Lincolnshire Wearables Project - Consented

AIM

The principal research question is to test the hypothesis:

“If information about patient behaviour, conditions and events, captured from wearables and other smart technologies can predict demand for services, then providing these technologies to patients and using the data generated, will enable providers to pre-empt and redirect demand or design new services.”

The hypothesis will be tested by deploying smart technologies with sensor-based wearables, software sensors using the camera on a smart phone or tablet, and web-based questionnaires to study data from the participants. This will then be linked to SUS data from NHS Digital for these participants.

Data scientists and researchers will perform data analysis and model development within the collaborative development environment with tools that manage the end-to-end process of analytics, analytics asset creation, deployment and support. The scientists and researchers will not have access to data that identifies the patient.

The analytics will seek to understand whether the use of such technologies and the data gathered from them, can indeed provide useful information in predicting adverse healthcare events and therefore inform the transformation of health services to make interventions sooner to achieve better outcomes.

BACKGROUND

At the highest level, the proposition builds on work that Philips and Helicon Health are already doing in the UK and abroad as a data processor for other organisations. The overall goals however are very ambitious from the perspectives of supporting, enabling and facilitating a series of changes to improve health and social care. The goal is to implement a system that meets the requirements but has the breadth and depth to scale to meet the greatest challenge as outlined and detailed by the 2018 Chief Medical Officer’s report.

The ICB believe that through the management of data collected in a variety of ways, they are increasingly poised to deliver what collaborators at Helicon Health have named “Precision Population Health”. This enables personalised detection and protection programs to be designed and implemented with people and for people at scale. For example, this data could be collected from:

• The electronic health and care records

• From sensors in wearables recording vital signs and behavioural factors of activity and sleep

• From sensors for gait and from environmental sensors and location tracking on phones

Each Commercial Partner was selected via an open and competitive procurement process across the EU, in-line with the requirements of the Public Contract Regulations; this approach and the procurement strategy were approved by NHS England prior to publication.

The wearables used for the study have been procured by Philips Ltd from various technology providers for the sole purpose of testing the research hypothesis. There are no additional commercial benefits to these technology providers or to Philips Ltd. i.e. there is no promise of any future commercial relationships with the NHS as a result of being involved in the study. For further clarity, the NHS England PoC research Programme comprises 3 research projects (this one and two more in West Essex and Northamptonshire) that are all testing the same hypothesis in different ways, using different suppliers and different technologies. This is to ensure the research remains agnostic of specific technologies / commercial providers and focuses on whether the data collected during the research can be used to predict deterioration in health. If the research proves that remote health monitoring can predict deterioration in health, and the NHS wishes to procure technology to enable this, it will be able to choose the technology it uses on the open market via its existing procurement frameworks, with no obligation to select suppliers involved in this research.

LEGAL BASIS

Legal Basis for Processing Data:

Article 6(1)(e)

(processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller)

Public Authority: The Data Protection Act 2018 s7(1)(a) defines ‘public bodies’ for the purpose of the GDPR as “a public authority as defined by the Freedom of Information Act 2000”.

The FOI Act 2000 Part 1, section 3 (1)(a)(i) specifies that a public authority means anybody which is listed in Schedule 1.

Schedule 1 of the FOI Act 2000 lists “Integrated Care Boards established under 14Z25 of the National Health Service Act 2006” as public authorities

‘Public Task’: Integrated Care Boards have a duty to conduct research under Section 25, 14Z40 of the Health and Care Act 2022.

As part of the application process, the requirement for the data requested has been assessed and NHS Digital is content that it is appropriate, necessary and proportionate for the performance of the task described in the Purpose statement.

‘Necessity’: Throughout the application process, the necessity of the processing for the performance of the task has been assessed. This included but was not limited to ensuring appropriate minimisation of the data to ensure that only the minimum amount of data required are processed. During the application process it has been considered whether the information that the processing aims to determine is already available from other sources or whether the task could be performed using publicly available data or data from alternative sources than NHS Digital. Consideration has been given to whether the volume of data being requested is proportionate to the expected benefit and, through examination of the expected benefits consideration has been given to whether the task is itself necessary.

Therefore, we are satisfied that this request is appropriate, necessary and proportionate for the performance of the task described in the Purpose statement and that there is no other reasonable means for the data processor to achieve their purpose that is less intrusive to the data subjects.

Article 9(2)(h)

(processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3)

- The data is required for the purpose of research.

- The data required by the ICB is the least intrusive to the data subject possible to be able to conduct their functions.

- The data required for research purposes is pseudonymised by NHS Digital to minimise the risk of identification.

As part of the standard Data Access Request Service application process:

- the applicant’s technical and organisational measures to safeguard the data have been assessed and meets NHS Digital’s acceptance criteria.

- the requested data has been assessed as proportionate to the aim pursued.

- respect to the essence of the right to data protection has been assessed (e.g. security assurance, data retention, controls and processing activities, etc.).

- measures to protect the rights and freedoms of data subjects have been assessed including transparency (fair processing) publishing subject’s rights to withdraw consent and/or have their data erased or rectified, etc.

Article 9(3)

(Personal data referred to in paragraph 1 may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.)

Data Protection Act 2018

Section 11 - Special categories of personal data etc: supplementary

(1) For the purposes of Article 9(2)(h) of the GDPR (processing for health or social care purposes etc.), the circumstances in which the processing of personal data is carried out subject to the conditions and safeguards referred to in Article 9(3) of the GDPR (obligation of secrecy) include circumstances in which it is carried out—

(a)by or under the responsibility of a health professional or a social work professional, or

(b)by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

The ICB contains within it health professionals who take responsibility for the processing.

Dissemination :

Health and Social Care Act 2012 – s261(2)(c)

Patients have consented to the use of their data. The ICB also has a statutory function to support research:

Health and Care Act 2022,

Section 25, 14Z40, Duty in respect of research

Each integrated care board must, in the exercise of its functions, facilitate or otherwise promote—

(a) research on matters relevant to the health service, and

(b) the use in the health service of evidence obtained from research.

FUNDING

The source of funding for this study is NHS England. This specific funding was made available to the Proof of Concept (PoC) as a research and development project and provides executive governance via its Proof of Concept Programme Board. Lincolnshire ICB acts as the Contracting Authority for this project. Philips Healthcare is the Prime Contractor and Helicon Health the subcontractor in the project, although they will have no access to data disseminated under this agreement.

CONTROLLERS AND PROCESSORS

NHS Lincolnshire Integrated Care Board (ICB) will be the Sole Data Controller for this Study

I5 Health will act as a data processor under the instruction of NHS Lincolnshire ICB

NHS Arden and GEM Commissioning Support Unit supply and store the data so are also listed as a data processor

OTHER ORGANISATIONS

Optima will collect the patient consent forms and assign the wearable devices to the patients. Optima do not receive or have access to the data released under this agreement so are not named as data processors. Helicon and Philips Healthcare are involved in the collection of the wearables data but not involved with data released under this agreement.

COHORT

The research team hope to recruit 500 participants to take part in the study. In order to achieve this target number, the research team anticipate that at least 1,000 potential participants will be selected by the GP Practices according to the following inclusion and exclusion criteria.

Inclusion Criteria

• Individuals over the age of 18 that:

• Have 2 or more long-term conditions AND/OR

• Have a medium to high frailty score AND/OR

• Are suffering from unsteadiness or falls AND/OR

• Those who are found to have paroxysmal and/or asymptomatic atrial fibrillation (AF), hypertension or heart failure

• Live in their own homes or in residential care homes or in nursing care homes

Exclusion criteria

• Children

• Individuals for whom consent cannot be obtained (i.e. individuals with severe mental impairments or learning difficulties)

• Patients on palliative care

• Individuals lacking mental health capacity or whose mental health conditions might be influenced by participating in the study

• Individuals whose mental capacity deteriorates before the release of SUS data will be removed from the study.

• Individuals who are unable to understand verbal explanations and written information given in English

In order to find suitable participants, the GPs will be asked to select patients who meet the required selection criteria for the study from the information already available to them. GPs will then make the final decision on their patients’ suitability for the study on the basis of both the patient medical records and the GPs clinical judgement. If deemed suitable the GP Practice will send potential participants an Invitation Letter, a Participant Information Sheet, a Consent Form and a prepaid return envelope by post. The invitation Letter and the Information Sheet will also contain a link to a webpage where participants can complete their consent electronically on line; and a link to an educational video about the study for further information.

The Clinical Research Network (CRN) were engaged to help identify research active GP practices that would identify participants for the study. The study was formally adopted onto the CRN portfolio of research at the same time as it was approved by the Health Research Authority.

In some instances, GP practices have been reimbursed for DocMail services. This is the service used by GPs to email patients and invite them to join the study. In most cases GP practices were provided with pre-printed invite letters and pre-paid methods of postage to ensure they were not paying for printing and posting costs themselves.

There will be no change in the arrangements that have already been proposed for seeking consent from the patients.

Note: the use of Optima Systems and the other third party support organisations (as detailed in the participant information leaflet), will be based on patient consent, as the patient will be the one to contact them directly or indirectly.

Once consent has been provided, each participant will be given an unique research identification number by Optima Systems. The participant will be asked to consent to being contacted by Optima Systems in the study consent form and to provide personal information in order for Optima Systems to do this.

DATA

The consented patients GPs will submit NHS Number, date of birth and trial id to the DSCRO. Where GPs do not have the capacity to do this, Optima will provide demographics details of the patient and the trial ID directly to the DSCRO. The consented patients demographic details will be submitted to the DSCRO via a secure transfer mechanism.

The ICB is requesting an extract of the following dataset:

- Secondary Use Services Dataset (SUS)

SUS will provide the most up to date hospital records for each consented patient. It will also allow the analysis of the financial impact which will support the case for change. The data will be disseminated by the DSCRO as they already hold the required SUS data for the ICB's commissioning requirements. Only data for the consented patients will be released. The SUS data will contain trial ID in order to link to the data captured by the wearable devices. No patient identifiable fields will be disseminated.

The mapping table containing identifiable patient details and their trial ID will only be held by Optima and the patients GP.

ETHICAL CONSIDERATION

Covid-19

Due to Covid-19, consenting processes and the overall study design has been adapted to ensure that all activities are undertaken on an entirely remote basis. There will be no in-person contact between participants and anyone outside of their usual care team during the study.

To further mitigate any risk of Covid-19 infection transmission resulting from taking part in the study, the research team have outlined guidance for care homes on infection control when participants are using the devices required for the study.

Approvals

The protocol, informed consent form and participant information sheet were submitted to an appropriate Research Ethics Committee (REC), and HRA and have received approval

Other Ethical Considerations

No children will be included in this study. This study is non-interventional, meaning no medical intervention will take place and data will not be analysed until data collection is complete.

It is important to note that data are not collected for diagnostic purposes and will not be used by clinicians or as a substitute for a clinical appointment. Data collection is intended for research purposes only. Participants will not be able to view the results of health measurements taken on the devices they are given to use during the study. Only their temperature taken using a hand-held thermometer which they will need to see in order to manually enter the reading into the questionnaire. Similarly, clinicians will not have access to participant data collected during the study and so no obligation or duty of responsibility can be assumed through clinical observations of participants health measurements.

PROCESSING CONDITIONS

Data must only be used for the purposes stipulated within this Data Sharing Agreement. Any additional disclosure / publication will require further approval from NHS Digital. All access to data is auditable by NHS Digital.

The Data Controller must keep a record of locations the data is processed and stored. These addresses must be within the UK. The Data Controller should minimise the number of processing and storage locations to prevent excessive processing. NHS Digital may request a record of processing and storage locations at any time.

All access to data is managed under Role-Based Access Controls. Users can only access data authorised by their role and the tasks that they are required to undertake.

Data may only be processed and held as long as is required to carry out the purposes listed within this agreement.

Patient level data will not be linked other than as specifically detailed within this Data Sharing Agreement. Data released will only be used for the purposes laid out in the application/agreement.

There will be no attempt to re-identify any of the data supplied under this agreement. The data processor / controller will not have access to the NHS Number to trial ID mapping table at any point.

Data processing is only carried out by substantive employees of the data processor(s) and or data controller(s) who have been appropriately trained in data protection and confidentiality.

NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract i.e.: employees, agents and contractors of the Data Recipient who may have access to that data).

The former CCG(s) has submitted their Data Security Protection Toolkit (DSPT) for 21/22. The ICB will submit their DSPT in line with the 22/23 submission timetable, and the ICB commits to abide by the former DSPT assessments submitted under those CCG(s);

The following CCG(s) previously occupied the footprint of the ICB:

• NHS Lincolnshire CCG

DATA PROCESSORS

Data Processors must be listed in section 5b of this Data Sharing Agreement. These include Cloud and IT infrastructure providers.

The Data Controller should ensure appropriate data processing agreements with all data processors contracted to undertaking work referenced within this agreement.

Microsoft Limited provide Cloud Services for NHS Arden and GEM Commissioning Support Unit and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Greater Manchester Shared Services (hosted by NHS Greater Manchester Integrated Care Board) and NHS Midlands and Lancashire Commissioning Support Unit supply IT infrastructure for Arden and GEM Commissioning Support Unit and are therefore listed as a data processor. They supply support to the system, but do not access data. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

ONWARD SHARING:

Aggregated reports only with small number suppression can be shared externally as set out within NHS Digital guidance applicable to each data set.

SEGREGATION:

Where the Data Processor and/or the Data Controller hold both identifiable and pseudonymised data, the data will be held separately so data cannot be linked.

DATA FLOWS

Dataset:

Pseudonymised Secondary Use Services (SUS) Data

Data Minimisation:

Data will be limited to patients that have consented to the release of their data

Processors

• I5 Health

• NHS Arden and Gem Commissioning Support Unit

Processing:

1. GPs identify patients who would be ideal for study and send them a letter inviting them to participate

2. Patient returns consent form to Optima (includes trial id)

3. Optima assign patients the wearable devices and forwards the patients details to the GP

4. GP sends NHS Number, trial id and demographic details of consented patients to the DSCRO. Where the GPs do not have the capacity due to workloads, Optima will submit demographics details and trial ID to the DSCRO themselves.

5. DSCRO sends pseudonymised SUS data with trial id for those patients to I5 Health

6. I5 Health link the SUS data to the data collected from the wearables

7. A report with small number suppressed is then shared with the ICB and the patients who consented to be in the study

8. The linked pseudonymised data is then sent to Arden and GEM Commissioning Support Unit who will store the data

Reporting and dissemination

Results will be fed back initially to the Study Steering Committee, and subsequently to any associated funding bodies. Results of any studies will be presented at scientific meetings and disseminated in the form of scientific papers. The completion date for this is expected to be March 2023

What will happen after the study ends

At the end of the study, I5 Health will write a report for Lincolnshire ICB with the findings and recommendations for how this new technology could be used to improve NHS services. Patients will not be mentioned personally in any report, and it will not be possible to find out that they were involved in the study from the study report. Within three months after the end of the study I5, will send the consented patients a copy of the report. This will only contain aggregated data with small number suppression.

The ICB intend to make assessments of the likely qualitative and economic benefits of the predictive system based on the data collected. These will be tested through data quality evaluation, model selection, training data categorisation, learning algorithm(s), sensitivity and specificity analyses. to help determine the confidence of the predictive systems (Ref: Longstaff 2010). The benefits can accrue in several parts of the “services”.

It is hoped that the results from the study will pave the future for how healthcare can be delivered and how vulnerable patients can be target before requiring hospital admission. Due to the ever increasing demands on the healthcare system, prevention of worse outcomes is a key target for the NHS.

Yielded Benefits is not a requirement for new applications.