Genomics England: Generations Study cohort data for use in the National Genomics Research Library (NGRL)

Genomics England requires access to NHS England Data for use in their National Genomics Research Library (NGRL).

The NGRL is a secure national resource of genomic, health and sample data managed by Genomics England, which builds on the research environment created by Genomics England for the 100,000 Genomes Project that completed recruitment in 2018 and involved the sequencing of approximately 100,000 genomes. It contains cohorts of patients/participants recruited via programmes set up for the NHS Genomic Medicine Service (GMS), the 100,000 Genomes Project, and other studies/programmes where patients/participants genomes have been sequenced, and provides a national standardised genomic research resource. Being able to compare all patient data in one place provides researchers with an opportunity to better understand diseases, develop new treatments and can lead to new discoveries.

Under this Data Sharing Agreement (DSA), Genomics England will receive NHS England Data linked to the Generations Study cohort and that Data will be accessed via the NGRL.

On average, nine babies in the UK are born each day with a rare genetic condition that could be treated, prevented, or even cured if only it had been diagnosed when those babies were newborns. The Generation Study is aiming to find out if this situation can be improved by recruiting 100,000 newborn babies at NHS Trusts throughout England and conducting whole genome sequencing (WGS) to screen for over 200 rare genetic conditions that are treatable in early childhood. It is hoped that babies affected by these conditions will be identified more quickly, treated earlier and therefore have improved clinical outcomes.

The 3 research questions that Genomics England hope to answer are:

1. Can we better diagnose, and therefore care for, children with rare diseases?

2. Can we give researchers opportunities to improve their understanding of rare disease, to develop new treatments, and diagnoses, and better understand how our genes affect our health?

3. Should we, and if so how should we, use a baby’s genome throughout their lifetime as a resource they and their doctors can use if, for example, they become ill as they get older?

Processing for the Generation Study involves but is not limited to:

> Identifying discrepancies between WGS interpretation results and Bloodspot data results from the CSDS Dataset. This will be conducted on AWS cloud via an automated system developed by Genomics England. Discrepancies will be reported in the cases interpretation portal to be made available to the treating clinician.

> Evaluation of the cost effectiveness, health related outcomes, demographics monitoring and impact on the NHS. Further details of the outputs are detailed below.

The following NHS England Data will be accessed:

> Hospital Episode Statistics (HES) - these Datasets provide the core clinical data for participants and are vital to the provision of a detailed longitudinal medical history for participants. Specifically, the following HES Datasets are required:

- Admitted Patient Care (APC)

- Critical Care (CC)

- Outpatients (OP)

> Emergency Care Data Set (ECDS) – necessary to understand which patients attend emergency departments and what treatment they receive in order to assess if there are associations with genetic markers.

> Diagnostic Imaging Dataset (DID) – necessary to provide invaluable, detailed information to build on participants’ phenotypes (observable characteristics), e.g., tumour size and spread in cancer, adding to the understanding of patients’ histories on individual and cohort level and their relationship with genomic alterations.

> Civil Registration Mortality – necessary because deaths Data is essential for performing survival analyses; this is crucial information for research in combination with other medical history. Knowledge of participant death is also vital for the correct analysis of medical timeline data and for the management of participant cohorts.

> Community Services Data Set (CSDS) – necessary to evaluate the cost effectiveness of the Generation Study, to estimate the impact of WGS in newborns, and identify discrepancies in diseases identified between WGS interpretation results and the CSDS Dataset, which will be reported in the interpretation portal to be made available to the treating clinician.

>Maternity Services Data Set (MSDS) – necessary for discovery research purposes.

NHS England Data is matched to the consented cohorts in the NGRL and therefore provides a more comprehensive medical history, and going forward, a more comprehensive patient journey. NHS England is the richest source of the data required.

The evaluation of WGS data in the context of rich and extended phenotypes derived from electronic health records, such as blood pressure, cholesterol, glucose, and pharmacogenomics (a field of research that studies how a person's genes affect how he or she responds to medications.), adds significant value. The richness of the NGRL datasets will allow Genomics England to move beyond the primary phenotype of the rare disease, cancer or infectious disease that led to the patient’s initial WGS in the context of other continuous traits, diseases and response to therapy including harm.

The level of the Data will be:

> Identifiable

For the following Datasets: HES APC; HES OP; ECDS; Civil Registrations of Death, many indirect identifiable Data items are required because they provide valuable Data that can help researchers make new scientific and medical discoveries. All directly identifiable Data items will either be removed or transformed according to best practice agreed with NHS England. To ensure patients will not be identified the researchers and their projects are examined before access is granted to the Data, and an agreement to not re-identify patients is signed. Further Genomics England monitors all Data leaving the NGRL and will not allow patient records to be exported.

The Data will be minimised as follows:

> Limited to a study cohort identified by Genomics England, comprising of patients recruited via the Generations Project, which follows newborn babies (expected ~50,000 new additions per year - recruitment is due to begin in December 2023 and will continue until 100,000 participants have been recruited in 2025).

Genomics England is the controller as the organisation responsible for ensuring that the Data will only be processed for the purpose described above.

The lawful basis for processing personal data under the UK GDPR is:

> Article 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

Genomics England has determined the processing is necessary for its legitimate interests in carrying out medical research on the causes, diagnosis and treatment of rare diseases and cancers.

The lawful basis for processing special category data under the UK GDPR is:

> Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

It is necessary for Genomics England to process special category participant data for carrying out medical research on the causes, diagnosis and treatment of rare diseases and cancers, which is expected to benefit patients.

The funding is provided by the Department of Health and Social Care. The funding is specifically for the projects described. Funding is in place until March 2025, with the intention to renew this funding periodically.

Lifebit provides IT support to Genomics England.

Amazon Web Services (AWS) provides IT back up services to Genomics England and will store copies of the Data as contracted by Genomics England.

Representatives from patient and public bodies have an important role to play in Genomics England commercial initiatives. These representatives ensure transparency is upheld, and the interest of those whose data is being used is always being respected.

In the early stages of the Library, Genomics England undertook a range of work to ensure that potential participant’s views were included in the formulation of the ethical policies submitted for research ethics approval and in the development of patient information. The views of different groups of potential participants (those affected by cancer, rare disease, and those from BAME communities) in relation to ethical issues raised by the 100,000 Genomes Project were sought and findings were published on the Genomics England website (See all reports under ‘patient and public involvement - https://www.genomicsengland.co.uk/library-and-resources/ and the Genomics England Engagement Strategy). Genomics England will continue to engage with these stakeholders. Further to this, each of the 13 currently recruiting NHS Genomic Medicine Centres had dedicated Patient and Public Involvement leads (PPI) who are responsible for engaging with and involving local potential participant groups from diverse backgrounds. It is expected that the future NHS GMS will continue these local PPI activities to shape and inform the service.

A Participant Panel has also been established. This 30-strong group has provided invaluable advice on a range of topics, for instance, in shaping how analysis is monitored, how results are returned, and how advice and support should be framed. Participant Panel members have either donated samples to the Library themselves or are carers of participants. They take part in a wide variety of consultative groups, such as the Genomics England Ethics Advisory Committee but most importantly are guardians of the dataset, with representatives on the Access Review Committee. Participants play an important part in every decision made about access to data.

SUB-LICENCING:

Genomics Clinical Interpretation Partners (GeCIP) members (Academic research organisations), and members of the Discovery Forum (Commercial organisations) will also have access to the pseudonymised Data within the NGRL, subject to internal approval by Genomics England. NHS England Data is combined with the genomic and sample data within the NGRL, providing a more comprehensive medical history, and going forward, a more comprehensive patient journey which will be a valuable resource for medical research. All applications have to provide health and social care benefits and are reviewed by a panel (the Access Review Committee (ARC)) before access is granted.

It is anticipated that the volume of sub-licences will be 150-200 per year. The GeCIP sub licence agreement is indefinite, until it is terminated by either the GeCIP member or Genomics England.

The Data Access Agreement for Discovery Forum Members has a specified term, normally 12 months, at which point the company and Genomics England can choose to renew or not.

All requests for data access will be subject to the following considerations:

• Protection of data subjects (honouring commitments made to them, acting within the scope of consent and according to conditions of Research Ethics Committee approval).

• Compliance with legal and regulatory requirements General Data Protection Regulation 2018, Data Protection Bill 2017, Freedom of Information Act 2000, NHS Act 2006, Health and Social Care Act 2012, the Common Law Duty of Confidentiality, Human Tissue Act 2004 and applicable requirements from organisations affiliated with the Health Research Authority, including Research Ethics Committees and the Confidentiality Advisory Group (CAG).

• Provision of a signed Genomics England data access agreement to the Access Review Committee.

• Prioritisation of access according to resource availability.

• Facilitation of high-quality health research

Commercial partnerships are crucial to achieving the aims of the NGRL and are achieved through the Discovery Forum. As with the non-commercial academic research led by GeCIP, commercial research aims to bring benefit to the patients and, through the use of the Data, inform development of platforms and tools for future diagnostic discovery. Commercial research can be broadly categorised into four themes that answer different questions along the typical Research and Discovery Biopharmaceutical Pipeline. At a high level they are divided into:

• Diagnostic discovery

• Pre-clinical research

• Clinical Trials Referral

• Real World Evidence / Market Access

Approval process for Commercial organisations for access to the NGRL:

Discovery Forum applications from a commercial organisation would be reviewed for suitability by the Partnership Development (PD)Team. The PD Team consider the credentials of the applying organisation including consideration of adverse public perception and reputational risk from approving data access for that organisation. If the PD Team feel appropriate, they are then passed on to be scrutinised by the independent Access Review Committee (ARC). ARC is constituted of Participant Panel members and senior individuals from various scientific and medical backgrounds. ARC assess the company’s research proposal, including patient/participant involvement, potential future value to patients/the NHS and the ethics of the proposal.

Approval process for GeCIP users (academic) of the NGRL:

• Researcher visits Genomics England website to enrol as a GECIP member

• Completion of onboarding process; Verification by their institution (institution will be required to sign a Genomics participation agreement and appoint a membership secretary), verification of their self-stated qualifications and areas of research interest by the GEL Scientific Manager to join their domain of choice, take the IG and GECIP rules training course and pass test with at least 80%. They are then able to access the NGRL and the Research Portal (the area where prospective GeCIP applicants can apply and register their research project)

• Within 3 months of gaining access they need to either submit a research proposal for Genomics England approval, which currently has to fit with the Detailed Research Plan for their domain, or join another registered project. Otherwise they will lose access.

• On an annual basis, complete a survey sent out by Genomics England giving details of their research progress and any outputs, to aid reporting to ARC.

• Any data they wish to either import or export to/from the NGRL has to be approved by Airlock (Airlock policy is described below) as not being personally identifiable.

• If a researcher has not accessed the NGRL, the Research Portal, or logged into their GEL account to gain access to either of the previous for 6 months their account will be deactivated.

All research activities undertaken in the NGRL aim to enrich the existing dataset via one or multiple routes:

• Identification of diagnoses originally missed by the standardised pipeline

• Feedback of new diagnoses to patients

• Mobilising samples which can help to identify diagnoses that were missed through analyses of WGS alone

Researchers can access pseudonymised Data through NGRL under sub licence. The only Data allowed to be exported are summary results. An airlock policy has been established which enables material (data, files, tools etc) to be moved in or out of the NGRL in a controlled and supervised manner; facilitating research and discovery, while maintaining control of security and access.

Data accessed under sub licence is only granted to named individuals identified to Genomics England who agree to comply with the Airlock policy, Information Governance and IT Security Policy. Before being provided with credentials necessary to access the NGRL a Company Researcher must complete information governance training which shall be provided by Genomics England.

AIRLOCK POLICY:

The following rules are applied to all airlock requests:

1. All relevant details of the summary results to be transferred must be provided with every request.

2. All summary results transferred must be checked by Genomics England to ensure compliance with the relevant policies. Users will be notified of any summary results rejected along with the reason for the rejection.

3. All imports will be checked for viruses and malware and those failing this test will be rejected. It is the responsibility of the requestors to resolve such issues before re-submitting the file for transfer.

4. Summary results requested for transfer are assessed using the following criteria:

a. whether the request aligns with the users ARC approval in full;

b. whether the request can clearly be demonstrated to be aligned with a registered project in the NGRL;

c. any data security implications;

d. any disclosure risks;

e. the technical feasibility and associated cost of the request;

f. when importing data, its scientific value to the community of researchers within the NGRL, and when and how it will be shared;

g. when importing data, checks will be performed to ensure that the data importer owns the data and holds the correct consents and approvals.

The Airlock Manager has formal delegated approval to approve requests where there is precedent from previous Airlock Review Committees. For more complicated requests or where no precedent has been set these will go to the airlock committee for review and a decision. The airlock committee is a delegation of the Genomics England Chief Scientist who responsible for oversight of all airlock requests in accordance with the airlock policy. The committee comprises of:

• Technical Lead

• User Community Representative

• Bioinformatics Director

• Caldicott Guardian

• Chief Scientist representative

The Data will be processed worldwide.

Access is restricted to substantive employees of Genomics England, Genomics Clinical Interpretation Partners (GeCIP) members, and members of the Discovery Forum, who have authorisation from the Principal Investigator.

GeCIP membership is open to any individual, student or member of staff, who is affiliated with a host institution which include the following:

• UK academic research institutions (e.g., universities, research institutions etc.)

• NHS trusts or authorities

• UK and foreign charitable organisations directly related to the focus of the 100,000 Genomes Project

• Foreign universities and research institutions that carry out significant research activity

• UK and foreign governmental departments that carry out significant research activity (e.g., Medical Research Council (MRC), National Institute of Health (NIH), Public Health England (PHE))

• Foreign healthcare organisations (private or public) that undertake significant research activity

To be eligible for data access as a GeCIP member, applicants must meet these requirements:

• Their host institution has signed a GeCIP Participation Agreement, which outlines the key principles that members of each institution must adhere to, including the Intellectual Property and Publication Policy.

• Their host institution has verified that they are affiliated with that institution.

• The applicant’s GeCIP domain has submitted a detailed research plan and it has been approved by the Genomics England Access Review Committee (see below).

• The GeCIP domain lead has approved the application.

• Following approval, GeCIP researchers must sign a specific agreement (‘GeCIP rules’) covering their behaviour and working practice within the data infrastructure.

• Data access will not then be granted until a researcher has successfully passed mandatory information governance training.

All applications have to provide health and social care benefits in England and are reviewed by a panel (the Access Review Committee (ARC)).

The ARC provides an independent examination of requests for data access. The ARC comprises external scientific experts, patient representatives and members of Genomics England’s Participant Panel.

GeCIP users will be granted access to all data and knowledge held within the NGRL. Each GeCIP domain will have access to its own private shared area of the NGRL for data storage and collaboration. The secure virtual desktop infrastructure will provide the ‘workspace’ for clinical teams, research groups and trainees to undertake their work.

All personnel accessing the Data have been appropriately trained in data protection and confidentiality.

The Data will be linked at person record level with the patient’s genetic data within the NGRL. This includes the following data:

> National Cancer Registration and Analysis Service (NCRAS) and uncurated NCRAS data

> Secure Anonymised Information Linkage (SAIL) data; Welsh data

> Patient samples (e.g., blood, saliva, tissue, RNA, plasma and serum)

> NHS Trust's data

The Data will not be linked with any other data.

The identifying details will be stored in a separate database to the linked dataset used for analysis. All analyses will use the pseudonymised Dataset. There will be no requirement and no attempt to reidentify individuals when using the pseudonymised Dataset.

To protect patient confidentiality, access to the NGRL will be granted only for specific, approved purposes in accordance with informed consent. Any attempted use beyond the specified purpose may lead to exclusion and possible legal action, where appropriate.

Data accessed under sub licence will not be re-identified.

Data shared through the Airlock process is aggregate data only.

A release register detailing any sub licences and onward sharing can be found here: https://research.genomicsengland.co.uk/research-registry/browse

Genomics England will take responsibility for the actions and omissions of all sub licences and breach of a sub licence will automatically be regarded as breach of the Data Sharing Framework Contract.

In the event of termination or expiry of the Data Sharing Framework Contract between NHS England and Genomics England, Data from NHS England will be removed from the NGRL, preventing access to the Data for all users.

Genomics England will transfer data to NHS England. The data will consist of identifying details (specifically study ID, NHS Number, Date of Birth, Surname, Forename, Gender, Postcode and Other Given Name) which are required for the cohort to be linked with NHS England Data. This is the minimum requirement of identifiers required for linkage to guarantee complete matching.

NHS England Data will provide the relevant records from the HES APC, HES CC, HES OP, ECDS, Civil Registrations of Death, DIDs, CSDS and MSDS Datasets to Genomics England’s Amazon Web Services (AWS) cloud storage. The Data will:

> Contain directly identifying Data items including but not limited to: Names, Postcode, Cause of Deaths, Place of Birth, Cancer Registration Number, which are required to provide maximum insight, and therefore maximum value to the researchers accessing the Data.

The NHS England Data is pseudonymised within the AWS cloud and is then loaded into the NGRL. Raw, identifiable files are kept in a secure location on AWS.

The Data will not be transferred to any other location.

The Data will be stored on the NGRL and the AWS Cloud at Genomics England.

Genomics England stores NGRL data on the Cloud provided by Amazon Web Services (AWS).

The Data will be accessed by authorised personnel via remote access.

The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.

For remote access:

- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;

- Access controls granting users the minimum level of access required are in place;

- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;

- Multifactor authentication (MFA) is required for remote access;

- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for remote access;

- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

Data is physically stored in England.

Remote access is permitted from the following specified countries; UK, EEA Countries, United States, Canada, Australia, Qatar, Republic of Korea, Japan, Switzerland, Brazil, India, New Zealand, Argentina

Should any country on the permitted list above become a high risk country through the duration of this agreement, the Recipient will cease disseminating data to researchers/organisations based in that country and request that data already disseminated be destroyed.

Should the Recipient wish to share data with any countries not listed above, it will require an update to this agreement

Should Genomics England wish to facilitate remote access from a country that is not listed above, prior written agreement from NHS England must be obtained.

Genomics England upholds the following safeguards and controls:

1. Compliance with National Cyber Security Centre (NCSC) guidance, leading to the implementation of geo-blocking measures for IP addresses originating from Iran, Russia, North Korea and Belarus

2. Collaboration with the NCSC and other security partners to identify and block potentially risky IP addresses, irrespective of their country of origin.

3. Implementation of two email authentication methods, namely Domain-based Message Authentication Reporting and Conformance (DMARC) and Sender Policy Framework (SPF), to detect and respond to spoofing and spam. This is crucial, as these activities often target our firewalls from international IP addresses.

4. Introduction of additional assurance activities related to international access within the Office 365 estate.

5. Conducting due diligence on companies associated with BGI Genomics.

6. Responsibilities of the Access Review Committee (ARC) include the thorough review of applications and applicants.

7. Continuous improvement of Information Governance training and cybersecurity awareness at Genomics England.

Access to confidential patient identifiable Data is restricted to an extremely limited number of employees of Genomics England, accessible on AWS.

Substantive employees of Genomics England and researchers who are a member of the GeCIP and Discovery Forum will process the Data for the purposes described above.

Researchers will have their own dissemination and communication strategies, however a full list of scientific publications and conferences/posters will be made available on the Genomics England website on an ongoing basis. The expected outputs of the processing will be:

> Submissions to peer reviewed journals

> Presentations at conferences

> Posters

> Creation of a database of all genomic data, including all genomic and omics tests.

The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the Dataset(s) from which the information was derived.

The outputs will be communicated to relevant recipients through the following dissemination channels:

> Journals

> Posters

> Website: A list of publications is kept up-to-date on the Genomics website: https://www.genomicsengland.co.uk/research/publications?

> Presentations at appropriate conferences

> Upload of findings onto the ‘Discovery Forum’: Genomics England works with industry partners through the Discovery Forum. All members of the Forum are obliged to publish all findings and research at the point at which intellectual property for any product is protected. Additionally, it allows the NGRL users to report back to Genomics England on what aspects of the data are proving to be most useful to their research studies, what data is missing and how the data should be collected and developed. These partners act as a critical friend and have already made many helpful suggestions to increase the likelihood of successful research in the future for all those using Genomics England's NGRL.

Gene discovery in the NGRL will create significant opportunities for scientific innovation through routine service, the focus on residual unmet need, and emphasis upon national and international collaborations. The library is expected to enable genomically-driven reclassification of rare diseases leading to opportunities to recall patients for deeper phenotyping through Rare Diseases Translational Research Collaboration (RD-TRC). RD-TRC has been setup by the National Institute for Health and Care Research and its aim is to provide research infrastructure that harnesses the strength of the NHS to support discoveries and translational research on rare diseases. These data are expected to pave the way for functional characterisation of findings, thereby adding further value to datasets, improving diagnostic utility and possibly identifying new targets and therapies.

The use of the Data could help to achieve the following benefits:

> Through the international coalition of research intellects known as the Genomics England Clinical Interpretation Partnership (GeCIP) and the Discovery Forum, the framework for Genomics England to work with Industry:

• Create a mechanism for research to continually improve the accuracy and reliability of information fed back to patients

• Add to knowledge of the genetic basis of disease

• Increase opportunities for clinical trials

• Build the evidence base to accelerate the introduction of new technologies into healthcare

> Stimulate and enhance UK industry and investment

> Provide access to this unique research data resource to industry for the purpose of developing new knowledge, methods of analysis, medicines, diagnostics and devices

> Attract inward investment from life science companies, with an aim of increasing opportunities of access to medicines that would otherwise be unavailable to UK patients

> Result in new scientific insights and discoveries

> Information linked to continually updated with long-term patient health and personal information to aid analysis by researchers.

> Increase public knowledge and support for genomic medicine by delivering an ethical and transparent programme, retaining patient and public trust and confidence. This is aided by work with a range of partners to increase knowledge of genomics.

Specific Example: Generations Study:

Within the Generations Study, Genomics England intend to use NHS England Data to provide evidence to answer the questions set out above for evaluation purposes. Specifically, HES and CSDS will be used for the following:

• Cost effectiveness

To approximate the true costs associated with additional / fewer =healthcare encounters of WGS in newborns, to include A&E attendances, outpatient appointments, admissions, allied health professional appointments, procedures, medication and treatment for all participants that screen positive through the Generation Study.

• Health related outcomes

To estimate the impact of WGS in newborns on the following, for all participants that screen positive through the Generation Study:

o Diagnostic Odyssey to include i) time from first clinical contact to diagnosis, ii) age at diagnosis, iii) frequency and duration of health encounters during the diagnostic period.

o Health encounters such as A&E attendances, outpatient appointments, admissions, allied health professional appointments over a defined time period.

o Interventions for example procedures, medication and treatment over a defined time period.

o Mortality to include i) age at death, and ii) cause of death.

• Demographics monitoring

To ensure enrolled participants are representative of the wider English population based on a variety of demographic variables.

• Impacts on the NHS

To identify if there has been any impact on the uptake of existing NHS newborn screening amongst participants of the Generation Study

Genomics England also hope to link NHS England Data to genomic data for discovery research purposes. HES, CSDS and MSDS are expected to prove useful for researchers seeking opportunities to improve their understanding of rare disease, to develop new treatments, and diagnoses, and better understand how genes affect health.

Yielded Benefits is not a requirement for new applications.