Waiting List Minimum Data Set (WLMDS) - for the purposes of Statistics and Statistical Research, under section 45 of the Statistics and Registration Services Act 2007 as amended by the Digital Economy Act 2017

The Statistics Board requires an extract from the Waiting List Minimum Dataset (WLMDS) held by NHS England, in order to carry out its functions in accordance with section 20 of the Statistics and Registration Service Act 2007 (SRSA). The legal gateway for this will be Section 45C of the SRSA 2007 (as inserted by section 80 of the Digital Economy Act 2017) which permits The Board to serve a Notice on a public authority requiring it to disclose information it holds in connection with its functions:

http://www.legislation.gov.uk/ukpga/2007/18/section/45C

To do so, the information so disclosed must be required by the Statistics Board for one or more of its functions as set out in the SRSA 2007 and the Census Act 1920. The Office for National Statistics (ONS), as executive arm of the Statistics Board, is described as the body exercising those functions and is Data Controller for the uses outlined in this Data Sharing Agreement (DSA).

The SRSA (2007) states that the ONS’s objectives include ‘promoting and safeguarding the production and publication of official statistics that serve the public good, where serving public good includes informing the public about social and economic matters and assisting in the development and evaluation of public policy’. It also sets out the Board’s functions, which are the specifically referred to in section 45c of the amended SRSA. Notably they include, under section 20, that ONS ‘may produce and publish statistics relating to any matter relating to the United Kingdom or any part of it’.

Requirements made under section 45 must also be in line with a statistical statement of principles that has been approved by parliament:

https://www.gov.uk/government/publications/digital-economy-act-2017-part-5-codes-of-practice/statistics-statement-of-principles-and-code-of-practice-on-changes-to-data-systems

This states that ‘We will only seek access to data for the purposes of fulfilling one or more of our statutory functions, including to produce official statistics and undertake statistical research that meets identifiable user needs for the public good.’

The statement also sets out six principles to which ONS will adhere when requiring information under section 45; they state that ONS will:

• safeguard confidentiality

• be transparent about what data it is accessing and why

• ensure accessing the data is lawful and meet strict ethical standards

• ensure that accessing the data is in the public interest - for example that the data are fit for purpose for the statistical use which ONS intends

• ensure requiring that the data be supplied is proportionate – for example, ONS will have exhausted possible alternatives

• seek to collaborate with suppliers at all times

Using robust information governance processes, ONS has determined that the conditions associated with requiring data under section 45c of the amended SRSA have been met for the information in this DSA. This process included working closely with NHS England’s experts to help determine that the data would be fit for purpose to meet the proposed statistical purposes. This work guided ONS’s assessment against some of the principles underpinning its legal powers – for example whether sharing the data is in the public interest, and proportionate in terms of burden on the supplier. In addition, as part of its commitment to transparency, ONS will publish full details of the reasons for acquiring the information, and ONS notes that NHS England will also publish the details of this DSA. In terms of public interest, it is worth noting that the benefits gained from the statistics enabled by this data share do not need to be specific to health and social care when data are flowing under section 45 of the SRSA, although for this particular project the benefits should meet such a test.

To protect patient confidentiality, ONS has conducted a full Data Protection Impact Assessment (DPIA) for all of the NHS England health data that it controls and processes. This will apply to these data which are similar in nature and sensitivity to the NHS England health data that ONS already holds.

The following are some of the key mitigations ONS employs for the data protection risks identified:

• The technical and procedural protections of the ONS secure data environment

• ONS staff have high levels of training and security clearance, and it is a criminal offence under the Statistics and Registration Service Act 2007 to disclose personal information held by ONS

• The data will be de-identified at the earliest opportunity and those conducting data linkage will be separate from those conducting analysis using linked de-identified attribute information

• Analysts will never seek to re-identify subjects and

• ONS is only interested in producing aggregate statistics for the public good

ONS will carry Public and Patient Involvement and Engagement to test public acceptability and promote transparency.

The Data shared with ONS under this DSA will not be onward disseminated or shared, except as disclosure controlled aggregate statistics and/or analysis as aggregated data with small numbers suppressed, in line with the relevant disclosure rules for the dataset(s) from which the information was derived. Any exceptions to this would require additional NHS England approval. It would also require an appropriate alternative legal gateway, because section 45c of the SRSA as amended by the Digital Economy Act only enables data to be shared with ONS (not for example, other Government departments or academic researchers).

The rest of this section will set out the specific purposes for which ONS requires the dataset under this DSA. In future, should ONS decide to put the dataset to new uses not explained below, the new use will be in line with ONS’s legally defined functions, and ONS will inform NHS England and enter into an amended DSA before proceeding with that new purpose.

Specific uses for these data:

The statistics ONS produces are driven by user needs. Often these user needs come from Government departments who are seeking better evidence to inform decision making in an emerging or increasingly high priority policy area. During and since the pandemic, there has been an increase in economic inactivity – particularly due to ill health – and ONS are uniquely placed to produce statistics that will provide better evidence about what is happening. This includes the impact of health on labour market participation, and vice versa. The ONS intends to use the Data for its health and labour market statistical work programme. Stakeholders such as the Treasury, Cabinet Office, DWP and DHSC are interested in ONS producing such statistics, and ONS has initiated a programme of work to produce new statistics in response. Part of this work programme requires the acquisition, linkage and analysis of the WLMDS.

ONS will link the WLMDS to data on employment and benefits, as well as to mortality and hospital (HES) records, to investigate the impact of waiting times on labour market participation, and also on long-term health outcomes. This will include investigating whether there are differences between time waited and between different conditions/interventions. Without it, ONS only has visibility of those who have actually been treated (via Hospital Episode Statistics data), not those who are still waiting, or who died waiting; also the actual wait time for those who have been treated will be harder to determine using HES.

The data will be used for the following projects:

ONS’s broader work programme on the relationship between health and the labour market, including exploring the impact of health interventions (e.g. weight loss surgery, orthopaedic surgery) on subsequent employment and pay, and how these impacts may be attenuated or accentuated by the time patients waited to access the services concerned. To begin with, for WLMDS data, this will mean the following specific project, which was approved within a more wide ranging health and labour market ethics application to the National Statistician’s Data Ethics Advisory Committee (NS-DEC):

• Association between adverse health events, NHS waiting lists and employment-related characteristics:

Longitudinal statistical techniques will be used, such as fixed effects modelling and time-dependent survival analysis, to assess changes in employment variables after an individual experiences an adverse health event, and as a function for time spent waiting for outpatient (elective) hospital treatment. ONS' longitudinal modelling approach will allow them to explore contemporaneous and dynamic (lagged) relationships between health changes and employment changes, and also the reverse: the extent to which changes in employment status are associated with downstream changes in health status. ONS will explore differences in these relationships across health conditions (such as musculoskeletal conditions, diabetes, major adverse cardiovascular events, respiratory failure, and cancer), pre-existing health/disability states and baseline employment characteristics (such as industrial sector, occupation, and employer size).

The data that will be integrated to determine the labour market outcomes are the Benefits and Income Dataset (BIDS) (soon to replaced with the Benefits Dataset, BENS), which the Department for Work and Pensions share with ONS, and Pay As You Earn (PAYE) data which HMRC shares with ONS. In both cases, the data are shared with ONS under section 45A of the SRSA for the production of official statistics. And in both cases, these data are deidentified and linked to the ONS demographic index (a method to enable onward linking to other sources without the need for direct identifiers) before any integration with other data sources (including health data sources as per this DSA) occurs.

The following NHS England Data will also be accessed and integrated to enable ONS to fulfil the purposes outlined above:

- Waiting List Minimum Dataset (WLMDS)

- HES Admitted Patient Care

- HES Accident & Emergency

- HES Outpatients

- HES Critical Care

- Emergency Care Data Set

- Improving Access to Psychological Therapies Dataset

The level of Data will be identifiable – Linkage to other sources at a record level is a prerequisite to success for the proposed uses, and therefore identifiers are required; as a minimum, NHS number, but other identifiers such as date of birth will be included where available as these will help quality assure whether links made with other datasets based on NHS number matching are indeed the same subject.

ONS sought advice from NHS England analysts who work with the WLMDS and have established that all variables collected in the "Open Pathways" and "ClockStops" datasets are required to fulfil the purpose outlined in this DSA. Data is required from the start of the collection (Sept 2021) to latest available at time of extraction, and quarterly through to 2026/2027.

ONS is the controller as the organisation responsible for ensuring that the Data will only be processed for the purpose described above. Although the health and labour market statistical work programme is currently sponsored by the Treasury, the Treasury will not carry out any controllership activities. The Cabinet Office, Department for Work and Pensions and Department for Health and Social Care are all stakeholders in this work. Analysts and data experts from these Departments may provide advice, but will never access the data. ONS retains its independence to ultimately determine what statistics are produced and how they are presented and published. Data will be accessed by substantive employees of ONS who have the relevant security clearance.

The purpose and use of these datasets, has been approved by the independent National Statistics Data Ethics Advisory Committee (NS-DEC).

The lawful basis for processing personal data under UK GDPR is:

Article 6(1)(e) - The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Where the official authority for ONS to produce, promote and safeguard official statistics is found in the Statistics and Registration Service Act 2007.

Article 9(2)(j) - The processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The health and labour market statistical work programme is currently funded by the Treasury and potentially other funding bodies in the future. Some of the costs incurred will be covered by bespoke additional funding from the Treasury, which is additional funding beyond standard ONS baseline funding from the Treasury, for example, the Treasury’s Shared Outcome Fund. The Cabinet Office, Department for Work and Pensions and Department for Health and Social Care are all stakeholders in this work. Analysts and data experts from these departments may provide advice, but will never access the data.

Amazon Web Services and Google UK Limited are processors acting under the instruction of ONS.

Ark Data Centres Limited provide IT infrastructure and support for Amazon Web Services.

No Data will flow to NHS England for the purposes of this DSA.

NHS England, via the North of England Data Services for Commissioners Regional Office (DSCRO), will provide the relevant records from the WLMDS. The Data will contain directly identifying data items including (NHS Number, postcode and date of birth) which are required to link the Data at record level with data already held by ONS.

The Data will be stored on servers at ONS within an assured ONS data analysis environment that includes the following elements of security control:

• Need to know access applied through user account access and management.

• Access to the data is restricted to individuals granted access on the basis of a justified need to access the data

• Controlled ingest and export of data into/out from the environment

• Controlled account access using unique credentials based on job role

• Logged and monitored access of user activity within the environment

• Secure build configuration for infrastructure

• Vulnerability tested infrastructure with appropriate remediation and patching

• Compliance checks against security enforcing controls

• Architectural review against standards and best practice

• Staff security cleared to the appropriate level based on their supervised and/or unsupervised access to sensitive data in accordance with ONS clearance policies and data access processes

• Education and awareness of environment users covering security policies and secure working practices

• Operational support processes to securely manage the environment

• Risk assessment to identify security risks and mitigation actions to reduce this risk.

ONS Secure Data Environment users set up 'project spaces' and apply for access to data through the Information Asset Owner. Each 'project space' includes only the data required to carry out their analysis and only the users who require access to that data. Users will not be permitted to access identifiers for the purposes of analysis. ONS will keep the number of staff permitted to process identifiers to an absolute minimum, and these staff will have a higher level of clearance. All other staff will only be permitted to access non-identifying data.

Access is via the ONS Secure Data Environment will only do so via their ONS issued hardware. This may include access on ONS sites, or when working from home via VPN. All ONS users of the ONS Secure Data Environment have high levels of clearance, training and sign an auditable SyOps document with conditions of use of the environment.

For remote access:

- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;

- Access controls granting users the minimum level of access required are in place;

- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;

- Multifactor authentication (MFA) is required for remote access;

- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;

- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

This processing activity takes place in a dedicated ONS environment provided by Amazon Web Services, and based in England and Wales only.

The data will reside within Google Cloud Platform (GCP). All cloud services consumed for the storage and use of the data are scoped to securely managed GCP Projects. GCP Projects in scope for this project are not connected to ONS corporate networks. GCP Projects in scope for this project are accessible via the internet for administration/analytical work. Access is securely bound up with Google identity services, internet authentication proxies and multi-factor authentication. All platform infrastructure and storage is deployed into the Europe-west2 region (London) and in any of the 3 available zones for redundancy and high availability (where applicable). Processing of data can only be carried out on GCP infrastructure within the deployed region. Access to GCP platform is region locked to UK IP addresses only. Overseas connections are monitored, and connection attempts will lead to account suspension.

Access is restricted to substantive employees of ONS. Following policy specified by the ONS Chief Security Officer, ONS user access to the data environment is only after approval of an application by the Information Asset Owner. A list of approved users is available for NHS England to request as required. All personnel accessing the Data have been appropriately trained in data protection and confidentiality. Staff accessing identifiable data have a higher level of security clearance.

The Data will be linked at person record level with HES, ECDS and IAPT Data provided under separate Data Sharing Agreements with NHS England (DARS-NIC-175120-W5G2X and DARS-NIC-400304-S1P1B), ONS mortality data, Census data, and data on employment and benefits from the Benefits and Income Dataset (BIDS) provisioned to ONS by the Department for Work and Pensions (DWP), and the Pay As You Earn (PAYE) dataset provisioned to ONS by the HMRC, to achieve the statistical purposes. The key derived variables that ONS will link include: PAYE employee status, gross employee pay and maybe working hours (from HMRC) and benefits status and amount of benefits received (from DWP). These would be linked using Census ID to encrypted NINo (HMRC) and Census ID to CIS ID (DWP) look-up tables.

ONS is only interested in producing aggregate statistics and using these to uncover trends and other useful insights based on the non-identifiable 'attribute' information.

Only statistical disclosure controlled aggregate outputs will be exportable from the secure data analysis environment. Other than the initial transfer of the data from NHS England to ONS, the identifiable data will never be in transit and will always be protected by procedural controls in place.

To protect patient confidentiality, ONS has conducted a full Data Protection Impact Assessment (DPIA) for the NHS England health data that it controls and processes. This will apply to these data which are similar in nature and sensitivity to the NHS England health data that ONS already holds. The following are some of the key mitigations for the risks identified:

• The protections of the ONS secure data environment

• ONS staff have high levels of training and security clearance, and it is a criminal offence under the Statistics and Registration Service Act 2007 to disclose personal information held by ONS

• The data will be de-identified at the earliest opportunity and those conducting data linkage will be separate from those conducting analysis using linked de-identified attribute information

• Analysts will never seek to re-identify subjects and

• ONS is only interested in producing aggregate statistics for the public good

Analysts from the ONS will analyse the Data for the purposes described above.

The data will be used to produce official statistics. These will be released on the ONS website in the form of a statistical bulletin and statistically disclosure controlled aggregate data tables, and potentially in peer-reviewed scientific journals. Headline results may also be published on social media, and within a blog on the ONS website.

In the first instance this will be the results/statistics produced from the specific projects mentioned in the Objective for Processing:

• Association between adverse health events, NHS waiting lists and employment-related characteristics

The outputs will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.

Outputs are expected to continue throughout the duration of this DSA.

The statistics produced are expected to provide better evidence on the impact of health on labour market participation, and vice versa, to policy and decision makers at the stakeholder Government departments (Treasury, DHSC, DWP). They will then use this evidence as part of their decision making about policy development/change.

The mechanism by which these benefits could be achieved is as described – by providing better evidence to policy makers; this could affect decisions made about policy design, thereby changing (improving) relevant public/health service provision.

ONS has a wide range of stakeholders and partners in the health statistics arena beyond Government departments. For example, think tanks and charities. ONS will ensure all relevant partners are made aware of these statistics once produced. As noted in section 5c, the outputs may include blogs and social media for the general audience, as well as papers in academic journals aimed at the scientific community, which will assist in maximising reach.

The WLMDS has been used for both data quality assessment and exploratory analysis, contributing to research on the impact of waiting times on labour market outcomes. The publication looked at age standardised average monthly pay and percentage of people in paid employment, 12 months prior to and 60 months after hospital attendance for elective inpatient care for various treatment specialties, and the estimated impact on earnings and employment if waiting times were reduced to match the distribution observed in the most recent year when the waiting time target was met.

As the quality of the WLMDS continues to improve and a longer time series becomes available, the dataset will be used for future analyses to further understand of the impact of NHS waiting times.