Accessing and using routine datasets for future cancer clinical trials – Prospective validation project using data from POETIC

The Institute of Cancer Research requires access to NHS England data for the purpose of the following research project:

Accessing and using routine datasets for future cancer clinical trials - Prospective validation project using data from Trial of Perioperative Endocrine Therapy – Individualising Care (POETIC)

The following is a summary of the aims of the research project provided on behalf of The Institute of Cancer Research:

With continued improvements in breast cancer outcomes and risk of recurrence occurring until at least 20 years post-diagnosis, it is important to continue to follow-up clinical trial participants to characterise long-term treatment impact. Traditionally follow-up has been via hospitals; entailing burden on patients and site-staff. Using routinely collected health datasets (RCHD) as an alternative method is attractive, but historically cancer recurrence is poorly recorded unlike initial cancer diagnosis. Building on previous work, the aim of this project is to evaluate the reliability and validity of routine data to be able to replace trial-specific CRF data collection via centres in order to provide robust assessments of common cancer trial endpoints. To do this we will use data collected prospectively from four large, multi-centre breast cancer clinical trials, including POETIC, to develop and test a procedure to identify recurrence within RCHD.

The following NHS England Data will be accessed:

• NDRS Cancer Registrations

• NDRS Linked HES AE

• NDRS Linked HES APC

• NDRS Linked HES Outpatient

• NDRS Systemic Anti-Cancer Therapy Dataset (SACT)

The level of the Data will be

• Identifiable – necessary to establish deterministic linkage between the Poetic cohort and cancer registry

The Data will be minimised as follows:

• Limited to the Poetic trial participants

The lawful basis for processing personal data under the UK GDPR is:

Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

The lawful basis for processing special category data under the UK GDPR is:

Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

This processing is in the public interest because it adheres to the UK Policy Framework for Health and Social Care Research, which protects and promotes the interests of patients, service users and the public, and aims to produce generalisable and publicly available information to inform future decisions over patients’ treatments or care.

The funding is provided by Institute of Cancer Research. The funding is specifically for the study described above.

PPIE Members that were engaged with the trial, ten years ago at the trials inception, were informed and asked for input on potential benefits of the trial taking place and design.

The institute of Cancer Research will transfer data to NHS England. The data will consist of identifying details (specifically NHS Number, Date of Birth and a unique person ID) for the cohort to be linked with NHS England data.

NHS England will provide the relevant records from the datasets listed in the DSA to Institute of Cancer Research.

The Data will

• contain directly identifying data items including NHS Number, Date of Birth, which are required to link the Data at record level with data already held by the recipient

The Data will not be transferred to any other location.

The Data will be stored on servers at Institute of Cancer Research.

The Data will be accessed by authorised personnel via remote access.

The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.

For remote access:

- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;

- Access controls granting users the minimum level of access required are in place;

- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;

- Multifactor authentication (MFA) is required for remote access;

- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;

- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

The Data will not leave the UK at any time.

Access is restricted to individuals within the Institute of Cancer Research, Clinical Trials and Statistics Unit (ICR-CTSUICR-CTSU) who have authorisation from the chief investigator. All such individuals are substantive employees of ICR.

All personnel accessing the Data have been appropriately trained in data protection and confidentiality.

The Data will be linked at person record level with clinical trial datasets obtained from ICR-CTSU – ie the clinical trial datasets for the trial in question, e.g. Poetic, which are held within ICR-CTSU on ICR servers.

The identifying details will be stored in a separate database to the linked dataset used for analysis. All analyses will use the pseudonymised dataset. There will be no requirement and no attempt to reidentify individuals when using the pseudonymised dataset.

Analysts from the Institute of Cancer Research will analyse the Data for the purposes described above.

The expected outputs of the processing will be:

• Submissions to peer reviewed journals- A journal has been submitted to Trials journal in July 2024 and awaiting outcome. This is the only planned submission.

• Presentations at the Cancer Research UK Data Science Conference.

The outputs only contain aggregated data from both trial and NHS England databases. No patient identifiable information has been shared.

The outputs will be communicated to relevant recipients through the following dissemination channels upon publication:

• Journals

• Poster

• ICR website (lay summary)

• Social media

The Poster was presented Cancer Research UK Conference in October 2023. Publication was submitted July 2024 and aim to complete publication process by Q4 2025.

The public benefits relating to health and/or social care are to confirm that it is possible, with reasonable accuracy, to identify cancer recurrences using routinely collected healthcare data in the place of hospital-based data collection after the point of primary analysis. This will enable the possibility of reducing burden at hospitals in terms of long term follow-up in patients participating in breast cancer trials in future.

It is expected that future cancer trials may use these results to switch to routinely collected data for long term follow-up data collection.

Should trials switch to using routine data collection instead of hospital based follow-up it may reduce the burden of future trial participants with breast cancer requiring to provide long term follow-up information to their treating hospital.

It is envisioned that researchers designing future trials and trials that may be ongoing choose routine data collection for long term follow-up as an alternative to hospital based follow-up.

The Data Controller will present work at the Cancer Research UK (CRUK) data science conference and submit work to a peer reviewed journal. The Data Controller will also promote the publication when available via social media and on the ICR website (as a lay summary). CRUK are aware of this project and the work completed via ICR-CTSU’s core programme grant renewal process.

The Data Controller is awaiting publication of this work; therefore yielded benefits are currently unmeasurable. However, it is expected that future cancer trials may use these results to switch to routinely collected data for long term follow-up data collection.