DSfC - NHS South East London Integrated Care Board - IV & Comm

NHS South East London Integrated Care Board · ICB - Integrated Care Board

In term In term in the September 2026 edition: the latest version runs to 26 February 2029.

Reference: DARS-NIC-615981-K2W5D
Current version: v6.2
Term of current version: 27 February 2026 to 26 February 2029
Start date: 3 November 2022
Data controller: Sole Data Controller
Commercial purposes: No
Sublicensing: Yes
Files released to date: 0

Why the data was released

Objective for processing

The Health and Social Care Act 2022 created 42 Integrated Care Boards (ICB). These are legal entities which have replaced CCGs. The ICB has taken on the NHS commissioning functions of CCGs as well as some of NHS England’s commissioning functions. It is accountable for NHS spend and performance within the system. Within each ICB geographical area, there will also be an Integrated Care Partnership (ICP), a joint committee which brings together the ICB and their partner local authorities, and other locally determined representatives (for example from health, social care, public health; and potentially others, such as social care or housing providers) to set local priorities and develop an integrated health and social care strategy.

ICP constituent members (other than the ICB) do not carry out data controllership activities and do not make decisions on sub-licensing.

INVOICE VALIDATION

Invoice validation is part of a process by which providers of care or services get paid for the work they do.

Invoices are submitted to the Integrated Care Board (ICB) so the ICB is able to ensure that the patient is their responsibility and the activity claimed is correct. This is done by processing and analysing Invoice Validation Datasets, which are received into a secure Controlled Environment for Finance (CEfF). The identifiers included are in line with the CAG approval. The identifiers are only used to link and confirm the accuracy of backing-data sets (data from providers).

The ICB are advised by the appointed CEfF whether payment for invoices can be made or not.

COMMISSIONING

To use pseudonymised Commissioning Datasets to provide intelligence to support the commissioning of health services. The data (containing both clinical and financial information) is analysed so that health care provision can be planned to support the needs of the population within the ICB area.

The ICBs commission services from a range of providers covering a wide array of services. Each of the data flow categories requested supports the commissioned activity of one or more providers.

The pseudonymised data is required for the following purposes:

 Population health management

 Data Quality and Validation – allowing data quality checks on the submitted data

 Thoroughly investigating the needs of the population, to inform the commissioning or appropriate services for that population’s health needs

 Understanding cohorts of residents who are at risk of becoming users of some of the more expensive services, to better understand and manage those needs

 Monitoring population health and care interactions to understand where people may slip through the net, or where the provision of care may be being duplicated

 Modelling activity across all data sets to understand how services interact with each other, and to understand how changes in one service may affect flows through another

 Service redesign

 Health Needs Assessment – identification of disease prevalence within the local population

 Patient stratification and predictive modelling - to highlight cohorts of patients at risk of requiring hospital admission and other avoidable factors such as risk of falls, computed using algorithms executed against linked de-identified data, and identification of future service delivery models

 Demand Management – ensuring enough capacity to manage the demand by predicting the impact on certain care pathways.

 Support measuring the health and care needs of the total local population.

 Provide intelligence about the safety and effectiveness of medicines.

 Allow analysis of patient pathways across healthcare and social care.

DIRECT CARE

In the development of cohorts of pseudonymised patients considered to be at risk, the data controllers may need the facility to provide identifiable results back to direct health or care professionals for the purpose of direct care. Additionally clinicians, made aware of a number of cases that they believe would need intervention may request re-identification for that direct care purpose. These instances of re-identification will generally be carried out as programmes of work or, separately, on an individual/small group basis as a result of coincidental findings. The ICB does not have a statutory function to provide direct care and as such, does not see the identifiable data.

NHS England provides a re-identification service for this process. All re-id requests will be processed and authorised by NHS England on a case by case basis, including requests under a sub-licence. National data opt outs are not applied in these cases as they are for the purposes of direct care which follows the legal basis of implied consent. It is anticipated that this re-id ability in the future will allow risk stratification to be conducted under a single flow of pseudonymised data.

The following is a typical example of an instance where an ICB might want to use the re-identification process:

A&E High Attendance usage

The ICB can filter data to show for example the number of A&E attendances in a given period for each patient. The ICB can then flag to the relevant GP of the patient any patients that require intervention. An outcome of this is earlier intervention in the patient(s) care thus potentially reducing future costs and minimising future risk.

RESEARCH

This use is permitted where the research relates to commissioning activities for the health and care benefit of the ICS (and other ICS footprints under the appropriate governance arrangements).

Each ICB in law is required in the exercise of its functions, to facilitate otherwise promote

(a) research on matters relevant to the health service, and

(b) the use in the health service of evidence obtained from research.

The data controller may only use the data for research for one or more of the following purposes, which align with the advantages of evidence-based commissioning:

• lead to innovation in service design and delivery,

• enhance the quality of health and care provision,

• reduce clinical variation between locations and providers,

• improve equity of access to services,

• improve patient and population outcomes.

Research can only be undertaken by the data controller(s),or a sub-licensee(s) who is permitted by the data controller(s) to undertake research, which must:

· be for the benefit of health or social care within the ICS footprint area; and

· assist health and social care commissioning objectives, and allow the ICB to extend benefits to other ICS footprints under Board review governance arrangements; and

• support one or more of the purposes listed above; and

• a sub-licence cannot be granted where the research only requires data supplied by NHS England. A sub-licence is needed where additional, non-NHS England supplied, data sets are required from the controller for the research to be undertaken

Data will be accessed by:

· Individuals holding an honorary contract under the supervision of a substantive employee of NHS North Central London Integrated Care Board (NCL ICB) for the purposes described in this DSA only. NCL ICB must maintain records in a single location that cover the following details of each individual given access under an honorary contract:

o Their substantive employer;

o Their role in respect of the purpose for the processing specified in the DSA;

o The start date and end date of the duration in which the Data will be accessed by the individual under an honorary contract;

o The necessity for the Data to be accessed by the person(s) holding an honorary contract, instead of a substantive employee of an organisation named as controller or a processor in this DSA;

o Confirmation that an appropriate contract is in place which follows the relevant guidance and is countersigned by the substantive employer of the honorary contract holder.

Processing activities

PROCESSING CONDITIONS

Data must only be used for the purposes stipulated within this Data Sharing Agreement. Any additional disclosure / publication will require further approval from NHS England. All access to data is auditable by NHS England.

The Data Controller must keep a record of locations the data is processed and stored. These addresses must be within the UK. The Data Controller should minimise the number of processing and storage locations to prevent excessive processing. NHS England may request a record of processing and storage locations at any time.

All access to data is managed under Role-Based Access Controls. Users can only access data authorised by their role and the tasks that they are required to undertake.

Data may only be processed and held as long as is required to carry out the purposes listed within this agreement.

Patient level data will not be linked other than as specifically detailed within this Data Sharing Agreement. Data released will only be used for the purposes laid out in the application/agreement .

DATA PROCESSORS

Data Processors must be listed in section 5b of this Data Sharing Agreement. These include Cloud and IT infrastructure providers.

The Data Controller should ensure appropriate data processing agreements with all data processors contracted to undertaking work referenced within this agreement.

Microsoft Limited supply Cloud Services for NHS North East London ICB and NHS North of England Commissioning Support Unit are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Snowflake Computing UK Limited supply Cloud services for NHS South East London ICB and NHS North East London ICB and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Palantir Technologies UK Ltd support the Local FDP instance for the ICB and so are therefore listed as a data processor. Palantir Technologies UK Ltd support the system and so will have access to personal data for support purposes.

Amazon Web Services supply Cloud Services for Palantir Technologies UK Ltd so are therefore listed as a data processor, the supply support to the system but do not access data. Therefore, any access to data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database(s) containing the data.

InterWorks are sub-contracted by NEL ICB to provide Project Management Office (PMO) support, technical advisory, data engineering and platform services, InterWorks will act as a sub-processor under data protection law for the LDS.

Answer Digital Ltd are sub-contracted by NEL ICB to provide technical advisory, data engineering, analytical and project management services, Answer Digital will act as a sub-processor under data protection law for the LDS.

Imperial College Healthcare NHS Trust (ICHT) are sub-contracted by NWL ICB to provide the infrastructure and secure environment within which the London Analytics Platform (LAP) will operate, the company will act as sub-processor under data protection law.

Accenture UK Ltd are sub-contracted by ICHT to serve as a managed service provider, Accenture will provide data platform engineering to support the development of cloud data analytics and research environment. Additionally, they will be undertaking development for capabilities and security provisions, supporting implementation of Microsoft Power BI tool on the analytics environment.

SEL ICB have commissioning Carnell Farrar to do an Acute Services Review, in which Carnell Farrar will be accessing SUS data disseminated under this Data Sharing Agreement. Therefore, Carnell Farrar are listed as a data processor.

The ICBs listed here (hereby referred to as the One London ICBs), wish to be listed as Data Processors for each other across the data sharing agreements for all One London ICBs:

NHS North Central London Integrated Care Board

NHS South East London Integrated Care Board

NHS North East London Integrated Care Board

NHS North West London Integrated Care Board

NHS South West London Integrated Care Board

The One London ICBs will process data for the purposes listed within the Processing Activities below.

ONWARD SHARING:

Patient level data can only be shared outside the Data Controller / Processor in the following circumstances:

• For the purpose of Direct Care, where it may be re-identified and shared only with those health or care. professionals who have a legitimate relationship with the patient and a legitimate reason to access the data.

• Back to a provider to challenge data submissions. The data transferred to the provider is only that which relates directly to the data previously submitted by that particular provider and is limited to that being necessary to challenge the data submission.

• With members of the ICB’s Integrated Care System, under the terms of a sub-licensing agreement as detailed in this Data Sharing Agreement

Aggregated reports with small numbers suppressed (as set out within NHS England guidance applicable to each data set) may be shared externally as anonymous derived data and not subject to a sublicence.

SEGREGATION:

Where the Data Processor and/or the Data Controller hold both identifiable and pseudonymised data, the data will be held separately so data cannot be linked.

Where the Data Processor and/or the Data Controller hold identifiable data with opt outs applied and identifiable data with opt outs not applied, the data will be held separately so data cannot be linked.

INVOICE VALIDATION

Dataset:

Identifiable Invoice Validation Datasets

Data Minimisation:

• Activity for patients that are or have previously been registered to a GP practice within the responsibility of the ICB or the ICB's predecessor organisation(s).

and/or

• Activity for patients that are or have previously been resident within the ICB or the ICB's predecessor organisation(s).

and

• Data is limited to the period of time the patient was registered and/or resident and to the period of invoice validation being undertaken.

Processing:

1. The DSCRO pushes a one-way data flow of the data directly into the Controlled Environment for Finance (CEfF). Data is kept within the CEfF, and only used by staff properly trained and authorised for the activity.

2. The CEfF also receive backing data from the provider.

3. The following processing activities within the CEfF for invoice validation purposes:

a. Validating that the ICB are responsible for payment for the care of the individual by using Invoice Validation data and/or provider backing flow data.

b. Once the provider backing information is received, this will be checked against national NHS and local commissioning policies as well as being checked against system access and reports provided by NHS England to confirm the payments are:

i. In line with Payment by Results tariffs.

ii. are in relation to a patient registered with a ICB GP or resident within the ICB area.

iii. The health care provided should be paid by the ICB in line with ICB guidance.

4. The ICB are notified that the invoice has been validated and can be paid. Any discrepancies or non-validated invoices are investigated and resolved between the CEfF team and the provider. The ICB only receives notification to pay and management reporting detailing the total quantum of invoices received pending, processed etc.

Linkage will be limited to:

• Backing data as described in the NHS England “Who Pays” Guidance. The 'backing data', which are separate

from the invoice, contain evidence to justify the amount claimed.

COMMISSIONING

Dataset:

Pseudonymised Commissioning Datasets

Data Minimisation:

• Activity for patients registered to GP practices within the responsibility of the ICB (Including historic activity where the patient may have been registered to another commissioner); and historical activity for patients previously registered to GP practices within the responsibility of the ICB or its predecessor organisations.

and/or

• Activity for patients resident in Output Areas located in the geographic boundary of the ICB (Including historic activity where the patient may have been resident in a different Output Area); and historical activity for patients previously resident in Output Areas located in the geographic boundary of the ICB or its predecessor organisations.

and/or

• Patients under the care of a provider where ICB is the host/co-ordinating commissioner and/or has the primary responsibility for the provider services in the local health economy – this is only for commissioning and relates to both national and local flows.

and/or

• Activity identified by the provider and recorded as such within national systems (such as SUS+) as for the attention of ICB - this is only for commissioning and relates to both national and local flows.

and/or

• Patients under the care of a provider where ICB has joint responsibility for the provider services in the local health economy – this is only for Ambulance Trust data.

Processing:

1. Commissioning Datasets are pseudonymised by the DSCRO using a non disclosed SALT key.

2. Local patient identifiers are permitted to be included for the purpose of challenging data submissions with providers.

3. Pseudonymised Commissioning Datasets are securely transferred from the DSCRO to the Data Controller / Processor.

4. Data is processed for the purpose of commissioning as stipulated within this agreement.

5. Row level Pseudonymised Commissioning Data is also available in the National Federated Data Platform (FDP) ICBs are able to access national commissioning datasets that are currently received as extracts via steps 1 - 4 above within FDP to enable the testing of the platform for Population Health Management (PHM) across incubator sites for future use of the Strategic Commissioning Tool (SCT) within FDP, and the backing data for the Strategic Commissioning Tool to non-incubator ICBs for analytics on their FDP tenant. Palantir Technologies UK Ltd is a data processor for the ICB for data the ICB holds in its local FDP tenant. This will eventually replace the need for data extracts to flow outside of NHSE tenant for commissioning purposes.

Relevant data that is already shared under this agreement can be shared with the ICB in its FDP tenant at row level without leaving the FDP secure boundary or aggregated on the national tenant and flowed in aggregate format to the ICB tenant. This data will then be processed on the ICB tenant and service the strategic commissioning product in Population Health Management (PHM) use case on FDP.

The ICB is permitted to link NHS England commissioning datasets with locally sourced datasets from within the ICB footprint area.

A list of the datasets approved for linkage is available on the NHS England website: https://digital.nhs.uk/services/data-services-for-commissioners/commissioning-datasets'

Additionally, the following datasets can be linked to:

• GP Data

• Adult Social Care Data

• Social Prescribing Data

• Continuing Healthcare Data

Linkage Method:

i. Identifiable data is submitted to the processor and lands in a segregated area.

ii. The processor pseudonymises the data using a DSCRO provided key specific to the individual request and is then passed outside the segregated area.

iii. To enable linkage, the DSCRO sends an encrypted mapping table to the data processor. The ICB has a contract in place with the data processor to enable the use of a black box process.

iv. The black box process uses the encrypted mapping table to overwrite the organisation specific pseudonym with the DSCRO pseudonym to enable linkage to NHS England released products.

Where the data has already been pseudonymised by the provider using a separate DSCRO allocated key then a black box solution isn’t required.

Linkage may also be permitted within NHS England where NHS England acts as a data processor on behalf of a provider. There must be a valid and NHS England approved data processing contract in place.

Processors:

• One London ICB's

• North of England Commissioning Support Unit

• Snowflake Computing UK Limited

• Palantir Technologies UK Ltd

• Amazon Web Services

National Cancer Waiting Times:

In addition to the dissemination of Cancer Waiting Times Data via the DSCRO, the ICB is able to access reports held within the CWT system in NHS England directly. Access within the ICB is limited to those with a need to process the data for the purposes described in this agreement. A ICB user will be able to access the provider extracts from the portal for any provider where at least 1 patient for whom they are the registered ICB for that individuals GP practice appears in that setting. Although a ICB user may have access to pseudonymised patient information not related to that ICB, users should only process and analyse data for which they have a legitimate relationship (as described within Data Minimisation).

DIRECT CARE

The Re-identification process for direct care is as follows:

1. The ICB identifies a patient cohort to be re-identified for the purpose of direct care.

2. The ICB sends a re-id request to the DSCRO. This may be done through the ICB or CSU’s Business Intelligence (BI) Tool, or through a manual form.

3. The DSCRO assesses as to whether the request passes the specified re-identification process checks. Checks include if the requester is authorised to access identifiable data, if the number of patients in the cohort is appropriate, and that the request does not seem inappropriate or outside of expected parameters, including for example around timings and the requestor’s relationship with patients in the data. These checks are carried out either by DSCRO staff using pre-approved information (timing’s, requester’s identity etc) or via an automated system.

4. For automated systems, steps 1 - 3 wouldn’t apply in most cases as it would be the direct care professional who identifies the cohort and as long as they are an approved re-id user and have gone through security checks initially, they will be able to re-id without further checks.

5. If successful/approved, the DSCRO re-identifies the relevant data item(s) for the appropriate patients and returns the identifiable fields to Health or Care professional(s) with a legitimate relationship to the patient. The ICB does not see the identifiable record.

6. DSCROs retain an audit trail of all re-id requests.

RESEARCH

Processing Conditions:

All access to sub-licenced data for research is managed under Role-Based Access Controls (RBAC) within the ICB’s Secure Environment . Users can only access data authorised by their role and the task that requires completion.

Patient level data shared may only be used for the purposes and in the manner stipulated within this DSA and as stated under the research sub licensing agreement.

The data controller(s) must publish and maintain a publicly accessible UK GDPR compliant transparency notice that includes sharing data under sub-licensing for research.

Only the pseudonymised commissioning datasets may be used for the research purpose stipulated in the DSA and sub-licencing agreement.

Where applicable, the ICB is responsible for managing the implementation of a local data opt-out, and are accountable for ensuring that the national data opt-out is appropriately applied for any flows of non-NHSE data. The data provided by NHS England has been pseudonymised, and in line with policy is provided without the national opt-out (or any local data opt-out) being applied. The ICB must ensure that this is correctly stated within any related HRA CAG application, and any of their own documentation on opt-out implementation. If the ICB collects data locally, the ICB should follow the NDO policy and apply where applicable to that dataset

The data controller(s) by signing this DSA and sub licencing agreement for research must:

• Ensure that the appropriate ICB Board/Committee that reviews research strategies and associated research briefs, provides advice on the ICB’s sub-licencing process and individual requests for sub-licences to the ICBs Senior Information Risk Owner (SIRO) who formally approves the requests.

• Ensure representation from patients, clinical, and privacy are part of the research review Board / Committee and approval process

• Ensure that, if a sub license for research has a commercial aspect then there must be:

o Evidence of compliance with the DARS Data sharing standard 5e - Commercial Purpose.

o A process is in place that annually reviews any potential interests and conflict of interest for the organisation delivering the research project. (This including any benefits which may accrue noting that benefits may be delayed, indirect or non-financial. For example, if the organisation is commercial and holds a patent on a drug or treatment being studied or on a rival drug or treatment to that being studied.)

Auditing:

The data controller(s) must hold the sub-licensee contractually accountable to the Data Access Standards as published by NHS England. This includes the ability to audit compliance with the DSA and DSFC by the data controller and / or NHS England.

Minimisation must be applied for each research purpose so that only the necessary data is made available for that purpose.

Expected output

INVOICE VALIDATION

1. Accurate budget reports.

2. Enable a system of communication that will enable the ICB to challenge invoices and raise discrepancies and disputes.

3. Reports on the accuracy of invoices.

4. Validation of invoices for non-contracted events where a service delivered to a patient by a provider that does not have a written contract with the patient’s responsible commissioner, but does have a written contract with another NHS commissioner/s.

5. Budget control of the ICB.

COMMISSIONING

1. Commissioner reporting on providers, finances, readmission analysis etc…

2. Production of aggregate reports for ICB Business Intelligence.

3. Production of project / programme level dashboards.

4. Monitoring of acute / community / mental health quality matrix.

5. Clinical coding reviews / audits.

6. Budget reporting down to individual GP Practice level.

7. GP Practice level dashboard reports.

8. Comparators of ICB performance with similar ICBs as set out by a specific range of care quality and performance measures detailed activity and cost reports.

9. Data Quality and Validation measures allowing data quality checks on the submitted data.

10. Contract Management and Modelling.

11. Patient Stratification dashboards to highlight cohorts of patients with similar conditions at risk.

12. Manage demand, by understanding the quantity of assessments required ICBs are able to improve the care service for patients by predicting the impact on certain care pathways and ensure the secondary care system has enough capacity to manage the demand.

13. Identify low priority procedures which could be directed to community-based alternatives and as such commission these services and deflect referrals for low priority procedures resulting in a reduction in hospital referrals.

14. Compare providers (trusts) mortality outcomes to the national baseline.

15. Identify medication prescribing trends and their effectiveness.

16. Linking prescribing habits to entry points into the health and social care system.

17. Identify, quantify and understand cohorts of patient’s high numbers of different medications (polypharmacy).

18. Feedback to NHS service providers on data quality at an aggregate and individual record level – only on data initially provided by the service providers.

DIRECT CARE

1. Reports and dashboards that highlight cohorts of patients that can be targeted for clinical intervention by direct health and care professionals.

2. Lists of at risk patients made available to direct health and care professionals that require direct care intervention.

3. Reports and dashboards to show the outcome of clinical intervention including patient outcomes and modelled transactional cost savings.

RESEARCH

The research outputs from project commissioned in line with the purposes set out in section 5a,may include the following:

1. Predictive modelling tools based on research project outcomes,

2. Research studies proving insight into disparities in outcomes based on demographic factors,

3. Development of tools or algorithms that assist the ICB in resource allocation decision making,

4. Research outcomes focused on specific interventions or treatment by the ICB,

5. Research output that provides the ICB with cost-effectiveness assessments of specific health needs of the ICS population which can include analyses of disease.

6. Prevalence, health inequalities and social determinants of health guiding the strategic priorities for commissioning

Expected measurable benefits

INVOICE VALIDATION

The invoice validation process supports the ongoing delivery of patient care across the NHS and the ICB region by:

1. Ensuring that activity is fully financially validated.

2. Ensuring that service providers are accurately paid for the patient’s treatment.

3. Enabling services to be planned, commissioned, managed, and subjected to financial control.

4. Enabling commissioners to confirm that they are paying appropriately for treatment of patients for whom they are responsible.

5. Fulfilling commissioners duties to fiscal probity and scrutiny.

6. Ensuring full financial accountability for relevant organisations.

7. Ensuring robust commissioning and performance management.

8. Ensuring commissioning objectives do not compromise patient confidentiality.

9. Ensuring the avoidance of misappropriation of public funds.

COMMISSIONING

1. Supporting Quality Innovation Productivity and Prevention (QIPP) to review demand management, integrated care and pathways.

2. Supporting Joint Strategic Needs Assessment (JSNA) for specific disease types.

3. Health economic modelling to analyse provider performance and patient pathways.

4. Commissioning cycle support for grouping and re-costing previous activity.

5. Enables monitoring of commissioned services to ensure they are performing as expected.

6. Improved planning by better understanding patient flows through the healthcare system, thus allowing commissioners to identify priorities and identify commissioning plans to address these (pathways would be designed by service providers within the ICS with input from appropriate stakeholders including patient and public representation).

7. Reduced emergency readmissions, especially avoidable emergency admissions leading to improved quality of services. This is achieved through mapping of frequent users of emergency services and early intervention of appropriate care.

8. Improved access to services by identifying which services may be in demand but have poor access, and from this identify areas where improvement is required.

9. Potentially reduced premature mortality by more targeted intervention in primary care, which supports the commissioner to meets its requirement to reduce premature mortality in line with the ICB Outcome Framework.

10. Better understanding of the health of and the variations in health outcomes within the population to help understand local population characteristics.

11. Better understanding of contract requirements, contract execution, and required services for management of existing contracts, and to assist with identification and planning of future contracts.

12. Insights into patient outcomes, and identification of the possible efficacy of outcomes-based contracting opportunities.

13. Providing greater understanding of the underlying causes and look to commission improved supportive networks, this would be ongoing work which would be continually assessed.

14. Insight to understand the numerous factors that play a role in the outcome for patients in all datasets. The linkage allows the reporting both prior to, during and after the activity, to provide greater assurance on predictive outcomes and delivery of best practice.

15. Provision of indicators of health problems, and patterns of risk within the commissioning region.

16. Support of benchmarking for evaluating progress in future years.

17. Assists commissioners to make better decisions to support patients and drive changes in health care.

18. Allows comparisons of providers performance to assist improvement in services – increase the quality.

19. Allow analysis of health care provision to be completed to support the needs of the health profile of the population within the ICB area based on the full analysis of multiple pseudonymised datasets.

20. To evaluate the impact of new services and innovations (e.g. if commissioners implement a new service or type of procedure with a provider, they can evaluate whether it improves outcomes for patients compared to the previous one).

DIRECT CARE

1. Enables clinical intervention to prevent worse outcomes, such as A&E attendance.

2. Allows the ICB to perform their statutory duty to protect patients.

3. Allows clinicians with direct care responsibilities to improve quality of care for patients identified. This may reduce the risk of unwanted emergency hospital admission, premature complications of disease and of premature death.

RESEARCH

1. Improved outcomes for patients

2. Reducing the health inequalities that have been identified at a local level

3. Improved patient experience

4. Decisions which are informed and based upon the latest available evidence e.g. improved outcomes or providing value for money

5. Reduced waste and the risk of duplication

6. The spread and adoption of innovative ideas

7. The identification of evidence gaps which can be used to produce future research which is relevant to the needs of the commissioning system

8. Enabling and supporting horizon scanning for commissioner

Benefits reported so far

INVOICE VALIDATION

The invoice validation process supports the ongoing delivery of patient care across the NHS and the ICB

region by:

1. Ensuring that activity is fully financially validated.

2. Ensuring that service providers are accurately paid for the patient’s treatment.

3. Enabling services to be planned, commissioned, managed, and subjected to financial control.

4. Enabling commissioners to confirm that they are paying appropriately for treatment of patients for whom

they are responsible.

5. Fulfilling commissioners duties to fiscal probity and scrutiny.

6. Ensuring full financial accountability for relevant organisations.

7. Ensuring robust commissioning and performance management.

8. Ensuring commissioning objectives do not compromise patient confidentiality.

9. Ensuring the avoidance of misappropriation of public funds.

COMMISSIONING

1. Supporting Quality Innovation Productivity and Prevention (QIPP) to review demand management,

integrated care and pathways.

2. Supporting Joint Strategic Needs Assessment (JSNA) for specific disease types.

3. Health economic modelling to analyse provider performance and patient pathways.

4. Commissioning cycle support for grouping and re-costing previous activity.

5. Enables monitoring of commissioned services to ensure they are performing as expected.

6. Improved planning by better understanding patient flows through the healthcare system, thus allowing

commissioners to identify priorities and identify commissioning plans to address these (pathways would be

public representation).

7. Reduced emergency readmissions, especially avoidable emergency admissions leading to improved

quality of services. This is achieved through mapping of frequent users of emergency services and early

intervention of appropriate care.

8. Improved access to services by identifying which services may be in demand but have poor access, and

from this identify areas where improvement is required.

9. Potentially reduced premature mortality by more targeted intervention in primary care, which supports the

commissioner to meets its requirement to reduce premature mortality in line with the ICB Outcome

Framework.

10. Better understanding of the health of and the variations in health outcomes within the population to help

understand local population characteristics.

11. Better understanding of contract requirements, contract execution, and required services for

management of existing contracts, and to assist with identification and planning of future contracts.

12. Insights into patient outcomes, and identification of the possible efficacy of outcomes-based contracting

opportunities.

13. Providing greater understanding of the underlying causes and look to commission improved supportive

networks, this would be ongoing work which would be continually assessed.

14. Insight to understand the numerous factors that play a role in the outcome for patients in all datasets.

The linkage allows the reporting both prior to, during and after the activity, to provide greater assurance on

predictive outcomes and delivery of best practice.

15. Provision of indicators of health problems, and patterns of risk within the commissioning region.

16. Support of benchmarking for evaluating progress in future years.

17. Assists commissioners to make better decisions to support patients and drive changes in health care.

18. Allows comparisons of providers performance to assist improvement in services – increase the quality.

19. Allow analysis of health care provision to be completed to support the needs of the health profile of the

population within the ICB area based on the full analysis of multiple pseudonymised datasets.

20. To evaluate the impact of new services and innovations (e.g. if commissioners implement a new service

or type of procedure with a provider, they can evaluate whether it improves outcomes for patients

compared to the previous one).

DIRECT CARE

1. Enables clinical intervention to prevent worse outcomes, such as A&E attendance.

2. Allows the ICB to perform their statutory duty to protect patients.

3. Allows clinicians with direct care responsibilities to improve quality of care for patients identified. This

may reduce the risk of unwanted emergency hospital admission, premature complications of disease and of

premature death.

Datasets on the current version

Legal basis for provision: Health and Social Care Act 2012 - s261(5)(d); Health and Social Care Act 2012 – s261(7); National Health Service Act 2006 - s251 - 'Control of patient information'.

Datasets approved under DARS-NIC-615981-K2W5D-v6.2
Dataset	Type of data	Sensitivity	Frequency	Confidential data
Commissioning Datasets	Anonymised - ICO Code Compliant	Sensitive	Frequent Adhoc Flow	Mixture of confidential data flow(s) with support under section 251 NHS Act 2006 and non-confidential data flow(s)
Invoice Validation Datasets	Identifiable	Sensitive	Frequent Adhoc Flow	Mixture of confidential data flow(s) with support under section 251 NHS Act 2006 and non-confidential data flow(s)

Files released

Files released counts only files released externally by DARS. Access granted in NHS England's own systems, such as its Secure Data Environment, is not included.

This agreement permits sublicensing: the applicant may pass data on to others. Anything passed on is not recorded in this register.

No files recorded as released under this agreement.

Version history

The register lists each renewal of this agreement as a separate row. This site has 7 versions.

DARS-NIC-615981-K2W5D-v6.2 27 February 2026 to 26 February 2029

Title: DSfC - NHS South East London Integrated Care Board - IV & Comm
Commercial: No
Sublicensing: Yes
Datasets: 2
Files released: 0

Datasets: Commissioning Datasets; Invoice Validation Datasets

What changed from DARS-NIC-615981-K2W5D-v5.2

Text removed is ~~struck through~~; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Fields changed from DARS-NIC-615981-K2W5D-v5.2
Field	Was	Became
Start date	~~2025-12-05~~	2026-02-27
End date	~~2026-06-26~~	2029-02-26

Objective for processing

[29 paragraphs unchanged] RESEARCH This use is permitted where the research relates to commissioning activities for the health and care benefit of the ICS (and other ICS footprints under the appropriate governance arrangements). Each ICB in law is required in the exercise of its functions, to facilitate otherwise promote (a) research on matters relevant to the health service, and (b) the use in the health service of evidence obtained from research. The data controller may only use the data for research for one or more of the following purposes, which align with the advantages of evidence-based commissioning: • lead to innovation in service design and delivery, • enhance the quality of health and care provision, • reduce clinical variation between locations and providers, • improve equity of access to services, • improve patient and population outcomes. Research can only be undertaken by the data controller(s),or a sub-licensee(s) who is permitted by the data controller(s) to undertake research, which must: · be for the benefit of health or social care within the ICS footprint area; and · assist health and social care commissioning objectives, and allow the ICB to extend benefits to other ICS footprints under Board review governance arrangements; and • support one or more of the purposes listed above; and • a sub-licence cannot be granted where the research only requires data supplied by NHS England. A sub-licence is needed where additional, non-NHS England supplied, data sets are required from the controller for the research to be undertaken Data will be accessed by: · Individuals holding an honorary contract under the supervision of a substantive employee of NHS North Central London Integrated Care Board (NCL ICB) for the purposes described in this DSA only. NCL ICB must maintain records in a single location that cover the following details of each individual given access under an honorary contract: o Their substantive employer; o Their role in respect of the purpose for the processing specified in the DSA; o The start date and end date of the duration in which the Data will be accessed by the individual under an honorary contract; o The necessity for the Data to be accessed by the person(s) holding an honorary contract, instead of a substantive employee of an organisation named as controller or a processor in this DSA; o Confirmation that an appropriate contract is in place which follows the relevant guidance and is countersigned by the substantive employer of the honorary contract holder.

Processing activities

[9 paragraphs unchanged] Microsoft Limited supply Cloud Services for ~~Liaison Financial Services,~~ NHS North East London ICB and NHS North of England Commissioning Support [36 words unchanged] agreement. This includes granting of access to the database[s] containing the data. [3 paragraphs unchanged] InterWorks are sub-contracted by NEL ICB to provide Project Management Office (PMO) support, technical advisory, data engineering and platform services, InterWorks will act as a sub-processor under data protection law for the LDS. Answer Digital Ltd are sub-contracted by NEL ICB to provide technical advisory, data engineering, analytical and project management services, Answer Digital will act as a sub-processor under data protection law for the LDS. Imperial College Healthcare NHS Trust (ICHT) are sub-contracted by NWL ICB to provide the infrastructure and secure environment within which the London Analytics Platform (LAP) will operate, the company will act as sub-processor under data protection law. Accenture UK Ltd are sub-contracted by ICHT to serve as a managed service provider, Accenture will provide data platform engineering to support the development of cloud data analytics and research environment. Additionally, they will be undertaking development for capabilities and security provisions, supporting implementation of Microsoft Power BI tool on the analytics environment. SEL ICB have commissioning Carnell Farrar to do an Acute Services Review, in which Carnell Farrar will be accessing SUS data disseminated under this Data Sharing Agreement. Therefore, Carnell Farrar are listed as a data processor. [38 paragraphs unchanged] ~~Processors:~~ ~~• Liaison Financial Services Ltd~~ [50 paragraphs unchanged] RESEARCH Processing Conditions: All access to sub-licenced data for research is managed under Role-Based Access Controls (RBAC) within the ICB’s Secure Environment . Users can only access data authorised by their role and the task that requires completion. Patient level data shared may only be used for the purposes and in the manner stipulated within this DSA and as stated under the research sub licensing agreement. The data controller(s) must publish and maintain a publicly accessible UK GDPR compliant transparency notice that includes sharing data under sub-licensing for research. Only the pseudonymised commissioning datasets may be used for the research purpose stipulated in the DSA and sub-licencing agreement. Where applicable, the ICB is responsible for managing the implementation of a local data opt-out, and are accountable for ensuring that the national data opt-out is appropriately applied for any flows of non-NHSE data. The data provided by NHS England has been pseudonymised, and in line with policy is provided without the national opt-out (or any local data opt-out) being applied. The ICB must ensure that this is correctly stated within any related HRA CAG application, and any of their own documentation on opt-out implementation. If the ICB collects data locally, the ICB should follow the NDO policy and apply where applicable to that dataset The data controller(s) by signing this DSA and sub licencing agreement for research must: • Ensure that the appropriate ICB Board/Committee that reviews research strategies and associated research briefs, provides advice on the ICB’s sub-licencing process and individual requests for sub-licences to the ICBs Senior Information Risk Owner (SIRO) who formally approves the requests. • Ensure representation from patients, clinical, and privacy are part of the research review Board / Committee and approval process • Ensure that, if a sub license for research has a commercial aspect then there must be: o Evidence of compliance with the DARS Data sharing standard 5e - Commercial Purpose. o A process is in place that annually reviews any potential interests and conflict of interest for the organisation delivering the research project. (This including any benefits which may accrue noting that benefits may be delayed, indirect or non-financial. For example, if the organisation is commercial and holds a patent on a drug or treatment being studied or on a rival drug or treatment to that being studied.) Auditing: The data controller(s) must hold the sub-licensee contractually accountable to the Data Access Standards as published by NHS England. This includes the ability to audit compliance with the DSA and DSFC by the data controller and / or NHS England. Minimisation must be applied for each research purpose so that only the necessary data is made available for that purpose.

Expected output

[29 paragraphs unchanged] RESEARCH The research outputs from project commissioned in line with the purposes set out in section 5a,may include the following: 1. Predictive modelling tools based on research project outcomes, 2. Research studies proving insight into disparities in outcomes based on demographic factors, 3. Development of tools or algorithms that assist the ICB in resource allocation decision making, 4. Research outcomes focused on specific interventions or treatment by the ICB, 5. Research output that provides the ICB with cost-effectiveness assessments of specific health needs of the ICS population which can include analyses of disease. 6. Prevalence, health inequalities and social determinants of health guiding the strategic priorities for commissioning

Expected measurable benefits

[36 paragraphs unchanged] RESEARCH 1. Improved outcomes for patients 2. Reducing the health inequalities that have been identified at a local level 3. Improved patient experience 4. Decisions which are informed and based upon the latest available evidence e.g. improved outcomes or providing value for money 5. Reduced waste and the risk of duplication 6. The spread and adoption of innovative ideas 7. The identification of evidence gaps which can be used to produce future research which is relevant to the needs of the commissioning system 8. Enabling and supporting horizon scanning for commissioner

Unchanged: Benefits reported.

DARS-NIC-615981-K2W5D-v5.2 5 December 2025 to 26 June 2026

Title: DSfC - NHS South East London Integrated Care Board - IV & Comm
Commercial: No
Sublicensing: Yes
Datasets: 2
Files released: 0

Datasets: Commissioning Datasets; Invoice Validation Datasets

What changed from DARS-NIC-615981-K2W5D-v4.3

Text removed is ~~struck through~~; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Fields changed from DARS-NIC-615981-K2W5D-v4.3
Field	Was	Became
Start date	~~2025-04-03~~	2025-12-05

Objective for processing

The Health and Social Care Act 2022 ~~has~~ created 42 Integrated Care Boards (ICB). These are ~~new~~ legal entities which have replaced CCGs. The ICB ~~will take~~ has taken on the NHS commissioning functions of CCGs as well as some of NHS England’s commissioning functions. It ~~will also be~~ is accountable for NHS spend and performance within the system. Within each ICB [48 words unchanged] set local priorities and develop an integrated health and social care strategy. [8 paragraphs unchanged] The pseudonymised data is required to for the following purposes: [19 paragraphs unchanged]

Processing activities

PROCESSING CONDITIONS [4 paragraphs unchanged] Patient level data will not be linked other than as specifically detailed [6 words unchanged] released will only be used for the purposes laid out in the ~~application/agreement.~~ application/agreement . NHS England reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract i.e.: employees, agents and contractors of the Data Recipient who may have access to that data). ~~The ICB must publish and maintain a publicly accessible UK GDPR compliant transparency notice that includes sharing data under sub-licensing.~~ [5 paragraphs unchanged] Palantir Technologies UK Ltd support the Local FDP instance for the ICB and so are therefore listed as a data processor. Palantir Technologies UK Ltd support the system and so will have access to personal data for support purposes. Amazon Web Services supply Cloud Services for Palantir Technologies UK Ltd so are therefore listed as a data processor, the supply support to the system but do not access data. Therefore, any access to data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database(s) containing the data. [10 paragraphs unchanged] • Back to a provider to challenge data submissions. The data transferred [5 words unchanged] that which relates directly to the data previously submitted by that particular ~~provider.~~ provider and is limited to that being necessary to challenge the data submission. • With members of the ICB’s Integrated Care ~~System~~ System, under the terms of a sub-licensing agreement as detailed in this Data Sharing ~~Agreement.~~ Agreement For data sharing under sub-licensing, the ICB must publish a release register detailing any sub-licences and onward sharing throughout the life of this agreement in the public domain, at a minimum, updated on a quarterly basis up to 3 months in arrears e.g. If a sub-licencing agreement is granted in October 2024, it is expected that this will be shown on a release register by April 2025. Aggregated reports with small numbers suppressed (as set out within NHS England guidance applicable to each data set) may be shared externally as anonymous derived data and not subject to a sublicence. ~~Aggregated reports only with small number suppression can be shared externally as set out within NHS England guidance applicable to each data set.~~ [45 paragraphs unchanged] ~~Linkage will be limited to:~~ 5. Row level Pseudonymised Commissioning Data is also available in the National Federated Data Platform (FDP) ICBs are able to access national commissioning datasets that are currently received as extracts via steps 1 - 4 above within FDP to enable the testing of the platform for Population Health Management (PHM) across incubator sites for future use of the Strategic Commissioning Tool (SCT) within FDP, and the backing data for the Strategic Commissioning Tool to non-incubator ICBs for analytics on their FDP tenant. Palantir Technologies UK Ltd is a data processor for the ICB for data the ICB holds in its local FDP tenant. This will eventually replace the need for data extracts to flow outside of NHSE tenant for commissioning purposes. ~~- GP Data~~ Relevant data that is already shared under this agreement can be shared with the ICB in its FDP tenant at row level without leaving the FDP secure boundary or aggregated on the national tenant and flowed in aggregate format to the ICB tenant. This data will then be processed on the ICB tenant and service the strategic commissioning product in Population Health Management (PHM) use case on FDP. ~~- Adult Social Care Data~~ The ICB is permitted to link NHS England commissioning datasets with locally sourced datasets from within the ICB footprint area. ~~- Social Prescribing Data~~ A list of the datasets approved for linkage is available on the NHS England website: https://digital.nhs.uk/services/data-services-for-commissioners/commissioning-datasets' ~~- Continuing Healthcare Data~~ Additionally, the following datasets can be linked to: • GP Data • Adult Social Care Data • Social Prescribing Data • Continuing Healthcare Data [11 paragraphs unchanged] • Palantir Technologies UK Ltd • Amazon Web Services [10 paragraphs unchanged]

Changed only in punctuation, spacing or capitalisation: Expected output.

Unchanged: Expected measurable benefits, Benefits reported.

Objective for processing

ICP constituent members (other than the ICB) do not carry out data controllership activities and do not make decisions on sub-licensing.

INVOICE VALIDATION

Invoice validation is part of a process by which providers of care or services get paid for the work they do.

The ICB are advised by the appointed CEfF whether payment for invoices can be made or not.

COMMISSIONING

The ICBs commission services from a range of providers covering a wide array of services. Each of the data flow categories requested supports the commissioned activity of one or more providers.

The pseudonymised data is required for the following purposes:

 Population health management

 Data Quality and Validation – allowing data quality checks on the submitted data

 Thoroughly investigating the needs of the population, to inform the commissioning or appropriate services for that population’s health needs

 Understanding cohorts of residents who are at risk of becoming users of some of the more expensive services, to better understand and manage those needs

 Monitoring population health and care interactions to understand where people may slip through the net, or where the provision of care may be being duplicated

 Modelling activity across all data sets to understand how services interact with each other, and to understand how changes in one service may affect flows through another

 Service redesign

 Health Needs Assessment – identification of disease prevalence within the local population

 Demand Management – ensuring enough capacity to manage the demand by predicting the impact on certain care pathways.

 Support measuring the health and care needs of the total local population.

 Provide intelligence about the safety and effectiveness of medicines.

 Allow analysis of patient pathways across healthcare and social care.

DIRECT CARE

The following is a typical example of an instance where an ICB might want to use the re-identification process:

A&E High Attendance usage

Expected output

INVOICE VALIDATION

1. Accurate budget reports.

2. Enable a system of communication that will enable the ICB to challenge invoices and raise discrepancies and disputes.

3. Reports on the accuracy of invoices.

5. Budget control of the ICB.

COMMISSIONING

1. Commissioner reporting on providers, finances, readmission analysis etc…

2. Production of aggregate reports for ICB Business Intelligence.

3. Production of project / programme level dashboards.

4. Monitoring of acute / community / mental health quality matrix.

5. Clinical coding reviews / audits.

6. Budget reporting down to individual GP Practice level.

7. GP Practice level dashboard reports.

8. Comparators of ICB performance with similar ICBs as set out by a specific range of care quality and performance measures detailed activity and cost reports.

9. Data Quality and Validation measures allowing data quality checks on the submitted data.

10. Contract Management and Modelling.

11. Patient Stratification dashboards to highlight cohorts of patients with similar conditions at risk.

14. Compare providers (trusts) mortality outcomes to the national baseline.

15. Identify medication prescribing trends and their effectiveness.

16. Linking prescribing habits to entry points into the health and social care system.

17. Identify, quantify and understand cohorts of patient’s high numbers of different medications (polypharmacy).

18. Feedback to NHS service providers on data quality at an aggregate and individual record level – only on data initially provided by the service providers.

DIRECT CARE

1. Reports and dashboards that highlight cohorts of patients that can be targeted for clinical intervention by direct health and care professionals.

2. Lists of at risk patients made available to direct health and care professionals that require direct care intervention.

3. Reports and dashboards to show the outcome of clinical intervention including patient outcomes and modelled transactional cost savings.

Benefits reported