ONS / NHS England TRE Public Health Asset

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Processing activities

[11 paragraphs unchanged] For the purposes of this agreement, the linked data are then deidentified, [58 words unchanged] are the Secure Research Service (SRS) and the ONS led cross government Integrated Data Service (IDS). Google Cloud Platform Analytical Platform (GCP AP). [16 paragraphs unchanged] For Integrated Data Service (IDS): Google Cloud Platform Analytical Platform (GCP AP): The data resides within Google Cloud Platform (GCP). All cloud services consumed [103 words unchanged] GCP platform is region locked to UK IP addresses only. Access to IDS GCP AP and any data it holds is not permitted from outside the UK. Overseas connections are monitored, and connection attempts will lead to account suspension. [26 paragraphs unchanged] The SRS presently runs on cloud-based infrastructure provided by Crown Hosting Data Centres Ltd and iTS computing Ltd. Security assurance documentation for these organisations has been supplied to NHS England and approved by the NHS England Security Team. The SRS presently runs on cloud-based infrastructure provided by Crown Data Centres Limited. All implementation and maintenance services related to the SRS's use of Crown Data Centres Limited's infrastructure are provided by their service provider; Ark Data Centres Ltd, who are listed as a data processor. All implementation and maintenance services related to the SRS's use of Crown Hosting Data Centres Ltd infrastructure are provided by their service provider; Ark Data Centres Ltd who have been added as a data processor.

Benefits reported

There are several live projects currently accessing the PHRD and multiple project applications to access PHRD that are being reviewed. Almost all projects are accessing the Census and Mortality parts of PHRD, with the majority also accessing either HES and/or GP data. Most projects have not yet requested outputs from the ONS TRE to feed into their planned publications, as the work is still in progress, although one has submitted two articles for the journals Trends in Mortality and Trends in 'Deaths of Despair'. This will be kept under regular review and ONS will consider the best way to make clear the benefits that the PHRD is delivering as projects begin to release findings and have an impact. The SRS are no longer accepting new applications however there are still a number of live projects. Almost all projects are accessing the Census and Mortality parts of PHRD, with the majority also accessing either HES and/or GP data. Most projects have not yet requested outputs from the ONS TRE to feed into their planned publications, as the work is still in progress, although one has submitted two articles for the journals Trends in Mortality and Trends in 'Deaths of Despair'. This will be kept under regular review and ONS will consider the best way to make clear the benefits that the PHRD is delivering as projects begin to release findings and have an impact. [4 paragraphs unchanged] There is also a project researching how social environment characteristics and geographic mobility patterns influence public health outcomes across England and Wales. By leveraging demographic data, travel behaviour surveys, and health records, the study aims to uncover spatial inequalities in health linked to socio-economic status, transport accessibility, and commuting patterns. Using advanced methods such as machine learning and causal inference, the research will identify area-based risk factors and support evidence-based planning for healthier, more equitable communities.

Unchanged: Objective for processing, Expected output, Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Expected output

[13 paragraphs unchanged] 4. The research into how social environment characteristics and geographic mobility patterns influence public health outcomes across England and Wales will use datasets in the following way: 1. Census 2011 Individual-Level Data (LAD level): Used to construct detailed demographic and socio-economic profiles for each Local Authority District; 2. Census 2011 Origin-Destination (Ward level): Used to map commuting flows and define contextual mobility patterns at the ward level; 3. National Travel Survey (OA level): Used to characterize area-level travel mode shares, frequency, and accessibility indicators by sociodemographic factors such as gender, age, and occupation; 4. Public Health Research Database (England and Wales) will be used to model spatial variation in health outcomes in relation to demographic and contextual mobility factors. Statistical and machine learning methods will be used to detect associations, and causal inference methods will support identification of structural drivers.

Expected measurable benefits

[6 paragraphs unchanged] 4. The research into how social environment characteristics and geographic mobility patterns influence public health outcomes across England and Wales aims to: 1. develop a multi-level spatial model linking socio-demographic and mobility indicators to public health outcomes; 2. characterize area-level travel behaviour and accessibility patterns using national datasets; 3. identify social environment factors associated with adverse health outcomes and map geographic health inequalities; 4. support evidence-based planning and public health interventions through data-driven insights.

Benefits reported

[4 paragraphs unchanged] A recent project was approved which looks to investigate how social environment characteristics and geographic mobility patterns influence public health outcomes across England and Wales. By leveraging demographic data, travel behaviour surveys, and health records, the study aims to uncover spatial inequalities in health linked to socio-economic status, transport accessibility, and commuting patterns. Using advanced methods such as machine learning and causal inference, the research will identify area-based risk factors and support evidence-based planning for healthier, more equitable communities. There is also a project researching how social environment characteristics and geographic mobility patterns influence public health outcomes across England and Wales. By leveraging demographic data, travel behaviour surveys, and health records, the study aims to uncover spatial inequalities in health linked to socio-economic status, transport accessibility, and commuting patterns. Using advanced methods such as machine learning and causal inference, the research will identify area-based risk factors and support evidence-based planning for healthier, more equitable communities.

Unchanged: Objective for processing, Processing activities.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Benefits reported

There are serveral several live projects currently accessing the PHRD and multiple project applications to access [91 words unchanged] is delivering as projects begin to release findings and have an impact. [3 paragraphs unchanged]

Unchanged: Objective for processing, Processing activities, Expected output, Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + COVID-19 General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (GDPPR); + COVID-19 Vaccination Status; + Hospital Episode Statistics Critical Care (HES Critical Care)

Objective for processing

The overall objective of this request is to permit This Data Sharing Agreement (DSA) permits the continuation of work by ONS to make an anonymised version for the management of an existing dataset it holds containing NHS Digital data (called the Public Health Data Asset and (PHDA) hereafter referred to as 'the asset') available for use by approved researchers in its Trusted Research Environment (TRE). asset'. Under this iteration of the Agreement ONS are requesting to extend the scope of previous approvals to: ONS has been granted access to NHS England controlled identifiable data for its functions (which broadly involves the production of official statistics), including HES, GDPPR, and ECDS data. For HES Admitted Patients Care (APC), HES Accident & Emergency (A&E), HES Outpatients, Vaccination and ECDS data, the legal basis is section 45C of the SRSA 2007, as amended by the Digital Economy Act (2017). For the GDPPR and HES Critical Care data, the legal basis is section 45A of the SRSA, 2007, as amended by the Digital Economy Act (2017). The legal basis for processing the datasets included within this DSA is in line with the Articles 6.1.e and 9.2.j of the GDPR. 1. Permit the inclusion of the Emergency Care Dataset (ECDS) and Covid-19 Vaccination Status data in the Public Health Research Database (PHRD), for approved users to access via ONS’ Trusted Research Environment (TRE). No further data will be disseminated under this agreement; ONS will re-use the data already being disseminated under existing agreements with NHS England - DARS-NIC-175120-W5G2X & DARS-NIC-400304-S1P1B. 2. Add UKCloud Ltd., Equiniti Group Plc and Crown Hosting Data Centres as data processors. A key part of processing the HES and GDPPR data is to produce official statistics. This involves linking the data at a record level to ONS held 2011 Census and mortality data. This linkage allows ONS to create a person level health-based dataset that includes a large proportion of the population of England who were present in 2011. It includes their characteristics, as recorded on the 2011 Census, if they have subsequently died, cause of death (including COVID-19), and what underlying conditions they have/had using evidence from the event based HES and GDPPR data. To confirm, ONS will be continuing to process GDPPR data under this iteration of the Agreement. The legal basis for ONS to do so is section 45A of the Statistics and Registration Services Act (SRSA 2007); the data will be processed in line with Articles 6.1.e and 9.2.j of the GDPR. In line with the governance path for GDPPR requests, this application has been presented in front of the Profession Assurance Group and the Independent Group Advising on the Release of Data, receiving approval and recommendation for approval respectively. DARS will continue to keep PAG informed of the continued dissemination and processing of the GDPPR data for all applications that relied on COPI for their processing of the GDPPR data. The HES data and ECDS data also allows ONS to include hospitalisation from COVID-19 as an outcome (following recovery) permitting statistical insight to support priorities such as to investigate long-term health outcomes following SARS-CoV-2 infection, including analysis of a range of diagnosed conditions across organ systems which may or may not have resulted in hospital attendance. Vaccination data provides an indication of COVID-19 vaccination status, including which dose, which manufacturer, and where the vaccination was administered. This anonymised version (to be called the 'Public Health Research Database', hereafter referred to as the PHRD) includes a number of underlying data sources that have previously been linked at a record level for internal ONS statistical purposes. The resulting linked data asset is termed the Public Health Data Asset (or 'the asset') within ONS. The approved ONS statistical purposes for the asset are covered in ONS’ existing DSAs with NHS England as referenced above. ONS has to date, released outputs based on the data that were important for decision making and public debate around the pandemic; for example, the relative risk of COVID-19 mortality across different ethnic groups, and vaccination uptake by different characteristics. At present the NHS information included in the PHRD is derived information from Hospital Episodes Statistics (HES) data and GPES Data for Pandemic Planning and Research (GDPPR) data. Under this iteration of the Agreement ONS are looking to amend existing permissions so that information derived from the COVID-19 Vaccination Status data (hereafter referred to as ‘vaccination data’), and the Emergency Care Dataset (ECDS) are also added to the PHRD. The core features of the asset are as follows: However, further insight could be gained from this linked asset than can be reasonably researched by ONS analysts on their own. Processing of this linked data could support further insights to deliver significant public good in the form of better, evidence based, public health measures which can be of importance in decision making by professionals and health care professionals. It is in the public interest that these data be made available to approved researchers as long as the data can be made available in an anonymised form that is proportionate, and minimises data protection risks. ONS currently has approved access to NHS Digital controlled identifiable data for its functions (which broadly involves the production of official statistics), including HES, GDPPR, and ECDS data. ONS are currently awaiting approval to receive Vaccination Data. For HES Admitted Patients Care (APC), HES Accident & Emergency (A&E), HES Outpatients, the vaccination and ECDS data, the legal basis is section 45C of the SRSA 2007, as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement (DARS-NIC-175120-W5G2X). For the GDPPR and HES Critical Care data, the legal basis is section 45A of the SRSA, 2007, as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement (DARS-NIC-400304-S1P1B). Note that no new data will be disseminated under this agreement; ONS will re-use the data already being disseminated under the above agreements. Birth notification and IAPT data are also included in DARS-NIC-175120-W5G2X but only the HES, vaccination and ECDS data are being used here. A key part of processing the HES and GDPPR data is to produce official statistics. This involves linking the data at a record level to ONS held 2011 Census and mortality data. This linkage allows ONS to create a person level health-based dataset that includes a large proportion of the population of England who were present in 2011. It includes their characteristics, as recorded on the 2011 Census, if they have subsequently died, cause of death (including COVID-19), and what underlying conditions they have/had using evidence from the event based HES and GDPPR data. The HES data and ECDS data also allows ONS to include hospitalisation from COVID-19 as an outcome (when they subsequently recover). Furthermore, a priority for 2022 is to investigate long-term health outcomes following SARS-CoV-2 infection, including analysis of a range of diagnosed conditions across organ systems which may or may not have resulted in hospital attendance. The vaccination data provides an indication of COVID-19 vaccination status, including which dose, which manufacturer, and where the vaccination was administered. The resulting linked data asset is termed the Public Health Data Asset (or 'the asset') within ONS. The approved ONS statistical purposes for the asset are covered in ONS’ existing DSAs with NHS Digital (the ones referenced above). These include using this powerful linked data to model the risk of COVID-19 mortality and morbidity based on the other socio-economic and health information held in the linked dataset. ONS had already released outputs based on the data that were important for decision making and public debate around the pandemic; for example, the relative risk of COVID-19 mortality across different ethnic groups, and vaccination uptake by different characteristics. However, there is far more insight that could be gained from this powerful linked asset than can be reasonably researched by ONS analysts on their own, and these insights could deliver significant public good in the form of better, evidence based, public health measures. Such missed opportunities could be of importance in decision making in the fight against the pandemic, or in countering its lasting effects as the country moves to an endemic state. It is in the public interest that these data be made available to approved researchers as long as the data can be made available in an anonymised form that is proportionate, and minimises data protection risks. [1 paragraph unchanged] The resulting dataset (PHRD)will be held within the ONS TRE and be jointly controlled by ONS and NHS Digital, with a sub-licence issued by NHS Digital setting out the basis for creation of and secure access to the PHRD. Although the application process will be managed by ONS, it has been developed in collaboration with NHS Digital. And the agreed process flow will include the referral of all applications to NHS Digital for consent under the terms of the SRSA 2007, in conjunction with approval by ONS and the UK Statistics Authority Research Accreditation Panel. Only once approval has been granted by all relevant parties will access to the data be given to approved researchers. This anonymised version (to be called the 'Public Health Research Database', hereafter referred to as the PHRD) includes a number of underlying data sources that have previously been linked at a record level for internal ONS statistical purposes. At present the NHS information included in the PHRD is derived information from Hospital Episodes Statistics (HES) data, Emergency Care Dataset (ECDS) data, COVID-19 Vaccination Status data and GPES Data for Pandemic Planning and Research (GDPPR) data. The resulting dataset (PHRD) will be held within the ONS TRE and be jointly controlled by ONS and NHS England, with a sublicence issued by NHS England setting out the basis for creation of and secure access to the PHRD. Although the application process will be managed by ONS, it has been developed in collaboration with NHS England. And the agreed process flow will include the referral of all applications to NHS England for consent under the terms of the SRSA 2007, in conjunction with approval by ONS and the UK Statistics Authority Research Accreditation Panel. Only once approval has been granted by all relevant parties will access to the data be given to approved researchers. [2 paragraphs unchanged] Hospital Episode Statistics (HES) APC - record level identifiable 2009/10 through to 2020/21 latest available. HES OP - record level identifiable 2009/10 through to 2020/22 (and ongoing). latest available. [1 paragraph unchanged] ECDS – - record level identifiable 2019/20 through to 2020/22 (and ongoing) latest available. COVID-19 vaccination data – - record level identifiable 2020-22 (and ongoing). 2020 to latest available. The GDPPR Data Sharing Agreement (DARS-NIC-400304) includes record level identifiable data covering 2000-2021 (and ongoing), 2000-2021, and HES critical care – - record level identifiable 2009/10 through to 2020/22 (and ongoing). 2020/22. Only the relevant information needed to achieve ONS’s statistical coronavirus response has [31 words unchanged] the information held on this internal asset. Specifically, in terms of NHS Digital England owned health data, the following have been derived and will be included on the PHRD made available under this agreement: [8 paragraphs unchanged] The National Data Opt-out is not applied to the NHS Digital England data in the Public Health Research Database. Both ONS and NHS England recognise their role as joint data controllers (including for example the creation of relevant DPIA and joint controller arrangements which set out their respective responsibilities as joint controllers) and are committed to ensuring that appropriate transparency information is put in place. Both ONS and NHS Digital recognise their role as joint data controllers (including for example the creation of relevant DPIA and joint controller arrangements which set out their respective responsibilities as joint controllers) and are committed to ensuring that appropriate transparency information is put in place.

Processing activities

As described in section 5a, ONS holds NHS Digital HES and GDPPR data and these have been used to derive ONS are permitted to continue processing the following data for the objectives outlined in this agreement. The datasets and periods available to ONS for the asset are: person level health information that has been added to an internal linked dataset being used by ONS analysts under existing Data Sharing Agreements. ONS are referring to these linked data as the Public Health Data Asset (from hereon, the asset). Hospital Episode Statistics (HES) APC - record level identifiable 2009/10 through to 2020/21 (and ongoing). Under this Amendment, ONS are now requesting to amend existing permissions to derive personal level health information from COVID-19 vaccination and ECDS data that will then be added to an internal linked datasets being used by ONS analysts under existing Data Sharing Agreements and the PHRD. The datasets and periods available to ONS for the asset are: Hospital Episode Statistics (HES) APC - record level identifiable 2009/10 through to 2020/21. [2 paragraphs unchanged] HES critical care – - record level identifiable 2009/10 through to 2020/21 (and ongoing). 2021/22. ECDS – - record level identifiable 2019/20 through to 2020/21(and 2020/21 (and ongoing) COVID-19 vaccination data – - record level identifiable 2020-22 2020-23 [11 paragraphs unchanged] 2. ONS will provide access to the de-identified linked data to approved [44 words unchanged] assessed and approved by RAP and ONS will require consent from NHS Digital England under SRSA 2007 before it grants access to an approved researcher (where [12 words unchanged] not if they only want information from the census and mortality data). ONS will also refer all applications for access to linked data that [14 words unchanged] 2007 via an information governance approvals process agreed with them under the sub-licence sublicence agreed via this application. This is broadly as follows: The application process will be managed by ONS but has been developed in collaboration with NHS Digital. England. The main part of the application process involves the UK Statistics Authority [15 words unchanged] data according to a set of criteria. See here for further information: [1 paragraph unchanged] RAP includes a number of independent members, as well senior civil servants. However, the agreed process flow will also include the referral of all applications to NHS Digital England for consent under the terms of the SRSA 2007. The order of [16 words unchanged] relevant parties will access to the data be given to approved researchers. [1 paragraph unchanged] • - Approved researchers under the approved researcher framework who are carrying out statistical research for COVID-19 purposes only. • - ONS support staff who have appropriate training and security clearance (at least [21 words unchanged] check the research outputs to ensure that they are safe to publish. [4 paragraphs unchanged] The ONS TRE does not, as a standard, provide a way for [32 words unchanged] and provide specific permission on a case-by-case basis with consent from NHS Digital. England. The frequency of this occurring is likely to be low based on other ONS TRE past usage. 5. Destruction: ONS will destroy the data in line with the NHS Digital standard for data destruction. 5. Destruction: ONS will destroy the data in line with the NHS England standard for data destruction. If NHS England or ONS wish to withdraw a dataset from the ONS TRE, ONS will destroy the data and remove the data catalogue entry. ONS will jointly agree how to deal with active projects using their data and act accordingly. As soon as all data dependencies are addressed ONS will destroy the data. If NHS Digital or ONS wish to withdraw a dataset from the ONS TRE, ONS will destroy the data and remove the data catalogue entry. ONS will jointly agree how to deal with active projects using their data and act accordingly. As soon as all data dependencies are addressed ONS will destroy the data. For individual research projects, after the end of the research project, the specific data used in that research will be kept for a period of 2 years to allow validation of the research results and then it will be destroyed unless ONS specifies otherwise. At that time the project is moved to a data archive. ONS will destroy the data from the archive after 5 years. For individual research projects, after the end of the research project, the specific data used in that research will be kept for a period of 2 years to allow validation of the research results and then it will be destroyed unless ONS specifies otherwise. At that time the project is moved to a data archive. ONS will destroy the data from the archive after 5 years. ONS will make use of the exemptions available for processing data for statistical purposes to allow ONS to use these retention periods. 6. Minimisation: The project accreditation process together with the technical controls in [11 words unchanged] available by ONS to each researcher to achieve the stated research outcomes. This is achieved by restricting researcher access to their own project storage areas, and ensuring that only a limited number of ONS support staff are able to transfer pre-approved data into those folders. This is achieved by restricting researcher access to their own project storage areas, and ensuring that only a limited number of ONS support staff are able to transfer pre-approved data into those folders. [1 paragraph unchanged] 8. Technology used: ONS use well established statistical techniques based on advice [46 words unchanged] such tools in relation to the jointly controlled data asset with NHS Digital. England. [17 paragraphs unchanged] The SRS presently runs on cloud-based infrastructure provided by UKCloud Crown Hosting Data Centres Ltd and iTS computing Ltd. Security assurance documentation for UKCloud these organisations has been supplied to NHS Digital England and approved by the NHS Digital England Security Team. All implementation and maintenance services related to the SRS’s use of UKCloud infrastructure are provided by Equiniti. Equiniti is included in the within the data processor, processing Location and storage location sections of this Agreement. In the coming months it is anticipated that the ONS SRS will be migrated from UKCloud and Equiniti infrastructure to infrastructure provided by Crown Hosting Data Centres. All security controls (i.e ‘The Five Safes approach’) currently in place within the ONS SRS will still be in place once the data is migrated to Crown Hosting Data Centres. Crown Hosting Data Centres have been added as a data processor, and relevant storage and processing locations have been approved by NHS Digital’s Cyber Security Consultant. All implementation and maintenance services related to the SRS's use of Crown Hosting Data Centres Ltd infrastructure are provided by their service provider; Ark Data Centres Ltd who have been added as a data processor.

Expected output

The outputs/outcome of this application hope to be a sub-licensing agreement that [19 words unchanged] to approved projects run by approved researchers, with the consent of NHS Digital. England. [8 paragraphs unchanged] The below outlines the expected outputs of some of the current projects that have access to anonymised NHS Digital England datasets within PHRD: [3 paragraphs unchanged]

Expected measurable benefits

It is not possible to be specific as to the final public benefits until one or more projects as described in section 5c complete their work and publish results. However, the design of the dataset itself is specifically aimed at enabling research into health in the powerful socio-economic context of the 2011 Census data. It is also specifically aimed at providing data that is of direct relevance to the COVID-19 pandemic. Project applications must have a specific health and COVID-19 purpose focus. And as a result, projects are expected to produce results that could inform pandemic decision making and/or increase understanding of the COVID-19 pandemic and its effects over time. However, the design of the dataset itself is specifically aimed at enabling research into health in the powerful The below outlines the expected benefits of some of the current projects that have access to anonymised NHS England datasets within PHRD: socio-economic context of the 2011 Census data. It is also specifically aimed at providing data that is of direct relevance to the COVID-19 pandemic. Project applications must have a specific health and COVID-19 purpose focus. And as a result, projects are expected to produce results that could inform pandemic decision making and/or increase understanding of the COVID-19 pandemic and its effects over time. The below outlines the expected benefits of some of the current projects that have access to anonymised NHS Digital datasets within PHRD: [2 paragraphs unchanged] 3. The national coronavirus population study may lead to a better estimation [14 words unchanged] have had COVID-19 (even if they hadn’t realise it at the time). This estimations have the potential to improve and decrease uncertainty of models that have been used to predict the effect of interventions aimed at reducing the spread of the virus. This estimations have the potential to improve and decrease uncertainty of models that have been used to predict the effect of interventions aimed at reducing the spread of the virus.

Benefits reported

As of March 2022, there There are 8 serveral live projects currently accessing the PHRD and 2 multiple project applications to access PHRD that are being reviewed. Almost all projects [83 words unchanged] is delivering as projects begin to release findings and have an impact. Findings from the Cabinet Office’s Race Disparities Project on risk factors related to ethnicity and deprivation, associated with Covid-19 infection and severe outcomes, informed decisions on public service delivery in response to the pandemic. In October 2020, the UK Government released £23.75 million in funding under the Community Champions scheme for local authorities to work with grassroots advocates to tailor public health communications, counter misinformation and encourage vaccine uptake. The work prompted the government to mandate recording ethnicity as part of the death certification process to establish a complete picture of the impact of the virus on ethnic minorities, which will further inform ONS mortality statistics. The project Gestational age at birth, chronic conditions, and school outcomes: a population-based data linkage study of children born in England, established the link between school achievement for children and adolescents with underlying chronic conditions and between education outcomes and subsequent use of hospital services. This was achieved through linking the National Pupil Database (NPD), Personal Demographic Service (PDS), Hospital Episode Statistics (HES) and mortality data, with linkage success rates of 92% to 99% for children born between 1990 and 2005 within the SRS. The result of this work has seen recommendations to policy makers for additional support for high-risk groups based on early health indicators and socioeconomic factors shown to influence later outcomes. The success of data linkage was further reported by ethnicity and deprivation, allowing the researchers to identify biases and the potential to underestimate the health needs of disadvantaged groups. This established outcomes relevant to all users of linked data and promoted transparency in reporting errors as well as successes.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + Emergency Care Data Set (ECDS); + Hospital Episode Statistics Accident and Emergency (HES A and E); + Hospital Episode Statistics Admitted Patient Care (HES APC); + Hospital Episode Statistics Outpatients (HES OP)

Objective for processing

Amendment March 2021: The overall objective of this request is to permit the continuation of work by ONS to make an anonymised version of an existing dataset it holds containing NHS Digital data (called the Public Health Data Asset and hereafter referred to as 'the asset') available for use by approved researchers in its Trusted Research Environment (TRE). An amendment to add the GPES Data for Pandemic Planning and Research (COVID-19) to the Public Health Data Asset and Public Health Research Database. Under this iteration of the Agreement ONS are requesting to extend the scope of previous approvals to: The objective of this application is to seek permission for ONS to make an anonymised version of an existing dataset it holds containing NHS Digital data (called the ‘Public health data asset’, and from hereon 'the asset') available for use by approved researchers in its Trusted Research Environment (TRE). 1. Permit the inclusion of the Emergency Care Dataset (ECDS) and Covid-19 Vaccination Status data in the Public Health Research Database (PHRD), for approved users to access via ONS’ Trusted Research Environment (TRE). This anonymised version (to be called the 'Public Health Research Database', or PHRD) includes a number of underlying data sources that have previously been linked at a record level for internal ONS statistical purposes. The NHS information included in the PHRD is derived information from HES and GPES Data for Pandemic Planning and Research (GDPPR) datasets. The core features of the asset are as follows. 2. Add UKCloud Ltd., Equiniti Group Plc and Crown Hosting Data Centres as data processors. ONS currently has approved access to NHS Digital controlled identifiable data for its functions (essentially the production of official statistics), including HES and GDPPR data. To confirm, ONS will be continuing to process GDPPR data under this iteration of the Agreement. The legal basis for ONS to do so is section 45A of the Statistics and Registration Services Act (SRSA 2007); the data will be processed in line with Articles 6.1.e and 9.2.j of the GDPR. In line with the governance path for GDPPR requests, this application has been presented in front of the Profession Assurance Group and the Independent Group Advising on the Release of Data, receiving approval and recommendation for approval respectively. DARS will continue to keep PAG informed of the continued dissemination and processing of the GDPPR data for all applications that relied on COPI for their processing of the GDPPR data. For the HES data, the legal basis is section 45C of the Statistics and Registration Services Act (2008), as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement DARS-NIC-175120-W5G2X. This anonymised version (to be called the 'Public Health Research Database', hereafter referred to as the PHRD) includes a number of underlying data sources that have previously been linked at a record level for internal ONS statistical purposes. For the GDPPR data, the legal basis is section 45A of the Statistics and Registration Services Act (2008), as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement (DARS-NIC-400304-S1P1B). At present the NHS information included in the PHRD is derived information from Hospital Episodes Statistics (HES) data and GPES Data for Pandemic Planning and Research (GDPPR) data. Under this iteration of the Agreement ONS are looking to amend existing permissions so that information derived from the COVID-19 Vaccination Status data (hereafter referred to as ‘vaccination data’), and the Emergency Care Dataset (ECDS) are also added to the PHRD. The core features of the asset are as follows: Note that no new data will be disseminated under this agreement; ONS will use the data already being disseminated under the above agreements. ONS currently has approved access to NHS Digital controlled identifiable data for its functions (which broadly involves the production of official statistics), including HES, GDPPR, and ECDS data. ONS are currently awaiting approval to receive Vaccination Data. Birth notification and IAPT data are included in DARS-NIC-175120-W5G2X but only the HES data are being used here. For HES Admitted Patients Care (APC), HES Accident & Emergency (A&E), HES Outpatients, the vaccination and ECDS data, the legal basis is section 45C of the SRSA 2007, as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement (DARS-NIC-175120-W5G2X). NIC-400304, Investigation COVID-19, which provides GPES Data for Pandemic Planning and Research (COVID-19), Emergency Care Data Set (ECDS), HES A&E, APC and OP. It is only the GDPPR data from NIC-400304 that will be used under this Agreement (NIC-420710) For the GDPPR and HES Critical Care data, the legal basis is section 45A of the SRSA, 2007, as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement (DARS-NIC-400304-S1P1B). A key part of the processing of the HES and GDPPR data for the production of official statistics involves linking them at a record level to ONS held 2011 Census and mortality data. This linkage allows ONS to create a person level health based research dataset that includes a large proportion of the England and Wales population who were present in 2011. It includes: their characteristics as recorded on the 2011 Census, if they have subsequently Note that no new data will be disseminated under this agreement; ONS will re-use the data already being disseminated under the above agreements. Birth notification and IAPT data are also included in DARS-NIC-175120-W5G2X but only the HES, vaccination and ECDS data are being used here. died, cause of death (including if from COVID-19 this year), and what underlying conditions they have/had using evidence from the event based HES and GDPPR data. A key part of processing the HES and GDPPR data is to produce official statistics. This involves linking the data at a record level to ONS held 2011 Census and mortality data. This linkage allows ONS to create a person level health-based dataset that includes a large proportion of the population of England who were present in 2011. The HES data also allow ONS to include hospitalisation from COVID-19 as an outcome (when they subsequently recover). It includes their characteristics, as recorded on the 2011 Census, if they have subsequently died, cause of death (including COVID-19), and what underlying conditions they have/had using evidence from the event based HES and GDPPR data. The resulted linked data asset is termed the “Public health data asset’ (or 'the asset') within ONS. The HES data and ECDS data also allows ONS to include hospitalisation from COVID-19 as an outcome (when they subsequently recover). Furthermore, a priority for 2022 is to investigate long-term health outcomes following SARS-CoV-2 infection, including analysis of a range of diagnosed conditions across organ systems which may or may not have resulted in hospital attendance. The approved ONS statistical purposes for the data in its own DSAs with NHS Digital (the ones referenced above) include using this powerful linked data to model the risk of COVID-19 mortality and morbidity based on the other socio-economic and health information held in the linked dataset. As at February 2021, ONS had already released outputs based on the data that were important for decision making and public debate around the pandemic, notably the relative risk of COVID-19 mortality across different ethnic groups. The vaccination data provides an indication of COVID-19 vaccination status, including which dose, which manufacturer, and where the vaccination was administered. However, there is far more insight that could be gained from this powerful linked asset than can be reasonably researched by ONS analysts on its own. Such missed insights could be of importance in decision making in the fight against the pandemic, and as such could ultimately save lives. It is therefore clearly in the public interest that these data be made available to approved researchers as long as the data can be made available in an anonymised form that is proportionate, and minimises data protection risks. The resulting linked data asset is termed the Public Health Data Asset (or 'the asset') within ONS. The approved ONS statistical purposes for the asset are covered in ONS’ existing DSAs with NHS Digital (the ones referenced above). These include using this powerful linked data to model the risk of COVID-19 mortality and morbidity based on the other socio-economic and health information held in the linked dataset. Therefore, this agreement permits the additional data processing required to ensure that the asset held by ONS is suitably transformed ready for access in a TRE by approved applications and researchers. The resulting dataset will be functionally anonymous (and therefore non-personal) in the hands of the researchers given the technical and contractual controls that ONS apply to this manipulated data asset. Such external research will be limited to statistic research for COVID-19 purposes. ONS had already released outputs based on the data that were important for decision making and public debate around the pandemic; for example, the relative risk of COVID-19 mortality across different ethnic groups, and vaccination uptake by different characteristics. The resulting dataset (the 'Public Health Research Database', or PHRD) will be held within the ONS Trusted Research Environment (TRE) and be jointly controlled by ONS and NHS Digital, with a sub-licence issued by NHS Digital setting out the basis for the creation and onward sharing of the ONS asset by ONS. Although the application process will be managed by ONS, it has been developed in collaboration with NHS Digital. And the agreed process flow will include the referral of all applications to NHS Digital for consent under the terms of the Statistics and Registration Services Act 2007, in conjunction with approval by ONS. Only once approval has been granted by ONS will access to the data be given. However, there is far more insight that could be gained from this powerful linked asset than can be reasonably researched by ONS analysts on their own, and these insights could deliver significant public good in the form of better, evidence based, public health measures. Such missed opportunities could be of importance in decision making in the fight against the pandemic, or in countering its lasting effects as the country moves to an endemic state. It is in the public interest that these data be made available to approved researchers as long as the data can be made available in an anonymised form that is proportionate, and minimises data protection risks. In terms of data minimisation, ONS already minimised the HES and GDPPR data that it holds under its own DSAs for statistical purposes, to the years and variables needed to achieve its statistical goals. The variables used by ONS do include personal identifiers to enable the linkage of those data to the 2011 Census and mortality data. But such variables are not needed by ONS analysts post linkage, and have already been removed from the linked dataset being used by ONS analysts – i.e. only the necessary data linkers in ONS access these identifiers. These identifiers will obviously remain absent in the PHRD. Therefore, this agreement permits the additional data processing required to transform the internal version of the asset into a deidentified version that is suitable for access by approved researchers in a Trusted Research Environment (TRE). The resulting dataset will be functionally anonymous (and therefore non-personal) in the hands of the researchers given the technical and contractual controls that ONS apply to this manipulated data asset in its TRE. Such external research will be limited to statistical research for COVID-19 purposes. The resulting dataset (PHRD)will be held within the ONS TRE and be jointly controlled by ONS and NHS Digital, with a sub-licence issued by NHS Digital setting out the basis for creation of and secure access to the PHRD. Although the application process will be managed by ONS, it has been developed in collaboration with NHS Digital. And the agreed process flow will include the referral of all applications to NHS Digital for consent under the terms of the SRSA 2007, in conjunction with approval by ONS and the UK Statistics Authority Research Accreditation Panel. Only once approval has been granted by all relevant parties will access to the data be given to approved researchers. In terms of data minimisation, ONS has already minimised the HES, GDPPR, vaccination and ECDS data that it holds under existing DSAs for statistical purposes, to the years and variables needed to achieve statistical goals. The variables used by ONS internally do include personal identifiers to enable the linkage of those data to the 2011 Census and mortality data. But such variables are not needed by ONS analysts after the linkage has been achieved, and have already been removed from the asset being used internally by ONS analysts i.e. only the necessary data linkage staff in ONS access these identifiers. These identifiers will remain absent in the PHRD. [1 paragraph unchanged] • Hospital Episode Statistics (HES) APC - record level identifiable 2009/10 through to 2020/21. 2020/21 • HES OP - record level identifiable 2009/10 through to 2020/21. 2020/22 (and ongoing). • HES A&E - record level identifiable 2009/10 through to 2019/20. (discontinued April 2020). The GDPPR Data Sharing Agreement (DARS-NIC-400304) includes record level identifiable data covering 2000-2020. ECDS – record level identifiable 2019/20 through to 2020/22 (and ongoing) Only the relevant information needed to achieve ONS’s statistical coronavirus response has been drawn across from the Census, Mortality, HES and GDPPR, into the asset being used internally by ONS analysts. COVID-19 vaccination data – record level identifiable 2020-22 (and ongoing). Then in terms of the functionally anonymous PHRD that this agreement will cover, this will only include some of the information on this internal data asset. Specifically, in terms of NHS Digital owned health data, the following have been derived and will be included on the PHRD made available under this agreement: The GDPPR Data Sharing Agreement (DARS-NIC-400304) includes record level identifiable data covering 2000-2021 (and ongoing), and 1. Derived ‘yes/no’ variables that indicate whether there is evidence of a subject having suffered from a particular condition in the past based on their HES and GDPPR records. In the case of the HES data, this is derived from records within the last 3 years, and for the GDPPR data from records from the last 20 years. There is only a small set of comorbidities. For example, there are 28 of these yes/no variables derived from HES for broad conditions relevant to risk of poor outcomes from COVID-19 such as cancer, COPD, asthma, diabetes. There are 30 derived comorbidities from the GDPPR data. HES critical care – record level identifiable 2009/10 through to 2020/22 (and ongoing). Having comorbidities derived from both sources provides a much more complete picture of comorbidities than HES data on its own. Only the relevant information needed to achieve ONS’s statistical coronavirus response has been integrated from the Census, Mortality, HES, GDPPR vaccination and ECDS datasets. Then in terms of the functionally anonymous PHRD that this agreement will cover, this will only include some of the information held on this internal asset. Specifically, in terms of NHS Digital owned health data, the following have been derived and will be included on the PHRD made available under this agreement: There already is (and in future will be) additional information in the asset being used internally. These are not yet part of the PHRD, but they could usefully be added to the PHRD once such information has been fully integrated, QA’d, and confirmed as statistically useful by ONS within its internal version of the data. 1. Derived yes/no variables that indicate whether there is evidence of a subject suffering or having suffered from a particular condition in the past based on their HES and GDPPR records. Such information allows comorbidities to be explored and controlled for in models of the risk factors for COVID-19 mortality and morbidity. The types of this additional derived information are set out below. But to be clear at this stage, this is just to flag they might be added to the Public Health Research Database in future. Having comorbidities derived from both sources provides a much more complete picture of comorbidities than HES data on its own. Specific dates of diagnoses will never be added to the PHRD, only generic timeframes, for example, evidence or not (yes/no) of that condition being present in clinical codes in HES/GP data within the last x years. In the case of items 1-3, these are derived from the HES and will be taken to already be covered by this agreement, should these additions be made. Item 4 would be information derived from other datasets and therefore would require an amendment to this agreement before they could be added: 2. Evidence of being hospitalised from COVID-19 derived from the HES and ECDS event based data from March 2020 onwards. This allows exploration of severe illness as an outcome. This will be limited to month of admission and month of discharge. 1. Additional binary comorbidity information for further conditions where there is a link to coronavirus. See box 1 here for a longer list of comorbidities: Other derived person level COVID-19 hospitalisation information will include whether a patient was admitted to an Intensive Therapy Unit (ITU) during their stay and if so, for how long. The risk of inadvertent reidentification will be minimised through the exclusion of specifics such as dates (as noted above) and hospital where treated. https://www.bmj.com/content/371/bmj.m3731 3. Vaccination data: Information on timing, which dose (1st, 2nd, booster), manufacturer of dose, and setting that the vaccination was administered in (e.g. care home), will be added to the PHRD. 2. Currently, the time related element of the comorbidity variables is simply whether there is any evidence of that condition in HES within the last three years, or in the GDPPR data within the last 20 years. However, if and when research suggests it could be related to outcome, then additional variables may be developed for each comorbidity to provide more information on how recently there is evidence of that condition. For example, evidence of that condition in HES within the last three months, within the last 6 months, 12 months, 2 years, etc. Should ONS wish to share any data that would not meet the agreed definition of functionally anonymous a further Amendment will be required to this Agreement. 3. Evidence of being hospitalised but then recovering from COVID-19 will be derived from the HES event based data for March 2020 onwards and added as person level variables to the linked research dataset. This will allow exploration of severe illness (but not death) as an outcome. For ONS statistical purposes conducted by ONS analysts on its secure systems (under its existing DSAs), then this will include the specific date of admission and date of discharge as these will be important for survival analyses. However, for any version of the linked data to be made available under this agreement in the PHRD, then ONS will engage with NHSD on the appropriate level of granularity to ensure the data remain functionally anonymous. For example, limiting the information to month of admission and month of discharge. Other derived person level COVID-19 hospitalisation information will include whether a patient was admitted to ITU during their stay and if so, for how long, and other treatments they received. NHS Digital data will always be heavily derived before being made visible to researchers. The data will be processed by ONS under GDPR article 6 (1) (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law and article 9 (2) (j): 4. Vaccination data, test and trace data, and ONS COVID Infection Survey data. Of these, only the vaccination data will be NHSD owned data. The Test and trace data are owned by DHSC and the CIS data are owned by ONS. Archiving, research and statistics (with a basis in law). Processing includes creating the PHRD and ONS granting access to the PHRD. The data will be processed by ONS under GDPR article 6 (1) (e) Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law and article 9 (2) (j): Archiving, research and statistics (with a basis in law). Processing includes creating the Public Health Research Database and ONS granting access to the Public Health Research Database. [1 paragraph unchanged] Both ONS and NHS Digital recognise their role as joint data controllers (including for example the creation of relevant DPIA and joint controller arrangements which sets set out their respective responsibilities as joint controllers) and are committed to ensuring that appropriate transparency information is put in place.

Processing activities

As described in section 5a, ONS holds NHS Digital HES and GDPPR data and these have been used / will be used to derive person level health information that has been added / will be added to an internal linked dataset being used by ONS analysts under its own data sharing agreements. ONS are referring to as the ‘Public health data asset’ (from hereon, ‘the asset’). person level health information that has been added to an internal linked dataset being used by ONS analysts under existing Data Sharing Agreements. ONS are referring to these linked data as the Public Health Data Asset (from hereon, the asset). Under this Amendment, ONS are now requesting to amend existing permissions to derive personal level health information from COVID-19 vaccination and ECDS data that will then be added to an internal linked datasets being used by ONS analysts under existing Data Sharing Agreements and the PHRD. [1 paragraph unchanged] • HES Hospital Episode Statistics (HES) APC - record level identifiable 2009/10 through to 2020/21. • HES OP - record level identifiable 2009/10 through to 2020/21. 2020/21 (and ongoing). • HES A&E - record level identifiable 2009/10 through to 2019/20. (discontinued April 2020). • GDPPR data – record level identifiable data for 2000-2020 HES critical care – record level identifiable 2009/10 through to 2020/21 (and ongoing). The asset is a person level dataset that includes information from over 50 million respondents to the 2011 Census, including their age, sex, ethnicity, occupation and disability stats (as at 2011). It also includes their date and cause of death where relevant, and where successful linkage has been made to ONS mortality data. The mortality data covers from 2011 Census date to virtually up to date. ECDS – record level identifiable 2019/20 through to 2020/21(and ongoing) The linked Census and mortality data are then linked to the derived person level health data (as described at 5a) for ONS internal use as part of the asset. For the purposes of this agreement, the linked data are then deidentified and will be transferred to the ONS Trusted research Environment (TRE) to become the Public Health Research Database (PHRD) where they will only be accessed by approved researchers and be anonymous in the context of the TRE controls. COVID-19 vaccination data – record level identifiable 2020-22 All ONS processing of the data (ie when it is ‘the asset’) for the statistical purposes covered in ONS’s own DSAs is performed in the ONS secure data platform that only cleared ONS staff can access. GDPPR Data- record level identifiable data covering 2000-2021 Details of the transfer of the data from NHSD to ONS, the security features of the ONS internal and secure data platform, and how access to identifiable data by ONS analysts is minimised, are described in those DSAs. The asset is a person level dataset that includes information from over 50 million respondents to the 2011 Census, including their age, sex, ethnicity, occupation and disability stats (as at 2011). It also includes their date and cause of death where relevant, and where successful linkage has been made to ONS mortality data. Those flows and associated processing will not need to be repeated to achieve the objective of this application. All that is required is to further deidentify the linked data that ONS analysts are using. This will then allow the linked data to be made available in the ONS TRE where it will be accessed by researchers as anonymous in context. The mortality data covers from 2011 Census date to virtually up to date. The linked Census and mortality data are then linked to the derived person level health data (as described in 5a) for ONS internal use as part of the asset. For the purposes of this agreement, the linked data are then deidentified, including the removal of specific information that could increase the risk of re-identification as described in 5a. It will then be transferred to ONS Trusted research Environments (TREs) to become the Public Health Research Database (PHRD) where it will only be accessed by approved researchers and be anonymous in the context of the TRE controls. The ONS TREs are the Secure Research Service (SRS) and the ONS led cross government Integrated Data Service (IDS). All ONS processing of the data - ie processing for the statistical purposes covered in ONS’s own DSAs - is performed in the ONS secure data platform that only security cleared and specially trained ONS staff can access. Details of the transfer of the data from NHSD to ONS under these agreements, the security features of the ONS internal and secure data platform, and how access to identifiable data by ONS analysts is minimised, are described in those DSAs. The flows and associated processing will not need to be repeated to achieve the objective of this application. All that is required is to further deidentify the linked data that ONS analysts are using. This will then allow the linked data to be made available in the ONS TRE where it will be accessed by researchers as anonymous in context. [1 paragraph unchanged] Once the deidentified data have version has been securely transferred to the ONS TRE team by secure electronic data transfer, Secure File Transfer, the data will be processed as follows by the ONS TRE team: [2 paragraphs unchanged] 2. ONS will provide access to the de-identified linked data to approved researchers under s39(4)(i) of the SRSA. SRSA 2007. This included includes issuing a Research Code of Practice and Accreditation Criteria which sets out [26 words unchanged] by RAP and ONS will require consent from NHS Digital under SRSA 2007 before it grants access to an approved researcher. researcher (where the applicant wants to access NHSD owned parts of the product, but not if they only want information from the census and mortality data). ONS will also refer all applications for access to linked data that includes HES HES, GDPPR, vaccination and GDPPR ECDS data to NHSD for their consent under SRSA 2007 via an information governance approvals process agreed with them under the sub-licence agreed via this application. This is broadly as follows: External researchers are only allowed access to the data once their applications have been accredited by RAP, and NHSD have also given their consent. The application process will be managed by ONS but has been developed in collaboration with NHS Digital. The main part of the application process involves the UK Statistics Authority Research Accreditation Panel (RAP) who will assess all projects and researchers seeking to access the data according to a set of criteria. See here for further information: https://uksa.statisticsauthority.gov.uk/digitaleconomyact-research-statistics/research-accreditation-panel/ RAP includes a number of independent members, as well senior civil servants. However, the agreed process flow will also include the referral of all applications to NHS Digital for consent under the terms of the SRSA 2007. The order of the RAP and NHSD approvals may vary but only once approval has been granted by all relevant parties will access to the data be given to approved researchers. [4 paragraphs unchanged] For Secure Research Service (SRS): The servers used to store data, and to host the analysis environment [45 words unchanged] encrypted drive before it is loaded in line with government security standards. Once in the TRE it is stored in a data holding area accessible only to selected and security cleared ONS support staff. When placed in project folders, for access by the researchers, the data are made available as a read-only copy ensuring that researchers cannot edit or tamper with the original dataset in any way. For Integrated Data Service (IDS): The data resides within Google Cloud Platform (GCP). All cloud services consumed for the storage and use of the data are scoped to securely managed GCP Projects. GCP Projects in scope for this project are not connected to ONS corporate networks. GCP Projects in scope for this project are accessible via the internet for administration/analytical work. Access is securely bound up with Google identity services, internet authentication proxies and multi-factor authentication. All platform infrastructure and storage is deployed into the Europe-west2 region (London) and in any of the 3 available zones for redundancy and high availability (where applicable). Processing of data can only be carried out on GCP infrastructure within the deployed region. Access to GCP platform is region locked to UK IP addresses only. Access to IDS and any data it holds is not permitted from outside the UK. Overseas connections are monitored, and connection attempts will lead to account suspension. Once in the TRE it is stored in a data holding area accessible only to selected and security cleared ONS support staff. When placed in project folders, for access by the researchers, the data are made available as a read-only copy ensuring that researchers cannot edit or tamper with the original dataset in any way. [1 paragraph unchanged] 5. Deletion: Destruction: ONS will destroy the data in line with the NHS Digital standard for data destruction. If NHS Digital or ONS wish to withdraw a dataset from the ONS TRE, ONS will delete destroy the data and remove the data catalogue entry. ONS will jointly agree [13 words unchanged] soon as all data dependencies are addressed ONS will destroy the data. [2 paragraphs unchanged] 7. Frequency of processing: Normally, ONS request data controllers re-confirm their approval for ONS to hold the data on an annual basis. New versions of HES the HES, GDPPR, vaccination and GDPPR ECDS datasets are received by ONS from NHSD according to its own agreements for statistical purposes. In the case of the Public health data asset Health Data Asset that ONS then creates for internal use, the linked data will be [49 words unchanged] or amended ONS will respond to these requests as quickly as possible. 8. Technology used: ONS use well established statistical techniques based on advice [12 words unchanged] of new software after the Security team assesses the technological and technical risks and no risks. No software used in the ONS TRE is able to connect to the [9 words unchanged] tools in relation to the jointly controlled data asset with NHS Digital. Processing of data is done on secure infrastructure, which meets government security standards and complies with ISO27001 ISO27001. [7 paragraphs unchanged] Data is only made available for specific research purposes where data owners [72 words unchanged] if required. Research use of data always will adhere to the agreed purpose purposes and controls are in place to ensure any deviation from the agreed purpose are dealt with through the SRS breaches policy. [1 paragraph unchanged] The environment in which Approved Researchers gain access to data for their [45 words unchanged] applications record every mouse click, keyboard stroke and screen shot of all who have access to the system, from the researcher, right through to the administration [14 words unchanged] to the system and from where. All activity is recorded and checked. [6 paragraphs unchanged] The SRS presently runs on cloud-based infrastructure provided by UKCloud Ltd. Security assurance documentation for UKCloud has been supplied to NHS Digital and approved by the NHS Digital Security Team. All implementation and maintenance services related to the SRS’s use of UKCloud infrastructure are provided by Equiniti. Equiniti is included in the within the data processor, processing Location and storage location sections of this Agreement. In the coming months it is anticipated that the ONS SRS will be migrated from UKCloud and Equiniti infrastructure to infrastructure provided by Crown Hosting Data Centres. All security controls (i.e ‘The Five Safes approach’) currently in place within the ONS SRS will still be in place once the data is migrated to Crown Hosting Data Centres. Crown Hosting Data Centres have been added as a data processor, and relevant storage and processing locations have been approved by NHS Digital’s Cyber Security Consultant.

Expected output

The outputs/outcome of this application will simply hope to be a sub-licensing agreement that sets up a framework within which ONS can, in theory, can make an anonymised version of its Public health data asset Health Data Asset available to approved projects run by approved researchers researchers, with the consent of NHS Digital. Only once an approved researcher makes an application through the ONS approvals process agreed with NHS Digital, will it become clear what the research outputs that will make use of the data will be. After one year of being in operation, there are several projects currently making use of the data. These can be found on the UK Statistic Authority Research Accreditation Panel accredited research project register: https://uksa.statisticsauthority.gov.uk/digitaleconomyact-research-statistics/better-useofdata-for-research-information-for-researchers/list-of-accredited-researchers-and-research-projects-under-the-research-strand-of-the-digital-economy-act/ An example of an approved project summary is: "People from minority ethnic groups are disproportionally affected by COVID-19, particularly South Asian and Black and African Caribbean communities. This application seeks to use ONS census, Hospital Episode Statistics (HES) and mortality data to investigate the key sociodemographic and clinical confounders, effect modifiers and mediators of the excess risk of COVID-19 mortality in ethnic minority groups and identify whether these have changed over time. What has been done so far? Research has shown that minority ethnic groups were up to 4 times more likely to die from COVID-19 in the first wave of the disease, with increased risk remaining elevated in some groups in the second wave. However, the reason for this increased risk is unclear. Mediation analysis by the applicants on a smaller dataset (UK Biobank) suggested that around 40% of the excess risk of COVID-19 mortality in minority ethnic groups could potentially be eliminated if modest changes to material deprivation were made within the whole population. What are we going to do? We will use national ONS controlled census and HES data that has been linked to COVID-19 mortality, and the COVID Infection Survey. Within these datasets, we will use statistical modelling to examine whether the increased risk in minority ethnic groups is explained by differences in underlying factors linked to social inequality, deprivation or chronic disease prevalence. We will also seek to understand whether the factors that help explain differences in risk between ethnic groups have changed between the first and second waves of the pandemic. Why is this important? This work will unpick why minority ethnic groups may be at increased risk and whether this increased risk is spread equally across the population. For example, is the increased risk in minority ethnic groups explained by living in more deprived areas or by living with more people? Addressing these questions will help inform public health priorities and actions in the short-term (e.g. understanding the sociodemographic and clinical factors that predict greatest risk could help effectively target populations with vaccination and preventions policies) and longer-term (e.g. quantifying how policies aimed at targeting markers of deprivation generally will affect ethnic inequalities specifically)." It is expected that the addition of vaccination data may increase demand as this is a significant limitation of the current iteration of the PHRD that has been used during the first year of the agreement. The below outlines the expected outputs of some of the current projects that have access to anonymised NHS Digital datasets within PHRD: 1. An investigation into the impact of austerity policies and racism on health inequalities observed during the COVID-19 pandemic is expected to publish findings in health economics and health policy journals (i.e. Journal of Health Economics, Journal of Epidemiology and Community Health) 2. A HDR project looking at the interplay between ethnicity and COVID-19, and the determinants of excess risk is aiming to publish findings in medical journals, present findings at patient and public engagement events run by the Centre for Black and Minority Ethnic Health (run by the University of Leicester), through SAGE and other networks. 3. The national coronavirus population study aims to continue to use the data within the PHRD to regularly publish infection and antibody estimates via the ONS website.

Expected measurable benefits

Like with section 5c, it It is not possible to be specific as to the final public benefits until one or more projects are approved to use the sub-licensed, jointly controlled linked data as described in the ONS TRE. section 5c complete their work and publish results. However, the design of the dataset itself is specifically aimed at enabling research into health in the powerful socio-economic context of the 2011 Census data. It is also specifically aimed at providing data that is of direct relevance to the COVID-19 pandemic. Project applications must have a specific health and COVID-19 purpose focus. And as a result, the results will be used to inform pandemic decision making and increase understanding of the COVID-19 pandemic and its effects over time. However, the design of the dataset itself is specifically aimed at enabling research into health in the powerful socio-economic context of the 2011 Census data. It is also specifically aimed at providing data that is of direct relevance to the COVID-19 pandemic. Project applications must have a specific health and COVID-19 purpose focus. And as a result, projects are expected to produce results that could inform pandemic decision making and/or increase understanding of the COVID-19 pandemic and its effects over time. The below outlines the expected benefits of some of the current projects that have access to anonymised NHS Digital datasets within PHRD: 1. An investigation into the impact of austerity policies and racism on the health inequalities observed during the pandemic may facilitate a better understanding of the impacts of the experience of austerity and racial discrimination observed during the pandemic. The findings of this work may then be used to influence future economic and health policies. 2. A HDR project looking at the interplay between ethnicity and COVID-19, and the determinants of excess risk may lead to a better understanding of the key sociodemographic and clinical confounders, effect modifiers and mediators of the excess risk of COVID-19 mortality in ethnic minority groups and aid in identifying whether these have changed over time. The findings may in turn influence future policies and best-practice guidance. 3. The national coronavirus population study may lead to a better estimation of how many individuals within the population have COVID-19, how many are likely to have had COVID-19 (even if they hadn’t realise it at the time). This estimations have the potential to improve and decrease uncertainty of models that have been used to predict the effect of interventions aimed at reducing the spread of the virus.

Benefits reported

Not stated in the previous version; added here.

As of March 2022, there are 8 live projects currently accessing the PHRD and 2 project applications to access PHRD that are being reviewed. Almost all projects are accessing the Census and Mortality parts of PHRD, with the majority also accessing either HES and/or GP data. Most projects have not yet requested outputs from the ONS TRE to feed into their planned publications, as the work is still in progress, although one has submitted two articles for the journals Trends in Mortality and Trends in 'Deaths of Despair'. This will be kept under regular review and ONS will consider the best way to make clear the benefits that the PHRD is delivering as projects begin to release findings and have an impact.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

The objective of this application is to seek permission for ONS to make an anonymised version of an existing dataset it holds containing NHS Digital data (called the ‘Public health data asset’) available for use by approved researchers in its Trusted Research Environment. This data asset (to be called the Public Health Research Database) includes a number of underlying data sources that have previously been linked at a record level for statistical purposes. The core features of the asset are as follows. Amendment March 2021: ONS currently has approved access to NHS Digital controlled identifiable data for its functions (essentially the production of official statistics). For the HES data, the legal basis is section 45C of the Statistics and Registration Services Act (2008), as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement. An amendment to add the GPES Data for Pandemic Planning and Research (COVID-19) to the Public Health Data Asset and Public Health Research Database. Note that no new data will be disseminated under this agreement – ONS will use the HES data already being disseminated under DARS-NIC-175120-W5G2X . Details on this data are included within this agreement to set out the intention, but the sub-licencing (and making available to other researchers) currently only applies to the HES data shared under NIC-175120. The objective of this application is to seek permission for ONS to make an anonymised version of an existing dataset it holds containing NHS Digital data (called the ‘Public health data asset’, and from hereon 'the asset') available for use by approved researchers in its Trusted Research Environment (TRE). NIC-175120 includes birth notification data, HES data and Improving Access to Psychological Therapies data. The purpose of the data sharing agreement is for ONS, as the executive arm of the UK Statistics Authority (UKSA), to carry out the production of official statistics. Legal basis is Section 45C of the Statistics and Registration Service Act (2007) as amended by the Digital Economy Act 2017. This anonymised version (to be called the 'Public Health Research Database', or PHRD) includes a number of underlying data sources that have previously been linked at a record level for internal ONS statistical purposes. The NHS information included in the PHRD is derived information from HES and GPES Data for Pandemic Planning and Research (GDPPR) datasets. The core features of the asset are as follows. A key part of the processing of these data for the production of statistics involves linking them at a record level to ONS held 2011 Census and mortality data. This linkage allows ONS to create a person level health based research dataset that includes a large proportion of the England and Wales population who were present in 2011. It includes: their characteristics as recorded on the 2011 Census, if they have subsequently ONS currently has approved access to NHS Digital controlled identifiable data for its functions (essentially the production of official statistics), including HES and GDPPR data. died, cause of death (including if from COVID-19 this year), and what underlying conditions they have/had using evidence from the event based HES data. For the HES data, the legal basis is section 45C of the Statistics and Registration Services Act (2008), as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement DARS-NIC-175120-W5G2X. For the GDPPR data, the legal basis is section 45A of the Statistics and Registration Services Act (2008), as amended by the Digital Economy Act (2017). Full details are available in this linked Data Sharing Agreement (DARS-NIC-400304-S1P1B). Note that no new data will be disseminated under this agreement; ONS will use the data already being disseminated under the above agreements. Birth notification and IAPT data are included in DARS-NIC-175120-W5G2X but only the HES data are being used here. NIC-400304, Investigation COVID-19, which provides GPES Data for Pandemic Planning and Research (COVID-19), Emergency Care Data Set (ECDS), HES A&E, APC and OP. It is only the GDPPR data from NIC-400304 that will be used under this Agreement (NIC-420710) A key part of the processing of the HES and GDPPR data for the production of official statistics involves linking them at a record level to ONS held 2011 Census and mortality data. This linkage allows ONS to create a person level health based research dataset that includes a large proportion of the England and Wales population who were present in 2011. It includes: their characteristics as recorded on the 2011 Census, if they have subsequently died, cause of death (including if from COVID-19 this year), and what underlying conditions they have/had using evidence from the event based HES and GDPPR data. [1 paragraph unchanged] This subsequent linked data asset is termed the “Public health data asset’. For internal ONS purposes only, it also includes person level information on comorbidities derived from the event based GP Extraction Service Data for Pandemic Planning and Response (GDPPR). The resulted linked data asset is termed the “Public health data asset’ (or 'the asset') within ONS. The approved ONS statistical purposes for the data in the its own DSAs with NHS Digital (the ones referenced above) include using this powerful linked data to model the risk of COVID-19 mortality and morbidity based on the other socio-economic and health information held in the linked dataset. As at December 2020, February 2021, ONS had already released outputs based on the data that were important for decision making and public debate around the pandemic, notably the relative risk of COVID-19 mortality across different ethnic groups. COVID-19 mortality across different ethnic groups. However, there is far more insight that could be gained from this powerful linked asset than can be reasonably researched by ONS analysts on its own. Such missed insights could be of importance in decision making in the fight against the pandemic, and as such could ultimately save lives. It is therefore clearly in the public interest that these data be made available to approved researchers as long as the data can be made available in an anonymised form that is proportionate, and minimises data protection risks. However, there is far more insight that could be gained from this powerful linked ‘Public health data asset’ than can be reasonably researched by ONS on its own. Such missed insights could be of importance in decision making in the fight against the pandemic, and as such could ultimately save lives. It is therefore clearly in the public interest that these data be made available to approved researchers as long as the data can be made available in an anonymised form that is proportionate, and minimises data protection risks. Therefore, this agreement permits the additional data processing required to ensure that the asset held by ONS is suitably transformed ready for access in a TRE by approved applications and researchers. The resulting dataset will be functionally anonymous (and therefore non-personal) in the hands of the researchers given the technical and contractual controls that ONS apply to this manipulated data asset. Such external research will be limited to statistic research for COVID-19 purposes. Therefore, this agreement permits the additional data processing required to ensure that the pseudonymised data held by ONS is suitably transformed ready for access in a TRE by approved applications and researchers, such that the data is anonymous (and therefore non-personal) in the hands of the researchers given the technical and contractual controls that ONS apply to the manipulated data asset. Such external research will be limited to statistic research for COVID-19 purposes. The resulting dataset (the 'Public Health Research Database', or PHRD) will be held within the ONS Trusted Research Environment (TRE) and be jointly controlled by ONS and NHS Digital, with a sub-licence issued by NHS Digital setting out the basis for the creation and onward sharing of the ONS asset by ONS. Although the application process will be managed by ONS, it has been developed in collaboration with NHS Digital. And the agreed process flow will include the referral of all applications to NHS Digital for consent under the terms of the Statistics and Registration Services Act 2007, in conjunction with approval by ONS. Only once approval has been granted by ONS will access to the data be given. The resulting dataset (the Public Health Research Database) will be held within the ONS Trusted Research Environment (TRE) and be jointly controlled by ONS and NHS Digital, with a sub-licence issued by NHS Digital setting out the basis for the creation and onward sharing of the ONS asset by ONS. Although the application process will be managed by ONS, it has been developed in collaboration with NHS Digital. And the agreed process flow will include the referral of all applications to NHS Digital for consent under the terms of the Statistics and Registration Services Act 2007, in conjunction with approval by ONS. Only once approval has been granted by ONS will access to the data be given. In terms of data minimisation, ONS already minimised the HES and GDPPR data that it holds under its own DSAs for statistical purposes, to the years and variables needed to achieve its statistical goals. The variables used by ONS do include personal identifiers to enable the linkage of those data to the 2011 Census and mortality data. But such variables are not needed by ONS analysts post linkage, and have already been removed from the linked dataset being used by ONS analysts – i.e. only the necessary data linkers in ONS access these identifiers. These identifiers will obviously remain absent in the PHRD. In terms of data minimisation, ONS already minimised the HES data that it holds under its own DSAs for statistical purposes, to the years and variables needed to achieve its statistical goals. These variables used by ONS did include personal identifiers to enable the linkage of those data to the 2011 Census and mortality data. But such variables are not needed by ONS analysts post linkage, and have been removed from the linked dataset being used by ONS analysts. – i.e. only the necessary data linkers in ONS access these identifiers. These identifiers will obviously remain absent in the Public Health Research Database. Data Sharing Agreement DARS-NIC-175120-W5G2X provides the following data periods: As at December 2020 Data Sharing Agreement DARS-NIC-175120-W5G2X provides the following data periods: [3 paragraphs unchanged] In addition, only the relevant information needed to achieve ONS’s statistical coronavirus response has been / will be drawn across from other datasets such as Census, Mortality, HES and GDPPR, into the Public Health Data Asset being used internally by ONS analysts for its statistical purposes. In terms of the functionally anonymous Public Health Research Database that will only include some of the information on this internal data asset, the following have been derived and will be on the first iteration of the Public Health Research Database made available under this agreement: The GDPPR Data Sharing Agreement (DARS-NIC-400304) includes record level identifiable data covering 2000-2020. Only derived ‘yes/no’ variables that indicate whether there is evidence of a subject having suffered from a particular condition in the past based on their HES records within the last 3 years. This is only a small set of comorbidities (ie 28 of these yes/no variables for broad conditions relevant to risk of poor outcomes from COVID-19 such as cancer, COPD, asthma, diabetes). Only the relevant information needed to achieve ONS’s statistical coronavirus response has been drawn across from the Census, Mortality, HES and GDPPR, into the asset being used internally by ONS analysts. There already is (and in future will be) additional information in the internal linked data (the Public Health Data Asset) that ONS has produced for statistics. Then in terms of the functionally anonymous PHRD that this agreement will cover, this will only include some of the information on this internal data asset. Specifically, in terms of NHS Digital owned health data, the following have been derived and will be included on the PHRD made available under this agreement: These are not yet part of the Public Health Research Database, but they may be once such information has been fully integrated, QA’d, and confirmed as statistically useful by ONS within its internal version of the data (the Public Health Data Asset). 1. Derived ‘yes/no’ variables that indicate whether there is evidence of a subject having suffered from a particular condition in the past based on their HES and GDPPR records. In the case of the HES data, this is derived from records within the last 3 years, and for the GDPPR data from records from the last 20 years. There is only a small set of comorbidities. For example, there are 28 of these yes/no variables derived from HES for broad conditions relevant to risk of poor outcomes from COVID-19 such as cancer, COPD, asthma, diabetes. There are 30 derived comorbidities from the GDPPR data. The types of this additional derived information is set out below, but to be clear at this stage, this is just to flag they may be added to the Public Health Research Database in future. In the case of items 1-3, these are derived from the HES and will be taken to already be covered by this agreement, should these additions be made. Having comorbidities derived from both sources provides a much more complete picture of comorbidities than HES data on its own. Items 4 and 5 are/would be information derived from other datasets and therefore would require an amendment to this agreement before they could be added: There already is (and in future will be) additional information in the asset being used internally. These are not yet part of the PHRD, but they could usefully be added to the PHRD once such information has been fully integrated, QA’d, and confirmed as statistically useful by ONS within its internal version of the data. The types of this additional derived information are set out below. But to be clear at this stage, this is just to flag they might be added to the Public Health Research Database in future. In the case of items 1-3, these are derived from the HES and will be taken to already be covered by this agreement, should these additions be made. Item 4 would be information derived from other datasets and therefore would require an amendment to this agreement before they could be added: [2 paragraphs unchanged] 2. Currently, the time related element of the comorbidity variables is simply whether there is any evidence of that condition in HES within the last three years (as at March 2020). years, or in the GDPPR data within the last 20 years. However, if and when research suggests it could be related to outcome, [22 words unchanged] For example, evidence of that condition in HES within the last three months (as at March 2020), months, within the last 6 months, 12 months, 2 years, etc. This will always maintain at least a month’s separation. 3. Evidence of being hospitalised but then recovering from COVID-19 will be [74 words unchanged] any version of the linked data to be made available under this agreement, agreement in the PHRD, then ONS will engage with NHSD on the appropriate level of granularity [38 words unchanged] stay and if so, for how long, and other treatments they received. As such NHS Digital data will always be heavily derived before being made visible to researchers. 4. Similar person level comorbidity variable as described for HES above – i.e. ones relevant to risk from coronavirus – but derived from the GDPPR data. This will give a more complete picture of comorbidity, particularly where relevant conditions tend to be managed solely through primary care. 4. Vaccination data, test and trace data, and ONS COVID Infection Survey data. Of these, only the vaccination data will be NHSD owned data. The Test and trace data are owned by DHSC and the CIS data are owned by ONS. 5. Vaccination data, test and trace data, and ONS COVID Infection Survey data. Of these, only the vaccination data will be NHSD owned data. The Test and trace data are owned by DHSC and the CIS data are owned by ONS. [1 paragraph unchanged] The National Data Opt-out is not applied to the NHS Digital data in the Public Health Research Database. [1 paragraph unchanged]

Processing activities

As described in section 5a, ONS holds the following NHS Digital HES and GDPPR data and these have been used / will be used to derive person level health information that has been added / will be added to the research an internal linked dataset that being used by ONS analysts under its own data sharing agreements. ONS are referring to as the ‘Public health data asset’. asset’ (from hereon, ‘the asset’). As at December 2020 the The datasets and periods available to ONS for the Public Health Asset are asset are: [3 paragraphs unchanged] The Public health data asset is a person level dataset that includes information from over 50 million respondents to the 2011 Census, including their age, sex, ethnicity, occupation and disability stats (as at 2011). It also includes their date and cause of death where relevant, and where successful linkage has been made to ONS mortality data that covers from 2011 Census date to virtually up to date. Once linked to derived person level health data (as described at 5a), the linked data are deidentified and for the purposes of this application, will be transferred to the ONS TRE. • GDPPR data – record level identifiable data for 2000-2020 All ONS processing of the data for the statistical purposes covered in other DSAs is performed in the ONS secure data platform that is for internal use only. Details of the transfer of the data from NHSD to ONS, the security features of the ONS internal and secure data platform, and how access to identifiable data by ONS analysts is minimised, are described in those DSAs. The asset is a person level dataset that includes information from over 50 million respondents to the 2011 Census, including their age, sex, ethnicity, occupation and disability stats (as at 2011). It also includes their date and cause of death where relevant, and where successful linkage has been made to ONS mortality data. The mortality data covers from 2011 Census date to virtually up to date. Those flows The linked Census and associated processing will not need mortality data are then linked to be repeated to achieve the objective derived person level health data (as described at 5a) for ONS internal use as part of the asset. For the purposes of this application. All that is required is to further deidentify agreement, the linked data that ONS analysts are using (if indeed further deidentification beyond that already completed is required). This then deidentified and will then allow the linked data be transferred to be made available in the ONS TRE Trusted research Environment (TRE) to become the Public Health Research Database (PHRD) where it they will only be accessed by approved researchers as and be anonymous in context. the context of the TRE controls. All ONS processing of the data (ie when it is ‘the asset’) for the statistical purposes covered in ONS’s own DSAs is performed in the ONS secure data platform that only cleared ONS staff can access. Details of the transfer of the data from NHSD to ONS, the security features of the ONS internal and secure data platform, and how access to identifiable data by ONS analysts is minimised, are described in those DSAs. Those flows and associated processing will not need to be repeated to achieve the objective of this application. All that is required is to further deidentify the linked data that ONS analysts are using. This will then allow the linked data to be made available in the ONS TRE where it will be accessed by researchers as anonymous in context. [1 paragraph unchanged] Once pseudonymised deidentified data have been securely transferred to the ONS TRE team by secure electronic data transfer, the data will be processed as follows by the ONS TRE team: [3 paragraphs unchanged] ONS will also refer all applications for access to linked data that includes HES and GDPPR data to NHSD for their consent under SRSA via an information governance approvals process agreed with them under the sub-licence agreed via this application. External researchers are only allowed access to the data once their applications have been accredited by RAP, and NHSD have also given their consent. If/when any linked data are made available that includes the test and trace data controlled by DHSC, then ONS will agree an approvals and sign-off process, and make amendment to the data processing agreement with DHSC for those data, as required. [10 paragraphs unchanged] 7. Frequency of processing: Normally, ONS request data controllers re-confirm their approval for ONS to hold the data on an annual basis. At this stage ONS request any new iteration to the data which would require further processing. New versions of HES and GDPPR datasets are received by ONS from NHSD according to the related agreements. its own agreements for statistical purposes. In the case of this the Public health data asset, asset that ONS then creates for internal use, the linked data will be updated regularly; at least quarterly, monthly given more mortality and if deemed appropriate monthly, HES data arrive each month, and because of the fast moving nature of the pandemic. ONS will determine the optimal frequency to then update the PHRD too. If a data controller informs ONS that their data have to be updating the linked data monthly for its own statistical purposes monthly anyway, because new mortality and HES data in particular, become available this often. corrected or amended ONS will respond to these requests as quickly as possible. If a data controller informs ONS that their data have to be corrected or amended ONS will respond to these requests as quickly as possible. [4 paragraphs unchanged] Within the TRE TRE, ONS use the Five Safes approach to ensure safe processing of data. ONS and the TRE have been accredited under the Digital Economy Act: [13 paragraphs unchanged]

Expected measurable benefits

Like with section 5c, it is not possible to be specific as the final public benefits until one or more projects are approved to use the sub-licensed, joint jointly controlled linked data in the ONS TRE. However, the design of the dataset itself is specifically aimed at enabled research into health in the powerful socio-economic context of the 2011 Census data. It is also specifically aimed at providing data that is of direct relevance to the COVID-19 pandemic. Project applications must have a specific health and COVID-19 purpose focus. And as a result, the results will be used to inform pandemic decision making and increase understanding of the COVID-19 pandemic and its effects over time. However, the design of the dataset itself is specifically aimed at enabling research into health in the powerful socio-economic context of the 2011 Census data. It is also specifically aimed at providing data that is of direct relevance to the COVID-19 pandemic. Project applications must have a specific health and COVID-19 purpose focus. And as a result, the results will be used to inform pandemic decision making and increase understanding of the COVID-19 pandemic and its effects over time.

Benefits reported

Stated in the previous version and removed here.

Yielded Benefits is not a requirement for new applications.

Unchanged: Expected output.