Treatment Pathway of HR+/HER2- Metastatic Breast Cancer in England ( ODR2021_059 )

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Data controllers: + NOVARTIS PHARMACEUTICALS UK LIMITED · − HEALTH IQ LTD

Objective for processing

Novartis – are the funder for the project and act as Health IQ's client. Health IQ will implement the project on behalf of the client.  This contract was put in place by PHE and subsequently novated to NHS England. On return Health IQ must uplift the application to meet all DARS standards which will ratify the relationship between Health IQ and NOVARTIS. Novartis is requesting data from NHS England to conduct the following research project “Treatment Pathway of HR+/HER2- Metastatic Breast Cancer in England” The Data Recipient (Health IQ) will conduct an epidemiological research study with the following aims/objectives: The research is aimed at addressing the overarching research question driving the study, which is: Research questions [1 paragraph unchanged] Primary Objective The Data will be used to provide the following services only: To describe the lines of therapy received by all HR+/HER2- mBrCA patients post-diagnosis along with systemic therapies received under each line of therapy. • Benchmarking Secondary Objectives • Care pathway analysis • To create a cohort of patients with HR+/HER2- mBrCA in England • Health economics and outcomes research studies • To describe this cohort of patients by demographic and pertinent clinical characteristics • Epidemiology studies • To determine differences in access to treatment across England by regions and provider trust. The following NHS England Data has been provided previously: • NDRS Linked Hospital Episode Statistics o Admitted Patient Care o Accident & Emergency o Outpatients • NDRS Linked Cancer Registration • NDRS Systemic Anti-Cancer Therapy Dataset (SACT) • NDRS Linked Diagnostic Imaging Dataset (DID) • NDRS Radiotherapy Dataset (RTDS) • NDRS Linked Cancer Waiting Times (Treatment Data) (CWT) The level of the Data disseminated is pseudonymised, non-identifying NDRS SACT dataset was previously in April 2023 released to Health IQ (the data processor), however, due to filtering issues this dataset was subsequently destroyed by Health IQ and a new version will be released with this application. While the planned analysis for the above objectives has been completed, an update to the SACT data was provided by NHS England in April 2023 but due to an error found in the originally provided data the term of this DSA needs extending. The SACT data that's being resupplied is de-identified and does not contain any personally identifiable information. The data will be used to analyse the treatment pathway for HR+/HER2- mBrCA patients. The analysis of the current dataset will guide a future study design for an epidemiological analysis of all HR+/HER2- breast cancer patients. Additionally, the results will be used in Novartis' (funder of the research) future regulatory/payer submissions for ribociclib to provide real-world data on HR +/HER2- breast cancer treatment in England. Therefore, retaining access to the data to respond to data queries from NICE is essential. Health IQ Ltd continuing to process the data in support of this NICE review, allows policymakers to make informed decisions for the optimal delivery of the healthcare of breast cancer patients, and hence of benefit to the patients. Novartis is the sponsor and the data controller as the organisation responsible for ensuring that the data will only be processed by Health iQ (the processor) for the purpose described above. Health IQ will only access the data in a secure environment and will take all necessary steps to protect it from unauthorized access. The research is being conducted in accordance with Article 6(1)(f) of GDPR, “the processing is necessary for the legitimate interests of the data controller or the legitimate interests of a third party”. ‘Novartis Pharmaceuticals UK Limited (“Novartis”) as data controller has performed a legitimate interests assessment and this has determined that the processing of personal data (which is being anonymised and does not result in harm or negative effects to the data subjects), can be conducted using the legitimate interests basis. Novartis anticipates that the data may help with understanding the treatment landscape of HR+ HER2- breast cancer and the outcomes of patients undergoing treatment. There is a legitimate interest for Novartis to perform this research, to increase understanding in the described disease in order for Novartis to better understand patient and HCP needs and improvement areas in their therapeutic areas of interest'. Health IQ as data processors legitimate interest is that data will be used to improve healthcare for citizen’s and provide support services to healthcare providers to enable those providers to deliver better healthcare to citizens. Health IQ has undertaken a Legitimate Interest Assessment, and the primary purpose for requesting this data is to facilitate vital research and analysis aimed at improving healthcare outcomes and addressing public health challenges. Health IQ has carefully considered the available variables in the data dictionary and is only requesting the variables necessary for analysis. The lawful basis for processing special category data under the UK GDPR is: Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject The funding is provided by Novartis Pharmaceuticals UK Limited. The funder will have no ability to limit of supress the findings and outputs derived from this research. Health IQ is a data processor (so is AWS who has been appointed by Health iQ to provide IT support) acting under the instruction of Novartis. Health IQ’s role is limited to data storage, analysis and interpretation, Novartis does not have access to the patient level data disseminated under this agreement. The data controller(s) listed within this agreement confirm that they will ensure that a GDPR compliant, publicly accessible transparency notice, to the extent legally required by data protection laws, is maintained throughout the life of this agreement. The data requested in this agreement is not considered confidential under the Health and Social Care Act 2012 and therefore the national data opt-out is not applied. Where individuals have opted out of disease registration by the National Disease Registration Service (NDRS), their data has been permanently removed from the registry and therefore will not be disseminated under this Data Sharing Agreement (DSA).

Processing activities

Both the NCR and SACT are datasets administered by Public Health England (PHE). In compliance with PHE procedure, an application to the dataset shall be initiated with an ethics review by Health iQ. No data will flow to NHS England for the purposes of this Data Sharing Agreement (DSA). The ethics review may be performed by any of the Research Ethics Committees (RECs) of the NHS Health Research Authority (HRA). This review is an iterative process involving an initial submission of requirements, and several rounds of revision, as well as a potential interview and presentation, should clarifications in methodology be necessary. The requirements usually include the research protocol, a description of research team members, a filled-out standard REC application form, a declaration of conflicts of interest. No further data will be requested under this version of the Agreement other than to re-access the updated SACT data provided in April 2023. Following ethics approval, Health iQ shall then submit an application to the ODR at PHE. This is a 3-stage process. The first stage is application, where Health iQ shall submit a completed ODR request form, along with the approved research protocol, and data specification (i.e. inclusion and exclusion criteria, fields to be used, linkage methodology, etc). We will also have to declare all intended uses of the project, including the client’s involvement. Our data protection compliance certifications will also be valuable. Health iQ possesses IG Toolkit and DPA numbers that align with that requirement. More information on the process can be read at this link. NHS England will provide the relevant records from the SACT datasets to Health iQ. The Data will contain no direct identifying data items. The Data will be pseudonymised and individuals cannot be reidentified through linkage with other data in the possession of the recipient. This shall then be followed by an assessment stage, which typically takes 90 working days. During this stage clarifications and protocol modifications may take place. Upon approval, we proceed to the access stage where we now are able to formally place a data request with ODR, aligned with our research protocol. Data identification and linkage shall be performed by ODR on the requested pseudonymised data, which will then be downloaded into our servers for analysis. Data will be downloaded to an encrypted AWS (Amazon Web Services) Workspace, by a named individual (the ‘Data Receiver’). Standard QC checks will be run against the data, and some additional calculated fields added. Both raw and the processed data will be stored in secure environment in Health iQ Ltd registered office. In the applications submitted, we will be looking at a phased approach as follows: Amazon Web Services (AWS) is, strictly, a data processor in the sense that the data are hosted and manipulated on their infrastructure. By design, AWS themselves cannot access or read any of the data in Health iQ that are hosted on their infrastructure, nor can anyone else who is not specifically granted individual access to the data (including Health iQ employees). Phase 1 that allows us to fulfil objectives 1 and 2 on current data Amazon Web Services UK are compliant with many standard security frameworks, including ISO 9001, 27001, 27017, 27018; the Cloud Security Alliance certification and UK Cyber Essentials Plus Phase 2 that allows us to fulfil objectives 3 and 4 on refreshed data covering the most recent tranche The Data will not be transferred to any other location, never be linked to any external dataset nor will it ever be re-identified. No data is to be accessed, stored or processed outside the Territory of Use stated within the agreement Subsequent refreshes of data following 2019 (quarterly to annual, wherever feasible and practical) Health iQ Ltd analysts will access record level data via the AWS Data Warehouse using a secure VPN (with 2FA) connection only. Multifactor authentication (MFA) is required for remote access. The Data will remain on the servers at Health iQ at all times. To achieve the first objective of this study, a cohort of patients shall be selected from the dataset through the diagnosis of breast cancer through ICD-10 code C50. For remote access: Metastatic breast cancer at diagnosis shall be determined through a score of 1 in the metastasis flag of the TNM classification in the data OR treatment with CDK4/6 inhibitors such as abemaciclib, palbociclib or ribociclib for patients who progress from non-metastatic disease at diagnosis - Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA; HR+ and HER2 negativity shall be determined through flags in the data for these markers. - Access controls granting users the minimum level of access required are in place; The study shall include only patients aged 18 years and over. There shall be no exclusion criteria for patients. Records of patients will be screened for data quality and included or excluded accordingly. (see section on missing data and data quality) - Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data; Index date shall be the date of first diagnosis of breast cancer where there is a flag for metastasis or treatment with CDK4/6 inhibitors. Observation period shall run from index date until last interaction in the dataset or until death, whichever comes earlier. - Multifactor authentication (MFA) is required for remote access; The study period shall run from 1 April 2012 (the date when systemic therapies were recorded routinely in the SACT dataset) until the latest available data. - Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access; Subgroups shall be created based on the following: - All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this agreement) and complies with the organisation’s remote access policy. Pre-and peri-menopause: The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose). Inclusion Criterion: All Health iQ Ltd staff are instructed not to download any record level data to local PCs, laptops or any non-encrypted device, and this is enforced by Health iQ Ltd’s Data Security policy (note only approved staff will have physical access anyway, this instruction is an additional measure for approved data-handlers to ensure data is never taken off the server, which is the only location on which it can be analysed). All patients < 35 years Health iQ Ltd analysts use PC/ laptops with encrypted drives only. For patients 35 to 54 years: NO diagnosis of ICD-10 codes E28.3, N95, M80.0, M80.1, M81.0, M81.1 on or before diagnosis of breast cancer (C50) in HES linked data or in the PHE tumour table All staff who have access to the raw record level data are Health iQ Ltd staff, and this function is never outsourced to anyone else. Exclusion Criteria: Age > 54 years The Data will not leave England at any time. Post-menopause: Data will not be accessed by individuals other than substantive employees of Health IQ. All users accessing the Data complete mandatory training on information governance and data protection that are required annually for all employees of Health iQ. Inclusion Criterion: The data received will already be linked between the Cancer Registration, HES APC, OP, and AE, and DIDs, and will never be linked to any external dataset, nor will it ever be re-identified. All patients > 54 years Analysts from the Health iQ will process and analyse the Data for the purposes described above. For patients 35 to 54 years: WITH diagnosis of ICD-10 codes E28.3, N95, M80.0, M80.1, M81.0, M81.1 on or before diagnosis of breast cancer (C50) in HES linked data or in the PHE tumour table Any and all outputs of any kind visible to third parties will always be in an aggregate, non-identifiable form and with small numbers double-suppressed. Exclusion Criteria: Age < 35 years A count of patients shall be determined for each inclusion and exclusion criterion sequentially to assess the impact of each criterion on the counts. Further counts of patients for each code shall be performed where necessary to determine the impact of each code on the number of patients in the cohort. To achieve objective two, the following outcomes shall be determined for each of the cohorts and sub-cohorts: Demographics Total patients = the number of patients with an index date within the study period Mean age on inclusion = the average age of patients at their index date, with standard deviations reported Median age on inclusion = the calculated median age of patients at their index date Age distribution by decade (including missing age) Percent males = (the number of males in the group/total number of patients in the group) * 100 [including missing sex] Total time in cohort = total of (time from index date to end of study period, for each patient), reported as patient-days Mean follow-up = the average of (time from index date to end of study period, for each patient), reported as months, with standard deviations reported Median follow-up = the calculated median time of (index date to end of study period for each patient), reported as months Charlson Co-morbidity Score Distribution, reported as counts and percentage of the total across scores: 0-10 11-20 21+ Performance status (ECOG), reported as counts and percentage of the total across performance status scores: 0 1 2 3 4 Deprivation Quintile Distribution, reported as counts and percentage of the total across quintiles: First Second Third Fourth Fifth Treatment received To achieve objective three, we shall determine lines of therapy along with systematic therapies received in each as below: Lines of therapy, reported as counts and percentage of patients on each line of therapy, as well as regimens within each line of therapy, as follows: 1L, total and the broken down by the following regimens (for example): Regimen A Regimen B Regimen C, etc 2L, total and the broken down by the following regimens (for example): Regimen A Regimen B Regimen C, etc 3L+, total and the broken down by the following regimens (for example): Regimen A Regimen B Regimen C, etc Ranked Analysis A ranked list of all therapies given will be provided for each of the following: 1L 2L 3L+ This ranked list will show number of patients on each line and percentage of the total cohort or subcohort. Regimens will be used rather than individual component medications. Pathway Analysis To achieve the fourth objective, a Sankey diagram outlining treatment lines for the overall cohort shall be constructed. This will contain patient numbers and proportions flowing from one treatment line to another. A pathway shall be constructed to map the interactions of patients in the NHS. This pathway shall have the following parameters: Touchpoints: Diagnosis/Treatment Naïve patients 1L 2L 3L+ Sub-analyses By individual therapy within each line of therapy Display output A Sankey diagram Patient counts and percentages displayed Duplicates shall be excluded from the dataset. Likewise, any birth or maternity activity shall be excluded from the dataset. Records shall be processed using DB Visualiser 10.0.10. They will then be analysed using R for Windows 3.5.1. Validation of the codes were performed by experts from Health iQ and the client. SQL scripts used to calculate metrics were validated by 2 independent analysts. The results were validated similarly. Where data has outliers or has been miscoded, this shall be identified wherever it is feasibly possible based on validation processes and expertise within Health iQ. Should there still be results which are influenced by these outliers, a procedure shall be agreed on how to deal with these results.

Expected output

Most of Health iQ’s work is intended for publication, and as such we demand the highest quality work and academically vetted, robust methodology. Should the client decide to move forward with a publication, as likewise strongly encouraged by PHE for any project that is undertaken with their data, Health iQ is happy to author research for this project. 1. Summary aggregate outputs (no small number suppression required as no small numbers resulted from the aggregate outputs generated) will be included in Novartis' (funder of the research) future NICE submission for Ribociclib to provide real-world data on hormone receptor positive, human epidermal growth factor receptor 2 negative (HR+/HER2-) breast cancer treatment in England. As part of Good Clinical Practice, Health iQ plans to register this study in preparation for future publication. Any such step will be taken only with the consent of the client. 2. Aggregate data (with no small numbers included) will be included in a peer-review publication for which drafting is planned to commence in 2024. Leading consultant oncologists will be involved in this publication to ensure clinically relevant information is produced and suitable dissemination of findings through the relevant medical community is achieved. Target conferences include: ISPOR, ISPOR Europe, ESMO, depending on date of completion of the study. Target journals include the BMJ, The Lancet Oncology, Value in Health and Health Economics

Expected measurable benefits

Not stated in the previous version; added here.

This project aims to describe the real-world demographic and clinical profile of women with HR+/HER- breast cancer in England, as well as the treatment provided to these patients and the clinical outcomes experienced by the patient group.

Referring back to the stated Outputs, the benefits derived from these outputs are listed below.

1. NICE submission: The inclusion of these data in a NICE submission aids informed policymaking decisions, with real-word data now seen as key for inclusion in health technology assessment decision-making. The inclusion of data in the NICE submission ensures that policy decisions are well evidenced, and in turn patients are provided with the best possible treatment options.

2. Manuscript: disseminating up-to-date real-world data results to a wide clinical and public health audience, allowing review and discussion of HR+/HER- breast cancer real-world treatment by such an audience aims to facilitate any necessary improvements in treatment and equity to treatment.

Benefits reported

Not stated in the previous version; added here.

Results generated are guiding a future research project looking at more specific epidemiological and treatment related questions and a new DARS submission to be completed in 2024.