Identifiable data required for DHCW's Statutory Functions
Digital Health and Care Wales · Specialised Commissioning Hub
In term In term in the September 2026 edition: the latest version runs to 27 March 2028.
- Reference
- DARS-NIC-660630-L4H3T
- Current version
- v4.3
- Term of current version
- 28 March 2025 to 27 March 2028
- Start date
- 6 November 2023
- Data controller
- Sole Data Controller
- Commercial purposes
- No
- Sublicensing
- No
- Files released to date
- 10
Why the data was released
Objective for processing
Digital Health and Care Wales (DHCW) requires access to NHS England data specifically for residents of Wales, and/or individuals registered with a Welsh GP Practice who live and are treated in England
DHCW requires episodic information on residents of Wales, and/or individuals registered with a Welsh GP Practice for the purpose of:
• Direct care
• Healthcare planning
• Commissioning and validation of services
• Value based healthcare
• National Tariff reimbursement
• The development of national policy
• Supporting the information needs of the Health Boards in the management of their resources and services.
• Support the management and planning of health services
• Enable general medical research and statistical functions
• Identify public health issues
• Monitor improvements in public health on behalf of other organisations responsible for public health provision
• Develop, monitor and evaluate government policies, and otherwise support the work of the Health & Social Services Group of the Welsh Government
• Contribute to the production of Welsh Government statistical publications
• Improve the patient or carer experience
• In support of information processed as part of the collection and remuneration of dispensed drugs by Community Pharmacies
• In support of information processed as part of transactions through the delivery of additional services by Community Pharmacies
• National Clinical Audits data
These purposes fall under DHCW’s powers of which is reflected in a Direction issued by the Welsh Government:
Welsh Government issued general powers:
• https://www.gov.wales/digital-health-and-care-wales-establishment-and-functions
General power set out in the following directions:
• https://www.gov.wales/digital-health-and-care-wales-directions-2020
• https://www.gov.wales/digital-health-and-care-wales-no2-directions-2021
Directing letter describing these functions:
• https://www.gov.wales/digital-health-and-care-wales-dhcw-direction-use-health-service-data?_ga=2.197054255.2062409619.1680265872-1268629993.1655389813
DHCW relies on directions issued pursuant to Section 23(1) of the National Health Service Act (Wales) 2006. The specific provision in Section 23(3) of the National Health Service (Wales) Act 2006 provides that nothing in provision made by or under this or any other Act affects the generality of any direction made under section 23(1).
This Data Sharing Agreement (DSA) permits the flow of identifiable Secondary Use Service (SUS) and national audit data back into Wales following residents of Wales, and/or individuals registered with a Welsh GP Practice who live in England being treated in NHS England established healthcare providers. DHCW has a statutory function to facilitate the data requirements of national audits, and in particular is the central body that requests National Diabetes Audit (NDA) data from NHS England pursuant to section 255 of the Health and Social Care Act 2012. There are a lot of services that NHS Wales cannot provide without access to the clinical details in the NDA data, which is to be used for service improvement.
Identifiable data is required as it is part of the purposes previously defined and as described within DHCW’s functions and powers. NHS number and Date of Birth is required to enable data linkage to other databases. As part of DHCW’s responsibilities DHCW have robust processes of ensuring that the data is rendered unidentifiable where appropriate for any secondary purpose for onwards disclosure if there is no corresponding lawful basis to provide identifiably to any other agency or statutory body.
All of the fields that have been requested, including sensitive fields, are with the aim of improving services. Everything that was deemed worth collecting by the audit needs to be used by DHCW for their statutory functions.
DHCW also require the data in identifiable form in order to respond to any direct care requirements. A centralised copy of all Welsh residents is maintained in the data warehouse.
In many respects the secondary use of data determined by Digital Health and Care Wales is just part of the collective responsibility that includes Welsh Ministers. Welsh Government (and Welsh Ministers) are responsible for the resident population of Wales wherever treated, with DHCW having the legal responsibility for the wider collection, processing and dissemination of said Welsh resident information.
The data will be minimised to residents of Wales, and/or individuals registered with a Welsh GP Practice who live in England being treated in NHS England established healthcare providers.
DHCW is the sole Controller who will also (solely) process the data. Data will only be processed by substantive employees of DHCW. Direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patients.
The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
The condition of processing special category data under the UK GDPR is:
Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
Processing activities
No data will flow to NHS England for the purposes of this DSA.
NHS England data will provide the relevant records from the SUS and national audit datasets to DHCW. The data will contain directly identifying data items.
DHCW may, at any time, receive requests for data from medical professionals for Direct Care purposes. In this case direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patient(s).
As one of DHCWs functions, DHCW is required to provide data services for the NHS in Wales, including the sharing of data back to the Welsh Health Boards for data of patients that they are responsible for (resident patients, or treated within the Health Board).
The data will not be transferred to any other location.
The data will be stored on servers at DHCW.
The data will be accessed onsite at the premises of DHCW, or by authorised personnel via remote access.
The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.
For remote access:
- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;
- Access controls granting users the minimum level of access required are in place;
- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;
- Multifactor authentication (MFA) is required for remote access
- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;
- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.
The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).
The data will not leave England/Wales at any time.
Access is restricted to substantive employees of DHCW, except where data is shared back to Health Boards or medical professionals with direct care requirements for the individuals concerned.
On receipt, the data will be stored on servers under the direct responsibility of DHCW for the purpose of fulfilling its statutory functions.
The data will be accessed via the NHS Wales secure network, by authorised users.
All personnel accessing the data have been appropriately trained in data protection and confidentiality.
The data will be linked at person record level with Welsh medical data.
The Data will only be processed for the purposes described above.
Expected output
Outputs will be varied, but are expected to cover at least the following:
1. Commissioner reporting.
2. Readmissions analysis.
3. Production of project / programme level dashboards.
4. Monitoring of acute / community / mental health quality.
5. Responding to ad-hoc request from NHS Wales organisations and Welsh government
6. Data Quality and Validation measures allowing data quality checks on the submitted data
7. Patient Stratification, such as:
o Patients at highest risk of admission
o Most resource intensive (top 15%)
o Frail and elderly
o Patients that are currently in hospital
o Patients with most referrals to secondary care
o Patients with most emergency activity
o Patients with most expensive prescriptions
o Patients recently moving from one care setting to another
i. Discharged from hospital
ii. Discharged from community
8. Analysis of Clinical and Patient Outcomes
Expected measurable benefits
There are three main direct & indirect healthcare implications for DHCW:
• Managing patient pathways across boundaries, particularly the management of the Single Cancer Pathway and determining those patients that are waiting for treatment.
• Managing complications where patients treated in England present back at their local hospital with infections and other complications.
• Preventing recall of patients unnecessarily when they have had treatment in English Hospitals
For indirect healthcare provisions and additional to that described above other benefits of receiving the data are to:
Enable the management of individual SLAs with English providers in relation to:
• Identification of the patterns of patient flows for each Local Health Board;
• Assess the appropriateness of the care pathway
Performance planning
• Facilitate the development of key performance/efficiency/clinical indicators
• Monitor geographical equity of access/provision;
• Facilitate evidence based commissioning.
Financial governance, planning and improved expenditure
Quality of care provision
• Identification of inappropriate activity
• Identification of variations in clinical outcomes
This data flow is expected to help achieve this vision to empower clinicians and patients to access data to help inform their decision making in the clinical environment, as well as the ability to aggregate and link data to help drive transformation, improvement and quality to deliver care that matters to the community.
Benefits reported so far
From data already provided the following expected benefits have been achieved.
• Improved patient Care
• Improved delivery of Health Services
• Joined up Health Care
• Funding benefits / financial
• Health protection and prevention
Datasets on the current version
Legal basis for provision: Health and Social Care Act 2012 - s261(5)(d)
| Dataset | Type of data | Sensitivity | Frequency | Confidential data |
|---|---|---|---|---|
| National Diabetes Audit | Identifiable | Sensitive | Ongoing | Statutory exemption to flow confidential data without consent |
| SUS for Commissioners | Identifiable | Sensitive | Ongoing | Statutory exemption to flow confidential data without consent |
Files released
Files released counts only files released externally by DARS. Access granted in NHS England's own systems, such as its Secure Data Environment, is not included.
Patient opt-outs were not applied to any of the 10 files released under this agreement, across every version. About opt-outs
Files released against version 4.3 of this agreement, summarised by dataset.
| Dataset | Files | First released | Last released | Opt-outs applied |
|---|---|---|---|---|
| National Diabetes Audit | 6 | May 2026 | May 2026 | No |
Version history
The register lists each renewal of this agreement as a separate row. This site has 5 versions.
DARS-NIC-660630-L4H3T-v4.3 28 March 2025 to 27 March 2028
- Title
- Identifiable data required for DHCW's Statutory Functions
- Commercial
- No
- Sublicensing
- No
- Datasets
- 2
- Files released
- 6
Datasets: National Diabetes Audit; SUS for Commissioners
What changed from DARS-NIC-660630-L4H3T-v3.2
Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.
| Field | Was | Became |
|---|---|---|
| Start date | 2025-03-28 | |
| End date | 2028-03-27 |
Datasets: + National Diabetes Audit
Objective for processing
[28 paragraphs unchanged]
This
agreement is to permit
Data Sharing Agreement (DSA) permits
the flow of identifiable Secondary Use Service (SUS)
and national audit
data back into Wales following residents of Wales, and/or individuals registered with a Welsh GP Practice who live in England being treated in NHS England established healthcare providers.
DHCW has a statutory function to facilitate the data requirements of national audits, and in particular is the central body that requests National Diabetes Audit (NDA) data from NHS England pursuant to section 255 of the Health and Social Care Act 2012. There are a lot of services that NHS Wales cannot provide without access to the clinical details in the NDA data, which is to be used for service improvement.
Identifiable data is required as it is part of the purposes previously defined and as described within DHCW’s functions and powers.
NHS number and Date of Birth is required to enable data linkage to other databases.
As part of DHCW’s responsibilities DHCW have robust processes of ensuring that
[19 words unchanged]
lawful basis to provide identifiably to any other agency or statutory body.
All of the fields that have been requested, including sensitive fields, are with the aim of improving services. Everything that was deemed worth collecting by the audit needs to be used by DHCW for their statutory functions.
[8 paragraphs unchanged]
Processing activities
No data will flow to NHS England for the purposes of this
Agreement.
DSA.
NHS England data will provide the relevant records from the SUS
and national audit
datasets to DHCW. The data will contain directly identifying data items.
DHCW may, at any time, receive requests for data from medical professionals for Direct Care purposes. In this case direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patient(s).
As one of DHCWs functions, DHCW is required to provide data services for the NHS in Wales, including the sharing of data back to the Welsh Health Boards for data of patients that they are responsible for (resident patients, or treated within the Health Board).
[1 paragraph unchanged]
DHCW may, at any time, receive requests for data from medical professionals for Direct Care purposes. In this case direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patient(s).
[1 paragraph unchanged]
The data will be accessed onsite at the premises of
DHCW only.
DHCW, or by authorised personnel via remote access.
The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.
For remote access:
- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;
- Access controls granting users the minimum level of access required are in place;
- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;
- Multifactor authentication (MFA) is required for remote access
- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;
- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.
The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).
[1 paragraph unchanged]
Access is restricted to employees or agents of DHCW
Access is restricted to substantive employees of DHCW, except where data is shared back to Health Boards or medical professionals with direct care requirements for the individuals concerned.
All such individuals are substantive employees of DHCW.
On receipt, the data will be stored on servers under the direct responsibility of DHCW for the purpose of fulfilling its statutory functions.
The data will be accessed via the NHS Wales secure network, by authorised users.
[2 paragraphs unchanged]
DHCW
The Data
will only
process/analyse the data
be processed
for the purposes described above.
Expected output
[9 paragraphs unchanged]
o Most
expensive patients
resource intensive
(top 15%)
[9 paragraphs unchanged]
Expected measurable benefits
[4 paragraphs unchanged]
For indirect healthcare provisions and additional to that described above other benefits of receiving the
SUS
data are to:
[11 paragraphs unchanged]
This data flow is expected to help achieve this vision to empower clinicians and patients to access data to help inform their decision making in the clinical environment, as well as the ability to aggregate and link data to help drive transformation, improvement and quality to deliver care that matters to the community.
Benefits reported
From data already provided
under the current agreement / Provision of Services Arrangement (POSA)
the following expected benefits have been achieved.
[4 paragraphs unchanged]
• Health protection and prevention
including Covid-19 data
DARS-NIC-660630-L4H3T-v3.2 8 November 2024 to 7 November 2026
- Title
- Identifiable data required for DHCW's Statutory Functions
- Commercial
- No
- Sublicensing
- No
- Datasets
- 1
- Files released
- 0
Datasets: SUS for Commissioners
What changed from DARS-NIC-660630-L4H3T-v2.4
Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.
| Field | Was | Became |
|---|---|---|
| Title | Identifiable data required for DHCW's Statutory Functions | |
| Start date | 2024-11-08 | |
| End date | 2026-11-07 |
Datasets:
+ SUS for Commissioners · − Uncurated Low Latency Hospital Data Sets - Admitted Patient Care; − Uncurated Low Latency Hospital Data Sets - Critical Care; − Uncurated Low Latency Hospital Data Sets - Emergency Care; − Uncurated Low Latency Hospital Data Sets - Outpatient
Objective for processing
Digital Health and Care Wales (DHCW) requires access to NHS England data specifically for
residents of Wales, and/or individuals registered with a
Welsh
residents
GP Practice who live and are
treated in
England.
England
DHCW requires episodic information on
residents of Wales, and/or individuals registered with a
Welsh
residents as processed by Health & Care establishments outside of NHS Wales
GP Practice
for the purpose of:
[25 paragraphs unchanged]
DHCW relies on
directions issued pursuant to Section 23(1) of
the
National Health Service Act (Wales) 2006. The
specific provision in Section 23(3) of the National Health Service (Wales) Act 2006
which
provides that nothing in provision made by or under this or any other Act affects the generality of any direction made under section 23(1).
This agreement is to permit the flow of identifiable Secondary Use Service (SUS) data back into Wales following
residents of Wales, and/or individuals registered with a
Welsh
residents
GP Practice who live in England
being treated in NHS England established healthcare providers.
[3 paragraphs unchanged]
To address the Common Law Duty of Confidentiality the data is disseminated for the purposes of direct care. DHCW must satisfy themselves that they have an appropriate legal basis to then utilise that same data for their non-direct care / secondary use purposes.
The data will be minimised to residents of Wales, and/or individuals registered with a Welsh GP Practice who live in England being treated in NHS England established healthcare providers.
The data will be minimised to Welsh residents who were treated in England.
[2 paragraphs unchanged]
Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject;
Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
The
lawful basis for
condition of
processing special category data under the UK GDPR is:
[1 paragraph unchanged]
Unchanged: Processing activities, Expected output, Expected measurable benefits, Benefits reported.
Objective for processing
Digital Health and Care Wales (DHCW) requires access to NHS England data specifically for residents of Wales, and/or individuals registered with a Welsh GP Practice who live and are treated in England
DHCW requires episodic information on residents of Wales, and/or individuals registered with a Welsh GP Practice for the purpose of:
• Direct care
• Healthcare planning
• Commissioning and validation of services
• Value based healthcare
• National Tariff reimbursement
• The development of national policy
• Supporting the information needs of the Health Boards in the management of their resources and services.
• Support the management and planning of health services
• Enable general medical research and statistical functions
• Identify public health issues
• Monitor improvements in public health on behalf of other organisations responsible for public health provision
• Develop, monitor and evaluate government policies, and otherwise support the work of the Health & Social Services Group of the Welsh Government
• Contribute to the production of Welsh Government statistical publications
• Improve the patient or carer experience
• In support of information processed as part of the collection and remuneration of dispensed drugs by Community Pharmacies
• In support of information processed as part of transactions through the delivery of additional services by Community Pharmacies
• National Clinical Audits data
These purposes fall under DHCW’s powers of which is reflected in a Direction issued by the Welsh Government:
Welsh Government issued general powers:
• https://www.gov.wales/digital-health-and-care-wales-establishment-and-functions
General power set out in the following directions:
• https://www.gov.wales/digital-health-and-care-wales-directions-2020
• https://www.gov.wales/digital-health-and-care-wales-no2-directions-2021
Directing letter describing these functions:
• https://www.gov.wales/digital-health-and-care-wales-dhcw-direction-use-health-service-data?_ga=2.197054255.2062409619.1680265872-1268629993.1655389813
DHCW relies on directions issued pursuant to Section 23(1) of the National Health Service Act (Wales) 2006. The specific provision in Section 23(3) of the National Health Service (Wales) Act 2006 provides that nothing in provision made by or under this or any other Act affects the generality of any direction made under section 23(1).
This agreement is to permit the flow of identifiable Secondary Use Service (SUS) data back into Wales following residents of Wales, and/or individuals registered with a Welsh GP Practice who live in England being treated in NHS England established healthcare providers.
Identifiable data is required as it is part of the purposes previously defined and as described within DHCW’s functions and powers. As part of DHCW’s responsibilities DHCW have robust processes of ensuring that the data is rendered unidentifiable where appropriate for any secondary purpose for onwards disclosure if there is no corresponding lawful basis to provide identifiably to any other agency or statutory body.
DHCW also require the data in identifiable form in order to respond to any direct care requirements. A centralised copy of all Welsh residents is maintained in the data warehouse.
In many respects the secondary use of data determined by Digital Health and Care Wales is just part of the collective responsibility that includes Welsh Ministers. Welsh Government (and Welsh Ministers) are responsible for the resident population of Wales wherever treated, with DHCW having the legal responsibility for the wider collection, processing and dissemination of said Welsh resident information.
The data will be minimised to residents of Wales, and/or individuals registered with a Welsh GP Practice who live in England being treated in NHS England established healthcare providers.
DHCW is the sole Controller who will also (solely) process the data. Data will only be processed by substantive employees of DHCW. Direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patients.
The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
The condition of processing special category data under the UK GDPR is:
Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
Expected output
Outputs will be varied, but are expected to cover at least the following:
1. Commissioner reporting.
2. Readmissions analysis.
3. Production of project / programme level dashboards.
4. Monitoring of acute / community / mental health quality.
5. Responding to ad-hoc request from NHS Wales organisations and Welsh government
6. Data Quality and Validation measures allowing data quality checks on the submitted data
7. Patient Stratification, such as:
o Patients at highest risk of admission
o Most expensive patients (top 15%)
o Frail and elderly
o Patients that are currently in hospital
o Patients with most referrals to secondary care
o Patients with most emergency activity
o Patients with most expensive prescriptions
o Patients recently moving from one care setting to another
i. Discharged from hospital
ii. Discharged from community
8. Analysis of Clinical and Patient Outcomes
Benefits reported
From data already provided under the current agreement / Provision of Services Arrangement (POSA) the following expected benefits have been achieved.
• Improved patient Care
• Improved delivery of Health Services
• Joined up Health Care
• Funding benefits / financial
• Health protection and prevention including Covid-19 data
DARS-NIC-660630-L4H3T-v2.4 22 August 2024 to 5 November 2026
- Title
- Application for transfer of data from NHS Digital to NHS Wales Informatics Service
- Commercial
- No
- Sublicensing
- No
- Datasets
- 4
- Files released
- 0
Datasets: Uncurated Low Latency Hospital Data Sets - Admitted Patient Care; Uncurated Low Latency Hospital Data Sets - Critical Care; Uncurated Low Latency Hospital Data Sets - Emergency Care; Uncurated Low Latency Hospital Data Sets - Outpatient
What changed from DARS-NIC-660630-L4H3T-v1.2
Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.
| Field | Was | Became |
|---|---|---|
| Start date | 2024-08-22 | |
| End date | 2026-11-05 |
Datasets: + Uncurated Low Latency Hospital Data Sets - Critical Care
Objective for processing
[8 paragraphs unchanged]
• Supporting the information needs of the Health Boards in the management of their
resources and services.
• resources and services.
[3 paragraphs unchanged]
• Monitor improvements in public health on behalf of other organisations responsible
for public health provision
• for public health provision
• Develop, monitor and evaluate government policies, and otherwise support the work of the Health & Social Services Group of the Welsh Government
• Develop, monitor and evaluate government policies, and otherwise support the
• work of the Health & Social Services Group of the Welsh Government
[2 paragraphs unchanged]
• In support of information processed as part of the collection and remuneration of
dispensed drugs by Community Pharmacies
• dispensed drugs by Community Pharmacies
• In support of information processed as part of transactions through the delivery of additional services by Community Pharmacies
• In support of information processed as part of transactions through the delivery of
• additional services by Community Pharmacies
[21 paragraphs unchanged]
Unchanged: Processing activities, Expected output, Expected measurable benefits, Benefits reported.
Objective for processing
Digital Health and Care Wales (DHCW) requires access to NHS England data specifically for Welsh residents treated in England.
DHCW requires episodic information on Welsh residents as processed by Health & Care establishments outside of NHS Wales for the purpose of:
• Direct care
• Healthcare planning
• Commissioning and validation of services
• Value based healthcare
• National Tariff reimbursement
• The development of national policy
• Supporting the information needs of the Health Boards in the management of their resources and services.
• Support the management and planning of health services
• Enable general medical research and statistical functions
• Identify public health issues
• Monitor improvements in public health on behalf of other organisations responsible for public health provision
• Develop, monitor and evaluate government policies, and otherwise support the work of the Health & Social Services Group of the Welsh Government
• Contribute to the production of Welsh Government statistical publications
• Improve the patient or carer experience
• In support of information processed as part of the collection and remuneration of dispensed drugs by Community Pharmacies
• In support of information processed as part of transactions through the delivery of additional services by Community Pharmacies
• National Clinical Audits data
These purposes fall under DHCW’s powers of which is reflected in a Direction issued by the Welsh Government:
Welsh Government issued general powers:
• https://www.gov.wales/digital-health-and-care-wales-establishment-and-functions
General power set out in the following directions:
• https://www.gov.wales/digital-health-and-care-wales-directions-2020
• https://www.gov.wales/digital-health-and-care-wales-no2-directions-2021
Directing letter describing these functions:
• https://www.gov.wales/digital-health-and-care-wales-dhcw-direction-use-health-service-data?_ga=2.197054255.2062409619.1680265872-1268629993.1655389813
DHCW relies on the specific provision in Section 23(3) of the National Health Service (Wales) Act 2006 which provides that nothing in provision made by or under this or any other Act affects the generality of any direction made under section 23(1).
This agreement is to permit the flow of identifiable Secondary Use Service (SUS) data back into Wales following Welsh residents being treated in NHS England established healthcare providers.
Identifiable data is required as it is part of the purposes previously defined and as described within DHCW’s functions and powers. As part of DHCW’s responsibilities DHCW have robust processes of ensuring that the data is rendered unidentifiable where appropriate for any secondary purpose for onwards disclosure if there is no corresponding lawful basis to provide identifiably to any other agency or statutory body.
DHCW also require the data in identifiable form in order to respond to any direct care requirements. A centralised copy of all Welsh residents is maintained in the data warehouse.
In many respects the secondary use of data determined by Digital Health and Care Wales is just part of the collective responsibility that includes Welsh Ministers. Welsh Government (and Welsh Ministers) are responsible for the resident population of Wales wherever treated, with DHCW having the legal responsibility for the wider collection, processing and dissemination of said Welsh resident information.
To address the Common Law Duty of Confidentiality the data is disseminated for the purposes of direct care. DHCW must satisfy themselves that they have an appropriate legal basis to then utilise that same data for their non-direct care / secondary use purposes.
The data will be minimised to Welsh residents who were treated in England.
DHCW is the sole Controller who will also (solely) process the data. Data will only be processed by substantive employees of DHCW. Direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patients.
The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject;
The lawful basis for processing special category data under the UK GDPR is:
Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
Expected output
Outputs will be varied, but are expected to cover at least the following:
1. Commissioner reporting.
2. Readmissions analysis.
3. Production of project / programme level dashboards.
4. Monitoring of acute / community / mental health quality.
5. Responding to ad-hoc request from NHS Wales organisations and Welsh government
6. Data Quality and Validation measures allowing data quality checks on the submitted data
7. Patient Stratification, such as:
o Patients at highest risk of admission
o Most expensive patients (top 15%)
o Frail and elderly
o Patients that are currently in hospital
o Patients with most referrals to secondary care
o Patients with most emergency activity
o Patients with most expensive prescriptions
o Patients recently moving from one care setting to another
i. Discharged from hospital
ii. Discharged from community
8. Analysis of Clinical and Patient Outcomes
Benefits reported
From data already provided under the current agreement / Provision of Services Arrangement (POSA) the following expected benefits have been achieved.
• Improved patient Care
• Improved delivery of Health Services
• Joined up Health Care
• Funding benefits / financial
• Health protection and prevention including Covid-19 data
DARS-NIC-660630-L4H3T-v1.2 24 November 2023 to 5 November 2024
- Title
- Application for transfer of data from NHS Digital to NHS Wales Informatics Service
- Commercial
- No
- Sublicensing
- No
- Datasets
- 3
- Files released
- 4
Datasets: Uncurated Low Latency Hospital Data Sets - Admitted Patient Care; Uncurated Low Latency Hospital Data Sets - Emergency Care; Uncurated Low Latency Hospital Data Sets - Outpatient
What changed from DARS-NIC-660630-L4H3T-v0.2
Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.
| Field | Was | Became |
|---|---|---|
| Start date | 2023-11-24 |
Unchanged: Objective for processing, Processing activities, Expected output, Expected measurable benefits, Benefits reported.
Objective for processing
Digital Health and Care Wales (DHCW) requires access to NHS England data specifically for Welsh residents treated in England.
DHCW requires episodic information on Welsh residents as processed by Health & Care establishments outside of NHS Wales for the purpose of:
• Direct care
• Healthcare planning
• Commissioning and validation of services
• Value based healthcare
• National Tariff reimbursement
• The development of national policy
• Supporting the information needs of the Health Boards in the management of their
• resources and services.
• Support the management and planning of health services
• Enable general medical research and statistical functions
• Identify public health issues
• Monitor improvements in public health on behalf of other organisations responsible
• for public health provision
• Develop, monitor and evaluate government policies, and otherwise support the
• work of the Health & Social Services Group of the Welsh Government
• Contribute to the production of Welsh Government statistical publications
• Improve the patient or carer experience
• In support of information processed as part of the collection and remuneration of
• dispensed drugs by Community Pharmacies
• In support of information processed as part of transactions through the delivery of
• additional services by Community Pharmacies
• National Clinical Audits data
These purposes fall under DHCW’s powers of which is reflected in a Direction issued by the Welsh Government:
Welsh Government issued general powers:
• https://www.gov.wales/digital-health-and-care-wales-establishment-and-functions
General power set out in the following directions:
• https://www.gov.wales/digital-health-and-care-wales-directions-2020
• https://www.gov.wales/digital-health-and-care-wales-no2-directions-2021
Directing letter describing these functions:
• https://www.gov.wales/digital-health-and-care-wales-dhcw-direction-use-health-service-data?_ga=2.197054255.2062409619.1680265872-1268629993.1655389813
DHCW relies on the specific provision in Section 23(3) of the National Health Service (Wales) Act 2006 which provides that nothing in provision made by or under this or any other Act affects the generality of any direction made under section 23(1).
This agreement is to permit the flow of identifiable Secondary Use Service (SUS) data back into Wales following Welsh residents being treated in NHS England established healthcare providers.
Identifiable data is required as it is part of the purposes previously defined and as described within DHCW’s functions and powers. As part of DHCW’s responsibilities DHCW have robust processes of ensuring that the data is rendered unidentifiable where appropriate for any secondary purpose for onwards disclosure if there is no corresponding lawful basis to provide identifiably to any other agency or statutory body.
DHCW also require the data in identifiable form in order to respond to any direct care requirements. A centralised copy of all Welsh residents is maintained in the data warehouse.
In many respects the secondary use of data determined by Digital Health and Care Wales is just part of the collective responsibility that includes Welsh Ministers. Welsh Government (and Welsh Ministers) are responsible for the resident population of Wales wherever treated, with DHCW having the legal responsibility for the wider collection, processing and dissemination of said Welsh resident information.
To address the Common Law Duty of Confidentiality the data is disseminated for the purposes of direct care. DHCW must satisfy themselves that they have an appropriate legal basis to then utilise that same data for their non-direct care / secondary use purposes.
The data will be minimised to Welsh residents who were treated in England.
DHCW is the sole Controller who will also (solely) process the data. Data will only be processed by substantive employees of DHCW. Direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patients.
The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject;
The lawful basis for processing special category data under the UK GDPR is:
Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
Expected output
Outputs will be varied, but are expected to cover at least the following:
1. Commissioner reporting.
2. Readmissions analysis.
3. Production of project / programme level dashboards.
4. Monitoring of acute / community / mental health quality.
5. Responding to ad-hoc request from NHS Wales organisations and Welsh government
6. Data Quality and Validation measures allowing data quality checks on the submitted data
7. Patient Stratification, such as:
o Patients at highest risk of admission
o Most expensive patients (top 15%)
o Frail and elderly
o Patients that are currently in hospital
o Patients with most referrals to secondary care
o Patients with most emergency activity
o Patients with most expensive prescriptions
o Patients recently moving from one care setting to another
i. Discharged from hospital
ii. Discharged from community
8. Analysis of Clinical and Patient Outcomes
Benefits reported
From data already provided under the current agreement / Provision of Services Arrangement (POSA) the following expected benefits have been achieved.
• Improved patient Care
• Improved delivery of Health Services
• Joined up Health Care
• Funding benefits / financial
• Health protection and prevention including Covid-19 data
DARS-NIC-660630-L4H3T-v0.2 6 November 2023 to 5 November 2024
- Title
- Application for transfer of data from NHS Digital to NHS Wales Informatics Service
- Commercial
- No
- Sublicensing
- No
- Datasets
- 3
- Files released
- 0
Datasets: Uncurated Low Latency Hospital Data Sets - Admitted Patient Care; Uncurated Low Latency Hospital Data Sets - Emergency Care; Uncurated Low Latency Hospital Data Sets - Outpatient
Objective for processing
Digital Health and Care Wales (DHCW) requires access to NHS England data specifically for Welsh residents treated in England.
DHCW requires episodic information on Welsh residents as processed by Health & Care establishments outside of NHS Wales for the purpose of:
• Direct care
• Healthcare planning
• Commissioning and validation of services
• Value based healthcare
• National Tariff reimbursement
• The development of national policy
• Supporting the information needs of the Health Boards in the management of their
• resources and services.
• Support the management and planning of health services
• Enable general medical research and statistical functions
• Identify public health issues
• Monitor improvements in public health on behalf of other organisations responsible
• for public health provision
• Develop, monitor and evaluate government policies, and otherwise support the
• work of the Health & Social Services Group of the Welsh Government
• Contribute to the production of Welsh Government statistical publications
• Improve the patient or carer experience
• In support of information processed as part of the collection and remuneration of
• dispensed drugs by Community Pharmacies
• In support of information processed as part of transactions through the delivery of
• additional services by Community Pharmacies
• National Clinical Audits data
These purposes fall under DHCW’s powers of which is reflected in a Direction issued by the Welsh Government:
Welsh Government issued general powers:
• https://www.gov.wales/digital-health-and-care-wales-establishment-and-functions
General power set out in the following directions:
• https://www.gov.wales/digital-health-and-care-wales-directions-2020
• https://www.gov.wales/digital-health-and-care-wales-no2-directions-2021
Directing letter describing these functions:
• https://www.gov.wales/digital-health-and-care-wales-dhcw-direction-use-health-service-data?_ga=2.197054255.2062409619.1680265872-1268629993.1655389813
DHCW relies on the specific provision in Section 23(3) of the National Health Service (Wales) Act 2006 which provides that nothing in provision made by or under this or any other Act affects the generality of any direction made under section 23(1).
This agreement is to permit the flow of identifiable Secondary Use Service (SUS) data back into Wales following Welsh residents being treated in NHS England established healthcare providers.
Identifiable data is required as it is part of the purposes previously defined and as described within DHCW’s functions and powers. As part of DHCW’s responsibilities DHCW have robust processes of ensuring that the data is rendered unidentifiable where appropriate for any secondary purpose for onwards disclosure if there is no corresponding lawful basis to provide identifiably to any other agency or statutory body.
DHCW also require the data in identifiable form in order to respond to any direct care requirements. A centralised copy of all Welsh residents is maintained in the data warehouse.
In many respects the secondary use of data determined by Digital Health and Care Wales is just part of the collective responsibility that includes Welsh Ministers. Welsh Government (and Welsh Ministers) are responsible for the resident population of Wales wherever treated, with DHCW having the legal responsibility for the wider collection, processing and dissemination of said Welsh resident information.
To address the Common Law Duty of Confidentiality the data is disseminated for the purposes of direct care. DHCW must satisfy themselves that they have an appropriate legal basis to then utilise that same data for their non-direct care / secondary use purposes.
The data will be minimised to Welsh residents who were treated in England.
DHCW is the sole Controller who will also (solely) process the data. Data will only be processed by substantive employees of DHCW. Direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patients.
The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject;
The lawful basis for processing special category data under the UK GDPR is:
Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
Expected output
Outputs will be varied, but are expected to cover at least the following:
1. Commissioner reporting.
2. Readmissions analysis.
3. Production of project / programme level dashboards.
4. Monitoring of acute / community / mental health quality.
5. Responding to ad-hoc request from NHS Wales organisations and Welsh government
6. Data Quality and Validation measures allowing data quality checks on the submitted data
7. Patient Stratification, such as:
o Patients at highest risk of admission
o Most expensive patients (top 15%)
o Frail and elderly
o Patients that are currently in hospital
o Patients with most referrals to secondary care
o Patients with most emergency activity
o Patients with most expensive prescriptions
o Patients recently moving from one care setting to another
i. Discharged from hospital
ii. Discharged from community
8. Analysis of Clinical and Patient Outcomes
Benefits reported
From data already provided under the current agreement / Provision of Services Arrangement (POSA) the following expected benefits have been achieved.
• Improved patient Care
• Improved delivery of Health Services
• Joined up Health Care
• Funding benefits / financial
• Health protection and prevention including Covid-19 data
Register history
When this agreement appeared in, or was edited in, each monthly edition of the register. Built by comparing every edition this site holds.
-
December 2023 —
first listed. 1 version: DARS-NIC-660630-L4H3T-v0.2
-
January 2024
1 version added: DARS-NIC-660630-L4H3T-v1.2
-
September 2024
1 version added: DARS-NIC-660630-L4H3T-v2.4
-
December 2024
1 version added: DARS-NIC-660630-L4H3T-v3.2
-
April 2025
1 version added: DARS-NIC-660630-L4H3T-v4.3
Cite this page
NHS England (2026) Data Uses Register, September 2026 edition, agreement DARS-NIC-660630-L4H3T, “Identifiable data required for DHCW's Statutory Functions”. Read via NHS Data Access Explorer (unofficial), https://healthdatauses.uk/agreements/dars-nic-660630-l4h3t/ (accessed [date]).
This address stays the same, but the page is rebuilt with each monthly edition, so the citation names the edition it shows. Every edition's data is kept in the facts store.
Source: datausesregister_september2026.xlsx, September 2026 edition of the NHS England Data Uses Register. Search that workbook for DARS-NIC-660630-L4H3T to see the original rows.