NHS Digital Data Release Register - reformatted
Astrazeneca Ab projects
57 data files in total were disseminated unsafely (information about files used safely is missing for TRE/"system access" projects).
DAPA MI — DARS-NIC-433176-J8Q2S
Type of data: information not disclosed for TRE projects
Opt outs honoured: No - consent provided by participants of research study, Anonymised - ICO Code Compliant, No, Identifiable (Consent (Reasonable Expectation))
Legal basis: Health and Social Care Act 2012 – s261(2)(c), Health and Social Care Act 2012 s261(2)(c)
Purposes: Yes (Research)
Sensitive: Non Sensitive, and Sensitive, and Non-Sensitive
When:DSA runs 2021-03-25 — 2022-03-24 2021.04 — 2023.07.
Access method: One-Off, Ongoing
Data-controller type: ASTRAZENECA AB
Sublicensing allowed: No
Datasets:
- NICOR Myocardial Ischaemia National Audit Project (MINAP)
- Civil Registration - Deaths
- Civil Registrations of Death
- NICOR Myocardial Ischaemia National Audit Project v10.3.2
Objectives:
Approximately 7 million individuals suffer a heart attack (myocardial infarction (MI)) annually, and survivors of MI remain at high risk for new major adverse cardiovascular (CV) events, including CV death and heart failure (HF). The development of HF following an MI is strongly associated with incapacitating symptoms, poor functional status, reduced health-related quality of life and unfavourable long-term prognosis. HF is also one of the leading causes of all hospital admissions, generating substantial costs for health care systems. Therefore, MI therapies that could prevent the development of HF as well as re-occurrence of major CV events represent a large and unmet medical need.
This study will evaluate the effect of dapagliflozin 10 mg versus placebo, given once daily, in addition to Standard of Care (SoC) therapies for patients with MI, for the prevention of hospitalisation for HF or CV death. The study seeks to determine dapagliflozin’s potential in the early prevention of serious complications, hospitalisations for HF or CV death, immediately following an MI.
This multi-centre clinical trial has been designed as a registry-based randomised controlled trial (R-RCT) which combines traditional study design elements within a pragmatic trial framework to provide high quality evidence on the potential benefit of dapagliflozin when administered in the early phase after MI. Traditional design elements such as randomisation and double blinding will minimise potential bias while the pragmatic and streamlined trial elements are expected to capture a broad MI population that will increase external validity and generalisability of study results and at the same time limit study burden on patients and investigators by usage of existing healthcare infrastructure and enabled by continuous clinical quality registries/clinical audits used in routine health care.
Ethics committee approval and patient consent:
The trial has been approved by the relevant Ethics Committees in the UK and Sweden. The subjects participating in this study will have provided informed consent for their data to be linked to the different national data bases. The patients have also consented to their data being transferred to Uppsala Clinical Research Center, Sweden, and on to NHS Digital for the purpose of this clinical trial. However, only pseudonymised data will be transferred to the trial database after the initial linkage necessary via the randomisation module.
Registry-based randomised controlled trial design:
The R-RCT contains a framework, which allows for randomisation and blinding and enables a pragmatic data collection using existing clinical registry data with readily available trial infrastructure facilitating data and endpoint collection. The study design is intended to ensure a robust yet streamlined trial capable of producing high-quality evidence of clinical effectiveness and safety.
This is a parallel group treatment study with 2 arms that is participant and investigator blinded. The patients admitted with MI will be consecutively screened for participation to achieve at least 6,400 randomly assigned to study intervention (3,200 from UK, 3,200 from Sweden).
The anticipated duration of the study is approximately 30 months with an estimated median treatment period for a patient of 21 months. The study closure procedures will be initiated when the predetermined number of primary endpoints are predicted to have occurred (n = 722) i.e., the primary analysis censoring date. The study duration may be changed if the event rate or randomisation rate is different than anticipated. The study may be terminated early if either a clear beneficial or harmful effect of the study treatment is detected during the Data Monitoring Committee review.
Randomisation and evaluation of subsequent CV events:
All participating patients will consent to their inclusion and the use of their data for the purposes of the trial. Following randomisation, NHS Digital will receive the NHS Number, Ecode (Study ID) and Inclusion Date for each consented patient on a twice-weekly basis from Uppsala Clinical Research Center (UCR). NHS Digital will then extract the relevant MINAP registry data for each consented patient and pass this securely to UCR where the complete electronic case record will be created for the trial. From this, the final data will be passed to the trial database (EntimeICE) held by AstraZeneca AB. No patient identifiable data is used in EntimeICE.
The study will utilise 2 high-quality national, population-based clinical registries:
(1) the Swedish Web-system for Enhancement and Development of Evidence-based care in Heart disease Evaluated According to Recommended Therapies (SWEDEHEART).
(2) the UK-based Myocardial Ischaemia National Audit Project (MINAP).
Patients will be recruited into the study at hospital level. For the purposes of this application, recruitment will take place in around 50 hospitals based in England. Once the patients have been randomised the study number/ Ecode will be generated and this will be entered into the study database, known as ‘EDC/MACRO’. Participating hospitals will follow patients up in accordance with Good Clinical Practice and identify and collect end-points and report adverse and serious adverse events.
With consent, patient identifiers (e.g. NHS Number) will be required for the randomisation/blinding process and subsequently for linkage purposes via NHS Digital with Hospital Episode Statistics (HES) and Civil Registrations of Death data to provide evidence of key CV end-points. In addition to MINAP, other National Cardiac Audit Programme domains, the National Audit of Percutaneous Coronary Intervention (NAPCI) and the National Adult Cardiac Surgery Audit (NACSA) will be interrogated to identify whether there is evidence that randomised patients have undergone subsequent percutaneous coronary intervention (PCI) and cardiac surgery during the designated follow-up period of the trial.
GDPR:
Article 6(1)(c) - processing of data in this clinical trial (for the protection of health) is that it is necessary for compliance with a legal obligation (Clinical Trial Regulations). Processing is necessary for fulfilling the legal obligations around on-going safety evaluation and safety reporting on medicinal products, for example, adverse events and reactions, in accordance with the following clinical trials regulations:
- EU Clinical Trials Regulation (EU 536/2014)
- EU Pharmacovigilance Regulation (EC 726/2004)
- Medicines for Human Use (Clinical Trials) Regulations 2004 and any other applicable law including UK laws and statutory instruments relating to clinical trials.
Article 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Processing personal data is necessary for AstraZeneca AB’s legitimate interests which are described in this application. The data to which access is requested are proportionate and necessary to achieve those interests. AstraZeneca AB is in the process of completing a legitimate interests assessment (LIA) and are satisfied that the interests of the data subjects do not override their legitimate interests; that they would reasonably expect the processing and it would not cause unjustified harm. The data subjects interests and fundamental rights are protected through appropriate minimisation of fields and patient records being processed; protection of the data in a secure environment, and guaranteeing secure destruction at any stage at the request of NHS Digital or after a defined period on completion of the project.
Article 9 (2) (i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy. This is justified as this clinical trial aims to drive improvements in the quality and safety of care and to improve treatment outcomes for patients.
Trial coordination:
The study is funded by AstraZeneca AB, which is the sole data controller for this agreement. It will be conducted in Sweden and in the United Kingdom (UK) - with 50 sites in each country. Trial conduct at each site will be monitored by AstraZeneca AB. The UK centres will be connected to the MINAP clinical audit and Swedish centres to the SWEDEHEART Registry. The recruitment period is planned for 18 months during which 6,400 patients will be randomised. The total trial period is planned for 30 months.
Uppsala Clinical Research Center (UCR) is the sole data processor for the trial. UCR is a non-profit academic research organization within Uppsala University and Uppsala University Hospital. UCR is also a National Clinical Quality Registry Center assigned by SALAR (Swedish Association of Local Authorities and Regions). In all its assignments UCR follows GDPR, the national supplement laws, The Data Protection Act and The Patient Data Act, and other regulations and guidelines in relation to Clinical Quality Registries and Research. The County Council of Uppsala (the public authority responsible for health care in the Uppsala Region, including Uppsala University Hospital) is the principal for all operations within UCR, including all aspects of Personal Data Protection and GDPR compliance, ensuring that all appropriate security arrangements are in place.
Under the EU's General Data Protection Regulation (EU/2016/679), each member state must designate an agency to be responsible for supervising the application of the regulation. This supervisory authority is to be fully independent in the performance of its duties and exercise of its authority. A corresponding authority is also to be designated in accordance with the EU's directive concerning data protection for law enforcement agencies (EU/2016/680). The Swedish government has designated the Swedish Data Protection Authority (DPA) to be the supervisory authority under the General Data Protection Regulation and the data protection directive. The Swedish DPA is also the supervisory authority under the Swedish law that is to supplement the General Data Protection Regulation, the Data Protection Act (2018:218). The Swedish DPA is also to monitor and describe developments in IT regarding issues concerning privacy and technology.
More information about the Swedish Data Protection Authority and it´s supervision can be found here https://www.datainspektionen.se/other-lang/. The DPA´s national registration number is 202100-0050.
SCORE is a UK management company contracted by AstraZeneca AB to act as a proxy for the payment of invoices relating to the work on the trial in the UK. SCORE will not have any access to any of the data within the trial or be a part of any decision-making in relation to the running of the trial.
No other organisations are involved in the trial, either in the running of it, the processing of the data, or in any other capacity.
Expected Benefits:
An internal report will be produced for the study. Submissions will be prepared for peer-reviewed publications, as well as for presentations at cardiovascular conferences.
Only study-level aggregate data will be reported with small number suppression where necessary.
Participating hospitals and patients will be informed of the results of the study.
Should enrolment and the expected clinical events occur as per the power calculation, the internal report would be expected by September 2024 and the main publication of the trial be expected by September 2025.
Should the trial results demonstrate a clinically important result in favour of the use of Dapagliflozin, the trial sponsor will submit appropriate applications to regulatory authorities to apply for a change in the indication for the clinical use of this drug. The results could also influence national and international guidelines on the optimal secondary preventive therapy to be offered to patients with a heart attack who have impaired left ventricular function.
Outputs:
An internal report will be produced for the study. Submissions will be prepared for peer-reviewed publications, as well as for presentations at cardiovascular conferences.
Only study-level aggregate data will be reported with small number suppression where necessary.
Participating hospitals and patients will be informed of the results of the study.
Should enrolment and the expected clinical events occur as per the power calculation, the internal report would be expected by September 2024 and the main publication of the trial be expected by September 2025.
Should the trial results demonstrate a clinically important result in favour of the use of Dapagliflozin, the trial sponsor will submit appropriate applications to regulatory authorities to apply for a change in the indication for the clinical use of this drug. The results could also influence national and international guidelines on the optimal secondary preventive therapy to be offered to patients with a heart attack who have impaired left ventricular function.
Processing:
Data will only be used for patients who have consented into the trial and enrolled according to the strict inclusion and exclusion criteria of the trial protocol. It is anticipated that the first patient will be enrolled in the UK in April 2021. Enrolment is planned for 18 months.
With consent, personally identifiable data will be used in the randomisation module at the hospital where patients are enrolled, which then provides the means to link to the MINAP registry. This will also be used to activate the process for prescription of trial drug or placebo. However, only pseudonymised data will be extracted to create the trial database known as EDC/MACRO, as managed by UCR in Sweden. Once the data is in EDC/MACRO no single person will be able to reverse the pseudonymisation process. Access to EDC/MACRO is limited to the Data Management team and access to the table that links the NHS-number and the pseudonymised Ecode is limited to the R-RCT development team. Therefore in order to reverse the pseudonymisation process will require a joint effort from at least two individuals from two different departments within UCR.
On a twice-weekly basis (Monday and Thursday), UCR will transfer the NHS Numbers, Ecodes and Inclusion Dates of all current members of the cohort to NHS Digital via secure transfer platform. NHS Digital will match the NHS numbers to their corresponding entries in the MINAP dataset, and link to the required data items from that dataset. NHS Digital will return only the Ecodes, along with the linked pseudonymised data, to UCR, who will update EDC/MACRO with this data. Any records that NHS Digital is unable to match within the MINAP registry will not be returned to UCR. This process will continue on a twice weekly basis until the 3,200 cohort members have been recruited, which is anticipated to take around 18 months.
The method of providing MINAP data to UCR for the entire cumulative DAPA MI cohort on each twice-weekly occasion, rather than only new and updated records, is based on the already implemented and reliably proven method used for the DAPA MI cohort recruited in Sweden:
• If UCR receives the whole dataset each time they can be certain that the latest data is always stored in the EDC/MACRO system.
• In case there is a problem with processing of the dataset, UCR know that the next dataset will contain all the data again, and any missing data in the EDC/MACRO system will be corrected without intervention.
• If there is a problem with the processing of a partial update, the data of that update would need to be resent before or included in the next update.
• Processing partial updates out of order is likely to cause invalid data to be stored in the EDC/MACRO system.
In addition to the linkage to the MINAP data (‘Registration Data’), the trial team also has a requirement to link the cohort to the following ‘Surveillance Data’:
• Civil Registrations of Deaths on a quarterly basis.
• HES data at time of study end.
• Other NCAP-based datasets (NACSA, NAPCI) at time of study end.
Linkage to all of these datasets is required to provide a comprehensive view on mortality and re-hospitalisation in order to identify the clinical end points of the trial. Due to the one year length of this agreement, the HES and further NCAP linkage will be covered under a later version of the agreement. The linkage to Civil Registration of Deaths will be covered via this application and once a quarter UCR will supply a separate version of the cohort including the extra field of Date of Birth alongside NHS Number and Ecode to aid in the linkage process.
All of the study data (Registration and Surveillance) are initially processed at Uppsala University, but stored in EDC/MACRO. Only substantive employees of UCR have the ability to access EDC/MACRO. EDC/MACRO is hosted by Rackspace UK, which provided housing for the data. No employees of Rackspace UK are able to access the data.
All processing is done on servers located in Uppsala University's server room in Uppsala. The server room is equipped with fire protection, backup power, climate control and strict entry check with personal cards and entrance logging.
UCR is part of Uppsala University and Region Uppsala/Uppsala University Hospital. For IT systems, UCR utilize their infrastructure with several server rooms and spare operations at the Swedish University of Agricultural Sciences (SLU). IT Operations are managed according to internal SOPs and Quality Requirements with ISO standards set by MSB (Swedish Civil Contingencies Agency).
The data in EDC/MACRO will be sent in pseudonymised form to AstraZeneca AB’s entimICE database via SFTP on a daily basis for analysis. EntimICE is a data storage area which has its physical database in Sweden. To be able to log into entimICE multiple training is required and it is only trained staff who will get access to the system. EntimICE users only get access to the specific project(s) they work with and they are not able to see the data for other projects.
There is also a hierarchy within the project which limits the data users can see. For example, the data managers within DAPA MI will only have access to the raw data area (which is the location the data is placed in during the conduct of the study) where data is uploaded. They will also have the possibility to aggregated share data with the data monitoring committee, via secured sFTP. The committee has a contract which describes their responsibilities and obligations in collaboration with AstraZeneca AB.
Once the database has been locked and the data are released to the Analysis and Reporting part of the system, multiple users are removed, such as data management, so only the users working with analysis and reporting have access to the data. The entimICE system and processes are built to limit the access to data and to protect the data collected for the study purpose. Only substantive employees of AstraZeneca AB will be able to access the data within entimICE.