Flag 4 -Latent TB Screening Portal and Database (LTBI)

The UK Health Security Agency (UKHSA), an executive agency of the Department of Health and Social Care (DHSC), requires access to NHS England Flag 4 data for the purpose of using Flag 4 data as a marker for recent inwards migration to England.

The National Latent TB (tuberculosis) Infection (LTBI) testing and treatment programme aims to systematically test and treat new migrants from high TB incidence areas. UKHSA has acquired appropriate approval to collect LTBI activity data including PII from primary and secondary care providers and laboratories.

TB is an infectious disease transmitted via the respiratory route. Following exposure the TB bacteria can also be dormant in asymptomatic persons as 'latent TB infection', LTBI. A number of persons will experience reactivation of LTBI resulting in TB disease. The aim of the LTBI testing and treatment program is to systematically diagnose and treat persons with latent TB to prevent reactivation into active TB by offering a course of antibiotics. Screening for LTBI was projected to be cost-saving to the NHS some years into the programme as such it is a fully NHS funded key intervention and part of the UKHSA / NHSE TB Action Plan. LTBI screening is a key intervention aiming to improve TB control with a reduction of TB incidence in England.

UKHSA will process Flag 4 data for the following uses:

• To serve as a baseline of population eligible for LTBI testing

• Enable knowledge more complete information about country of birth for those eligible for LTBI testing and treatment

• Support and monitor the UKHSA administered LTBI programme web portal and database

• Provide reports detailing LTBI test activity and LTBI positivity rates on a quarterly basis the NHSE and other scheduled or ad hoc reports as reasonably required under the Memorandum of Understanding (MOU) between the parties.

• Produce Flag 4 data reports to cascade to TB services and GP representatives who may use it to identify people eligible for LTBI testing and subsequently invite them for an LTBI test.

• Improve and optimise data reporting through engagement with providers.

• Produce quarterly, timely PDS patient data to providers.

• Conduct other epidemiological analysis mutually agreed under the MOU, where relevant.

In the event of an incident:

• Provide relevant situational awareness and a common operating picture (COP) to Government and other Category 1 responders; including but not limited to Briefing Notes, Situational Reports (Sitreps) or Cabinet Office for the Government's Common recognised Information Picture (CRIP), NSAC Daily Activity Report and other relevant reporting through Resilience Direct (RD)/ Central Alerting System (CAS).

• Conduct descriptive epidemiology to produce clear and comprehensive messaging that meets UKHSA’s obligations to warn and inform the public in an incident, in accordance with its statutory responsibilities under the Civil Contingency Act 2004 (CAA).

• Provide expert scientific advice and information to support public health interventions to protect life and prevent harm, including informed and impartial reporting of the hazard and risks.

The following NHS England Data will be accessed:

- Flag 4 data for all GPs in England - to identify an eligible population for testing under the LTBI programme and to monitor this public health intervention and evaluate the effectiveness of the programme to best practice in TB prevention.

Flag 4 data refers to the registration type (Flag 4) used when a person registers with a new GP and has entered the UK from overseas and has either never been a resident of the UK, or has previously been resident in the UK but has lived outside the UK for a period of 3 months.

The level of the Data will be

• Identifiable – necessary in order to deduplicate and link data from the different sources to complete the whole patient pathway as patients progress go through the programme. The majority of the LTBI testing is done in either GPs (primary care) or TB Services; samples sent to the laboratory and positive patients are referred to TB services (secondary care). Relevant data is collected from each part of the pathway from these three providers and can only be linked using identifiable Data.

The Data will be minimised as follows:

• The sampling frame will be limited to a cohort identified by NHS England as meeting the following criteria:

o All patients registered with a GP in England (identified using GENERAL MEDICAL PRACTICE CODE (PATIENT REGISTRATION))

o Assigned a Flag 4 code - i.e. individuals whose previous address was outside the UK;

o All patients who were age 16-65 where the registration falls in 2024

The lawful basis for processing personal data under the UK GDPR is:

Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

The lawful bases for processing special category data under the UK GDPR is:

Article 9(2)(i) - processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of domestic law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy domestic law;

UKHSA has approval from the Secretary of State for Health and Social Care to process confidential patient information under section 251 of the NHS Act 2006, as exercised through Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002. The purposes permitted under Regulation 3 include:

• 3(1)(a) diagnosing communicable diseases and other risks to public health - Flag 4 data is essential for identifying individuals at risk, which supports timely and appropriate public health interventions.

• 3(1)(b) recognising trends in such diseases and risks - Flag 4 data will be used by UKHSA for surveillance and epidemiological analysis of TB data to monitor disease patterns, detect emerging outbreaks, and assess risk factors, thereby supporting strategic public health planning.

• 3(1)(c) controlling and preventing the spread of such diseases and risks - Together with the NTBS, the Flag 4 data will underpin UKHSA’s statutory functions, including outbreak response, contact tracing, vaccination efforts, and targeted public health messaging, all of which are essential to interrupt transmission and safeguard population health.

These activities align directly with UKHSA’s legal mandate to protect health through the prevention, monitoring, and control of infectious disease threats, and they support broader efforts to reduce the burden of TB through improved diagnosis, treatment, and research-led innovation.

The funding is provided by DHSC and NHS England. The funding is specifically for the programme described.

DHSC is the controller as the organisation responsible for ensuring that the data will only be processed for the purpose described above. UKHSA is an executive agency of the DHSC. UKHSA is responsible for the operation and management of the programme.

All data and back ups will be stored on a database housed on a secure UKHSA server and penetration testing is performed annually.

Data will be accessed by substantive employees of UKHSA.

No data will flow to NHS England for the purposes of this Data Sharing Agreement (DSA).

NHS England will provide the relevant records from the Flag 4 dataset to UKHSA.

The Data will

• contain directly identifying data items including Names, NHS Number, Date of Birth, Postcode, Sex, Address, email address, telephone number which are required to link the Data at record level with data already held by UKHSA

The Flag 4 data will be cleaned and filtered by UKHSA to include only those who fit the current and or future programme eligibility, and further information is added such as ‘age at the time of registration’ and area code. These data are further cleaned using a Large Language Module AI programme developed with UKHSA for country of birth. No patient identifiable information is used in the process and TB Unit hold a dedicated SOP for this process.

This data is then disseminated to specified areas within the ICBs via encrypted, password protected nhs.net email accounts. The assigned recipients of the data under the NHSE TB control programmes then use this data to recruit eligible people for testing. In order to recruit people, they need addresses, phone numbers and emails.

The Data and backups will be stored on servers at UKHSA.

The Data will be accessed by authorised personnel via remote access.

The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.

For remote access:

- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;

- Access controls granting users the minimum level of access required are in place;

- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;

- Multifactor authentication (MFA) is required for remote access;

- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;

- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

Remote processing will be from secure locations within England. The data will not leave England at any time.

Access is restricted to employees of UKHSA who have authorisation from the head or Deputy (where appropriate) of the UKHSA TB Unit.

All personnel accessing the Data have been appropriately trained in data protection and confidentiality.

The Data will be linked at person record level with NTBS (National TB surveillance system) and pre-entry TB testing data processed by UKHSA (controlled by DHSC).

linking with NTBS allows for comparison for active TB notification. This allows for an assessment of opportunities of where an offer of testing may have been of benefit. Evaluating the program is improved through this linkage. Linkage also allows for clinical cases to confirm if testing had been successfully undertaken.

Confidential patient information will be processed on a need-to-know basis in line with the principle of least privilege. Analysis will be produced from pseudonymised extracts of the linked data and rendered functionally anonymised in line with ICO best practice and where relevant, published in accordance with the anonymisation plans set out in ISB1523.

The expected outputs of the processing will be:

• Contribution to TB Action plan proposal to ministers

• Internal reporting – such as business plan progress and reporting

• Potential analysis submissions to peer reviewed journals

The outputs will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.

The outputs will be communicated to relevant recipients through the following dissemination channels:

• Internal reports on progress against TB strategy

• Reports aimed at TB healthcare professionals

• Peer reviewed publication

The TB action plan draft is due to be submitted to ministers in July 2025.

The outputs from the data are expected to contribute to evidence-based decision-making for policy-makers to inform TB screening policy in order to better prevent, detect and respond to cases.

The use of the data could

• help the system to better understand the health and care needs of populations.

• lead to the identification or improvement of treatments or interventions, or health and care system design to improve health and care outcomes or experience.

• advance understanding of regional and national trends in health and social care needs.

• advance understanding of the need for, or effectiveness of, preventative health and care measures for migrant populations

• inform planning health services and programmes, for example to improve equity of access, experience and outcomes.

• inform decisions on how to effectively allocate and evaluate funding according to health needs.

• support knowledge creation or create cases for exploratory research

LTBI screening policy proposals aim to allow for earlier detection and treatment of latent TB in order to reduce chances of activation and subsequent disease progression.

Data will be used to directly influence policy making and examining strategies for reducing the burden of TB in England.

The national latent TB infection (LTBI) testing and treatment programme is an important evidence-based intervention, part of the “TB Action Plan for England, 2021 to 2026” written and published jointly by UKHSA and NHSE. The strategy aims to achieve a consistent year on year decrease in incidence, a reduction in health inequalities and eventually the elimination of TB as a public health issue in England. The programme aims to systematically test and treat new migrants aged 16-35 arriving from countries that have a TB incidence equivalent to or beyond 150 per 100,000 or if they are arriving from sub–Saharan Africa. Data will be used to directly influence policy making and examining strategies for reducing the burden of TB in England.

Yielded Benefits is not a requirement for new applications.