnosed from COVID-19 is higher in those in Black, Asian and Minority Ethnic (BAME) groups than in White ethnic groups. An analysis of survival among confirmed COVID-19 cases shows that, after accounting for the effect of sex, age, deprivation and region, people of Bangladeshi ethnicity had around twice the risk of death when compared to people of White British ethnicity. People of Chinese, Indian, Pakistani, Other Asian, Caribbean and Other Black ethnicity had between 10 and 50% higher risk of death when compared to White British. Similar results have been published from ONS. However the analysis so far does not take into account the existence of comorbidities which are strongly associated with the risk of dying from COVID-19 and may explain some of the differences. In addition, people from ethnic minorities are more likely to have pre existing health conditions such as diabetes, heart disease and cancer, which are diseases which in combination with COVID-19 can lead to mortality. For the above reasons, it is important to take into account the existence of comorbidities into an analysis of survival among confirmed COVID-19 cases. [1 paragraph unchanged] The lawful basis for processing data under GDPR has been reviewed against [28 words unchanged] interest or in the exercise of official authority vested in the controller)’. public The Office for Health England Improvement and Disparities exists to protect and improve the nation's health and wellbeing, and reduce health inequalities and is an executive agency, sponsored by part of the Department of Health & Social Care. And because health data is [85 words unchanged] and safety of health care and of medicinal products or medical devices’. PHE have a Caldicott Guardian who has overall responsibility for the use of healthcare data. The legal basis for identifiable data to flow from NHS Digital to PHE is under Regulation 3(4) of the National Health Service (Control of Patient Information Regulations) 2002 (COPI). DHSC have a Caldicott Guardian who has overall responsibility for the use of healthcare data. It is in the public interest because it will help DHSC understand the virus and the actions that will lessen its effect on the UK population; innovate responses, including diagnostics, drugs and vaccines, and use the evidence to inform the development of the most effective models of care. The legal basis for identifiable data to flow from NHS England to DHSC is under Regulation 3(4) of the National Health Service (Control of Patient Information Regulations) 2002 (COPI).

Processing activities

[1 paragraph unchanged] 1. Record level patient identifiable PID-level GPES Data for Pandemic Planning and Research (GDPPR) data extracts on a fortnightly quarterly basis are required to flow from NHS Digital England to PHE. DHSC. Data which flows from NHS Digital England to PHE DHSC will not be minimised as it has been assessed that the all fields required for analysis and linkage by PHE DHSC are necessary. PHE DHSC themselves will minimise the data once linked for specific usages, PHE DHSC analysts will apply to the applicant team in order to access the [19 words unchanged] apply appropriate data minimisation according to the needs of the individual project. 2. In order to deliver the outputs above PHE DHSC will link the GDPPR to the following datasets: • Second Generation Surveillance System (SGSS) - PHE UKHSA • Covid-19 Hospitalisation in England Surveillance System (CHESS) - PHE UKHSA • Hospital Episode Statistics (HES) - NHS Digital • Secondary Use Service Data (SUS+) - NHS Digital • Emergency Care Dataset (ECDS) – NHS Digital [3 paragraphs unchanged] 3. PHE DHSC reviews access requests from PHE DHSC analysts PHE DHSC will not share data with any third parties not named in this agreement. There are specific individual projects within PHE DHSC requiring access to GDPPR data, at different stages of definition and implementation. PHE DHSC analysts will apply to the applicant team in order to access the [5 words unchanged] data sets, who will ensure the purpose of data processing is COVID-19 related, related and apply appropriate data minimisation according to the needs of the individual project. PHE DHSC estimate the number of PHE DHSC analysts working on this data to be 50 during the lifetime of this agreement. This approach was the basis on which the NHS Digital CMO England Chief Medical Officer prioritisation was given for this release. It is a special condition of this agreement that any PHE DHSC study wishing to access the record-level data for the purposes of research will be required to apply for a separate data sharing agreement with NHS Digital, England, and provide the appropriate Ethics approval for the research. PHE DHSC currently have no oversight of the proposed GDPPR research planning applications. PHE DHSC will not use the data for performance management [1 paragraph unchanged] All fields of data are required. Data Minimisation will occur at a Local Level by PHE DHSC to align to the data requirements of each PHE DHSC team using the data. For most of the questions raised, the GPES [13 words unchanged] only positive COVID participants would reduce the effectiveness of the data analysis. [1 paragraph unchanged] Data provided by NHS Digital England are held by PHE UKHSA in a secure data service. The primary users of the data will be substantive PHE DHSC analytical staff working on the incident and its impacts. PHE DHSC has several GP data sets but this will be the most comprehensive in terms of coverage, and the most contemporaneous. PHE DHSC have a number of experienced primary care data analysts who will work [6 words unchanged] and analysis. Access to the data is limited to substantive employees of PHE DHSC or individuals under an Academic Honorary contract with PHE DHSC who are only allowed to use the data for the purposes described in this agreement. Academic Honorary contracts are approved on a case by case case-by-case basis by the Academic Public Health Research Strategy section (APHRS). Those Access to the data can only be granted to those on an Honorary contract will access these data through PHE systems using PHE laptops for network connection and follow honorary contracts where NHS England have approved the IG training and access controls required of all PHE staff. It is estimated that the number of Honorary contract holders working on this data to be 10 during the lifetime of this agreement. 'new' (UKHSA) forms. Those on an Honorary contract will access these data through DHSC systems using DHSC laptops for network connection and follow the IG training and access controls required of all DHSC staff. It is estimated that the number of Honorary contract holders working on this data to be 10 during the lifetime of this agreement. [1 paragraph unchanged] The GDPPR data will be held in the PHE UKHSA Data Lake and access to the data will be governed by the existing access management controls and governance arrangements. [1 paragraph unchanged] • PHE DHSC Caldicott sign off for all processing of patient identifiable data to ensure it is appropriate and proportionate • Confirmation from deputy director (or their named deputy) that the use [9 words unchanged] to the uses outlined in this agreement and is required to deliver PHE’s DHSC’s business plan and core remit. [2 paragraphs unchanged] All data shared under this agreement is processed and stored in secure locations within England and Wales and will not be shared outside PHE, DHSC, other than in the form of aggregated outputs with small numbers suppressed. Record level data flowing under this agreement is not permitted to be onwardly shared without an amendment and approval being granted by NHS Digital. England. PHE DHSC separate Person Identifiable Data (PID) from non-PCD non-PID data. PHE DHSC created a pseudonymised version of data for analysis. Access to PID and [17 words unchanged] for PID generally goes through the IG team and for Caldicott review. The statistical outputs based on the linked data are published by PHE DHSC as aggregate counts and rates (for example, at https://www.gov.uk/government/organisations/public-healthengland/about/statistics), with small numbers suppressed in accordance with NHS Digital England (see Disclosure Rules below) and Office for National Statistics guidance. [2 paragraphs unchanged] Whilst there are no specific GDPPR disclosure controls, outputs for public consumption should follow the Government (ONS) Statistical Service disclosure controls. We recommend It is recommended that users review and follow the disclosure control guidelines as set out within the HES Analysis Guide. Some, but not all requirements are outlined below: [8 paragraphs unchanged] PHE DHSC will not share any NHS Digital England data with any third parties. Main thematic areas: This GPES data intends to enable enquiry by multiple DHSC researchers into the broader phenomenology of COVID, beyond the narrow clinical secondary care environment. There are specific individual projects within DHSC requiring access to GPES, at different stages of definition and implementation. It is more convenient to list the following main areas of investigation: • Descriptive statistics Data currently accessible have allowed increased understanding of epidemiological features at secondary care level. Patients can be assessed on the basis of age, gender, underlying conditions, ethnicity and so on, but are however a subset of the broader general population which provides the basis. To complete the epidemiological understanding of the epidemic, any research will require a more granular view of determinants, pathways and outcomes at population level, as opposed to hospital level. Therefore, a comprehensive picture of population demographics, population subgroups (age, gender, ethnicity, deprivation, location, occupation) becomes necessary. This, in turn, needs to be linked to outcomes (mortality, LOS, ICU use) to understand different risk profiles. As an example, assessing the epidemiology of positive tests (age, gender, ethnicity, deprivation, Acorn scores, etc) and the trends in testing and positive tests. • Risk factors and wider determinants GPES data will be used by DHSC to analyse the relationship between COVID-19 (infection and/or complications) and potential risk factors including pre-existing medical conditions such as diabetes, heart disease, etc. behaviours such as smoking, obesity, and population characteristics such as deprivation, ethnicity, location. This has been published see link to publication. https://www.ons.gov.uk/peoplepopulationandcommunity/birthsdeathsandmarriages/deaths/articles/updatingethniccontrastsindeathsinvolvingthecoronaviruscovid19englandandwales/latest. Research here will help understand whether the risk of COVID-19 infection and complications is greater in vulnerable groups such as homeless people, migrants, people with disabilities, asylum seekers and refugees, and people with learning disabilities. • Patient flows through the system The epidemic has shown different pathways for COVID cases. Combining GDPPR data, hospital data, mortality data and testing data It is intended to describe the progress through the pathway, and the different outcomes. There is a need to understand more in detail progression from infection to admission and final outcome, time lags and movements of patients between home, community care, primary care and hospital. • Impact of specific programmes - Health Checks (NHSHC) Research is needed to investigate if CVD risk assessment captured as part of the NHSHC programme can be used to identify persons at risk of severe COVID-19 outcomes. This research will inform part of the review of the NHSHC programme. This work will be published in academic papers, and as part of the review of the NHSHC programme. The intention is to link GDPPR data to HES, mortality data and Health Checks data. • Wider impact GPES data will be linked to hospital data, mortality data, Syndromic Surveillance data, CHESS data, survey data (Lifestyle & Opinion Survey), Suicide Surveillance data, data on employment, social care, consumer habits. These will allow to monitor, on a timely basis, the indirect effects of the pandemic and impact of social distancing measures. In addition to morbidity and mortality resulting directly from COVID-19 infection, adverse outcomes may result indirectly from COVID-19 health-system pressures, or as an unintended consequence of the delay measures, such as exacerbating poor mental health or domestic violence. Projects to be supported by these data include the monitoring of national and inequalities data, new Fingertips profiles with Local Authority data, Mortality Trends and Exceedances Monitoring, Changes in service provision using real time data sources including CVD trends - Mortality, & Case Fatality. Results will take the form of reports, dashboards, and indicator production. There are inevitably areas of overlap and mutual support. For most of the questions raised, the GPES extract needs to cover both positive and negative tests. Minimising the data to only positive COVID participants would reduce the effectiveness of the analysis.

Expected output

Main thematic areas: There are immediate outputs, such as reports, academic publications, inputs into dashboards and production of Fingertips indicators. There are additional outputs such as contributing to an early warning system and increased understanding of the requirements of near-real time surveillance. Beyond that, this research clarifies operational developments around one of Public Health England’s strategic priorities, i.e. DHSC's 5-Year Strategy, priority 9, “Enhanced data and surveillance capabilities”.(https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/830105/DHSC_Strategy__2020-25__Executive_Summary.pdf) This GPES data intends to enable enquiry by multiple PHE researchers into the broader phenomenology of COVID, beyond the narrow clinical secondary care environment. There are specific individual projects within PHE requiring access to GPES, at different stages of definition and implementation. It is more convenient to list the following main areas of investigation: Patient and Public Involvement (PPI) - DHSC's public involvement team give advice and guidance on public involvement activity, commission an annual public opinion survey carried out by Ipsos MORI and manage the DHSC's People's Panel. The People's Panel is a group of 500 members of the public who have expressed an interest in being involved at a level that suits them: from completing online surveys to taking part in a focus group or sitting on a committee. It will work with the incident management team which is the overall Governance Group during the current epidemic response. • Descriptive statistics The PPI group will specifically be used to hold focus groups and surveys on the uses of the GDPPR data within DHSC to gain insight and feedback from patients directly. The PPI group has been used in the past by OHE to do such work on other disease areas and with other datasets. Data currently accessible have allowed increased understanding of epidemiological features at secondary care level. Patients can be assessed on the basis of age, gender, underlying conditions, ethnicity and so on, but are however a subset of the broader general population which provides the basis. To complete the epidemiological understanding of the epidemic, any research will require a more granular view of determinants, pathways and outcomes at population level, as opposed to hospital level. Therefore, a comprehensive picture of population demographics, population subgroups (age, gender, ethnicity, deprivation, location, occupation) becomes necessary. This, in turn, needs to be linked to outcomes (mortality, LOS, ICU use) to understand different risk profiles. As an example, assessing the epidemiology of positive tests (age, gender, ethnicity, deprivation, Acorn scores, etc) and the trends in testing and positive tests. • Risk factors and wider determinants GPES data will be used by PHE to analyse the relationship between COVID-19 (infection and/or complications) and potential risk factors including pre-existing medical conditions such as diabetes, heart disease, etc. behaviours such as smoking, obesity, and population characteristics such as deprivation, ethnicity, location. This is expected to be published in September 2020, i.e. a publicly available report or paper for a medical journal. Research here will help understand whether the risk of COVID-19 infection and complications is greater in vulnerable groups such as homeless people, migrants, people with disabilities, asylum seekers and refugees, and people with learning disabilities. • Patient flows through the system The epidemic has shown different pathways for COVID cases. Combining GDPPR data, hospital data, mortality data and testing data, we intend to describe the progress through the pathway, and the different outcomes. There is a need to understand more in detail progression from infection to admission and final outcome, time lags and movements of patients between home, community care, primary care and hospital. • Impact of specific programmes - Health Checks (NHSHC) Research is needed to investigate if CVD risk assessment captured as part of the NHSHC programme can be used to identify persons at risk of severe COVID-19 outcomes. This research will inform part of the review of the NHSHC programme. This work will be published in academic papers, and as part of the review of the NHSHC programme. The intention is to link GDPPR data to HES, mortality data and Health Checks data. • Wider impact GPES data will be linked to hospital data, mortality data, Syndromic Surveillance data, CHESS data, survey data (Lifestyle & Opinion Survey), Suicide Surveillance data, data on employment, social care, consumer habits. These will allow to monitor, on a timely basis, the indirect effects of the pandemic and impact of social distancing measures. In addition to morbidity and mortality resulting directly from COVID-19 infection, adverse outcomes may result indirectly from COVID-19 health-system pressures, or as an unintended consequence of the delay measures, such as exacerbating poor mental health or domestic violence. Projects to be supported by these data include the monitoring of national and inequalities data, new Fingertips profiles with Local Authority data, Mortality Trends and Exceedances Monitoring, Changes in service provision using real time data sources including CVD trends - Mortality, & Case Fatality. Results will take the form of reports, dashboards, and indicator production. Target date Q3 2020. There are inevitably areas of overlap and mutual support. For most of the questions raised, the GPES extract needs to cover both positive and negative tests. Minimising the data to only positive COVID participants would reduce the effectiveness of the analysis. There are immediate outputs, such as reports, academic publications, inputs into dashboards and production of Fingertips indicators. There are additional outputs such as contributing to an early warning system and increased understanding of the requirements of near-real time surveillance. Beyond that, this research clarifies operational developments around one of Public Health England’s strategic priorities, i.e. PHE's 5-Year Strategy, priority 9, “Enhanced data and surveillance capabilities”, and the development of the Public Health Intelligence System (PHISy) (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/830105/PHE_Strategy__2020-25__Executive_Summary.pdf) Patient and Public Involvement (PPI) - PHE's public involvement team give advice and guidance on public involvement activity, commission an annual public opinion survey carried out by Ipsos MORI and manage the PHE's People's Panel. The People's Panel is a group of 500 members of the public who have expressed an interest in being involved at a level that suits them: from completing online surveys to taking part in a focus group or sitting on a committee. It will work with the incident management team which is the overall Governance Group during the current epidemic response. The PPI group will specifically be used to hold focus groups and surveys on the uses of the GDPPR data within PHE to gain insight and feedback from patients directly. The PPI group has been used in the past by OHE to do such work on other disease areas and with other datasets. [1 paragraph unchanged] To estimate the Years of Life Lost for cohorts of individuals in different population subgroups who have received a positive COVID-19 diagnosis. The analysis will compare the outcomes of individuals within the cohorts that have and haven’t received a positive diagnosis for COVID-19. The results of the analysis will provide estimates of the average years of life lost from COVID-19 deaths, broken down by demographic attributes, which we will use to modify the estimates of expected deaths, allowing us more accurately to estimate excess deaths, and to predict winter deaths for NHS England.

Expected measurable benefits

[1 paragraph unchanged] For that purpose, broader understanding of risk factors, population susceptibility, wider determinants, [5 words unchanged] impact on and use of health services is required. This will allow PHE DHSC to identify population sub-groups at risk, monitor the progression of the epidemic, and develop appropriate models of care. In addition, it will play an important role in feeding back [15 words unchanged] interventions and measures prescribed, in order to enhance compliance and allay fears. [2 paragraphs unchanged] Since the dissolvement of PHE, UKHSA (under DHSC) sets out its delivery plan : https://www.gov.uk/government/publications/department-of-health-and-social-care-outcome-delivery-plan/department-of-health-and-social-care-outcome-delivery-plan-2021-to-2022 [7 paragraphs unchanged] For all thematic areas outlines above, outputs based on this would be [14 words unchanged] include, but would not be restricted to, non-public facing data to support PHE and DHSC policy and public-facing data in PHE DHSC tools, reports and bulletins, presentations and journal papers. The statistical outputs based on the linked data are published by PHE DHSC as aggregate counts and rates, with small numbers suppressed in accordance with NHS Digital England (as outlined in Section "Processing Activities") and Office for National Statistics guidance.

Benefits reported

At the time of this renewal, there has been a delay in receiving data from NHS Digital, and thus data analysis has not been able to start until very recently and therefore there have not - as yet - been any yielded benefits. Due to resource constraints, there have only been two drops of data. As a consequence, the data have been used in a limited way. The main benefit derived from access to the GPES Data has been their use in the ‘Mortality Displacement Tool’, an important instrument used by the Department of Health and Social Care to monitor the impact of the pandemic, and which would be impossible to maintain without continuous access to primary care data.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

**** This renewal of the original agreement with the Data Controller is to continue to obtain record-level patient identifiable PID-level GPES Data for Pandemic Planning and Research (GDPPR) data extracts on a fortnightly basis from NHS digital until the end of the current Control of Patient Information Regulations) 2002 (COPI) notice, which at the time of this renewal is set at 30/09/2021 **** [22 paragraphs unchanged]

Processing activities

[1 paragraph unchanged] 1. Record level patient identifiable PID-level GPES Data for Pandemic Planning and Research (GDPPR) data extract is extracts on a fortnightly basis are required to flow from NHS Digital to PHE. Data which flows from [69 words unchanged] apply appropriate data minimisation according to the needs of the individual project. [43 paragraphs unchanged]

Benefits reported

Yielded Benefits is not a requirement for new applications. At the time of this renewal, there has been a delay in receiving data from NHS Digital, and thus data analysis has not been able to start until very recently and therefore there have not - as yet - been any yielded benefits.

Unchanged: Expected output, Expected measurable benefits.