Use of PDS data to support the linkage of data required to inform statistical analysis of factors associated with the COVID-19 pandemic, by providing NHS number where the quality or completeness of personal identifiers are otherwise insufficient.

The Office for National Statistics currently receives data from the NHS Patient Demographic Service under section 43 of the Statistics and Registration Service Act 2007. These data are used in the production and publication of statistics on the number and condition of the UK population.

Since the start of the Coronavirus-19 pandemic, ONS has been frequently requested to provide urgent statistical support to contribute to the wider understanding of the virus, helping to inform a range of policy decisions taken by central government, health services and others. For this purpose, the ONS has relied on data either owned by ONS, acquired through its statutory powers, or provided to ONS under COPI Notice for this purpose. These data sources also include the initiation of new data collection instruments to increase understanding of the virus, for example the recent launch of the Coronavirus Infection Survey, a random sample-based household study of COVID-19 incidence and the School Infection Survey (SIS) a survey involving a sample of schools in England.

Because of the range of data being required to inform analysis on Coronavirus, ONS frequently needs to draw on multiple datasets in combination. In some circumstances this includes datasets where individual identifying details are incomplete or not of sufficient quality for data linkage. In the aforementioned Coronavirus Infection Survey (CIS) and School Infection Survey (SIS) for example, identifying details are collected from all participants, however the quality of linkage to other health sources is limited by the lack of NHS-number on the study. Such data is not sought from participants themselves as many people do not know their NHS Numbers.

Participants in the CIS do so on a voluntary basis and are informed of the intent to use these to link their data from the study with other data sources (see study protocols which can be found here: https://www.ndm.ox.ac.uk/covid-19/covid-19-infection-survey/protocol-and-information-sheets). Participants do not sign a consent form giving explicit permission for their survey responses to be linked with their health data but the intention for such linkage is clearly described in the Participant Information Sheets and further information is provided when each participant is visited at home when the survey is carried out in person. Permission to link the data is therefore considered implicit in participants’ voluntary participation

Under this Agreement, ONS is permitted to use the Patient Demographic Service (PDS) data to support linkage of the CIS and SIS datasets with other health data sources where common personal identifiers are incomplete or of low quality, in order to produce higher quality linkage outcomes specifically and only for COVID analytical studies which require the combination of data from multiple sources.

The use of PDS data for linkage purposes is approved only in circumstances where each of the following conditions apply:

1. The objective is to link CIS or SIS data with a health data source containing NHS Numbers and the PDS data will be linked with the CIS data to obtain a complete set of NHS Numbers to enable linkage of the CIS data with the health data source using the NHS Number;

2. The purpose of the linkage of the CIS or SIS data and other health data source(s) has been requested by SAGE for COVID-19 related purposes and the request was received via the National Statistician, a member of SAGE;

3. The PDS data will only be used for the purpose of facilitating the data linkage and will not be used in any subsequent analysis or outputs;

4. ONS will only link other health data sources with CIS data with the agreement from the supplier of that health data source and will ensure that all uses of the CIS data is transparent and in line with the reasonable expectations of the data subjects who participate in the CIS.

No clinical data is being requested under this Agreement and no additional supply is needed since a source of PDS data is already provided to ONS under an existing Data Sharing Agreement (reference: DARS-NIC-20951-D2K6S). The following list of PDS variables would be used to assist in COVID linkage work:

• NHS Number

• Family Name

• First Given Name

• Other Given Name

• Gender

• Date of Birth

• Type of Registration

• Postcode

• Address Line 1

• Address Line 2

• Address Line 3

• Address Line 4

• Address Line 5

ONS will also utilise administrative data such as the ‘Business Effective From Date’ which indicate when changes to the demographic data in PDS were updated.

Data security for storage and linkage of the data will be provided with an assured ONS data analysis environment (DAP) that includes the following elements of security control:

• Need To Know applied through user account access and management

• Controlled ingest and export of data into/out from the environment

• Controlled account access using unique credentials based on job role

• Logged and monitored access of user activity within the environment

• Secure build configuration for infrastructure, including cloud services

• Vulnerability tested infrastructure with appropriate remediation and patching

• Compliance checks against security enforcing controls

• Architectural review against standards and best practice

• Staff security cleared to the appropriate level based on their supervised and/or unsupervised access to sensitive data in accordance with ONS clearance policies and data access processes

• Education and awareness of environment users covering security policies and secure working practices

• Operational support processes to securely manage the environment

• Risk assessment to identify security risks and mitigation actions to reduce this risk.

ONS employs rigorous disclosure controls and access restrictions ensuring that physical, technical, procedural and personnel security is kept to the highest and most up to date standards. Following policy specified by the ONS Chief Security Officer, users will be granted supervised or unsupervised access following a clearance application. The ONS Information Asset Owner (IAO) grants access and a list of all authorised users is available on request.

The Coronavirus (COVID-19) Infection Survey is carried out by ONS and sponsored by the University of Oxford. The study involved collaborations from other organisations including IQVIA, The National Biosample Centre, the University of Manchester, Public Health England (PHE) and Wellcome Trust. The University of Oxford and ONS are joint Data Controllers for any data collected as part of the CIS and will be jointly responsible for any decisions to link the CIS data with other health data sources.

However, ONS will be the sole organisation responsible for determining the need to use PDS data and the manner in which the PDS data will be used and is therefore considered to be the sole data controller for the data under this Agreement

The SIS is carried out by ONS as a joint project with London School of Hygiene and Tropical Medicine (LSHTM) and Public Health England (PHE), sponsored by DHSC. ONS are the data controllers and are responsible for decisions to link the data collected as part of the survey. Data linkage has been cleared by LSHTM and PHE ethics panels.

This is a task in the public interest. This work is of critical priority across Government as part of the UK’s response to the COVID-19 pandemic. It will contribute to the wider understanding of the virus, helping to inform a range of policy decisions taken by central government, health services and others. Optimising such decision making could ultimately save lives.

ONS will rely on the following lawful basis from the GDPR for processing personal data including special category personal data:

• GDPR Article 6(1)(e) The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. The authority for ONS to produce, promote and safeguard official statistics is found in the Statistics and Registration Service Act 2007.

• GDPR Article 9(2)(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy;

Personal identifiers from the PDS would be used only during linkage work to join the information from necessary data sources and would be removed from the resulting analysis dataset after such linkage had taken place.

ONS receives Personal Demographics Service data from NHS Digital under a separate Data Sharing Agreement.

ONS will reuse that data as follows:

As required, the PDS data will be matched at record level with either the Coronavirus (COVID-19) Infection Survey (CIS) data or the COVID-19 Schools Infection Survey (SIS) using an automated linkage algorithm to match individuals based on combinations of identifying details in each dataset. The NHS Number from the PDS data will be combined with the identifying details from the CIS dataset to enable linkage with health datasets containing the NHS Number variable.

Where required, the PDS data will be matched in the same way described above with sets of patient identifiers from other health datasets in preparation for linking those datasets with the CIS or SIS data. For example, the Test and Trace dataset contains NHS Numbers for ~90% of respondents so linkage with PDS will help populate the missing NHS Numbers before the dataset is linked with CIS or SIS data.

All data linkages will be quality assured.

Once the CIS or SIS data has been linked with the other health dataset, PDS data will be removed. The linked datasets will be made available for analysis as pseudonymised linked datasets in ONS’ Secure Research Service (SRS). No PDS data will be accessible within the SRS.

The primary outputs from the use of PDS data as described above will be datasets comprising of CIS or SIS and other health datasets available for analysis as pseudonymised linked data within ONS’ SRS.

This will result in secondary outputs resulting from the analysis of such linked datasets for purposes determined by SAGE.

The primary benefit of the processing described above will be robust, quality-assured data linkages involving CIS or SIS and other health datasets.

This will support secondary benefits of producing official statistics which SAGE will use to inform policy decisions taken by the government.

Not stated in the register.