GDPPR Template for Local Authority

NHS Digital has been provided with the necessary powers to support the Secretary of State’s response to COVID-19 under the COVID-19 Public Health Directions 2020 (COVID-19 Directions) and support various COVID-19 purposes, the data shared under this agreement can be used for these specified purposes except where they would require the reidentification of individuals.

GPES data for pandemic planning and research (GDPPR COVID 19)

To support the response to the outbreak, NHS Digital has been legally directed to collect and analyse healthcare information about patients from their GP record for the duration of the COVID-19 emergency period under the COVID-19 Directions.

The data which NHS Digital has collected and is providing under this agreement includes coded health data, which is held in a patient’s GP record, such as details of:

• diagnoses and findings

• medications and other prescribed items

• investigations, tests and results

• treatments and outcomes

• vaccinations and immunisations

Details of any sensitive SNOMED codes included in the GDPPR data set can be found in the Reference Data and GDPPR COVID 19 user guides hosted on the NHS Digital website. SNOMED codes are included in GDPPR data.

There are no free text record entries in the data.

The Controller will use the pseudonymised GDPPR COVID 19 data to provide intelligence to support their local response to the COVID-19 emergency. The data is analysed so that health care provision can be planned to support the needs of the population within the CCG area for the COVID-19 purposes.

Such uses of the data include but are not limited to:

• Fulfilling our duty within the Health and Social Care Act 2012, and Directors of Public Health under the Health and Social Care Act 2012. This is in relation to the legal context for managing outbreaks of communicable disease which present a risk to the health of the public requiring urgent investigation.

• Analysis to support the operational response to COVID-19 as part of the Local Outbreak Management Plan.

o COVID-19 is here for a long period of time. There is an ongoing need for robust COVID-19 data that can be used to support the Public Health and wider system response.

o This includes working closely alongside adult social care, children and young people’s services, trading standards, districts and boroughs and health colleagues, to triangulate data and intelligence to reduce the spread of COVID-19 and reduce the impact of COVID-19 at a population level.

• Supporting the Suffolk Health Protection Board to:

o Coordinate the response to COVID-19 at a place level

o Identify actions to both prevent and manage outbreaks among settings, cohorts and high-risk individuals

o Reviews the data and evidence to make and agree recommendations on actions

• Using the data to highlight Public Health monitored characteristics of individuals who have had COVID-19. For example:

o Data on ethnicity is poorly coded in the COVID-19 case data. Using GDPPR would enable Public Health colleagues to interrogate the data for inequalities in COVID-19.

o GDPPR data could be audited to explore key characteristics of patients with COVID-19. This is potentially something that CCG colleagues would not have the appropriate resource to undertake. However, it would be crucial in planning for any future waves or ongoing monitoring of COVID-19. The Council estimates COVID-19 cases and outbreaks will likely be focused among those communities and individuals already experiencing worse social, economic and health outcomes.

o Public Health still need to monitor patients at risk of requiring hospital admission due to COVID-19 based on shared characteristics or identified co-morbidities, as well as risks associated with health inequalities. Again, this could mitigate the risk of harm in the most vulnerable cohorts

• Analysis of vaccination data – to identify uptake rates and any inequalities that appear to be affecting uptake, and to inform targeted actions and response. Public Health do not currently have access to line level vaccination data, or vaccination data linked to GPs. Identification of cohorts with lower vaccination uptake will help target the public health response, and target areas where inequalities may be more prevalent.

• Analysis of those that declined a vaccination will also be important – to look at key characteristics of these individuals

• Public Health colleagues can also use this data to monitor uptake of any booster vaccinations and look for low uptake.

• Analysis to understand the long-term direct and indirect impacts of COVID-19 on health and health inequalities, a key area of focus being long COVID. Data is currently limited to national percentages applied to local populations. This is beyond the remit of CCG colleagues to explore, but a key research area for Public Health. The SNOMED cluster (Possible post-COVID19 illness, recovery or assessment) would prove beneficial in identifying indicators of long COVID.

• Analysis of missed appointments - Analysis of local missed/delayed referrals due to the COVID-19 crisis to estimate the potential impact on health inequalities, linked to Paragraph 2.2.3 of the COVID-19 Directions. From a public health perspective, it is imperative to understand the potential impact of COVID-19 on population health – i.e. missed or delayed appointments that could lead to later identification of disease and worse outcomes.

For clarity, all references to Public Health colleagues / team refer to a division within Suffolk County Council. Public Health colleagues / team is part of Suffolk County Council and are not part of the CCG.

COVID Vaccine data

NHS England and NHS Digital have agreed that NHS Digital should become a joint controller of the Vaccine Data with NHS England under the COVID-19 Public Health (NHS England) Directions 2020 (COVID-19 Directions) to facilitate the analysis, linkage and dissemination of the Vaccine Data to requestors who have an appropriate legal basis to process it.

There is high demand from CCGs for the Vaccine Data which will help them;

- Understand vaccine categories and success of population roll out in their respective areas, required for weekly report to NHSE/Cabinet office

- Understand and decide whether new vaccine sites are required and stock control of vaccines to ensure immediate delivery/deploy to appropriate patients.

- Moderate and manage readmissions post vaccine e.g. how many patients are being re-admitted post vaccination

- Monitor secondary care Shielded patient activity post-vaccination.

- Identifying areas of low vaccine take-up and work directly with local communities and community leaders to address concerns.

- Ensure vulnerable individuals and groups are identified and supported through the vaccination process to ensure the maximum possible vaccination uptake.

NHS Digital has agreed to share the data with the recipients and their processors for the purpose of supporting the recipients in their local response to the COVID-19 emergency as part of the national response to the COVID-19 pandemic.

The Vaccine Data will include;

- Patient demographics

- Source organisation (where the vaccination data originated)

- Vaccination appointment and outcome details

- Vaccine batch details

COVID-19 Ethnic Category Data Set

NHS Digital has created a small stand-alone dataset known as the COVID-19 Ethnic Category Data Set. This data set is created using ethnic category data from the General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (COVID-19) (GDPPR) and Hospital Episodes Statistics (HES). By combining GDPPR ethnic category data with the latest available ethnicity data in HES, NHS Digital can substantively increase coverage in ethnic category data and therefore add strength to the GDPPR dataset when linked.

LINKAGE

The data may only be linked by the Data Controller or their respective Data Processor, to other pseudonymised datasets which it holds under a current data sharing agreement only where such data is provided for the purposes of general commissioning by NHS Digital. The Health Service Control of Patient Information Regulations (COPI) will also apply to any data linked to the data under this agreement.

The linked data may only be used for purposes stipulated within this agreement and may only be held and used whilst both data sharing agreements are live and in date. Using the linked data for any other purposes, including non-COVID-19 purposes would be considered a breach of this agreement.

RE-IDENTIFICATION

Reidentification of individuals under the GDPPR data is not permitted under this DSA.

Reidentification of individuals under the vaccination dataset is permitted but only for the purposes of direct care and is strictly limited to direct health care professionals or local authority direct care staff only with a legitimate relationship to the patient. All re-identification requests will be processed and authorised by the DSCRO on a case by case basis.

LEGAL BASIS FOR PROCESSING DATA:

Legal Basis for NHS Digital to Disseminate the Data:

NHS Digital is able to disseminate data with the Recipients for the agreed purposes under a notice issued to NHS Digital by the Secretary of State for Health and Social Care under Regulation 3(4) of the Health Service Control of Patient Information Regulations (COPI) dated 17 March 2020 (the NHSD COPI Notice).

The Recipients are covered by Regulation 3(3) of COPI and the agreed purposes (paragraphs 2.2.2-2.2.4 of the COVID-19 Directions, as stated below in section 5a) for which the disseminated data is being shared are covered by Regulation 3(1) of COPI.

Under the Health and Social Care Act, NHS Digital is relying on section 261(5)(d) – necessary or expedient to share the disseminated data with the Recipients for the agreed purposes.

NHS Digital will publish details about the sharing of the disseminated data with the Recipient in its Data Release Register.

Legal Basis for Processing:

The Recipients are able to receive and process the disseminated data under a notice issued to the Recipients by the Secretary of State for Health and Social Care under Regulation 3(4) of COPI dated 20th March (the Recipient COPI Notice section 2).

The Secretary of State has issued notices under the Health Service Control of Patient Information Regulations 2002 requiring the following organisations to process information:

Local Authorities

The Secretary of State for Health and Social Care has issued NHS Digital with a Notice under Regulation 3(4) of the National Health Service (Control of Patient Information Regulations) 2002 (COPI) to require NHS Digital to share confidential patient information with organisations permitted to process confidential information under Regulation 3(3) of COPI. These include:

• persons employed or engaged for the purposes of the health service

Local Authorities have a legal responsibility under Section 3 of the Care Act 2014 to conduct tasks that are in the public interest to promote integration of care and support with health services

Under GDPR, the Recipients can rely on Article 6(1)(e) – Public Task to receive and process the Disclosed Data from NHS Digital for the Agreed Purposes under the Recipient COPI Notice. As this is health information and therefore special category personal data the Recipients can also rely on Article 9(2)(h) –preventative or occupational medicine and para 6 of Schedule 1 DPA – statutory purpose.

PROCESSING CONDITIONS:

Data must only be used for the purposes stipulated within this Data Sharing Agreement. Any additional disclosure / publication will require further approval from NHS Digital.

Data Processors must only act upon specific instructions from the Data Controller.

All access to data is managed under Role-Based Access Controls. Users can only access data authorised by their role and the tasks that they are required to undertake.

Patient level data will not be linked other than as specifically detailed within this Data Sharing Agreement.

NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract i.e.: employees, agents and contractors of the Data Recipient who may have access to that data).

The Recipients will take all required security measures to protect the disseminated data and they will not generate copies of their cuts of the disseminated data unless this is strictly necessary. Where this is necessary, the Recipients will keep a log of all copies of the disseminated data and who is controlling them and ensure these are updated and destroyed securely.

Onward sharing of patient level data is not permitted under this agreement. Only aggregated reports with small number suppression can be shared externally.

The data disseminated will only be used for COVID-19 purposes as described in this DSA, any other purpose is excluded.

SEGREGATION:

Where the Data Processor and/or the Data Controller hold both identifiable and pseudonymised data, the data will be held separately so data cannot be linked.

AUDIT

All access to data is auditable by NHS Digital in accordance with the Data Sharing Framework Contract and NHS Digital terms.

Under the Local Audit and Accountability Act 2014, section 35, Secretary of State has power to audit all data that has flowed, including under COPI.

DATA MINIMISATION:

Data Minimisation in relation to the data sets listed within the application are listed below:

• Patients who are normally registered and/or resident within the CCG region (including historical activity where the patient was previously registered or resident in another commissioner area).

and/or

• Patients treated by a provider where the CCG is the host/co-ordinating commissioner and/or has the primary responsibility for the provider services in the local health economy.

and/or

• Activity identified by the provider and recorded as such within national systems (such as SUS+) as for the attention of the CCG.

The Data Services for Commissioners Regional Office (DSCRO) obtains the following data sets:

- GDPPR COVID 19 Data

- COVID Vaccine Data

- COVID-19 Ethnic Category Data Set

Pseudonymisation is completed within the DSCRO and is then disseminated as follows:

1. Pseudonymised GDPPR COVID 19, COVID Vaccine and COVID-19 Ethnic Category Data Set data is securely transferred from the DSCRO to the Data Controller / Processor

2. Aggregation of required data will be completed by the Controller (or the Processor as instructed by the Controller).

3. Patient level data may not be shared by the Controller (or any of its processors).

• Operational planning and management of Suffolk County Council resources. The virus and its variants will continue to circulate for some time, and both the public and the local authority will need to focus on living with the virus, requiring data and intelligence to support this (ongoing). This will include continued provision of advice and guidance to the Suffolk population – for example via the Healthy Suffolk website - through maintaining and updating current policies and messaging in line with identified trends, outbreaks, and best practice.

• To monitor the current impact of COVID-19 within Suffolk’s population, (ongoing) and identify any key considerations in respect of planning for future waves, especially up until Christmas 2021, and for future winter planning measure. In particular it would enable improved planning for local authority commissioned services such as the Home But Not Alone service.

• Investigating and monitoring the effects of COVID-19 in line with the Local Outbreak Management Plan. For example:

o the need for timely and accurate local data relating to COVID cases and outbreaks is likely to continue. In the event of future waves, rapid local action, for example surge testing, will require immediate input in terms of mapping, and identifying those who may need support to take a test or need a home test.

o work to further understand the impact of inequalities on COVID-19 in Suffolk, and the use of linked data to enable integrated teams to take action to mitigate those inequalities and assist recovery.

o communication and engagement around Infection Prevention and Control, building up towards winter 2021/22

o continue to look at those most disadvantaged by COVID-19 and ensure they are directed to appropriate support wherever possible. This work will happen by working closely through our Collaborative Communities Board and our Engaged Communities team to ensure it is targeted and effective in supporting self-isolation.

• Investigation of provisional cases of long covid in Suffolk (by Autumn 2021) to assist the local authority to provide appropriate guidance, messaging and advice to those within the wider Suffolk population identified as being most at risk.

• Reports for NHSE/Cabinet Office on the success of Vaccine rollout

• Identification of areas of low vaccine take up leading to work with local communities to address concerns

• Assist local authority commissioners to make decisions to support improvement of population health, alongside working in collaboration with CCG commissioners to improve population health from a clinical (CCG) and population health perspective (LA), to identify cohorts that may need targeted support/intervention.

• Identifying cohorts within the Suffolk population that are at the highest risk of adverse impacts of COVID-19, for example based on location, ethnic group or having one or more long term health conditions.

• Identifying COVID-19 trends within the Suffolk population and risks to public health within specific population groups.

• Enables Public Health and Suffolk County Council to continue to provide local guidance and develop policies to respond to the outbreak and communicating best practice to Suffolk residents and businesses, as outlined in the specific outputs section above.

• Controlling and helping to prevent the spread of the virus

• Using analysis findings to inform targeted action to improve health outcomes and address health inequalities in those most at risk from COVID-19, for example, within specific geographic areas or of particular vulnerable groups.

• Controlling and helping to prevent the spread of the virus

• Maintaining the high percentage of the population receiving the vaccination

It is intended that analysis identified would be undertaken during the course of 2021, with some aspects requiring ongoing monitoring.

Yielded Benefits is not a requirement for new applications.