OpenSAFELY and High Cost Drugs Linkage

NHS England request this data to support their Coronavirus (COVID-19) research platform work (https://www.england.nhs.uk/contact-us/privacy-notice/how-we-use-your-information/covid-19-response/coronavirus-covid-19-research-platform/) which uses the OpenSAFELY secure analytics software (www.opensafely.org). NHS England is the data controller. NHS England has established honorary contracts with researchers at the DataLab at the University of Oxford and the Electronic Health Records (EHR) group at the London School of Hygiene and Tropical Medicine to assist in conducting Covid-19 relevant studies using the OpenSAFELY suite of analytic software - deployed inside existing electronic health record systems. The Phoenix Partnership (TPP) and Egton Medical Information Systems EMIS (GP electronic health record (EHR) software companies ) are the data processor listed in this agreement, under contract with NHS England. NHS England is the sole data controller; currently NHS England, TPP and EMIS are the data processors; GP Data from TPP and EMIS remains within the IT infrastructure of TPP and EMIS. There are therefore currently two examples of where the OpenSAFELY suite of analytics software are being used - OpenSafely-EMIS, and OpenSafely-TPP.

OpenSAFELY is a suite of analytics software that is deployed inside an existing EHR system to carry out studies (using the underlying data) - created to deliver urgent results during the global COVID-19 emergency. It is now successfully delivering analyses across more than 24 million patients’ full pseudonymised primary care NHS records (TPP patient GP data). All the analytic software is open for security review, scientific review, and re-use. OpenSAFELY analytics software uses a new model for enhanced security and timely access to data: it does not transport large volumes of potentially disclosive pseudonymised patient data outside of the secure environments managed by the electronic health record software company; instead, trusted analysts can run large scale computation across near real-time pseudonymised patient records inside the data centre of the electronic health records software company. This pragmatic and secure approach has allowed the first analyses to be delivered in just five weeks from project start. Outputs are available here: https://opensafely.org/outputs/ and approved projects are available here - https://approved-projects.opensafely.pages.dev/approved-projects/

The GP infrastructure is accredited to the ISO 27001 information security standard and is NHS Data Security and Protection Toolkit compliant.

Patient data has been pseudonymized at source for analysis and linkage using industry standard cryptographic hashing techniques (SHA512+salt). All pseudonymized datasets transmitted for linkage onto OpenSAFELY are encrypted. Access to OpenSafely-EMIS and OpenSafely-TPP is through a virtual private network (VPN) connection, restricted to a small group of researchers. The researchers, who hold honorary contracts with NHS England, only access OpenSafely-TPP or OpenSafely-EMIS to initiate database queries and statistical models; all database activity is logged; and only aggregate statistical outputs leave the environment following best practice for anonymization of results such as statistical disclosure control for low cell counts.

A pseudonym is generated from the NHS number using the SHA 512 cryptographic hashing algorithm, in combination with a ‘salt’. This pseudonym is used to link datasets. The salt is transferred between data sharing organisations separately in an encrypted email, and a phone call is made to provide the decryption key to unencrypt the salt. The same salt is used by TPP and EMIS; the salt will be refreshed at 6 monthly intervals. Only restricted individuals in TPP, EMIS and the external data providers are aware of the salt.

As a concrete example, TPP created an appropriate salt, which was shared by the process described above with the relevant individual in the Office of National Statistics (ONS). Both TPP and ONS applied the SHA 512 algorithm, in combination with a salt, to their NHS numbers. This creates a unique pseudonym for each NHS number which can be used to match records. The purpose of using a salt (only known to limited individuals involved in the data flow process) is to further reduce the risk of re-identifying any pseudonymised datasets through the use of brute force attacks.

As both TPP and EMIS would have the technical ability to re-identify the data through the use of mapping tables, the data is considered as confidential and requires COPI to address the common law duty of confidentiality.

There is a tiered level of restricted researcher access to the pseudonymised and de-identified data within OpenSafely-EMIS and OpenSafely-TPP providing enhanced security and privacy protections to the underlying dataset. The descriptions of these 'levels' are described in Processing Activities below. They range from Level 1 - Level 4.

As of February 2022, 9 developers (with NHS England honorary contracts) have access to the level 2 or level 3 environment for development and maintenance purposes only. The Level 2 environment is where the event level pseudonymised data is held. The Level 3 environment is where the specific analysis’ cohort data is held.

Researchers now only access the Level 4 environment where the aggregated results of their studies are held. The Level 4 environment is where researchers review the results and apply disclosure controls before requesting the data to be released. Two independent output-checkers review the results and only release them if there are no disclosure concerns. 72 researchers have access to the Level 4 environment; the 9 developers also have access to this Level 4 environment

For the avoidance of doubt, no researchers can access the Level 1 data (which is where the identifiable data is de-identified and hashed). The full explanation of the levels is contained in processing activities below.

With respect to the GP providers, TPP and EMIS, Level 1 refers to the source identifiable GP data which undergoes pseudonymisation and de-identification before being readied for linkage to create Level 2 data.

This approach to maintaining patient privacy has support from MedConfidential: “It (OpenSAFELY) was designed and built to promote both research and patient confidentiality at the same time, rather than suggesting they’re opposites,” says one of the (MedConfidential’s) co-founders. https://www.economist.com/science-and-technology/2020/05/14/the-pandemic-has-spawned-a-new-way-to-study-medical-records

Community - Local Provider Flow

NHS England will use OpenSafely-EMIS and OpenSafely-TPP to process community local flow provider data provided by NHS Digital (filtered and specified to provide detail on high-cost drugs) to deliver specific analysis on various medicines with the potential to identify treatment targets or identify currently unknown risks to patients on these medications.

The National Tariff High Cost Drugs List contains the High Cost Drugs which are not covered by national prices under the National Tariff Payment System. These drugs are typically used in a relatively small number of specialist centres rather than across all Trusts. Commissioners and providers are required to agree prices locally (https://www.gov.uk/government/news/high-cost-drugs).

A protocol has been created to support examination of the association between the use of immunosuppression to treat immune mediated inflammatory diseases and severe COVID-19 outcomes among adults in England and NHS England are ready to start the analysis immediately if the high-cost drugs data is made available. A draft report has also been produced on the use of the data so far.

The purposes for processing are to identify medical conditions and medications that affect the risk or impact of Covid-19 infection on individuals; this will assist with identifying risk factors associated with poor patient outcomes as well as information to monitor and predict demand on health services.

High cost drug data can also be used to answer questions directly related to 'confounders' and those people in the UK who are shielding. NHS England can rapidly review how such specific medications are associated with COVID-19 related outcomes, such as mortality, to help inform clinical and policy decisions on shielding criteria. Although shielding restrictions have recently been relaxed, this information could inform important future decisions on shielding in the event of a future waves.

Other NHS Digital Datasets

NHS England will also use datasets it receives from NHS Digital under DARS-NIC-139035-X4B7K and DARS-NIC-384608-C9B4L in the OpenSafely platform to further enhance the data. These dataset include:

- Secondary Uses Services Data (SUS+)

- Second generation surveillance system (SGSS)

- Civil Registration Data - Deaths

Data provided via NHS Digital will be used to:

- Determine which people are at highest risk of hospital admission, ventilation, or death, to inform 111 advice, management choices, seclusion advice, and service planning. For example, there may be certain pre-existing medical problems that put people at much higher risk of Covid-related admission or death, that have not yet been identified, and which mean new categories of people need to be in the high-risk group for self-seclusion during the pandemic. As COVID-19 continually is evolving, this is a continuous activity.

- Rapidly assess specific hypotheses around treatment or prevention as they arise including: the possible benefits of chloroquine or antiretroviral medication for HIV; the possible hazards of ibuprofen; the possible benefits of inhaled corticosteroids; the benefits or hazards of drugs that up-regulate ACE2 receptors (such as ACE inhibitors and angiotensin receptor blockers); possible beneficial effects from the JAK inhibitor baricitinib. These can all be rapidly assessed by assessing rates of admission and death among those who have, and have not, been routinely taking such medications in primary care.

- Combine disease dynamics modelling with near-real-time hyperlocal clinical data on prevalence and population at risk, to predict local spread and service need, and (for example) to design and evaluate exit strategies from lockdown.

- Measure and mitigate the indirect health impacts of Covid-19: subject to approval NHS England can monitor the data to identify “Covid Aftershocks” and give early warning on clinical work displaced, such as cancer referrals, cardiovascular management, and vaccinations. NHS England can also help identify NHS organisations in need of additional support around delivering good care as the pandemic continues; and rapidly identify success stories from new best practice that others can learn from.

- Rapidly evaluate the impact of national interventions (and collect outcomes data for pragmatic cluster randomised trials of preventative or treatment interventions), especially on specific patient groups.

- Inform operational issues such as identifying NHS organisations in need of additional support around delivering good care on Covid, and non-Covid care as the pandemic continues; or identify the best practice others can learn from.

OVERSIGHT OF PROJECT:

Currently, given the need to rapidly prioritise the research questions that should be answered, the first wave of analyses have been decided by consensus amongst the team of OpenSAFELY researchers at the University of Oxford DataLab and the EHR group at the London School of Hygiene and Tropical Medicine. These researchers hold honorary contracts with NHS England and are operating in line with NHS England's requirements to support the response to COVID-19. The researchers discuss research protocols with the EHR vendors to ensure that the data within the EHR can be reasonably expected to answer the questions raised. A specific study protocol is written by the OpenSAFELY researchers and a Principle Investigator must give approval for the research to proceed. External researchers may provide advice on the study protocol.

Following generation of the results, a paper is drafted which is shared with appropriate charity/professional representative groups for review. The pre-publication draft is shared with NHS England’s information governance team for review. Following revisions, the paper is submitted for publication in a peer-reviewed journal alongside being made openly available on a pre-print server.

The OpenSAFELY researchers have deep expertise in the use of EHR data as well as epidemiological research. They also have access to a wider network of public health doctors and scientists advising the government, such as SAGE (Scientific Advisory Group for Emergencies), with contact with the Chief Medical Officer and Chief Scientific Advisor, and have drawn on such networks and individuals to inform analyses.

NHS England has an established Oversight Board. The Oversight Board has had 4 meetings and their agenda, documents and meetings notes are publicly available: https://www.opensafely.org/governance/

Amendment to change data frequency

The current dataset in OpenSAFELY-TPP is a one off collection covering submissions from FY 2018/19 and FY 2019/20, and there is no process in place to routinely update the information available in the High Cost Drug dataset. Whilst this is very useful for assessing events and outcomes early in the COVID-19 pandemic, a routine update of the data is needed to assess current high-priority questions and future important questions. For example, a routine update to this data will allow assessment of COVID-19 vaccine effectiveness in people using high-cost medicines or indeed people with a recorded diagnosis likely to be treated with a High Cost Drug. Therefore the controller is requesting the data frequency is changed to adhoc. This will allow regular (likely to be monthly) refreshes of the data that will better inform the changing medications required to treat COVID-19 as the virus continually evolves and effects patients differently.

NHS North of England Commissioning Support Unit (CSU) host the North of England Data Services for Commissioners Regional Officer (DSCRO). North of England CSU is only being utilised for the dissemination of the data as this is processed through the CSU servers. The CSU does no further processing on the data.

Legal Basis for Processing Data

Data accessed under this Agreement will be processed in accordance with GDPR Article 6(1)(e) (processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller) and Article 9(2)(i) (processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy).

Common Law Duty of Confidentiality

Although the data is pseudonymised when it is disseminated, as TPP and EMIS are in receipt of the SALT key used for this project, the data is considered as confidential. NHS England are relying on Reg 3 (3) of the COPI Notice (2002) to allow the dissemination of confidential patient information without consent.

Reports commissioned by Scientific Advisory Group on Emergencies (SAGE), or Department of Health Chief Medical Officer (CMO) / Chief Scientific Advisor (CSA), Joint Biosecurity Centre, or requests that come through the NHS England single point of access that are relevant to the COVID-19 public health emergency.

Work is ongoing to onboard other researcher organisations to use the OpenSAFELY analytics software

Analyses, including supplements, will be openly published online, often initially to a pre-print journal, before submission to a peer review journal and be made available on the OpenSAFELY website as soon as possible (subject to journal restrictions on open access timelines): https://opensafely.org/outputs/

Abstracts/summaries may be used in conferences and for presentations.

As described above, all data outputs that leave OpenSAFELY-EMIS or OpenSAFELY-TPP will be aggregated and anonymised with small number suppression. There will be no restrictions on sharing such outputs which will also be shared with policy makers, the wider research community as well as the public.

The OpenSAFELY analytics software and associated tools and codelists are all open source and available for re-use (https://opensafely.org/code/); derived data that is published are not subject to any intellectual property.

All published outputs will only contain aggregated results with small number suppression applied.

An article has been published already about the use of the OpenSAFELY analytics software in regards to how it was used to characterise factors associated with COVID-19 death in 17 million patients.

https://www.nature.com/articles/s41586-020-2521-4

A further detailed report on the outputs of the data can also be found here - https://wellcomeopenresearch.org/articles/6-360

NHS England has used OpenSafely for informing policy on shielding and vaccine prioritisation; they have added substantially to the evidence base for how several drugs, like hydroxychloroquine and inhaled corticosteroids are associated with COVID-19; and work on vaccine uptake has highlighted the large discrepancies in coverage between different ethnicities and socioeconomic groups. This impact will continue throughout the pandemic, for example with work on vaccine efficacy and long COVID follow-up.

The OpenSAFELY platform has given the power to quickly respond to emerging clinical population health and policy challenges with precise data and open methods.

Further details of benefits obtained through the processing of this data can be found here https://www.medrxiv.org/content/10.1101/2021.09.03.21262888v1

NHS England request this data to support their Coronavirus (COVID-19) research platform work (https://www.england.nhs.uk/contact-us/privacy-notice/how-we-use-your-information/covid-19-response/coronavirus-covid-19-research-platform/) which uses the OpenSAFELY secure analytics software (www.opensafely.org). NHS England is the data controller. NHS England has established honorary contracts with researchers at the DataLab at the University of Oxford and the Electronic Health Records (EHR) group at the London School of Hygiene and Tropical Medicine to assist in conducting Covid-19 relevant studies using the OpenSAFELY suite of analytic software - deployed inside existing electronic health record systems. The Phoenix Partnership (TPP) and Egton Medical Information Systems EMIS (GP electronic health record (EHR) software companies ) are the data processor listed in this agreement, under contract with NHS England. NHS England is the sole data controller; currently NHS England, TPP and EMIS are the data processors; GP Data from TPP and EMIS remains within the IT infrastructure of TPP and EMIS. There are therefore currently two examples of where the OpenSAFELY suite of analytics software are being used - OpenSafely-EMIS, and OpenSafely-TPP.

OpenSAFELY is a suite of analytics software that is deployed inside an existing EHR system to carry out studies (using the underlying data) - created to deliver urgent results during the global COVID-19 emergency. It is now successfully delivering analyses across more than 24 million patients’ full pseudonymised primary care NHS records (TPP patient GP data). All the analytic software is open for security review, scientific review, and re-use. OpenSAFELY analytics software uses a new model for enhanced security and timely access to data: it does not transport large volumes of potentially disclosive pseudonymised patient data outside of the secure environments managed by the electronic health record software company; instead, trusted analysts can run large scale computation across near real-time pseudonymised patient records inside the data centre of the electronic health records software company. This pragmatic and secure approach has allowed the first analyses to be delivered in just five weeks from project start. Outputs are available here: https://opensafely.org/outputs/ and approved projects are available here - https://approved-projects.opensafely.pages.dev/approved-projects/

The GP infrastructure is accredited to the ISO 27001 information security standard and is NHS Data Security and Protection Toolkit compliant.

Patient data has been pseudonymized at source for analysis and linkage using industry standard cryptographic hashing techniques (SHA512+salt). All pseudonymized datasets transmitted for linkage onto OpenSAFELY are encrypted. Access to OpenSafely-EMIS and OpenSafely-TPP is through a virtual private network (VPN) connection, restricted to a small group of researchers. The researchers, who hold honorary contracts with NHS England, only access OpenSafely-TPP or OpenSafely-EMIS to initiate database queries and statistical models; all database activity is logged; and only aggregate statistical outputs leave the environment following best practice for anonymization of results such as statistical disclosure control for low cell counts.

A pseudonym is generated from the NHS number using the SHA 512 cryptographic hashing algorithm, in combination with a ‘salt’. This pseudonym is used to link datasets. The salt is transferred between data sharing organisations separately in an encrypted email, and a phone call is made to provide the decryption key to unencrypt the salt. The same salt is used by TPP and EMIS; the salt will be refreshed at 6 monthly intervals. Only restricted individuals in TPP, EMIS and the external data providers are aware of the salt.

As a concrete example, TPP created an appropriate salt, which was shared by the process described above with the relevant individual in the Office of National Statistics (ONS). Both TPP and ONS applied the SHA 512 algorithm, in combination with a salt, to their NHS numbers. This creates a unique pseudonym for each NHS number which can be used to match records. The purpose of using a salt (only known to limited individuals involved in the data flow process) is to further reduce the risk of re-identifying any pseudonymised datasets through the use of brute force attacks.

As both TPP and EMIS would have the technical ability to re-identify the data through the use of mapping tables, the data is considered as confidential and requires COPI to address the common law duty of confidentiality.

There is a tiered level of restricted researcher access to the pseudonymised and de-identified data within OpenSafely-EMIS and OpenSafely-TPP providing enhanced security and privacy protections to the underlying dataset. The descriptions of these 'levels' are described in Processing Activities below. They range from Level 1 - Level 4.

As of February 2022, 9 developers (with NHS England honorary contracts) have access to the level 2 or level 3 environment for development and maintenance purposes only. The Level 2 environment is where the event level pseudonymised data is held. The Level 3 environment is where the specific analysis’ cohort data is held.

Researchers now only access the Level 4 environment where the aggregated results of their studies are held. The Level 4 environment is where researchers review the results and apply disclosure controls before requesting the data to be released. Two independent output-checkers review the results and only release them if there are no disclosure concerns. 72 researchers have access to the Level 4 environment; the 9 developers also have access to this Level 4 environment

For the avoidance of doubt, no researchers can access the Level 1 data (which is where the identifiable data is de-identified and hashed). The full explanation of the levels is contained in processing activities below.

With respect to the GP providers, TPP and EMIS, Level 1 refers to the source identifiable GP data which undergoes pseudonymisation and de-identification before being readied for linkage to create Level 2 data.

This approach to maintaining patient privacy has support from MedConfidential: “It (OpenSAFELY) was designed and built to promote both research and patient confidentiality at the same time, rather than suggesting they’re opposites,” says one of the (MedConfidential’s) co-founders. https://www.economist.com/science-and-technology/2020/05/14/the-pandemic-has-spawned-a-new-way-to-study-medical-records

Community - Local Provider Flow

NHS England will use OpenSafely-EMIS and OpenSafely-TPP to process community local flow provider data provided by NHS Digital (filtered and specified to provide detail on high-cost drugs) to deliver specific analysis on various medicines with the potential to identify treatment targets or identify currently unknown risks to patients on these medications.

The National Tariff High Cost Drugs List contains the High Cost Drugs which are not covered by national prices under the National Tariff Payment System. These drugs are typically used in a relatively small number of specialist centres rather than across all Trusts. Commissioners and providers are required to agree prices locally (https://www.gov.uk/government/news/high-cost-drugs).

A protocol has been created to support examination of the association between the use of immunosuppression to treat immune mediated inflammatory diseases and severe COVID-19 outcomes among adults in England and NHS England are ready to start the analysis immediately if the high-cost drugs data is made available. A draft report has also been produced on the use of the data so far.

The purposes for processing are to identify medical conditions and medications that affect the risk or impact of Covid-19 infection on individuals; this will assist with identifying risk factors associated with poor patient outcomes as well as information to monitor and predict demand on health services.

High cost drug data can also be used to answer questions directly related to 'confounders' and those people in the UK who are shielding. NHS England can rapidly review how such specific medications are associated with COVID-19 related outcomes, such as mortality, to help inform clinical and policy decisions on shielding criteria. Although shielding restrictions have recently been relaxed, this information could inform important future decisions on shielding in the event of a future waves.

Other NHS Digital Datasets

NHS England will also use datasets it receives from NHS Digital under DARS-NIC-139035-X4B7K and DARS-NIC-384608-C9B4L in the OpenSafely platform to further enhance the data. These dataset include:

- Secondary Uses Services Data (SUS+)

- Second generation surveillance system (SGSS)

- Civil Registration Data - Deaths

Data provided via NHS Digital will be used to:

- Determine which people are at highest risk of hospital admission, ventilation, or death, to inform 111 advice, management choices, seclusion advice, and service planning. For example, there may be certain pre-existing medical problems that put people at much higher risk of Covid-related admission or death, that have not yet been identified, and which mean new categories of people need to be in the high-risk group for self-seclusion during the pandemic. As COVID-19 continually is evolving, this is a continuous activity.

- Rapidly assess specific hypotheses around treatment or prevention as they arise including: the possible benefits of chloroquine or antiretroviral medication for HIV; the possible hazards of ibuprofen; the possible benefits of inhaled corticosteroids; the benefits or hazards of drugs that up-regulate ACE2 receptors (such as ACE inhibitors and angiotensin receptor blockers); possible beneficial effects from the JAK inhibitor baricitinib. These can all be rapidly assessed by assessing rates of admission and death among those who have, and have not, been routinely taking such medications in primary care.

- Combine disease dynamics modelling with near-real-time hyperlocal clinical data on prevalence and population at risk, to predict local spread and service need, and (for example) to design and evaluate exit strategies from lockdown.

- Measure and mitigate the indirect health impacts of Covid-19: subject to approval NHS England can monitor the data to identify “Covid Aftershocks” and give early warning on clinical work displaced, such as cancer referrals, cardiovascular management, and vaccinations. NHS England can also help identify NHS organisations in need of additional support around delivering good care as the pandemic continues; and rapidly identify success stories from new best practice that others can learn from.

- Rapidly evaluate the impact of national interventions (and collect outcomes data for pragmatic cluster randomised trials of preventative or treatment interventions), especially on specific patient groups.

- Inform operational issues such as identifying NHS organisations in need of additional support around delivering good care on Covid, and non-Covid care as the pandemic continues; or identify the best practice others can learn from.

OVERSIGHT OF PROJECT:

Currently, given the need to rapidly prioritise the research questions that should be answered, the first wave of analyses have been decided by consensus amongst the team of OpenSAFELY researchers at the University of Oxford DataLab and the EHR group at the London School of Hygiene and Tropical Medicine. These researchers hold honorary contracts with NHS England and are operating in line with NHS England's requirements to support the response to COVID-19. The researchers discuss research protocols with the EHR vendors to ensure that the data within the EHR can be reasonably expected to answer the questions raised. A specific study protocol is written by the OpenSAFELY researchers and a Principle Investigator must give approval for the research to proceed. External researchers may provide advice on the study protocol.

Following generation of the results, a paper is drafted which is shared with appropriate charity/professional representative groups for review. The pre-publication draft is shared with NHS England’s information governance team for review. Following revisions, the paper is submitted for publication in a peer-reviewed journal alongside being made openly available on a pre-print server.

The OpenSAFELY researchers have deep expertise in the use of EHR data as well as epidemiological research. They also have access to a wider network of public health doctors and scientists advising the government, such as SAGE (Scientific Advisory Group for Emergencies), with contact with the Chief Medical Officer and Chief Scientific Advisor, and have drawn on such networks and individuals to inform analyses.

NHS England has an established Oversight Board. The Oversight Board has had 4 meetings and their agenda, documents and meetings notes are publicly available: https://www.opensafely.org/governance/

Amendment to change data frequency

The current dataset in OpenSAFELY-TPP is a one off collection covering submissions from FY 2018/19 and FY 2019/20, and there is no process in place to routinely update the information available in the High Cost Drug dataset. Whilst this is very useful for assessing events and outcomes early in the COVID-19 pandemic, a routine update of the data is needed to assess current high-priority questions and future important questions. For example, a routine update to this data will allow assessment of COVID-19 vaccine effectiveness in people using high-cost medicines or indeed people with a recorded diagnosis likely to be treated with a High Cost Drug. Therefore the controller is requesting the data frequency is changed to adhoc. This will allow regular (likely to be monthly) refreshes of the data that will better inform the changing medications required to treat COVID-19 as the virus continually evolves and effects patients differently.

NHS North of England Commissioning Support Unit

NHS North of England Commissioning Support Unit (CSU) host the North of England Data Services for Commissioners Regional Officer (DSCRO).

North of England CSU is only being utilised for the dissemination of the data as this is processed through the CSU servers. The CSU does no further processing on the data.

Legal Basis for Processing Data

Data accessed under this Agreement will be processed in accordance with GDPR Article 6(1)(e) (processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller) and Article 9(2)(i) (processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy).

Common Law Duty of Confidentiality

Although the data is pseudonymised when it is disseminated, as TPP and EMIS are in receipt of the SALT key used for this project, the data is considered as confidential. NHS England are relying on Reg 3 (3) of the COPI Notice (2002) to allow the dissemination of confidential patient information without consent.

Reports commissioned by Scientific Advisory Group on Emergencies (SAGE), or Department of Health Chief Medical Officer (CMO) / Chief Scientific Advisor (CSA), Joint Biosecurity Centre, or requests that come through the NHS England single point of access that are relevant to the COVID-19 public health emergency.

Work is ongoing to onboard other researcher organisations to use the OpenSAFELY analytics software

Analyses, including supplements, will be openly published online, often initially to a pre-print journal, before submission to a peer review journal and be made available on the OpenSAFELY website as soon as possible (subject to journal restrictions on open access timelines): https://opensafely.org/outputs/

Abstracts/summaries may be used in conferences and for presentations.

As described above, all data outputs that leave OpenSAFELY-EMIS or OpenSAFELY-TPP will be aggregated and anonymised with small number suppression. There will be no restrictions on sharing such outputs which will also be shared with policy makers, the wider research community as well as the public.

The OpenSAFELY analytics software and associated tools and codelists are all open source and available for re-use (https://opensafely.org/code/); derived data that is published are not subject to any intellectual property.

All published outputs will only contain aggregated results with small number suppression applied.

An article has been published already about the use of the OpenSAFELY analytics software in regards to how it was used to characterise factors associated with COVID-19 death in 17 million patients.

https://www.nature.com/articles/s41586-020-2521-4

A further detailed report on the outputs of the data can also be found here - https://wellcomeopenresearch.org/articles/6-360

NHS England has used OpenSafely for informing policy on shielding and vaccine prioritisation; they have added substantially to the evidence base for how several drugs, like hydroxychloroquine and inhaled corticosteroids are associated with COVID-19; and work on vaccine uptake has highlighted the large discrepancies in coverage between different ethnicities and socioeconomic groups. This impact will continue throughout the pandemic, for example with work on vaccine efficacy and long COVID follow-up.

The OpenSAFELY platform has given the power to quickly respond to emerging clinical population health and policy challenges with precise data and open methods.

Further details of benefits obtained through the processing of this data can be found here https://www.medrxiv.org/content/10.1101/2021.09.03.21262888v1

NHS England request this data to support their Coronavirus (COVID-19) research platform work (https://www.england.nhs.uk/contact-us/privacy-notice/how-we-use-your-information/covid-19-response/coronavirus-covid-19-research-platform/) which uses the OpenSAFELY secure analytics software (www.opensafely.org). NHS England is the data controller. NHS England has established honorary contracts with researchers at the DataLab at the University of Oxford and the Electronic Health Records (EHR) group at the London School of Hygiene and Tropical Medicine to assist in conducting Covid-19 relevant studies using the OpenSAFELY suite of analytic software - deployed inside existing electronic health record systems. The Phoenix Partnership (TPP) and Egton Medical Information Systems EMIS (GP electronic health record (EHR) software companies ) are the data processor listed in this agreement, under contract with NHS England. NHS England is the sole data controller; currently NHS England, TPP and EMIS are the data processors; GP Data from TPP and EMIS remains within the IT infrastructure of TPP and EMIS. There are therefore currently two examples of where the OpenSAFELY suite of analytics software are being used - OpenSafely-EMIS, and OpenSafely-TPP.

OpenSAFELY is a suite of analytics software that is deployed inside an existing EHR system to carry out studies (using the underlying data) - created to deliver urgent results during the global COVID-19 emergency. It is now successfully delivering analyses across more than 24 million patients’ full pseudonymised primary care NHS records (TPP patient GP data). All the analytic software is open for security review, scientific review, and re-use. OpenSAFELY analytics software uses a new model for enhanced security and timely access to data: it does not transport large volumes of potentially disclosive pseudonymised patient data outside of the secure environments managed by the electronic health record software company; instead, trusted analysts can run large scale computation across near real-time pseudonymised patient records inside the data centre of the electronic health records software company. This pragmatic and secure approach has allowed the first analyses to be delivered in just five weeks from project start. Outputs are available here: https://opensafely.org/outputs/ and approved projects are available here - https://approved-projects.opensafely.pages.dev/approved-projects/

The GP infrastructure is accredited to the ISO 27001 information security standard and is NHS Data Security and Protection Toolkit compliant.

Patient data has been pseudonymized at source for analysis and linkage using industry standard cryptographic hashing techniques (SHA512+salt). All pseudonymized datasets transmitted for linkage onto OpenSAFELY are encrypted. Access to OpenSafely-EMIS and OpenSafely-TPP is through a virtual private network (VPN) connection, restricted to a small group of researchers. The researchers, who hold honorary contracts with NHS England, only access OpenSafely-TPP or OpenSafely-EMIS to initiate database queries and statistical models; all database activity is logged; and only aggregate statistical outputs leave the environment following best practice for anonymization of results such as statistical disclosure control for low cell counts.

A pseudonym is generated from the NHS number using the SHA 512 cryptographic hashing algorithm, in combination with a ‘salt’. This pseudonym is used to link datasets. The salt is transferred between data sharing organisations separately in an encrypted email, and a phone call is made to provide the decryption key to unencrypt the salt. The same salt is used by TPP and EMIS; the salt will be refreshed at 6 monthly intervals. Only restricted individuals in TPP, EMIS and the external data providers are aware of the salt.

As a concrete example, TPP created an appropriate salt, which was shared by the process described above with the relevant individual in the Office of National Statistics (ONS). Both TPP and ONS applied the SHA 512 algorithm, in combination with a salt, to their NHS numbers. This creates a unique pseudonym for each NHS number which can be used to match records. The purpose of using a salt (only known to limited individuals involved in the data flow process) is to further reduce the risk of re-identifying any pseudonymised datasets through the use of brute force attacks.

As both TPP and EMIS would have the technical ability to re-identify the data through the use of mapping tables, the data is considered as confidential and requires COPI to address the common law duty of confidentiality.

There is a tiered level of restricted researcher access to the pseudonymised and de-identified data within OpenSafely-EMIS and OpenSafely-TPP providing enhanced security and privacy protections to the underlying dataset. The descriptions of these 'levels' are described in Processing Activities below. They range from Level 1 - Level 4.

As of February 2022, 9 developers (with NHS England honorary contracts) have access to the level 2 or level 3 environment for development and maintenance purposes only. The Level 2 environment is where the event level pseudonymised data is held. The Level 3 environment is where the specific analysis’ cohort data is held.

Researchers now only access the Level 4 environment where the aggregated results of their studies are held. The Level 4 environment is where researchers review the results and apply disclosure controls before requesting the data to be released. Two independent output-checkers review the results and only release them if there are no disclosure concerns. 72 researchers have access to the Level 4 environment; the 9 developers also have access to this Level 4 environment

For the avoidance of doubt, no researchers can access the Level 1 data (which is where the identifiable data is de-identified and hashed). The full explanation of the levels is contained in processing activities below.

With respect to the GP providers, TPP and EMIS, Level 1 refers to the source identifiable GP data which undergoes pseudonymisation and de-identification before being readied for linkage to create Level 2 data.

This approach to maintaining patient privacy has support from MedConfidential: “It (OpenSAFELY) was designed and built to promote both research and patient confidentiality at the same time, rather than suggesting they’re opposites,” says one of the (MedConfidential’s) co-founders. https://www.economist.com/science-and-technology/2020/05/14/the-pandemic-has-spawned-a-new-way-to-study-medical-records

Community - Local Provider Flow

NHS England will use OpenSafely-EMIS and OpenSafely-TPP to process community local flow provider data provided by NHS Digital (filtered and specified to provide detail on high-cost drugs) to deliver specific analysis on various medicines with the potential to identify treatment targets or identify currently unknown risks to patients on these medications.

The National Tariff High Cost Drugs List contains the High Cost Drugs which are not covered by national prices under the National Tariff Payment System. These drugs are typically used in a relatively small number of specialist centres rather than across all Trusts. Commissioners and providers are required to agree prices locally (https://www.gov.uk/government/news/high-cost-drugs).

A protocol has been created to support examination of the association between the use of immunosuppression to treat immune mediated inflammatory diseases and severe COVID-19 outcomes among adults in England and NHS England are ready to start the analysis immediately if the high-cost drugs data is made available. A draft report has also been produced on the use of the data so far.

The purposes for processing are to identify medical conditions and medications that affect the risk or impact of Covid-19 infection on individuals; this will assist with identifying risk factors associated with poor patient outcomes as well as information to monitor and predict demand on health services.

High cost drug data can also be used to answer questions directly related to 'confounders' and those people in the UK who are shielding. NHS England can rapidly review how such specific medications are associated with COVID-19 related outcomes, such as mortality, to help inform clinical and policy decisions on shielding criteria. Although shielding restrictions have recently been relaxed, this information could inform important future decisions on shielding in the event of a future waves.

Other NHS Digital Datasets

NHS England will also use datasets it receives from NHS Digital under DARS-NIC-139035-X4B7K and DARS-NIC-384608-C9B4L in the OpenSafely platform to further enhance the data. These dataset include:

- Secondary Uses Services Data (SUS+)

- Second generation surveillance system (SGSS)

- Civil Registration Data - Deaths

Data provided via NHS Digital will be used to:

- Determine which people are at highest risk of hospital admission, ventilation, or death, to inform 111 advice, management choices, seclusion advice, and service planning. For example, there may be certain pre-existing medical problems that put people at much higher risk of Covid-related admission or death, that have not yet been identified, and which mean new categories of people need to be in the high-risk group for self-seclusion during the pandemic. As COVID-19 continually is evolving, this is a continuous activity.

- Rapidly assess specific hypotheses around treatment or prevention as they arise including: the possible benefits of chloroquine or antiretroviral medication for HIV; the possible hazards of ibuprofen; the possible benefits of inhaled corticosteroids; the benefits or hazards of drugs that up-regulate ACE2 receptors (such as ACE inhibitors and angiotensin receptor blockers); possible beneficial effects from the JAK inhibitor baricitinib. These can all be rapidly assessed by assessing rates of admission and death among those who have, and have not, been routinely taking such medications in primary care.

- Combine disease dynamics modelling with near-real-time hyperlocal clinical data on prevalence and population at risk, to predict local spread and service need, and (for example) to design and evaluate exit strategies from lockdown.

- Measure and mitigate the indirect health impacts of Covid-19: subject to approval NHS England can monitor the data to identify “Covid Aftershocks” and give early warning on clinical work displaced, such as cancer referrals, cardiovascular management, and vaccinations. NHS England can also help identify NHS organisations in need of additional support around delivering good care as the pandemic continues; and rapidly identify success stories from new best practice that others can learn from.

- Rapidly evaluate the impact of national interventions (and collect outcomes data for pragmatic cluster randomised trials of preventative or treatment interventions), especially on specific patient groups.

- Inform operational issues such as identifying NHS organisations in need of additional support around delivering good care on Covid, and non-Covid care as the pandemic continues; or identify the best practice others can learn from.

OVERSIGHT OF PROJECT:

Currently, given the need to rapidly prioritise the research questions that should be answered, the first wave of analyses have been decided by consensus amongst the team of OpenSAFELY researchers at the University of Oxford DataLab and the EHR group at the London School of Hygiene and Tropical Medicine. These researchers hold honorary contracts with NHS England and are operating in line with NHS England's requirements to support the response to COVID-19. The researchers discuss research protocols with the EHR vendors to ensure that the data within the EHR can be reasonably expected to answer the questions raised. A specific study protocol is written by the OpenSAFELY researchers and a Principle Investigator must give approval for the research to proceed. External researchers may provide advice on the study protocol.

Following generation of the results, a paper is drafted which is shared with appropriate charity/professional representative groups for review. The pre-publication draft is shared with NHS England’s information governance team for review. Following revisions, the paper is submitted for publication in a peer-reviewed journal alongside being made openly available on a pre-print server.

The OpenSAFELY researchers have deep expertise in the use of EHR data as well as epidemiological research. They also have access to a wider network of public health doctors and scientists advising the government, such as SAGE (Scientific Advisory Group for Emergencies), with contact with the Chief Medical Officer and Chief Scientific Advisor, and have drawn on such networks and individuals to inform analyses.

NHS England has an established Oversight Board. The Oversight Board has had 4 meetings and their agenda, documents and meetings notes are publicly available: https://www.opensafely.org/governance/

Amendment to change data frequency

The current dataset in OpenSAFELY-TPP is a one off collection covering submissions from FY 2018/19 and FY 2019/20, and there is no process in place to routinely update the information available in the High Cost Drug dataset. Whilst this is very useful for assessing events and outcomes early in the COVID-19 pandemic, a routine update of the data is needed to assess current high-priority questions and future important questions. For example, a routine update to this data will allow assessment of COVID-19 vaccine effectiveness in people using high-cost medicines or indeed people with a recorded diagnosis likely to be treated with a High Cost Drug. Therefore the controller is requesting the data frequency is changed to adhoc. This will allow regular (likely to be monthly) refreshes of the data that will better inform the changing medications required to treat COVID-19 as the virus continually evolves and effects patients differently.

NHS North of England Commissioning Support Unit

NHS North of England Commissioning Support Unit (CSU) host the North of England Data Services for Commissioners Regional Officer (DSCRO).

North of England CSU is only being utilised for the dissemination of the data as this is processed through the CSU servers. The CSU does no further processing on the data.

Legal Basis for Processing Data

Data accessed under this Agreement will be processed in accordance with GDPR Article 6(1)(e) (processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller) and Article 9(2)(i) (processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy).

Common Law Duty of Confidentiality

Although the data is pseudonymised when it is disseminated, as TPP and EMIS are in receipt of the SALT key used for this project, the data is considered as confidential. NHS England are relying on Reg 3 (3) of the COPI Notice (2002) to allow the dissemination of confidential patient information without consent.

Reports commissioned by Scientific Advisory Group on Emergencies (SAGE), or Department of Health Chief Medical Officer (CMO) / Chief Scientific Advisor (CSA), Joint Biosecurity Centre, or requests that come through the NHS England single point of access that are relevant to the COVID-19 public health emergency.

Work is ongoing to onboard other researcher organisations to use the OpenSAFELY analytics software

Analyses, including supplements, will be openly published online, often initially to a pre-print journal, before submission to a peer review journal and be made available on the OpenSAFELY website as soon as possible (subject to journal restrictions on open access timelines): https://opensafely.org/outputs/

Abstracts/summaries may be used in conferences and for presentations.

As described above, all data outputs that leave OpenSAFELY-EMIS or OpenSAFELY-TPP will be aggregated and anonymised with small number suppression. There will be no restrictions on sharing such outputs which will also be shared with policy makers, the wider research community as well as the public.

The OpenSAFELY analytics software and associated tools and codelists are all open source and available for re-use (https://opensafely.org/code/); derived data that is published are not subject to any intellectual property.

All published outputs will only contain aggregated results with small number suppression applied.

An article has been published already about the use of the OpenSAFELY analytics software in regards to how it was used to characterise factors associated with COVID-19 death in 17 million patients.

https://www.nature.com/articles/s41586-020-2521-4

A further detailed report on the outputs of the data can also be found here - https://wellcomeopenresearch.org/articles/6-360

NHS England has used OpenSafely for informing policy on shielding and vaccine prioritisation; they have added substantially to the evidence base for how several drugs, like hydroxychloroquine and inhaled corticosteroids are associated with COVID-19; and work on vaccine uptake has highlighted the large discrepancies in coverage between different ethnicities and socioeconomic groups. This impact will continue throughout the pandemic, for example with work on vaccine efficacy and long COVID follow-up.

The OpenSAFELY platform has given the power to quickly respond to emerging clinical population health and policy challenges with precise data and open methods.

Further details of benefits obtained through the processing of this data can be found here https://www.medrxiv.org/content/10.1101/2021.09.03.21262888v1

NHS England request this data to support their Coronavirus (COVID-19) research platform work (https://www.england.nhs.uk/contact-us/privacy-notice/how-we-use-your-information/covid-19-response/coronavirus-covid-19-research-platform/) which uses the OpenSAFELY secure analytics software (www.opensafely.org). NHS England is the data controller. NHS England has established honorary contracts with researchers at the DataLab at the University of Oxford and the Electronic Health Records (EHR) group at the London School of Hygiene and Tropical Medicine to assist in conducting Covid-19 relevant studies using the OpenSAFELY suite of analytic software - deployed inside existing electronic health record systems. The Phoenix Partnership (TPP) and Egton Medical Information Systems EMIS (GP electronic health record (EHR) software companies ) are the data processor listed in this agreement, under contract with NHS England. NHS England is the sole data controller; currently NHS England, TPP and EMIS are the data processors; GP Data from TPP and EMIS remains within the IT infrastructure of TPP and EMIS. There are therefore currently two examples of where the OpenSAFELY suite of analytics software are being used - OpenSafely-EMIS, and OpenSafely-TPP.

OpenSAFELY is a new suite of analytics software that is deployed inside an existing EHR system to carry out studies (using the underlying data) - created to deliver urgent results during the global COVID-19 emergency. It is now successfully delivering analyses across more than 24 million patients’ full pseudonymised primary care NHS records (TPP patient GP data), with analyses about to begin using OpenSAFELY-EMIS and OpenSAFELY-TPP. All the analytic software is open for security review, scientific review, and re-use. OpenSAFELY analytics software uses a new model for enhanced security and timely access to data: it does not transport large volumes of potentially disclosive pseudonymised patient data outside of the secure environments managed by the electronic health record software company; instead, trusted analysts can run large scale computation across near real-time pseudonymised patient records inside the data centre of the electronic health records software company. This pragmatic and secure approach has allowed the first analyses to be delivered in just five weeks from project start. Outputs are available here: https://opensafely.org/outputs/.

The GP infrastructure is accredited to the ISO 27001 information security standard and is NHS Data Security and Protection Toolkit compliant.

Patient data have been pseudonymized as source for analysis and linkage using industry standard cryptographic hashing techniques (SHA512+salt). All pseudonymized datasets transmitted for linkage onto OpenSAFELY are encrypted. Access to OpenSafely-EMIS and OpenSafely-TPP is through a virtual private network (VPN) connection, restricted to a small group of researchers. The researchers, who hold contracts with NHS England, only access OpenSafely-TPP or OpenSafely-EMIS to initiate database queries and statistical models; all database activity is logged; and only aggregate statistical outputs leave the environment following best practice for anonymization of results such as statistical disclosure control for low cell counts.

A pseudonym is generated from the NHS number using the SHA 512 cryptographic hashing algorithm, in combination with a ‘salt’. This pseudonym is used to link datasets. The salt is transferred between data sharing organisations separately in an encrypted email, and a phone call is made to provide the decryption key to unencrypt the salt. The same salt is used by TPP and EMIS; the salt will be refreshed at 6 monthly intervals. Only restricted individuals in TPP, EMIS and the external data providers are aware of the salt.

As a concrete example, TPP created an appropriate salt, which was shared by the process described above with the relevant individual in the Office of National Statistics (ONS). Both TPP and ONS applied the SHA 512 algorithm, in combination with a salt, to their NHS numbers. This creates a unique pseudonym for each NHS number which can be used to match records. The purpose of using a salt (only known to limited individuals involved in the data flow process) is to further reduce the risk of re-identifying any pseudonymised datasets through the use of brute force attacks.

There is a tiered level of restricted researcher access to the pseudonymised and de-identified data within OpenSafely-EMIS and OpenSafely-TPP providing enhanced security and privacy protections to the underlying dataset. The descriptions of these 'levels' are described in Processing Activities below. They range from Level 1 - Level 4.

As of writing, 15 researchers are level 2 and 3 approved (accessing OpenSafely-EMIS and OpenSafely-TPP to initiate database queries and statistical models, the code for which are openly available on online on GitHub - a leading software development platform which has tools available for analysts and developers); 11 researchers are level 4 approved (they can only access and review the outputs of the statistical models ie the raw study results). In this tiered model the data between Level 2, 3 and 4 is increasingly less disclosive.

For the avoidance of doubt, no researchers can access the Level 1 data (which is where the identifiable data is de-identified and hashed). The full explanation of the levels is contained in processing activities below.

With respect to the GP providers, TPP and EMIS, Level 1 refers to the source identifiable GP data which undergoes pseudonymisation and de-identification before being readied for linkage to create Level 2 data.

This approach to maintaining patient privacy has support from MedConfidential: “It (OpenSAFELY) was designed and built to promote both research and patient confidentiality at the same time, rather than suggesting they’re opposites,” says one of the (MedConfidential’s) co-founders. https://www.economist.com/science-and-technology/2020/05/14/the-pandemic-has-spawned-a-new-way-to-study-medical-records

NHS England will use OpenSafely-EMIS and OpenSafely-TPP to process community local flow provider data provided by NHS Digital (filtered and specified to provide detail on high-cost drugs) to deliver specific analysis on various medicines with the potential to identify treatment targets or identify currently unknown risks to patients on these medications.

The National Tariff High Cost Drugs List contains the High Cost Drugs which are not covered by national prices under the National Tariff Payment System. These drugs are typically used in a relatively small number of specialist centres rather than across all Trusts. Commissioners and providers are required to agree prices locally (https://www.gov.uk/government/news/high-cost-drugs).

A drafted protocol has been created to support examination of the association between the use of immunosuppression to treat immune mediated inflammatory diseases and severe COVID-19 outcomes among adults in England and NHS England are ready to start the analysis immediately if the high-cost drugs data is made available.

The purposes for processing are to identify medical conditions and medications that affect the risk or impact of Covid-19 infection on individuals; this will assist with identifying risk factors associated with poor patient outcomes as well as information to monitor and predict demand on health services.

High cost drug data can also be used to answer questions directly related to 'confounders' and those people in the UK who are shielding. NHS England can rapidly review how such specific medications are associated with COVID-19 related outcomes, such as mortality, to help inform clinical and policy decisions on shielding criteria. Although shielding restrictions have recently been relaxed, this information could inform important future decisions on shielding in the event of a second wave.

Data provided via NHS Digital will be used to:

- Determine which people are at highest risk of hospital admission, ventilation, or death, to inform 111 advice, management choices, seclusion advice, and service planning. For example, there may be certain pre-existing medical problems that put people at much higher risk of Covid-related admission or death, that have not yet been identified, and which mean new categories of people need to be in the high-risk group for self-seclusion during the pandemic.

- Rapidly assess specific hypotheses around treatment or prevention as they arise including: the possible benefits of chloroquine or antiretroviral medication for HIV; the possible hazards of ibuprofen; the possible benefits of inhaled corticosteroids; the benefits or hazards of drugs that up-regulate ACE2 receptors (such as ACE inhibitors and angiotensin receptor blockers); possible beneficial effects from the JAK inhibitor baricitinib. These can all be rapidly assessed by assessing rates of admission and death among those who have, and have not, been routinely taking such medications in primary care.

- Combine disease dynamics modelling with near-real-time hyperlocal clinical data on prevalence and population at risk, to predict local spread and service need, and (for example) to design and evaluate exit strategies from lockdown.

- Measure and mitigate the indirect health impacts of Covid-19: subject to approval NHS England can monitor the data to identify “Covid Aftershocks” and give early warning on clinical work displaced, such as cancer referrals, cardiovascular management, and vaccinations. NHS England can also help identify NHS organisations in need of additional support around delivering good care as the pandemic continues; and rapidly identify success stories from new best practice that others can learn from.

- Rapidly evaluate the impact of national interventions (and collect outcomes data for pragmatic cluster randomised trials of preventative or treatment interventions), especially on specific patient groups.

- Inform operational issues such as identifying NHS organisations in need of additional support around delivering good care on Covid, and non-Covid care as the pandemic continues; or identify the best practice others can learn from.

OVERSIGHT OF PROJECT:

Currently, given the need to rapidly prioritise the research questions that should be answered, the first wave of analyses have been decided by consensus amongst the team of OpenSAFELY researchers at the University of Oxford DataLab and the EHR group at the London School of Hygiene and Tropical Medicine. These researchers hold honorary contracts with NHS England and are operating in line with NHS England's requirements to support the response to COVID-19. The researchers discuss research protocols with the EHR vendors to ensure that the data within the EHR can be reasonably expected to answer the questions raised. A specific study protocol is written by the OpenSAFELY researchers and a Principle Investigator must give approval for the research to proceed. External researchers may provide advice on the study protocol.

Following generation of the results, a paper is drafted which is shared with appropriate charity/professional representative groups for review. The pre-publication draft is shared with NHS England’s and NHSX’s information governance team for review. Following revisions, the paper is submitted for publication in a peer-reviewed journal alongside being made openly available on a pre-print server.

The OpenSAFELY researchers have deep expertise in the use of EHR data as well as epidemiological research. They also have access to a wider networks of public health doctors and scientists advising the government, such as SAGE (Scientific Advisory Group for Emergencies), with contact with the Chief Medical Officer and Chief Scientific Advisor, and have drawn on such networks and individuals to inform analyses.

NHS England and NHSX is currently working on a model to establish an Interim Oversight Board, with a view to a permanent and formalised independent Oversight Board and user group, to advise on the research pipeline and development roadmap, as well as holding the OpenSAFELY collaborative (TPP, EMIS, University of Oxford DataLab, EHR group of London School of Hygiene and Tropical Medicine, NHS England) to account on the ethical and efficient use of patient data. Details of this can be made available as soon as plans have been finalised.

Reports commissioned by Scientific Advisory Group on Emergencies (SAGE), or Department of Health Chief Medical Officer (CMO) / Chief Scientific Advisor (CSA), Joint Biosecurity Centre, or requests that come through the NHS England single point of access that are relevant to the COVID-19 public health emergency.

Work is ongoing to onboard other researcher organisations to use the OpenSAFELY analytics software

Analyses, including supplements, will be openly published online, often initially to a pre-print journal, before submission to a peer review journal and be made available on the OpenSAFELY website as soon as possible (subject to journal restrictions on open access timelines): https://opensafely.org/outputs/

Abstracts/summaries may be used in conferences and for presentations.

As described above, all data outputs that leave OpenSAFELY-EMIS or OpenSAFELY-TPP will be aggregated and anonymised with small number suppression. There will be no restrictions on sharing such outputs which will also be shared with policy makers, the wider research community as well as the public.

The OpenSAFELY analytics software and associated tools and codelists are all open source and available for re-use (https://opensafely.org/code/); derived data that is published are not subject to any intellectual property.

All published outputs will only contain aggregated results with small number suppression applied.

An article has been published already about the use of the OpenSAFELY analytics software in regards to how it was used to characterise factors associated with COVID-19 death in 17 million patients.

https://www.nature.com/articles/s41586-020-2521-4

No yielded benefits have yet been obtained, as continued analysis work is still ongoing for this project.

NHS England request this data to support their Coronavirus (COVID-19) research platform work (https://www.england.nhs.uk/contact-us/privacy-notice/how-we-use-your-information/covid-19-response/coronavirus-covid-19-research-platform/) which uses the OpenSAFELY secure analytics software (www.opensafely.org). NHS England is the data controller. NHS England has established honorary contracts with researchers at the DataLab at the University of Oxford and the Electronic Health Records (EHR) group at the London School of Hygiene and Tropical Medicine to assist in conducting Covid-19 relevant studies using the OpenSAFELY suite of analytic software - deployed inside existing electronic health record systems. The Phoenix Partnership (TPP) and Egton Medical Information Systems EMIS (GP electronic health record (EHR) software companies ) are the data processor listed in this agreement, under contract with NHS England. NHS England is the sole data controller; currently NHS England, TPP and EMIS are the data processors; GP Data from TPP and EMIS remains within the IT infrastructure of TPP and EMIS. There are therefore currently two examples of where the OpenSAFELY suite of analytics software are being used - OpenSafely-EMIS, and OpenSafely-TPP.

OpenSAFELY is a new suite of analytics software that is deployed inside an existing EHR system to carry out studies (using the underlying data) - created to deliver urgent results during the global COVID-19 emergency. It is now successfully delivering analyses across more than 24 million patients’ full pseudonymised primary care NHS records (TPP patient GP data), with analyses about to begin using OpenSAFELY-EMIS and OpenSAFELY-TPP. All the analytic software is open for security review, scientific review, and re-use. OpenSAFELY analytics software uses a new model for enhanced security and timely access to data: it does not transport large volumes of potentially disclosive pseudonymised patient data outside of the secure environments managed by the electronic health record software company; instead, trusted analysts can run large scale computation across near real-time pseudonymised patient records inside the data centre of the electronic health records software company. This pragmatic and secure approach has allowed the first analyses to be delivered in just five weeks from project start. Outputs are available here: https://opensafely.org/outputs/.

The GP infrastructure is accredited to the ISO 27001 information security standard and is NHS Data Security and Protection Toolkit compliant.

Patient data have been pseudonymized as source for analysis and linkage using industry standard cryptographic hashing techniques (SHA512+salt). All pseudonymized datasets transmitted for linkage onto OpenSAFELY are encrypted. Access to OpenSafely-EMIS and OpenSafely-TPP is through a virtual private network (VPN) connection, restricted to a small group of researchers. The researchers, who hold contracts with NHS England, only access OpenSafely-TPP or OpenSafely-EMIS to initiate database queries and statistical models; all database activity is logged; and only aggregate statistical outputs leave the environment following best practice for anonymization of results such as statistical disclosure control for low cell counts.

A pseudonym is generated from the NHS number using the SHA 512 cryptographic hashing algorithm, in combination with a ‘salt’. This pseudonym is used to link datasets. The salt is transferred between data sharing organisations separately in an encrypted email, and a phone call is made to provide the decryption key to unencrypt the salt. The same salt is used by TPP and EMIS; the salt will be refreshed at 6 monthly intervals. Only restricted individuals in TPP, EMIS and the external data providers are aware of the salt.

As a concrete example, TPP created an appropriate salt, which was shared by the process described above with the relevant individual in the Office of National Statistics (ONS). Both TPP and ONS applied the SHA 512 algorithm, in combination with a salt, to their NHS numbers. This creates a unique pseudonym for each NHS number which can be used to match records. The purpose of using a salt (only known to limited individuals involved in the data flow process) is to further reduce the risk of re-identifying any pseudonymised datasets through the use of brute force attacks.

There is a tiered level of restricted researcher access to the pseudonymised and de-identified data within OpenSafely-EMIS and OpenSafely-TPP providing enhanced security and privacy protections to the underlying dataset. The descriptions of these 'levels' are described in Processing Activities below. They range from Level 1 - Level 4.

As of writing, 15 researchers are level 2 and 3 approved (accessing OpenSafely-EMIS and OpenSafely-TPP to initiate database queries and statistical models, the code for which are openly available on online on GitHub - a leading software development platform which has tools available for analysts and developers); 11 researchers are level 4 approved (they can only access and review the outputs of the statistical models ie the raw study results). In this tiered model the data between Level 2, 3 and 4 is increasingly less disclosive.

For the avoidance of doubt, no researchers can access the Level 1 data (which is where the identifiable data is de-identified and hashed). The full explanation of the levels is contained in processing activities below.

With respect to the GP providers, TPP and EMIS, Level 1 refers to the source identifiable GP data which undergoes pseudonymisation and de-identification before being readied for linkage to create Level 2 data.

This approach to maintaining patient privacy has support from MedConfidential: “It (OpenSAFELY) was designed and built to promote both research and patient confidentiality at the same time, rather than suggesting they’re opposites,” says one of the (MedConfidential’s) co-founders. https://www.economist.com/science-and-technology/2020/05/14/the-pandemic-has-spawned-a-new-way-to-study-medical-records

NHS England will use OpenSafely-EMIS and OpenSafely-TPP to process community local flow provider data provided by NHS Digital (filtered and specified to provide detail on high-cost drugs) to deliver specific analysis on various medicines with the potential to identify treatment targets or identify currently unknown risks to patients on these medications.

The National Tariff High Cost Drugs List contains the High Cost Drugs which are not covered by national prices under the National Tariff Payment System. These drugs are typically used in a relatively small number of specialist centres rather than across all Trusts. Commissioners and providers are required to agree prices locally (https://www.gov.uk/government/news/high-cost-drugs).

A drafted protocol has been created to support examination of the association between the use of immunosuppression to treat immune mediated inflammatory diseases and severe COVID-19 outcomes among adults in England and NHS England are ready to start the analysis immediately if the high-cost drugs data is made available.

The purposes for processing are to identify medical conditions and medications that affect the risk or impact of Covid-19 infection on individuals; this will assist with identifying risk factors associated with poor patient outcomes as well as information to monitor and predict demand on health services.

High cost drug data can also be used to answer questions directly related to 'confounders' and those people in the UK who are shielding. NHS England can rapidly review how such specific medications are associated with COVID-19 related outcomes, such as mortality, to help inform clinical and policy decisions on shielding criteria. Although shielding restrictions have recently been relaxed, this information could inform important future decisions on shielding in the event of a second wave.

Data provided via NHS Digital will be used to:

- Determine which people are at highest risk of hospital admission, ventilation, or death, to inform 111 advice, management choices, seclusion advice, and service planning. For example, there may be certain pre-existing medical problems that put people at much higher risk of Covid-related admission or death, that have not yet been identified, and which mean new categories of people need to be in the high-risk group for self-seclusion during the pandemic.

- Rapidly assess specific hypotheses around treatment or prevention as they arise including: the possible benefits of chloroquine or antiretroviral medication for HIV; the possible hazards of ibuprofen; the possible benefits of inhaled corticosteroids; the benefits or hazards of drugs that up-regulate ACE2 receptors (such as ACE inhibitors and angiotensin receptor blockers); possible beneficial effects from the JAK inhibitor baricitinib. These can all be rapidly assessed by assessing rates of admission and death among those who have, and have not, been routinely taking such medications in primary care.

- Combine disease dynamics modelling with near-real-time hyperlocal clinical data on prevalence and population at risk, to predict local spread and service need, and (for example) to design and evaluate exit strategies from lockdown.

- Measure and mitigate the indirect health impacts of Covid-19: subject to approval NHS England can monitor the data to identify “Covid Aftershocks” and give early warning on clinical work displaced, such as cancer referrals, cardiovascular management, and vaccinations. NHS England can also help identify NHS organisations in need of additional support around delivering good care as the pandemic continues; and rapidly identify success stories from new best practice that others can learn from.

- Rapidly evaluate the impact of national interventions (and collect outcomes data for pragmatic cluster randomised trials of preventative or treatment interventions), especially on specific patient groups.

- Inform operational issues such as identifying NHS organisations in need of additional support around delivering good care on Covid, and non-Covid care as the pandemic continues; or identify the best practice others can learn from.

OVERSIGHT OF PROJECT:

Currently, given the need to rapidly prioritise the research questions that should be answered, the first wave of analyses have been decided by consensus amongst the team of OpenSAFELY researchers at the University of Oxford DataLab and the EHR group at the London School of Hygiene and Tropical Medicine. These researchers hold honorary contracts with NHS England and are operating in line with NHS England's requirements to support the response to COVID-19. The researchers discuss research protocols with the EHR vendors to ensure that the data within the EHR can be reasonably expected to answer the questions raised. A specific study protocol is written by the OpenSAFELY researchers and a Principle Investigator must give approval for the research to proceed. External researchers may provide advice on the study protocol.

Following generation of the results, a paper is drafted which is shared with appropriate charity/professional representative groups for review. The pre-publication draft is shared with NHS England’s and NHSX’s information governance team for review. Following revisions, the paper is submitted for publication in a peer-reviewed journal alongside being made openly available on a pre-print server.

The OpenSAFELY researchers have deep expertise in the use of EHR data as well as epidemiological research. They also have access to a wider networks of public health doctors and scientists advising the government, such as SAGE (Scientific Advisory Group for Emergencies), with contact with the Chief Medical Officer and Chief Scientific Advisor, and have drawn on such networks and individuals to inform analyses.

NHS England and NHSX is currently working on a model to establish an Interim Oversight Board, with a view to a permanent and formalised independent Oversight Board and user group, to advise on the research pipeline and development roadmap, as well as holding the OpenSAFELY collaborative (TPP, EMIS, University of Oxford DataLab, EHR group of London School of Hygiene and Tropical Medicine, NHS England) to account on the ethical and efficient use of patient data. Details of this can be made available as soon as plans have been finalised.

Reports commissioned by Scientific Advisory Group on Emergencies (SAGE), or Department of Health Chief Medical Officer (CMO) / Chief Scientific Advisor (CSA), Joint Biosecurity Centre, or requests that come through the NHS England single point of access that are relevant to the COVID-19 public health emergency.

Work is ongoing to onboard other researcher organisations to use the OpenSAFELY analytics software

Analyses, including supplements, will be openly published online, often initially to a pre-print journal, before submission to a peer review journal and be made available on the OpenSAFELY website as soon as possible (subject to journal restrictions on open access timelines): https://opensafely.org/outputs/

Abstracts/summaries may be used in conferences and for presentations.

As described above, all data outputs that leave OpenSAFELY-EMIS or OpenSAFELY-TPP will be aggregated and anonymised with small number suppression. There will be no restrictions on sharing such outputs which will also be shared with policy makers, the wider research community as well as the public.

The OpenSAFELY analytics software and associated tools and codelists are all open source and available for re-use (https://opensafely.org/code/); derived data that is published are not subject to any intellectual property.

All published outputs will only contain aggregated results with small number suppression applied.

An article has been published already about the use of the OpenSAFELY analytics software in regards to how it was used to characterise factors associated with COVID-19 death in 17 million patients.

https://www.nature.com/articles/s41586-020-2521-4

No yielded benefits have yet been obtained, as continued analysis work is still ongoing for this project.

NHS England request this data to support their Coronavirus (COVID-19) research platform work (https://www.england.nhs.uk/contact-us/privacy-notice/how-we-use-your-information/covid-19-response/coronavirus-covid-19-research-platform/) which uses the OpenSAFELY secure analytics software (www.opensafely.org). NHS England is the data controller. NHS England has established honorary contracts with researchers at the DataLab at the University of Oxford and the Electronic Health Records (EHR) group at the London School of Hygiene and Tropical Medicine to assist in conducting Covid-19 relevant studies using the OpenSAFELY suite of analytic software - deployed inside existing electronic health record systems. The Phoenix Partnership (TPP) and Egton Medical Information Systems EMIS (GP electronic health record (EHR) software companies ) are the data processor listed in this agreement, under contract with NHS England. NHS England is the sole data controller; currently NHS England, TPP and EMIS are the data processors; GP Data from TPP and EMIS remains within the IT infrastructure of TPP and EMIS. There are therefore currently two examples of where the OpenSAFELY suite of analytics software are being used - OpenSafely-EMIS, and OpenSafely-TPP.

OpenSAFELY is a new suite of analytics software that is deployed inside an existing EHR system to carry out studies (using the underlying data) - created to deliver urgent results during the global COVID-19 emergency. It is now successfully delivering analyses across more than 24 million patients’ full pseudonymised primary care NHS records (TPP patient GP data), with analyses about to begin using OpenSAFELY-EMIS and OpenSAFELY-TPP. All the analytic software is open for security review, scientific review, and re-use. OpenSAFELY analytics software uses a new model for enhanced security and timely access to data: it does not transport large volumes of potentially disclosive pseudonymised patient data outside of the secure environments managed by the electronic health record software company; instead, trusted analysts can run large scale computation across near real-time pseudonymised patient records inside the data centre of the electronic health records software company. This pragmatic and secure approach has allowed the first analyses to be delivered in just five weeks from project start. Outputs are available here: https://opensafely.org/outputs/.

The GP infrastructure is accredited to the ISO 27001 information security standard and is NHS Data Security and Protection Toolkit compliant.

Patient data have been pseudonymized as source for analysis and linkage using industry standard cryptographic hashing techniques (SHA512+salt). All pseudonymized datasets transmitted for linkage onto OpenSAFELY are encrypted. Access to OpenSafely-EMIS and OpenSafely-TPP is through a virtual private network (VPN) connection, restricted to a small group of researchers. The researchers, who hold contracts with NHS England, only access OpenSafely-TPP or OpenSafely-EMIS to initiate database queries and statistical models; all database activity is logged; and only aggregate statistical outputs leave the environment following best practice for anonymization of results such as statistical disclosure control for low cell counts.

A pseudonym is generated from the NHS number using the SHA 512 cryptographic hashing algorithm, in combination with a ‘salt’. This pseudonym is used to link datasets. The salt is transferred between data sharing organisations separately in an encrypted email, and a phone call is made to provide the decryption key to unencrypt the salt. The same salt is used by TPP and EMIS; the salt will be refreshed at 6 monthly intervals. Only restricted individuals in TPP, EMIS and the external data providers are aware of the salt.

As a concrete example, TPP created an appropriate salt, which was shared by the process described above with the relevant individual in the Office of National Statistics (ONS). Both TPP and ONS applied the SHA 512 algorithm, in combination with a salt, to their NHS numbers. This creates a unique pseudonym for each NHS number which can be used to match records. The purpose of using a salt (only known to limited individuals involved in the data flow process) is to further reduce the risk of re-identifying any pseudonymised datasets through the use of brute force attacks.

There is a tiered level of restricted researcher access to the pseudonymised and de-identified data within OpenSafely-EMIS and OpenSafely-TPP providing enhanced security and privacy protections to the underlying dataset. The descriptions of these 'levels' are described in Processing Activities below. They range from Level 1 - Level 4.

As of writing, 15 researchers are level 2 and 3 approved (accessing OpenSafely-EMIS and OpenSafely-TPP to initiate database queries and statistical models, the code for which are openly available on online on GitHub - a leading software development platform which has tools available for analysts and developers); 11 researchers are level 4 approved (they can only access and review the outputs of the statistical models ie the raw study results). In this tiered model the data between Level 2, 3 and 4 is increasingly less disclosive.

For the avoidance of doubt, no researchers can access the Level 1 data (which is where the identifiable data is de-identified and hashed). The full explanation of the levels is contained in processing activities below.

With respect to the GP providers, TPP and EMIS, Level 1 refers to the source identifiable GP data which undergoes pseudonymisation and de-identification before being readied for linkage to create Level 2 data.

This approach to maintaining patient privacy has support from MedConfidential: “It (OpenSAFELY) was designed and built to promote both research and patient confidentiality at the same time, rather than suggesting they’re opposites,” says one of the (MedConfidential’s) co-founders. https://www.economist.com/science-and-technology/2020/05/14/the-pandemic-has-spawned-a-new-way-to-study-medical-records

NHS England will use OpenSafely-EMIS and OpenSafely-TPP to process community local flow provider data provided by NHS Digital (filtered and specified to provide detail on high-cost drugs) to deliver specific analysis on various medicines with the potential to identify treatment targets or identify currently unknown risks to patients on these medications.

The National Tariff High Cost Drugs List contains the High Cost Drugs which are not covered by national prices under the National Tariff Payment System. These drugs are typically used in a relatively small number of specialist centres rather than across all Trusts. Commissioners and providers are required to agree prices locally (https://www.gov.uk/government/news/high-cost-drugs).

A drafted protocol has been created to support examination of the association between the use of immunosuppression to treat immune mediated inflammatory diseases and severe COVID-19 outcomes among adults in England and NHS England are ready to start the analysis immediately if the high-cost drugs data is made available.

The purposes for processing are to identify medical conditions and medications that affect the risk or impact of Covid-19 infection on individuals; this will assist with identifying risk factors associated with poor patient outcomes as well as information to monitor and predict demand on health services.

High cost drug data can also be used to answer questions directly related to 'confounders' and those people in the UK who are shielding. NHS England can rapidly review how such specific medications are associated with COVID-19 related outcomes, such as mortality, to help inform clinical and policy decisions on shielding criteria. Although shielding restrictions have recently been relaxed, this information could inform important future decisions on shielding in the event of a second wave.

Data provided via NHS Digital will be used to:

- Determine which people are at highest risk of hospital admission, ventilation, or death, to inform 111 advice, management choices, seclusion advice, and service planning. For example, there may be certain pre-existing medical problems that put people at much higher risk of Covid-related admission or death, that have not yet been identified, and which mean new categories of people need to be in the high-risk group for self-seclusion during the pandemic.

- Rapidly assess specific hypotheses around treatment or prevention as they arise including: the possible benefits of chloroquine or antiretroviral medication for HIV; the possible hazards of ibuprofen; the possible benefits of inhaled corticosteroids; the benefits or hazards of drugs that up-regulate ACE2 receptors (such as ACE inhibitors and angiotensin receptor blockers); possible beneficial effects from the JAK inhibitor baricitinib. These can all be rapidly assessed by assessing rates of admission and death among those who have, and have not, been routinely taking such medications in primary care.

- Combine disease dynamics modelling with near-real-time hyperlocal clinical data on prevalence and population at risk, to predict local spread and service need, and (for example) to design and evaluate exit strategies from lockdown.

- Measure and mitigate the indirect health impacts of Covid-19: subject to approval NHS England can monitor the data to identify “Covid Aftershocks” and give early warning on clinical work displaced, such as cancer referrals, cardiovascular management, and vaccinations. NHS England can also help identify NHS organisations in need of additional support around delivering good care as the pandemic continues; and rapidly identify success stories from new best practice that others can learn from.

- Rapidly evaluate the impact of national interventions (and collect outcomes data for pragmatic cluster randomised trials of preventative or treatment interventions), especially on specific patient groups.

- Inform operational issues such as identifying NHS organisations in need of additional support around delivering good care on Covid, and non-Covid care as the pandemic continues; or identify the best practice others can learn from.

OVERSIGHT OF PROJECT:

Currently, given the need to rapidly prioritise the research questions that should be answered, the first wave of analyses have been decided by consensus amongst the team of OpenSAFELY researchers at the University of Oxford DataLab and the EHR group at the London School of Hygiene and Tropical Medicine. These researchers hold honorary contracts with NHS England and are operating in line with NHS England's requirements to support the response to COVID-19. The researchers discuss research protocols with the EHR vendors to ensure that the data within the EHR can be reasonably expected to answer the questions raised. A specific study protocol is written by the OpenSAFELY researchers and a Principle Investigator must give approval for the research to proceed. External researchers may provide advice on the study protocol.

Following generation of the results, a paper is drafted which is shared with appropriate charity/professional representative groups for review. The pre-publication draft is shared with NHS England’s and NHSX’s information governance team for review. Following revisions, the paper is submitted for publication in a peer-reviewed journal alongside being made openly available on a pre-print server.

The OpenSAFELY researchers have deep expertise in the use of EHR data as well as epidemiological research. They also have access to a wider networks of public health doctors and scientists advising the government, such as SAGE (Scientific Advisory Group for Emergencies), with contact with the Chief Medical Officer and Chief Scientific Advisor, and have drawn on such networks and individuals to inform analyses.

NHS England and NHSX is currently working on a model to establish an Interim Oversight Board, with a view to a permanent and formalised independent Oversight Board and user group, to advise on the research pipeline and development roadmap, as well as holding the OpenSAFELY collaborative (TPP, EMIS, University of Oxford DataLab, EHR group of London School of Hygiene and Tropical Medicine, NHS England) to account on the ethical and efficient use of patient data. Details of this can be made available as soon as plans have been finalised.

Reports commissioned by Scientific Advisory Group on Emergencies (SAGE), or Department of Health Chief Medical Officer (CMO) / Chief Scientific Advisor (CSA), Joint Biosecurity Centre, or requests that come through the NHS England single point of access that are relevant to the COVID-19 public health emergency.

Work is ongoing to onboard other researcher organisations to use the OpenSAFELY analytics software

Analyses, including supplements, will be openly published online, often initially to a pre-print journal, before submission to a peer review journal and be made available on the OpenSAFELY website as soon as possible (subject to journal restrictions on open access timelines): https://opensafely.org/outputs/

Abstracts/summaries may be used in conferences and for presentations.

As described above, all data outputs that leave OpenSAFELY-EMIS or OpenSAFELY-TPP will be aggregated and anonymised with small number suppression. There will be no restrictions on sharing such outputs which will also be shared with policy makers, the wider research community as well as the public.

The OpenSAFELY analytics software and associated tools and codelists are all open source and available for re-use (https://opensafely.org/code/); derived data that is published are not subject to any intellectual property.

All published outputs will only contain aggregated results with small number suppression applied.

An article has been published already about the use of the OpenSAFELY analytics software in regards to how it was used to characterise factors associated with COVID-19 death in 17 million patients.

https://www.nature.com/articles/s41586-020-2521-4

Yielded Benefits is not a requirement for new applications.