CV19DR1 Department of Health & Social Care – Test and Trace Programme

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

CONTEXT UKHSA is the national expert agency responsible for protecting the nation’s health. An executive agency of the DHSC, UKHSA become operational on 1 October 2021 and combines the health protection activities previously undertaken by Public Health England (PHE) with all of the activities of NHS Test and Trace and the Joint Biosecurity Centre (JBC). UKHSA is responsible for preventing, detecting, analysing, responding to and leading partnerships to protect the UK from communicable diseases and other threats to public health. It has particularly responsibility to advise on and support the ongoing national response to the COVID-19 pandemic. Data sharing agreement NIC-406871-Q9G2Q was originally agreed by NHS Digital with JBC and enable the dissemination of several business-critical data sets required to support the fulfilment of JBC’s remit to provide analysis and insight on the evolution of the COVID-19 epidemic and the drivers and risk factors for transmission. Following the transfer of JBC to UKHSA, work is underway to combine the JBC DSA with the DSA separately agreed by NHS Digital with PHE (NIC-343380-H5Q9K) into a new integrated UKHSA Single DSA. This work has been ongoing for several months and is expected to be completed by early November 2022. While the work to finalise the UKHSA DSA is underway, it is vital that the current flows of data agreed under the JBC DSA are maintained to ensure that the former JBC analyst and modelling teams that transferred to UKHSA can continue their business-critical work supporting the UKHSA response to COVID-19. To allow sufficient time to finalise the new UKHSA Single DSA, a short-term extension of the JBC DSA to 30 December 2022 is requested. Once the UKHSA Single DSA is active, the JBC DSA will be retired. For the purposes of this short-term extension to the JBC DSA, all references to JBC in the DSA should now be read as referring to UKHSA. The objectives, processing activities and outputs currently stated in the DSA remain unchanged following the transfer of JBC to UKHSA. Similarly, the Department of Health and Social Care remains the data controller for the data disseminated under the JBC DSA – JBC was previously a department of the DHSC, and UKHSA, as an executive agency of the DHSC, is listed under the DHSC data controller registration with the ICO. [3 paragraphs unchanged] NHS Arden & Greater East Midlands Commissioning Support Unit as well as the Office for National Statistics (ONS) act as data processors on behalf of DHSC. Microsoft Limited supply Cloud Services for Arden and GEM Commissioning Support Unit and are therefore listed as a data processor. Microsoft Limited supply support to the system, but do not access data. DHSC are the sole Data Controller under this Agreement. [21 paragraphs unchanged]

Unchanged: Processing activities, Expected output, Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

[3 paragraphs unchanged] NHS Arden & Greater East Midlands Commissioning Support Unit as well as the Office for National Statistics (ONS) act as data processors on behalf of DHSC. Microsoft Limited supply Cloud Services for Arden and GEM Commissioning Support Unit and are therefore listed as a data processor. Microsoft Limited supply support to the system, but do not access data. DHSC are the sole Data Controller under this Agreement. [8 paragraphs unchanged] JBC directly provides analytical insights to ministers. It is hard to exactly determine and predict in this agreement Agreement what decisions will be made, but this encapsulates any decisions made in response to the COVID-19 Crisis Crisis. The data is not intended to be used to inform direct care, [21 words unchanged] of the COVID-19 response, allowing Local and National authorities to make informed decisions decisions. As it stands stands, the JBC models are using an estimated number on the length of [6 words unchanged] stay 10 days in the hospital) but by plugging in the SUS data we will be able to more accurately forecast data, hospital admissions and occupancy. occupancy are expected to be more easily forecasted. This is particularly important in the context of vaccination rollout and lifting of national lockdown restriction - decision makers will want to plan ahead and foresee any increases. [1 paragraph unchanged] There is a need for JBC and the wider Programme to obtain and analyse data, including personal data, where necessary and proportionate, in order to: a. Recognise local outbreaks of COVID-19 and to inform local decision makers and response teams about its characteristics; b. Describe, at a granular level, whether particular groups/ sectors of the population are more vulnerable than others, either because of the characteristics of the group or sector (as described in terms of its ethnicity, gender, pre-existing health conditions, socio-economic class etc) or because of the living conditions, leisure pursuits or working conditions experienced by those groups or sectors; c. Develop an early warning capability to identify areas that are vulnerable to an outbreak; d. Be able to use data from more than one source/data set to produce assessments and analysis of better quality (for example, by linking current PHE data about COVID-19 death rates to death certificate data held by the Office for National Statistics, in order to provide more accurate statistics about morbidity rates and cause of death). The data requested is for the full England population, given the national nature of the Test & Trace work. Secondary Use Services Data is also required by the JBC. This data is to cover all of England is required from 2019 onwards to allow for enough data for a historical trend to be identified prior to COVID. Data on all patients, in both episodes and spells is required. This dataset is requested so information can be analysed regarding hospital admissions and length of stay. Detailed hospital admissions data required where possible to include Age, Gender, Ethnicity, socio-economic status, where the patent resides (i.e. at LSOA, LTLA level) and hospital name. The JBC will use this for modelling incidents and prevalence. The JBC will use to adjust for P2 cases removing existing bias to better understand infection prevalence. For example, JBC will use the data for our Lewis, Islay and other prevalence models. It will also assist to back calculate incidents for hospital admissions. The data will be used to link in to overall prevalence data sets that inform the infection rates.

Processing activities

[5 paragraphs unchanged] The need for personal data for an analytical function (taken from the Data Protection Impact Assessment) There is a need for JBC and the wider Programme to obtain and analyse data, including personal data, where necessary and proportionate, in order to: a. Recognise local outbreaks of COVID-19 and to inform local decision makers and response teams about its their characteristics; b. Describe, at a granular level, whether particular groups/ sectors of the population are more vulnerable than others, either because of the characteristics of the group or sector (as described in terms of its ethnicity, gender, pre-existing health conditions, socio-economic class etc) or because of the living conditions, leisure pursuits or working conditions experienced by those groups or sectors; c. Develop an early warning capability to identify areas that are vulnerable to an outbreak; d. Be able to use data from more than one source/data set to produce assessments and analysis of better quality (for example, by linking current PHE data about COVID-19 death rates to death certificate data held by the Office for National Statistics, in order to provide more accurate statistics about morbidity rates and cause of death). Secondary Use Services Data is also required by the JBC. This data is to cover all of England is required from 2019 onwards to allow for enough data for a historical trend to be identified prior to COVID. Data on all patients, in both episodes and spells is required. This dataset is requested so information can be analysed regarding hospital admissions and length of stay. Detailed hospital admissions data required where possible to include Age, Gender, Ethnicity, socio-economic status, where the patent resides (i.e. at LSOA, LTLA level) and hospital name. The JBC will use this for modelling incidents and prevalence. The JBC will use to adjust for P2 cases removing existing bias to better understand infection prevalencenFor example JBC will use the data for our Lewis, Islay and other prevalence models. It will also assist to back calculate incidents for hospital admissions. The data will be used to link in to overall prevalence data sets that inform the infection rates. [4 paragraphs unchanged] Access to the data will be via strictly controlled user access and [14 words unchanged] access specific resources. EDGE has a stringent access controls within the environment. Only substantive employees of the Department of Health & Social Care – Test and Trace Programme are accessing the data. Following IG approval from relevant teams within Northern Ireland’s Department of Health and the Welsh Government’s Health and Social Services Group, the Pillar 2 Antigen Testing (NPEX) data feed from NHSD to EDGE will be filtered to include test results from residents of Northern Ireland, Wales and England. Once approval has been gained from the Scottish Government, and evidence of this has been provided to NHSD the data will flow into EDGE for the entirety of the UK population. When the data is received into EDGE it will be filtered and placed into data marts with appropriate access controls in order to meet the conditions set out by the respective devolved administrations. Most importantly the condition that this data has been agreed to flow into EDGE for a specific use and must only be accessed by the teams creating the University Dashboards. As such the full data will flow into the University teams controlled environment and the rest of the marts will continue to receive England only testing data unless specifically granted permission from the devolved administrations

Unchanged: Expected output, Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + Covid-19 UK Non-hospital Antibody Testing Results (Pillar 3); + Secondary Uses Service Payment By Results Spells

Objective for processing

[5 paragraphs unchanged] This analysis includes • Recognising Local outbreaks, • impact of measures. • Determine vulnerability within the population, • Impact of the virus on different sectors and settings [1 paragraph unchanged] The data is not intended to be used to inform direct care, but instead to influence strategic / operational planning at a local and national level. JBC directly provides analytical insights to ministers. It is hard to exactly determine and predict in this agreement what decisions will be made, but this encapsulates any decisions made in response to the COVID-19 Crisis The data is not intended to be used to inform direct care, but instead to influence strategic / operational planning at a local and national level. The data will provide a macro view of the COVID-19 response, allowing Local and National authorities to make informed decisions As it stands the JBC models are using an estimated number on the length of stay (assumes that the patient will stay 10 days in the hospital) but by plugging in the SUS data we will be able to more accurately forecast hospital admissions and occupancy. This is particularly important in the context of vaccination rollout and lifting of national lockdown restriction - decision makers will want to plan ahead and foresee any increases. The insights will forecast impact to hospital admissions and occupancy and help inform local and national decision makers on what measures they need to consider for future hospitalisation planning.

Processing activities

At least daily data is required as the intention is that data feeds are carried out with the minimum possible latency. This will ensure that the research, analysis and statistics derived from the data science hub are a “single view of the facts”. Statistics, analysis and research from operational systems in Public Health England and NHS-Digital (for example) will continue. Reducing latency to a minimum will ensure these different sources of derived data have a comparable information basis. All organisations party to this agreement must comply with the data sharing framework contract requirements, including those regarding the use (and purposes of that use) by “personnel” (as defined within the data sharing framework contract i.e. employees, agents and contractors of the data recipient who may have access to that data). Regular data feeds are required as the intention is that data feeds are carried out with the minimum possible latency. This will ensure that the research, analysis and statistics derived from the data science hub are a “single view of the facts”. In its raw format the data will be stored in a secure file storage solution. Data will be classified, coded, cleaned, and de-identified (“pseudonymised”) or aggregated by the data engineering element of the Data Analysis Platform before being made accessible to its registered and authorised users. Many users of the data held in the Data Analysis Platform, and all JBC users, will analyse the data using a Data Science Hub. There are two elements of the Data Analysis Platform – the data engineering environment where data are ingested and prepared for use; and the data science hub, where analysis of those prepared data takes place. This is consistent with the model described in the Digital Economy Act Research Code of Practice. Data preparations drawn from the data engineering environment will be supplied into the data science hub to meet analytical requirements thereby minimising the processing of personal data. These will be de-identified (“pseudonymised”) where possible before being made accessible to registered and approved analytical, research and statistical users - where possible. Statistics, analysis and research from operational systems in Public Health England and NHS-Digital (for example) will continue. Reducing latency to a minimum will ensure these different sources of derived data have a comparable information basis. Reducing Latency across all feeds allow the clearest picture in the COVID-19 Crisis which is a constantly evolving picture. The need for personal data for an analytical function (taken from the Data Protection Impact Assessment) There is a need for JBC and the wider Programme to obtain and analyse data, including personal data, where necessary and proportionate, in order to: a. Recognise local outbreaks of COVID-19 and to inform local decision makers and response teams about its their characteristics; b. Describe, at a granular level, whether particular groups/ sectors of the population are more vulnerable than others, either because of the characteristics of the group or sector (as described in terms of its ethnicity, gender, pre-existing health conditions, socio-economic class etc) or because of the living conditions, leisure pursuits or working conditions experienced by those groups or sectors; c. Develop an early warning capability to identify areas that are vulnerable to an outbreak; d. Be able to use data from more than one source/data set to produce assessments and analysis of better quality (for example, by linking current PHE data about COVID-19 death rates to death certificate data held by the Office for National Statistics, in order to provide more accurate statistics about morbidity rates and cause of death). Secondary Use Services Data is also required by the JBC. This data is to cover all of England is required from 2019 onwards to allow for enough data for a historical trend to be identified prior to COVID. Data on all patients, in both episodes and spells is required. This dataset is requested so information can be analysed regarding hospital admissions and length of stay. Detailed hospital admissions data required where possible to include Age, Gender, Ethnicity, socio-economic status, where the patent resides (i.e. at LSOA, LTLA level) and hospital name. The JBC will use this for modelling incidents and prevalence. The JBC will use to adjust for P2 cases removing existing bias to better understand infection prevalencenFor example JBC will use the data for our Lewis, Islay and other prevalence models. It will also assist to back calculate incidents for hospital admissions. The data will be used to link in to overall prevalence data sets that inform the infection rates. Data from SUS will be used to produce a number of graphs and reports. JBC will use data to incorporate into prevalence dashboards that is used to inform the bronze, silver and gold reporting to No.10 Downing Street. Overall, SUS Data is required to help empower JBC stakeholders to make effective decisions on the COVID-19 response [2 paragraphs unchanged] - NHS 111 & 999 telephony triage Pathways data - Pillar 3 testing data Access to the data will be via strictly controlled user access and secure user management, with all users needing to be appropriately authenticated and authorised to access specific resources. EDGE has a stringent access controls within the environment. Access to the data will be via strictly controlled user access and secure user management, with all users needing to be appropriately authenticated and authorised to access specific resources. All organisations party to this agreement must comply with the data sharing framework contract requirements, including those regarding the use (and purposes of that use) by “personnel” (as defined within the data sharing framework contract i.e. employees, agents and contractors of the data recipient who may have access to that data).

Expected measurable benefits

[1 paragraph unchanged] The overall objective of the programme is to provide an integrated and world-class COVID-19 Test & Trace Programme, designed to control the Corona virus and enable people to live a safer and more normal life. Data is used to inform decisions at national and local levels, responsibility for the roll out lies with decision makers.

Benefits reported

Stated in the previous version and removed here.

Yielded Benefits is not a requirement for new applications.

Unchanged: Expected output.