Post-operative adjuvant treatment for HPV-positive tumours (PATHOS) - Request for Civil Registrations of Death

Cardiff University and Velindre University NHS Trust requires access to NHS England data for the purpose of the following research project:

PATHOS (Post-operative adjuvant treatment for HPV-positive tumours): A Phase III trial of risk-stratified, reduced intensity adjuvant treatment in patients undergoing transoral surgery for Human papillomavirus (HPV)-positive oropharyngeal cancer.

The PATHOS trial is being coordinated by the Cardiff University Centre for Trials Research (CTR). The following is a summary of the aims of the research project provided by Cardiff University and Velindre University NHS Trust:

PATHOS is a multicentre, international randomised phase III study. Participants will have minimally invasive mouth surgery to remove the primary tumour and a neck dissection to remove lymph glands in the neck. They will then be randomised to one of three risk-based arms indicated by their pathology sample; this will show whether further treatment in the form of radiotherapy and/or chemotherapy is recommended.

The trial objectives are:

1. To demonstrate if swallowing function can be improved and toxicities reduced (which have a major impact on quality of life), following transoral surgery for HPV-positive oropharyngeal cancer, by reducing the intensity of adjuvant treatment protocols.

2. To demonstrate the non-inferiority (the test is equivalent or at least not worse to the control) of reducing the intensity of adjuvant treatment protocols in terms of overall survival.

Phase III of the study aims to prove that cancer control rates and survival are maintained when the intensity of treatment is reduced.

The co-primary endpoints which are used to determine the sample size calculation for the trial are:

1. Overall survival (time to event); and

2. Swallowing function as measured

The PATHOS trial aims to recruit approximately 1100 patients internationally over 10 years.

NHS sites in the United Kingdom will complete a "Death Request Form" if they become aware of the death of a trial participant. PATHOS will contact NHS sites where a death is recorded in NHS England Data but not reported to the PATHOS trial team (suggesting a ‘missed’ reporting of deaths) or where the date of death reported by the NHS site differs to the data recorded in the NHS England Data. PATHOS will ask the NHS site to follow up on the participants information and update the "Death Request Form" accordingly. PATHOS will request date of death from NHS England only for participants who have consented.

Therefore, the PATHOS trial team wish to request mortality data to check the sites are reporting:

1. All death events; and that

2. Reported deaths are correct (date of death matches NHS England’s records)

The following NHS England Data will be accessed:

• Civil Registrations of Death – date of death only necessary to check for any missing events of death noted with NHS England but not reported on the PATHOS database) and is therefore necessary to undertake a reconciliation exercise to check for missing or discrepant death information held on the PATHOS database. The Data will inform whether the sample size calculation is correct by providing an indication on whether co-primary endpoint data is being reported correctly by sites.

The level of the Data will be identifiable.

The Data will be minimised by limiting to the PATHOS trial cohort of approximately of ~900 participants identified by Cardiff University who have consented to participate.

Velindre University NHS Trust and Cardiff University are joint Data Controllers and co-sponsors who are responsible for ensuring that the Data will only be processed for the purpose described above.

The lawful basis for processing personal data under the UK GDPR is:

Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests

of the data subject.

This processing is in the public interest because it adheres to the UK Policy Framework for Health and Social Care Research, which protects and promotes the interests of patients, service users and the public, and aims to produce generalisable and publicly available information to inform future decisions over patients’ treatments or care.

The PATHOS trial is being funded by Cancer Research UK. The funding is specifically for PATHOS trial described and is in place until 10/10/2027. The funder will have no ability to suppress or otherwise limit the publication of findings.

Cardiff University will process the Data at the Centre for Trials Research (CTR).

PATHOS has three oversight groups to provide expert advice and guidance: Trial Steering Committee (TSC), Independent Data Monitoring Committee (IDMC) and Trial Management Group.

PATHOS has a Public and Patient Involvement and Engagement group which helped refine the purpose of the research and strongly support the collection of the data from NHS England for the purposes described above. A PPIE representative is a member of the TMG and through this role will ensure the views of the patient and public are considered during the results and dissemination stages.

Cardiff University will transfer data to NHS England. The data will consist of identifying details (NHS Number, Postcode, Date of Birth, Name and Surname) and a unique person ID for the cohort to be linked with NHS England data.

NHS England will provide the relevant record from the Civil Registrations of Death dataset to the Cardiff University. The Data retuned to Cardiff University will contain no direct identifying data items. The Data will be identifiable as Cardiff University also control identifiable data.

Date of Death only will be returned to the Centre for Trials Research (CTR) at Cardiff University. The Data will not be transferred to any other location.

Cardiff University will use the NHS England Data to raise data queries on the pseudonymised clinical trial database. The NHS sites will be contacted and asked to respond to the queries through the provision of follow up information relating to the death. Cardiff University will not provide the NHS sites with the date of death.

The Data will be stored on servers at the Centre for Trials Research (CTR) at Cardiff University.

CTR at Cardiff University stores Data on the Cloud provided by Microsoft Azure back up.

The Data will be accessed by authorised personnel on site at Cardiff University or via remote access.

The Controllers must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.

For remote access:

- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;

- Access controls granting users the minimum level of access required are in place;

- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;

- Multifactor authentication (MFA) is required for remote access;

- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;

- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

Remote processing will be from secure locations within England/Wales. The data will not leave England/Wales at any time.

Access is restricted to substantive employees of the University of Cardiff who have authorisation from the Principal Investigator.

All personnel accessing the Data have been appropriately trained in data protection and confidentiality.

The Cardiff University clinical trial database source data is from NHS sites. NHS England Data will be used to raise data queries on the pseudonymised clinical trial database only.

The identifying details will be stored in a separate database to the dataset used for analysis.

Analysts from the CTR at Cardiff University will process the Data for the purposes described above.

The expected outputs of the processing will be:

A reconciliation of the clinical trial database to ensure that all death data have been reported. The output of this clinical trial database will be an aggregate number of deaths and survival estimates in trial arms and will be shown to the trial IDMC as part of a review of the overall sample size calculation and as part of a review of the co-primary endpoint data.

The outputs of the full trial results will be communicated to relevant recipients through the following dissemination channels:

• New England Medicine Journal.

• Conference Presentations:

• American Head and Neck Society International Conference

• Royal College of Speech and Language Therapists Conference

• International Clinical Trials Methodology Conference

• Royal College of Radiologists Annual Conference

• International Congress on Innovative Approaches in Head and Neck Oncology

• Multidisciplinary Head and Neck Cancer Symposium

• European Society of Radiotherapy and Oncology (ESTRO)

• British Association of Head and Neck Oncologists (BAHNO)

• UK Swallowing Research Group meeting

PATHOS plan to complete the trial analysis by October 2027 to with expected published results due in early 2028.

The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.

The services provided to clients are expected to identify improvement opportunities which the client may then exploit by making changes to systems, processes, resources or infrastructure in order to improve patient experience and patient care.

The use of the data could provide a mechanism for checking the quality of care. This could include identifying areas of good practice to learn from, or areas of poorer practice which need to be addressed.

The data will contribute to the co-primary endpoint of the trial and ensure accurate sample size calculations. Without accurate assessment of the event rate, the PATHOS trial may not be able to robustly answer the research question that it is designed for.

The data will ensure that no endpoints are missed and that the primary endpoints will be answered. PATHOS hope that the outcomes of the study will lead to better care, diagnosis, influence of national and international health guidance.

Yielded Benefits is not a requirement for new applications.