University of Oxford- National Core Studies Can phenotypes developed from enhanced remote primary care assessment of COVID-19 be used to identify a cohort of community cases, and enable comparison of recovered and long COVID?

Since the outbreak of COVID-19 in Wuhan, China, and the subsequent pandemic, Public Health England (PHE) has commissioned the Oxford Royal College of General Practitioners (RCGP) Research and Surveillance Centre (RSC) network based at the University of Oxford, to incorporate the monitoring of COVID-19 into its virology surveillance scheme. A vital part of this work has been to monitor the number of suspected COVID-19 cases in the community and ultimately establish the effect of COVID-19 infection on hospitalisation as the outcome measure.

OVERALL AIM

Primary aim of the RECAP (Remote COVID-19 Assessment in Primary Care) project is to assist primary care providers to improve patient care and health outcomes. Most COVID-19 patients are diagnosed and managed remotely by GP’s. This helps reduce the burden on hospitals. However, due to the wide number of possible symptoms, it is hard to predict and diagnose COVID-19.

Through this project, we aim to develop and validate an early warning score for GPs based on data collected to a remote GP consultation and then link this to the outcomes such as hospital admissions as a measure of clinical deterioration.

The purpose of this application is to link data held by NHS digital to support the RCGP RSC to conduct observational epidemiological studies that inform the national public health response to COVID-19. The RCGP RSC dataset includes individual patient level up-to-date primary care data which can be easily queried. Primary care/general practice data is rich in terms of diagnosis and information about the process of care.

For the purpose of this study, datasets coming into ORCHID as part of the MAINROUTE study (DARS-NIC-381683-R6R6K) will also be utilised.

The datasets included are:

- Detailed demographic and risk factor data.

- COVID-19 appointments: information on whether or not a virology swab was taken and the outcome of the swab

- Non-COVID-19 appointments

- Detailed data for the 32 conditions monitored by RCGP RSC on behalf of PHE

- Co-morbid conditions

- Medication which may be associated with better or adverse outcomes.

- Test results

- Referrals made

- A&E visits

- Inpatient appointments, including critical care

- COVID-19 SARI Watch (Formerly CHESS)

- Mortality data (if applicable)

Additional datasets under DARS-NIC-431355-B1L8W will also be utilised:

- COVID-19 Second Generation Surveillance System (SGSS) – (Pillar 1)

- COVID-19 UK Non-hospital Antigen Testing Results (Pillar2)

- Civil Registrations (Deaths)– Secondary Care Cut

Imperial College London:

Since Imperial College are the sponsors of this study, they are joint data controllers.

All the data will flow into the secure environment at University of Oxford, thus are data controllers. Furthermore, only University of Oxford will be processing the data.

The data controllers for the processing being undertaken within this agreement are University for Oxford and Imperial College London who have together the joint responsibilities. Some of the data which will be accessed under this agreement will be data which is already in the hands of University of Oxford under a different agreement DARS-NIC-381683-R6R6K for which University of Oxford operates as a Data processor for on behalf of Pubic Health England (PHE) and the Royal College of GPs (RCGP) and for DARS-NIC-431355-B1L8W where University of Oxford are a data controller for different purpose.

The lawful basis for processing the data are as follows:

Article 6(1)(e) (Public Task processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller).

Article 9(2)(j) (processing is necessary for reasons of public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interest of the data subject.

This Agreement permits the continued processing and storage of the data from the MAINROUTE study (DARS-NIC-381683-R6R6K) and under DARS-NIC-431355-B1L8W for the purposes described in this Agreement.

Flows of data:

- Data are extracted from practices that are members of the Royal College of General Practitioners (RCGP RSC) Research and Surveillance Network by Wellbeing. The University of Oxford subcontracts with Apollo to do this as part its contractual responsibilities.

- The University of Oxford will provide NHS digital with a list of pseudonymised NHS numbers and pseudonymised date of birth for the cohort each quarter.

- NHS Digital will link the cohort to the requested datasets and send pseudonymised linked datasets securely back to University of Oxford.

- University of Oxford will store the data on the secure network.

- University of Oxford will process and aggregate pseudonymised data to produce approved reports for surveillance (as part of the National surveillance process); and for the purpose of COVID-19 vaccine pharmacovigilance and quality improvement.

No identifiable data items will be passed into or out of NHS Digital

SALTING METHODLOGY:

The University of Oxford will follow a salting method in a manner that all the data will be non-identifiable. The process is as follows:

1. An encryption salt is held by a designated staff member of the University of Oxford Medical Science Division who is not a member of the ORCHID staff.

2. When a data linkage is required, the encryption salt holder sends the encryption salt to the data provider (NHS Digital)

3. The data provider will hash personal identifiers (in the data requested by ORCHID) using a hashing algorithm

4. The hashing algorithm is SHA2-512.

5. To make this key unique, an encryption salt is added at the end of the NHS number (e.g. NHS number= 12345678 ; SALT (held by someone other than ORCHID staff) = bob. So, hashing would take place using the SHA2-512 alogrithm by 12345678bob = return pseudonymised data)

The RCGP RSC data is controlled and processed by a group of staff who are all based at the University of Oxford; all are mandated to complete information governance training. The group is made up of analysts, academic fellows, Structure Language Query (SQL) developers, RCGP RSC practice liaison officers, a project manager and a head of department. The team work from secure workstations or secure laptops with encrypted drives within the group’s secure network.

Data will only be accessed by individuals within the RSC who have authorisation that are substantive employees of University of Oxford. The authorisation process includes: (1) Contractual requirement to follow IG principles; (2) Using the email registered with Human Resources to complete IG training and to return the certificate; (3) Staff email is authorised by the IT department for one year to access the secure network and staff computers are configured to allow this; (4) At any point the project managers or Head can have access to the secure network turned off. There is special authorisation to have access to the main database.

Only three SQL developers and one senior project manager can access the main database. Surveillance databases are

created for approved analyses once they have been agreed by the RCGP RSC approval committee. This agreed protocol

includes the list of variables required for the database. The SQL developers create separate databases for individual projects only including the required variables, for the required time interval.

The additional linkages will be added to the data that the University of Oxford already receives from the RCGP RSC network practices and PHE reference laboratories.

This process for previous projects linking different sets of data, and the linkage has been successful, provided both parties use the same pseudonymisation algorithm (SHA-512).

There will be no requirement nor attempt to re-identify individuals from the data. The data will not be made available to any third parties other than those specified except in the form of aggregated outputs with small numbers suppressed in line with the HES Analysis Guide.

The use of national data is needed as the University of Oxford are a national surveillance centre and the cohort are from across England and Wales.

The use of pseudonymised NHS numbers are essential as the request to link to the data that the University of Oxford already received from the RCGP RSC network general practices and PHE reference laboratories.

NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data).

Specific Outputs for this study are:

• To track the impact of COVID-19, visual descriptions (dashboards) of the number and rates of patients presenting specific symptoms (primary care data), being tested for specific tests, hospitalisation outcomes confirming deterioration

• Subgroups of data will be identified to enable display by GP practice, region, age group, gender, and ethnicity.

• Establishing a risk score for the predictability of COVID-19 diagnosis.

Furthermore, articles will be published in international scientific journals.

All outputs will contain only data that is aggregated with small numbers suppressed in line with the HES Analysis Guide.

The RECAP (Remote COVID-19 Assessment in Primary Care) project aims to assist primary care providers to improve patient care and health outcomes. Most COVID-19 patients are diagnosed and managed remotely by GP’s. This helps reduce the burden on hospitals. However, due to the wide number of possible symptoms, it is hard to predict and diagnose COVID-19.

Through this project, an early warning score for GPs based on data collected to a remote GP consultation will be developed and validated which will then be linked to outcomes such as hospital admissions as a measure of clinical deterioration.

a) As part of this project, two predictive risk scores have been developed. The manuscript for this work has been developed.

b) A post-acute COVID-19 (Long COVID) phenotype has been developed to inform the epidemiology of this condition and compare clinical symptoms in people with Long COVID before and after their infections. Two manuscripts have been developed and submitted to JMIR Public Health and Surveillance for review