Monitoring the Safety of Breast Implants using BCIR Data

Medicines and Healthcare Products Regulatory Agency (MHRA), an executive agency of the Department of Health and Social Care (DHSC), requires access to NHS England data for the purpose of the following research project: Monitoring the Safety of Breast Implants using Breast and Cosmetic Implant Registry (BCIR) Data.

The following is a summary of the aims of the research project provided by MHRA:

- Conduct exploratory data analyses for the purposes of assessing the value in the safety vigilance of breast implants of different textures.

- Explore the feasibility of using BCIR data to support MHRA’s vigilance and surveillance of breast implant products

- Use results of this project to provide insights into the strengths and limitations of the data within the BCIR for the purposes of supporting device vigilance.

Breast implants can be a life-enhancing procedure for many patients undergoing surgery for either cosmetic or reconstructive purposes. However, there have been reports of adverse systemic symptoms since their first use. The literature suggests there is no definitive association of breast implants with an increased risk of systemic symptoms. However, the occurrence of these symptoms does exist, albeit the extent of complications is not fully known. Studies generally show an improvement in systemic symptoms following explant. Thus, conducting a feasibility study into whether the BCIR holds adequate data on breast implant surgery can assist in the assessment of an association between breast implants and systemic symptoms.

The following NHS England Data will be accessed:

• Breast and Cosmetic Implant Registry (BCIR) Data – necessary to conduct exploratory data analyses for the purposes of assessing the value in the safety vigilance of breast implants of different textures. BCIR data is expected to provide a detailed record of the number of patients who have undergone breast procedures and support monitoring of any clinical complications associated with the use of the breast implant product.

The level of the data will be:

· Pseudonymised

The Data will be minimised as follows

• Limited to data between 2019 and 2023

• Limited to a study cohort identified by NHS England as meeting the following criteria: Had breast implants within England (including non-English nationals).

DHSC is the controller as the organisation responsible for ensuring that the data will only be processed for the purpose described above.

The lawful basis for processing personal data under the UK GDPR is:

Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

The lawful basis for processing special category data under the UK GDPR is:

Article 9(2)(i) - processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.

The Data is processed for: Effective regulation of medicines and medical devices (Article 9(2)(i)).

The BCIR data will inform on the use and safety of breast implants and will provide long-term insights for monitoring the use and safety of other surgical medical devices and implants used in the UK. The analysis and the required processing of the BCIR data is in the public interest because it adheres to the UK Policy Framework for Health and Social Care Research, which protects and promotes the interests of patients, service users and the public and aims to produce generalisable and publicly available information to inform future decisions over patients’ treatments or care.

The funding is self-funded by the MHRA. The funding is specifically for the project described. Funding is in place until 2025.

MHRA (an executive agency of DHSC) is a processor acting under the instructions of DHSC. MHRA is responsible for operating and managing the exploratory analyses described above.

NTT Data UK LTD provides IT hosting services to MHRA and will store the Data as contracted by MHRA.

The Plastic, Reconstructive and Aesthetic Surgery Expert Advisory Group (PRASEAG) are an independent expert advisory group to the MHRA. The expert advisory group report to the Interim Devices Working Group. Their remit is to provide independent advice to the MHRA regarding the safe use of medical devices used for reconstructive and aesthetic purposes. They have most notably advised on the safety of breast implants, including new and emerging safety signals, and have provided strategic project advice. The PRASEAG have endorsed MHRA recommendations to access the data provided in the Breast and Cosmetic Implant Registry to gain further insight into safety issues associated with breast implants to compliment the adverse events reported to the Agency.

No data will flow to NHS England for the purposes of this Data Sharing Agreement.

NHS England data will provide the relevant records from the Breast and Cosmetic Implant Registry dataset to MHRA. The data will contain no direct identifying data items. The data will be pseudonymised, and individuals cannot be reidentified through linkage with other data in the possession of the recipient.

The data will not be transferred to any other location.

The data will be stored on servers at MHRA.

MHRA stores data on the Azure Cloud provided by Microsoft Limited.

The data will be accessed by authorised personnel within MHRA via remote access.

The Controller must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.

For remote access:

- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;

- Access controls granting users the minimum level of access required are in place;

- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;

- Multifactor authentication (MFA) is required for remote access;

- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;

- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

The Data will not leave England at any time.

Access is restricted to individuals within the Epidemiology Unit of MHRA who have authorisation from the Principal Investigator. All such individuals are substantive employees of MHRA.

All personnel accessing the Data have been appropriately trained in data protection and confidentiality.

The Data will not be linked with any other data.

There will be no requirement and no attempt to reidentify individuals when using the Data.

Analysts from the MHRA will analyse the Data for the purposes described above.

The expected outputs of the processing will be:

• A data specification document from a researcher’s perspective will be drafted as a guide for the Epidemiology team in conducting analyses and interpreting the outputs of these analyses in future research projects using BCIR data.

• Submissions to peer reviewed journals

• Presentations to the Devices Expert Advisory Group, statutory committee providing the MHRA with advice on the safety, performance, benefits and risks of devices in the UK healthcare system.

• Dissemination to a Patient Safety Commissioner group.

The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.

The outputs will be communicated to relevant recipients through the following dissemination channels:

• Journals

• Public reports

• Press/media engagement

• Reports aimed at patients

The proposed target date for conducting all analyses, the dissemination and communication of the results of the analyses (including recommendations for the use of the Pelvic Floor Registry and overall BCIR) to the specified target audience is 12 months from receiving the data (Summer 2025).

The analyses conducted under this project would provide MHRA with knowledge and understanding of the data captured in the BCIR. Based on the evaluation of the data set, the BCIR could potentially be used in the MHRA’s routine vigilance activities to monitor the use and safety of breast implants, informing the ongoing refinement of the MHRA’s wider vigilance strategy.

The potential vigilance activities introduced include monitoring the number of breast implant procedures conducted to put into context the adverse incident reports received via the Yellow Card

Scheme (YCS), the strengthening of new potential safety signals identified in MHRA’s routine signal detection activities and the use of BCIR as an additional data source to conduct signal detection activities in.

The analyses seek to explore the feasibility of the BCIR data to fit the needs of the MHRA’s vigilance responsibilities in monitoring the safety of breast implants in patients. The outcome of the study would assist MHRA in informing the decision-making process for identifying potential associations between systematic conditions and breast implants.

It is hoped that the overall impact of this project will provide long-term insights for monitoring the use and safety of other surgical medical devices and implants used in the UK and, therefore, the potential for strengthening the MHRA’s post-marketing vigilance strategy for medical devices.

Yielded Benefits is not a requirement for new applications.