NHS Digital Data Release Register - reformatted

Astrazeneca Uk Limited projects

167 data files in total were disseminated unsafely (information about files used safely is missing for TRE/"system access" projects).

Phase II/III Study of AZD2816, a Vaccine for the Prevention of COVID-19 in Adults — DARS-NIC-474218-V7G7L

Type of data: information not disclosed for TRE projects

Opt outs honoured: Identifiable

Legal basis: Health and Social Care Act 2012 – s261(2)(c)

Purposes: Yes (Commercial)

Sensitive: Non-Sensitive

When:DSA runs 2021-06-23 — 2022-06-22

Access method: One-Off

Data-controller type: ASTRAZENECA UK LIMITED

Sublicensing allowed: No

Datasets:

  1. Permission to Contact

Objectives:

This Data Sharing Agreement authorises the use of information voluntarily provided to NHS Digital by individuals who have given permission to be contacted about potential participation in COVID-19 vaccine clinical trials. The data will be processed on behalf of the data controller, AstraZeneca UK Limited, by NHS Digital as a data processor for the purpose of supporting recruitment to participate in a COVID-19 vaccine trial being run by AstraZeneca UK Limited.

The following provides background to the Permission to Contact (PtC) Service:

NHS Digital has agreed to work in partnership with the National Institute of Health Research (NIHR) to build and host a first of type online Permission to Contact (PtC) Service on nhs.uk where members of the public can register their details and give their permission to be contacted by researchers working on NIHR approved UK coronavirus vaccine trials about participating in those trials. This PtC Service, which is called “Sign Up to be Contacted about Coronavirus Vaccine Studies” on the nhs.uk website was launched as a national service on 20th July 2020.

This Service enables participants to:
• Provide permission for NHS Digital to share an individual’s details provided through the Service with the researchers undertaking COVID-19 UK vaccine trials for the purposes of researchers contacting that individual about taking part in those trials.
• Provide their permission to be contacted by NHS Digital about progress and outcomes from CV19 vaccine studies and in relation to the development of the PtC Service, including to inform them of opportunities to participate in other types of health research.

The data collected from individuals who sign up includes sufficient information to achieve the following purposes:
• Matching potentially eligible participants to eligibility criteria provided by the vaccine trials for their specific studies. This data will comprise of age, sex, geographic locations, type of employment, and a number health question e.g. about whether they have long-term health conditions.
• Providing relevant details of potentially eligible participants which have been obtained through the Service to researchers. This will allow the researchers to contact the participants with a view to discussing their taking part in a trial and if so, to obtain their further permission to take part in the trial.
• NHS Digital will provide access to the information obtained from individuals through the Service via the existing Data Access Request Service (DARS) process available to researchers working on UK COVID-19 vaccine trials sponsored by the National Institute of Health Research. The Service will only provide researchers with the data collected directly from individuals themselves through the Service.

The contact details will be used to invite potentially eligible individuals to undertake an eligibility assessment and, if eligible, to give informed consent to participate in this trial. NHS Digital, as data processor acting on behalf of AstraZeneca UK Limited, will be sending the email to eligible participants.

This request relates specifically to a vaccine trial.

Recently, several variants of the SARS-CoV-2 virus with increased transmissibility have emerged, including B.1.1.7, first identified in the UK, P.1, first identified in Brazil, and B.1.351, first identified in South Africa. In an ongoing clinical trial of AZD1222 in South Africa, interim results failed to show protection against mild to moderate disease caused by the B.1.351 variant; protection against severe disease could not be determined as no severe cases were identified.

Based on available evidence about vaccine effectiveness and molecular epidemiology of emerging variants, B.1.351 is estimated to have a potential to escape vaccine-induced immunity. B.1.351 carries sequence mutations in common with other variants of concerns; immunity to B.1.351 therefore has the potential to provide some cross-immunity against other emerging strains. Development of candidate vaccines that include the B.1.351 S-protein variant is underway. AstraZeneca is developing AZD2816, a vaccine against the B.1.351 SARS-CoV-2 variant using the same ChAdOx1 platform and manufacturing processes used for AstraZeneca’s currently available COVD-19 vaccine, AZD1222.

The trial is aiming to recruit 900 volunteers. The initial mailout will aim for around four / five times the number of potential participants to be recruited and therefore the estimate is for around 4,500 individuals to be contacted.

The data will be used in support of the development of a commercial vaccine that, should the research prove successful, will generate income for AstraZeneca UK Limited to cover both the development costs of the vaccine and also generate profit for that organisation.

Expected Benefits:

The primary benefit of using the data will be to recruit participants for the clinical study/trial in a manner which:
• Enables individuals to volunteer in advance to participate in COVID-19 vaccine trials as an alternative to other potentially more intrusive mechanisms, e.g. sharing data with researchers about individuals under section 251 consents or COPI notices, which although lawful is initially less transparent.
• Allows researchers to identify a suitable cohort and recruit them quickly into the vaccine trials – thus reducing the overall time to recruit into the trials and to accelerate the delivery of an effective vaccine to treat individuals to manage the COVID-19 outbreak and to save lives.
• Reduces burden on research staff in identifying and contacting potential clinical trial participants.
• Supports the Vaccines Taskforce objectives to drive forward, expedite and coordinate efforts to research and then produce a coronavirus vaccine and make sure one is made available to the public as quickly as possible.

Outputs:

The information from NHS Digital will be used to facilitate contact with individuals who are potentially eligible and who have indicated willingness to potentially participate in studies/trials of COVID-19 vaccines.

This is expected to result in individuals entering the trials screening process with a view to them participating in the trial with fully informed consent.

The main results from this trial are expected to inform development of a safe and effective multiple vaccine combination against COVID 19.

Real-world effectiveness of the Oxford/AstraZeneca covid-19 vaccine in England - TRE Analysis — DARS-NIC-445543-W0D4N

Type of data: information not disclosed for TRE projects

Opt outs honoured: Anonymised - ICO Code Compliant, Identifiable (Does not include the flow of confidential data)

Legal basis: Health and Social Care Act 2012 - s261 - 'Other dissemination of information', Health and Social Care Act 2012 – s261(2)(b)(ii), Health and Social Care Act 2012 – s261(2)(a)

Purposes: Yes (Commercial)

Sensitive: Sensitive, and Non-Sensitive

When:DSA runs 2021-07-01 — 2022-06-30 2021.11 — 2024.09.

Access method: System Access
(System access exclusively means data was not disseminated, but was accessed under supervision on NHS Digital's systems)

Data-controller type: ASTRAZENECA UK LIMITED, UNIVERSITY OF OXFORD

Sublicensing allowed: No

Datasets:

  1. Civil Registration - Deaths
  2. COVID-19 Second Generation Surveillance System
  3. Covid-19 UK Non-hospital Antibody Testing Results (Pillar 3)
  4. Covid-19 UK Non-hospital Antigen Testing Results (pillar 2)
  5. COVID-19 Vaccination Status
  6. GPES Data for Pandemic Planning and Research (COVID-19)
  7. Hospital Episode Statistics Admitted Patient Care
  8. Hospital Episode Statistics Critical Care
  9. Uncurated Low Latency Hospital Data Sets - Admitted Patient Care
  10. COVID-19 Vaccination Adverse Reactions
  11. HES:Civil Registration (Deaths) bridge
  12. Uncurated Low Latency Hospital Data Sets - Outpatient
  13. Civil Registrations of Death
  14. COVID-19 General Practice Extraction Service (GPES) Data for Pandemic Planning and Research (GDPPR)
  15. COVID-19 Second Generation Surveillance System (SGSS)
  16. COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2)
  17. Hospital Episode Statistics Admitted Patient Care (HES APC)
  18. Hospital Episode Statistics Critical Care (HES Critical Care)
  19. COVID-19 SGSS First Positives (Second Generation Surveillance System)

Objectives:

The objective for processing the requested data is to support delivery of a real-world effectiveness study for COVID-19 vaccines in England. The primary objective of this study is the assess the real world effectiveness of the Oxford/AstraZeneca COVID-19 vaccine among people who receive one dose of the vaccine, overall and by age group and time period after 1 dose. The secondary objective of the study would be to: a) assess the vaccine effectiveness in people who have received the two doses; the timing after the 1st and 2nd dose , interval between the two doses and comorbidity status b) replicate the above analyses in people receiving the Pfizer COVID-19 vaccine as opposed to the Oxford/AstraZeneca vaccine.

Access to the data requested in this agreement will be via the NHS Digital Trusted Research Environment (TRE). No record level data will leave NHS Digital.

The study team's primary age of interest are people 16 years or older who are currently scheduled to receive the vaccine. Age for the purpose of this study is their age on 31st March 2021 - the index data selected in the UK by the Joint Committee for Vaccination and Immunisation (JCVI). However the study also wish to look at data for all ages reasons for this are detailed below;

• Vaccination may occur before an individual’s 16th birthday. Additionally, the study team require baseline data and all the available medial history for vaccines, but also for to examine their comparability among comparison groups. The study team therefore required their lifelong medical data. This may date from before their vaccination date.
• Also, levels of community infection impacts of vaccine effectiveness. The study team need to have some indication of the extent to which vaccines have been exposed to community infection.
• Vaccination age has been extended to children and young people age 12 to 15 years old with comorbidities, or for all children and young adults age 12 to 17 years old. Childhood vaccination is taking place internationally and is now authorised in Europe and the United States – generally from ages 12 to 17 years old.
• Models of vaccine effectiveness need to include information about household size and population levels of disease. Larger households have a higher risk of infection and high levels of childhood infection in a locality are associated with a population-wide increased number of cases.

In addition to the above processing activities, the NHS Digital Data Production team have been asked to develop and apply a household key to enable the analysts to establish potential household transmission. For this purpose each individual's address will be used to link individuals to a household. A new work request will be initiated to define and scope the development required to deliver this key if and when approved this will be delivered into the NHS Digital TRE environment. An amendment to this agreement would be required to ensure that the appropriate approvals have been sought for this and that the field is then added to the agreement.

The pseudonymised datasets requested in this application for access in the NHS Digital TRE are as follows:

Hospital Episode Statistics (HES) Admitted Patient Care (APC) (2019/20 to latest provisional data)
Hospital Episode Statistics Critical Care (CC) (2019/20 to latest provisional data)
Civil Registration - Deaths (March 2020 to latest available)
COVID-19 Second Generation Surveillance System (SGSS) (April 2020 to latest available)
COVID-19 UK Non-hospital Antibody Testing Results (Pillar 3) (September 2020 to latest available)
COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2) (April 2020 to latest available)
COVID-19 Vaccination Status (December 2020 to latest available)
GPES Data for Pandemic Planning and Research (COVID-19) (latest available)
Uncurated Low Latency Hospital Data Set - Admitted Patient Care (2019/20 to latest provisional data)

The size of the cohort will be every citizen registered with a GP practice in England who have not registered a Type 1 opt-out.

These datasets are required to adequately define a cohort of vaccinated and unvaccinated patients and to assess relevant demographic clinical characteristics, exposures and outcomes to robustly match patients and to assess the study outcomes.

Data will be pseudonymised record-level data to allow linkage across datasets and patient-level analysis. Outputs of the study will be aggregated and suppressed according to disclosure rules of each data set.

The datasets are also being requested as an extract to flow to University of Oxford under data sharing agreement DARS-NIC-459114-J3C1F to be linked to the data in the University of Oxford trusted research environment to develop analysis code and algorithms for analyses in a smaller cohort to which they will be linked, prior to these analysis code (epidemiological[a] models) and algorithms (ontological[b] algorithms for case identification[c]) being deployed in the national level data.

[a] relating to the branch of medicine which deals with the incidence, distribution, and control of diseases.
[b] showing the relations between the concepts and categories in a subject area or domain.
[c] timely disease notification is an essential first step in initiating infectious disease case management.

DATA CONTROLLERS AND PROCESSORS
The University of Oxford are Joint Data Controllers with AstraZeneca UK Limited (also known as AstraZeneca Global). The data will only be processed by University of Oxford and by Momentum Data. University of Oxford have subcontracted a part of the analysis to Momentum Data who will solely be acting as data processors on the instructions from University of Oxford and AstraZeneca UK Limited.

LEGAL BASIS
The lawful basis for processing data under GDPR has been reviewed and been assessed as acceptable. The University of Oxford process data under Article 6(1)(e): "processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller" as they are a Public Authority.

AstraZeneca UK Limited process data under Article 6(1)(f): “Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)”

Additionally, the University of Oxford and AstraZeneca UK Limited process the Special Category Health Data under Article 9(2)(j): "processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject" as the data are required for research purposes in the public interest.

COMMERCIAL PURPOSE
AstraZeneca is a co-partner with the University of Oxford in the development, manufacture and supply of the Oxford AstraZeneca COVID-19 Vaccine.

The studies are not conducted with the intention of generating profit. The primary focus will be on developing a further understanding of the efficacy and safety of the vaccines being administered globally. Results of the studies will improve the confidence of the vaccines and increase uptake of the vaccine.

Expected Benefits:

The vaccine has been proven to be effective in trials thus far, this study is now necessary to conclude on a scientific basis how and to what extent this is effective in real world terms. Demonstrating effectiveness of the UK vaccination programme is in the public interest and successful implementation of the government roll-out strategy is critical to gaining control of the COVID-19 pandemic.

The anticipated benefit expected from processing the data is to demonstrate the effectiveness of the COVID-19 vaccines and the UK vaccine roll-out in the adult population in England. Understanding of this effectiveness is expected to benefit citizens, healthcare professionals (HCPs), government and policy makers, vaccine manufacturers and researchers. AstraZeneca and University of Oxford specifically would get confirmation of the effectiveness of the Oxford-AstraZeneca vaccine which will grow confidence in the product and support strategic decision-making in the future. Citizens and HCPs are hoped to benefit from evidence that will grow confidence in the vaccines, supporting vaccine uptake, and identifying sub groups of patients in whom the vaccines show greatest effect. Government and Policy makers are hoped to gain benefit from the evidence which will demonstrate the effectiveness of the vaccine roll-out plan with regards to staggered age groups and vulnerable groups.

In just over 12 months, Oxford-AstraZeneca have developed a vaccine that is highly effective against all severities of COVID-19, and more than 500 million doses of the vaccine have been released for supply to 165 countries and it has helped save tens of thousands of lives since the start of the year. Whilst development has moved at pace the scientific rigor and safety standards have remained. Safety of the medicines is paramount both during clinical development and once approved for use.

Real world data are critical to understanding the benefit-risk of COVID-19 vaccines and their effectiveness in clinical practice. With the rapid and massive deployment of COVID-19 vaccines, routine spontaneous safety event reporting systems have captured precedented and unprecedented adverse events of special interest, which require further corroboration of association and causality assessment. Simultaneously, effectiveness needs to be established with the real-world administration regimes, especially for those vaccines with two doses for a range of outcomes and use across different demographics.

This study hopes to inform global use of the effectiveness of a first and second dose of COVID-19 Vaccine AstraZeneca and evaluate safety signals alongside other COVID-19 vaccines.

The benefits Oxford-AstraZeneca hope will be identified for the various stakeholders are important. Evidence that helps to grow public confidence in vaccine effectiveness is highly important to minimize vaccine hesitancy and increase uptake of vaccine to help bring an end to the pandemic. With the UK being one of the first countries globally to have widespread vaccination Oxford-AstraZeneca are in a fairly unique position to be able to generate this evidence on a national level.

This is on top of the health and emotional benefits to citizens gained through avoidance of severe COVID disease.

Outputs:

Aggregated results tables (before and after matching) including:
Summary baseline characteristics of population (demographics, comorbidities, other relevant treatments)
Vaccination information (Vaccine received, dose number, when received)
COVID-19 outcomes (hospitalisation, critical care, mortality associated with COVID-19 infection)
All cause outcomes (hospitalisation, critical care, mortality for any reason)

Small numbers will be supressed as required following standard statistical disclosure control methods.

1st Interim analysis (after 1st dose) - Target date: July 2021*
2nd interim analysis - Target date: September 2021
Final analysis (including patients receiving 2nd dose) – November 2021

The study team are planning to disseminate findings immediately after conducting the analysis, Therefore, the analysis target date will be dependent on the date data will be supplied by NHS Digital.

Publication of results is expected in conference presentations and peer-reviewed journals. Results will be communicated transparently and to relevant audiences (researchers, clinicians, policy makers, general public) at interim and final analyses to ensure knowledge developed by the research can benefit the health system and the general public.

Reporting of results will be done in a transparent manner and analytical code will be available on request. This will allow demonstrating reproducibility and validity of the analytical methods used. No unnecessary suppression of results in reporting will be applied. No unnecessary suppression of results in reporting would be applied. All outputs from this research will be published (not just positive outcomes for any particular vaccine) thus ensuring that any “unfavourable” results will not be supressed and will be given equal prominence and widespread dissemination, given the other vaccines being studied.

Processing:

No record level data will be extracted out of NHS Digital under this Data Sharing Agreement. Only aggregated data with small number suppression applied as per the relevant data set disclosure rules will be extracted out of the TRE under this Data Sharing Agreement (DSA). All processing will be conducted within the NHS Digital Trusted Research Environment (TRE) by University of Oxford and Momentum Data substantive employees who are appropriately qualified and trained in data protection and confidentiality. No identifiable data items will be accessed by either the Data Controller or Data Processor for the purpose of processing these data. No attempt will be made to reidentify individuals.

Under this Agreement, substantive employees of the University of Oxford and Momentum Data will use the Trusted Research Environment (TRE) service for England to enable analyses of linked, nationally collated healthcare datasets to enumerate the impact of the COVID-19 vaccination programme on the population of England.

Individually authorised analysts employed by University of Oxford and Momentum Data will be granted remote secure access to the Trusted Research Environment (TRE) within NHS Digital’s data platform, the Data Processing Service (DPS).

Within the TRE, the analysts will be able to access pseudonymised linked data only from the datasets outlined above. No data which directly identify data subjects, such as names, NHS Numbers, etc., will be accessible within the TRE.

Analysts will be authorised to access only the data they are permitted to see under this agreement and can utilise a variety of analytical tools available within the TRE platform.

Only summary, aggregate results data (data will be aggregated with small numbers suppressed in line with the relevant data set disclosure rules) will be exported from the TRE and this will be subject to review and approval by the NHS Digital team providing the TRE. The objective of this will be to ensure that no output contains information which could be used either on its own or in conjunction with other data to breach an individual's privacy.

Processing activities will include:
Provision of data products in the NHS Digital TRE Environment by NHS Digital Staff
Linkage of data products at a patient record level
Creation of analytical dataset and study variables
Statistical analysis and modelling
Creation of final outputs and results tables

Amazon Web Services is, strictly, a data processor in the sense that NHS Digital data are hosted and manipulated on their infrastructure. By design, AWS themselves cannot access or read any of the NHS Digital data in the TRE that are hosted on their infrastructure, nor can anyone else who is not specifically granted individual access to NHS Digital data via a data sharing agreement. Therefore, any access to the data held under this agreement would be considered a breach of the agreement. This includes granting of access to the database[s] containing the data.

Amazon Web Services UK are compliant with standard security frameworks, including ISO 9001, 27001, 27017, 27018; the Cloud Security Alliance certification and UK Cyber Essentials Plus. Amazon Web Services will only be storing NHS Digital data on UK based servers.

DISCLOSURE CONTROL RULES AND SMALL NUMBER SUPPRESSION
For GPES Data for Pandemic Planning and Research (COVID-19) - Whilst there are no specific GDPPR disclosure controls, outputs for public consumption should follow the Government (ONS) Statistical Service disclosure controls. NHS Digital recommend that users review and follow the disclosure control guidelines as set out within the HES Analysis Guide. Some, but not all requirements are outlined below:
Disclosure control only needs to be applied to values relating to individuals. No rounding or suppression is required for values not relating to individuals, such as a count of providers.
No small number suppression is required for national totals.
For any sub national geographies e.g. NHS Commissioning Region / Government Office Region or smaller, then the following apply:
• Zeroes can be shown.
• Values between 1-7 to be displayed as “*”.
• Any other numbers rounded to nearest 5.
• Percentages calculated from rounded values

For HES and Mortality data - In order to protect patient confidentiality, when presenting results calculated from HES record level data, outputs will contain only aggregate level data with small numbers suppressed in line with HES Analysis Guide. When publishing HES data, you must make sure that:
· cell values from 1 to 7 are suppressed at a local level to prevent possible identification of individuals from small counts within the table.
· Zeros (0) do not need to be suppressed.
· All other counts will be rounded to the nearest 5.
Data will not be made available to any third parties other than those specified except in the form of aggregated outputs with small numbers suppressed in line with the HES Analysis Guide.

For COVID-19 Second Generation Surveillance System (SGSS), COVID-19 UK Non-hospital Antibody Testing Results (Pillar 3), COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2) and the Vaccination data - As standard, all disseminations for these data set will adhere to the following business rules, as agreed with the IAO, on top of normal exclusion criteria:
1. Always filter the extract to be England only. This should be applied using the subjects home postcode, or country (if derived from subjects home postcode)**
2. Exclude any record that includes Organisation type = PRI – Prison will be excluded [Cant be applied to sgss]
3. Exclude any record that includes “justice” in the email address (emailaddress and/or MPSemailaddress)
4. Exclude any record that has “mpsgpcode” or “gpcode” = “A91” [Military GP code] [Cant be applied to sgss]
5. Exclude any record that has a British armed forces postcode, these start with BF (postcode and/or MPSpostcode]
6. Exclude contact details (P2_Landline / LandlineNumber, P2_mobile / MobileNumber and/or MPSMobileNumber, P2_email / EmailAddress and/or MPSEmailAddress) where the following criteria apply:
a. TestCentreID = “CHO” or “PRI” OR OrganisationType = “CHO” or “PRI” AND OrganisationRole = “resident” [Can't be applied to sgss]
Or
b. care_home = xxxxx [Can't be applied to the National Pathology Exchange system (Npex)]
7. ODS location code - Filter out the following site codes: 'XUL', 'XXA', 'XBN', 'XYL', 'YIM', 'XPJ' ; Exclude the following test centre postcodes - 'G84 8HL', 'PO1 3NH', 'GL7 5RD' [Can't be applied to Npex]

PROVENT - A Phase III Randomized, Double-blind, Placebo-controlled, Multi-center Study in Adults to Determine the Safety and Efficacy of AZD7442, a Combination Product of Two Monoclonal Antibodies (AZD8895 and AZD1061), for Pre-exposure Prophylaxis of COVID-19 — DARS-NIC-409290-L1F3L

Type of data: information not disclosed for TRE projects

Opt outs honoured: Identifiable (Consent (Reasonable Expectation))

Legal basis: Health and Social Care Act 2012 – s261(2)(c)

Purposes: Yes (Commercial)

Sensitive: Non-Sensitive

When:DSA runs 2020-10-22 — 2021-03-31

Access method: One-Off

Data-controller type: ASTRAZENECA UK LIMITED

Sublicensing allowed: No

Datasets:

  1. Permission to Contact

Expected Benefits:

The primary benefit of using the data will be to recruit participants for the clinical study/trial in a manner which:
• Enables individuals to volunteer in advance to participate in COVID-19 vaccine trials as an alternative to other potentially more intrusive mechanisms, e.g. sharing data with researchers about individuals under section 251 consents or COPI notices, which although lawful is initially less transparent.
• Allows researchers to identify a suitable cohort and recruit them quickly into the vaccine trials – thus reducing the overall time to recruit into the trials and to accelerate the delivery of an effective vaccine to treat individuals to manage the COVID-19 outbreak and to save lives.
• Reduces burden on research staff in identifying and contacting potential clinical trial participants.
• Supports the Vaccines Taskforce objectives to drive forward, expedite and coordinate efforts to research and then produce a coronavirus vaccine and make sure one is made available to the public as quickly as possible.

Outputs:

The information from NHS Digital will be used to facilitate contact with individuals who are potentially eligible and who have indicated willingness to potentially participate in studies/trials of COVID-19 vaccines.

This is expected to result in individuals entering the trials screening process with a view to them participating, with fully informed consent, in the Investigating a Vaccine Against COVID-19 study.

The main trial results of Investigating a Vaccine Against COVID-19 study are expected to inform development of a safe and effective vaccine against COVID 19.

Real-world effectiveness and safety of the Oxford/AstraZeneca covid-19 vaccine in England: ORCHID linkage — DARS-NIC-459114-J3C1F

Type of data: information not disclosed for TRE projects

Opt outs honoured: Anonymised - ICO Code Compliant, No, Identifiable (Does not include the flow of confidential data)

Legal basis: Health and Social Care Act 2012 - s261 - 'Other dissemination of information', Health and Social Care Act 2012 – s261(2)(b)(ii), Health and Social Care Act 2012 – s261(2)(a)

Purposes: Yes (Commercial)

Sensitive: Sensitive, and Non-Sensitive

When:DSA runs 2021-07-01 — 2022-06-30 2021.08 — 2022.12.

Access method: One-Off, Ongoing

Data-controller type: ASTRAZENECA UK LIMITED, UNIVERSITY OF OXFORD

Sublicensing allowed: No

Datasets:

  1. Civil Registration - Deaths
  2. COVID-19 Second Generation Surveillance System
  3. Covid-19 UK Non-hospital Antibody Testing Results (Pillar 3)
  4. Covid-19 UK Non-hospital Antigen Testing Results (pillar 2)
  5. COVID-19 Vaccination Status
  6. HES-ID to MPS-ID HES Admitted Patient Care
  7. Hospital Episode Statistics Admitted Patient Care
  8. Hospital Episode Statistics Critical Care
  9. COVID-19 Vaccination Adverse Reactions
  10. Emergency Care Data Set (ECDS)
  11. HES:Civil Registration (Deaths) bridge
  12. HES-ID to MPS-ID HES Critical Care
  13. Hospital Episode Statistics Outpatients
  14. Secondary Uses Service Payment By Results Episodes
  15. Secondary Uses Service Payment By Results Spells
  16. Civil Registrations of Death
  17. COVID-19 Second Generation Surveillance System (SGSS)
  18. COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2)
  19. Hospital Episode Statistics Admitted Patient Care (HES APC)
  20. Hospital Episode Statistics Critical Care (HES Critical Care)
  21. Hospital Episode Statistics Outpatients (HES OP)
  22. COVID-19 SGSS First Positives (Second Generation Surveillance System)

Objectives:

The objective for processing the requested data is to support delivery of a real-world effectiveness study for COVID-19 vaccines in England. The primary objective of this study is the assess the real world effectiveness of the Oxford/AstraZeneca COVID-19 vaccine among people who receive one dose of the vaccine, overall and by age group and time period after 1 dose. The secondary objective of the study would be to: a) assess the vaccine effectiveness in people who have received the two doses; the timing after the 1st and 2nd dose , interval between the two doses and comorbidity status b) replicate the above analyses in people receiving the Pfizer COVID-19 vaccine as opposed to the Oxford/AstraZeneca vaccine.

The requested datasets will be used to develop analysis code and algorithms for analyses in a smaller cohort to which they will be linked, prior to these analysis code (epidemiological models) and algorithms (ontological algorithms for case identification) being deployed in the national level data within the NHS Digital Trusted Research Environment (TRE) under data sharing agreement DARS-NIC-445543-W0D4N.

The requested datasets will feed as an extract into the Oxford-Royal College of General Practitioners Clinical Informatics Digital Hub’s (ORCHID) Trusted Research Environment (TRE). The University of Oxford team run the national primary care surveillance system – The Oxford-Royal College of General Practitioners Research and Surveillance Centre (RSC). This surveillance system is sponsored by Public Health England (PHE) and collaborates in reporting vaccine uptake and effectiveness, including of COVID-19 vaccine. It obtains a refresh of data either daily or twice weekly and maintains a good level of data quality as a result. The team are also able to validate the analysis against the PHE data and other projects that include adverse events of interests associated to COVID-19 vaccines. Validation of the analyses would be beneficial to the team prior to commencing analyses within the NHS Digital TRE. Furthermore, the data within ORCHID is granular and the team have the ability to curate more variables in order to answer the research questions especially for adverse events of interests.

Pseudonymised patient data is extracted from over 19,000 GP practices on a weekly basis to create the ORCHID database which is used for surveillance activities. The same pseudonymisation algorithm will be applied to all data involved in this study so the researchers can draw scientific conclusions for a study population.

The requested datasets are as follows:
Hospital Episode Statistics Admitted Patient Care
Hospital Episode Statistics Critical Care
Civil Registration - Deaths
COVID-19 Second Generation Surveillance System
COVID-19 UK Non-hospital Antibody Testing Results (Pillar 3)
COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2)
COVID-19 Vaccination Status

All the above requested data sets will enable the assessment of hospitalisation, ICU admission, and death as the primary outcomes of the study. Analyses could include the association of the vaccine to hospitalisation.

Data requested will be three drops of pseudonymised recorded-level extracts from the above data sets for the period April 2019 through to most recent period available for each dataset (at time of each data drop) linked to a cohort of approximately 25 million patients submitted (on three occasions) to NHS Digital by the University of Oxford.

For the purpose of this study, although the study team are requesting data from individuals of all ages, the analyses will consider all individuals 16 years and over. The purpose of requesting data from individuals under 16 years of age is due to the ascertain household transmission and population levels of the disease. The data held by Oxford already incudes a household key which is pseudonymised and held with the cohort data.

In order to be able to understand real-world vaccine effectiveness, three extracts of the requested data is required. One as soon as the agreement is active, one in October/ November 2021 and one in December 2021 / January 2022. This is so that detailed analyses around the effects of single and/or double doses can be established.

The study team's primary age of interest are people 16 years or older who are currently scheduled to receive the vaccine. Age for the purpose of this study is their age on 31st March 2021 - the index data selected in the UK by the Joint Committee for Vaccination and Immunisation (JCVI). However the study also wish to look at data for all ages reasons for this are detailed below:

• Vaccination may occur before an individual’s 16th birthday. Additionally, the study team require baseline data and all the available medial history for vaccines, but also for to examine their comparability among comparison groups. The study team hence required their lifelong medical data. This may date from before their vaccination date.
• Also, levels of community infection impacts of vaccine effectiveness. The study team need to have some indication of the extent to which vaccines have been exposed to community infection.
• Vaccination age has been extended to children and young people age 12 to 15 years old with comorbidities, or for all children and young adults age 12 to 17 years old. Childhood vaccination is taking place internationally and is now authorised in Europe and the United States – generally from ages 12 to 17 years old.
• Models of vaccine effectiveness need to include information about household size and population levels of disease. Larger households have a higher risk of infection and high levels of childhood infection in a locality are associated with a population-wide increased number of cases.

DATA CONTROLLERS AND PROCESSORS
The University of Oxford are Joint Data Controllers with AstraZeneca Limited UK (also known as AstraZeneca Global). The data will only be processed by University of Oxford and by Momentum Data. University of Oxford have subcontracted a part of the analysis to Momentum Data who will be acting as data processors on the instructions from University of Oxford and AstraZeneca UK Limited.

The Royal College of General Practitioners (RCGP) hold a contract with University of Oxford to run and manage the RCGP surveillance centre. The data within that environment is controlled by the RCGP for the surveillance work carried out. The use of the data for research purposes is controlled by the University of Oxford. The RCGP are informed of research activity but do not make any decisions about the means by which the data are processed for any research programmes. The RCGP are therefore not a controller on this agreement.

LEGAL BASIS
The lawful basis for processing data under GDPR has been reviewed and been assessed as acceptable. The University of Oxford process data under Article 6(1)(e): "processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller" as they are a Public Authority.

AstraZeneca UK Limited process data under Article 6(1)(f): “Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)”

Additionally, the University of Oxford and AstraZeneca UK Limited process the Special Category Health Data under Article 9(2)(j): "processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject" as the data are required for research purposes in the public interest.

COMMERCIAL PURPOSE
AstraZeneca is a co-partner with the University of Oxford in the development, manufacture and supply of the Oxford AstraZeneca COVID-19 Vaccine.

The studies are not conducted with the intention of generating profit. The primary focus will be on developing a further understanding of the efficacy and safety of the vaccines being administered globally. Results of the studies will improve the confidence of the vaccines and increase uptake of the vaccine.

Expected Benefits:

The vaccine has been proven to be effective in trials, this study is now necessary to conclude on a scientific basis how and to what extent this is effective in real world terms. Demonstrating effectiveness of the UK vaccination programme is in the public interest and successful implementation of the government roll-out strategy is critical to gaining control of the COVID-19 pandemic.

The anticipated benefit expected from processing the data is to demonstrate the effectiveness of the COVID-19 vaccines and the UK vaccine roll-out in the adult population in England. Understanding of this effectiveness is greatly hoped to benefit citizens, healthcare professionals (HCPs), government and policy makers, vaccine manufacturers and researchers. AstraZeneca and University of Oxford specifically would get confirmation of the effectiveness of the Oxford-AstraZeneca vaccine which they hope will grow confidence in the product and support strategic decision-making in the future. Citizens and HCPs are hoped to benefit from evidence that will grow confidence in the vaccines, supporting vaccine uptake, and identifying sub groups of patients in whom the vaccines show greatest effect. Government and Policy makers are hoped to gain benefit from the evidence which will demonstrate the effectiveness of the vaccine roll-out plan with regards to staggered age groups and vulnerable groups.

In just over 12 months, AstraZeneca/University of Oxford have developed a vaccine that is highly effective against all severities of COVID-19, and more than 500 million doses of the vaccine have been released for supply to 165 countries and it has helped save tens of thousands of lives since the start of the year. Whilst development has moved at pace the scientific rigor and safety standards have remained. Safety of AstraZeneca medicines is paramount both during clinical development and once approved for use.

Real world data are critical to understanding the benefit-risk of COVID-19 vaccines and their effectiveness in clinical practice. With the rapid and massive deployment of COVID-19 vaccines, routine spontaneous safety event reporting systems have captured precedented and unprecedented adverse events of special interest, which require further corroboration of association and causality assessment. Simultaneously, effectiveness needs to be established with the real-world administration regimes, especially for those vaccines with two doses for a range of outcomes and use across different demographics.

This study hopes to inform global use of the effectiveness of a first and second dose of COVID-19 Vaccine AstraZeneca and evaluate safety signals alongside other COVID-19 vaccines.

The benefits are hoped to be identified for the various stakeholders are important. Evidence that helps to grow public confidence in vaccine effectiveness is highly important to minimize vaccine hesitancy and increase uptake of vaccine to help bring an end to the pandemic. With the UK being one of the first countries globally to have widespread vaccination, the study team are in a fairly unique position to be able to generate this evidence on a national level.

This is on top of the health and emotional benefits to citizens gained through avoidance of severe COVID disease.

Outputs:

Algorithms for creation of required variables and outcomes for the study protocol provided - the aim is for these to be developed and tested in the ORCHID-linked dataset by University of Oxford, then used to facilitate analysis of the full national dataset in the NHS Digital Trusted Research Environment (TRE) under data sharing agreement DARS-NIC-445543-W0D4N.

Aggregated results tables (before and after matching) including:
- Summary baseline characteristics of population (demographics, comorbidities, other relevant treatments)
- Vaccination information (Vaccine received, dose number, when received)
- COVID-19 outcomes (hospitalisation, critical care, mortality associated with COVID-19 infection)
- All cause outcomes (hospitalisation, critical care, mortality for any reason)

Research findings are aimed to be disseminated through peer review journals and scientific conferences. Results are aimed to be communicated transparently and to relevant audiences (researchers, clinicians, policy makers, general public) at interim and final analyses to ensure knowledge developed by the research can benefit the health system and the general public.

Reporting of results will be done in a transparent manner and analytical code will be available on request. This will allow demonstrating reproducibility and validity of the analytical methods used. No unnecessary suppression of results in reporting would be applied All outputs from this research will be published (not just positive outcomes for any particular vaccine) thus ensuring that any “unfavourable” results will not be supressed and will be given equal prominence and widespread dissemination, given the other vaccines being studied.


Analysis Target date: Summer 2021 - the study team are planning to disseminate findings immediately after conducting the analysis, Therefore, the analysis target date will be dependent on the date data is supplied by NHS Digital.

Processing:

Data requested will be three drops of pseudonymised recorded-level extracts from the above data sets for the period April 2019 through to most recent period available for each dataset (at time of each data drop) linked to a cohort of approximately 25 million patients submitted (on three occasions) to NHS Digital by the University of Oxford.

FREQUENCY - One drop of data as soon as the agreement is active, one in October/ November 2021 and one in December 2021 / January 2022. On receipt of each new data drop, once validated the old data must be securely destroyed and a certificate of destruction provided to NHS Digital in line with data destruction guidelines.

METHODOLOGY
1. Data are extracted from practices that are members of the Royal College of General Practitioners (RCGP RSC) Research and Surveillance Network by Wellbeing. The University of Oxford subcontracts with Wellbeing to do this as part its contractual responsibilities.
2. The University of Oxford will provide NHS Digital with a list of pseudonymised (hashed) NHS numbers for the cohort (estimated to be 25 million patients via Secure Electronic File Transfer Service (SEFT).
3. NHS Digital will link the cohort to the requested datasets.
4. NHS Digital will remove identifiers and send pseudonymised linked data set files securely back to University of Oxford via SEFT.
5. University of Oxford will download and store the data on their secure network.
6. University of Oxford and Momentum Data will process the data and aggregate/suppress output data for the purpose of COVID-19 vaccine pharmacovigilance and quality improvement.

No identifiable data items will be passed out of NHS Digital.

SALTING METHODLOGY:
The University of Oxford will follow a salting method in a manner that all the data will be non-identifiable. Salting is a concept that typically pertains to password or data hashing. Essentially, it’ is a unique value that can be added to the end of a password or data to create a different hash value. In this case it's a unique value added to the NHS Number. This adds a layer of security to the hashing process. When salting, the additional value is referred to as a “salt.”

The salting process is as follows:
1. An encryption salt is held by a designated staff member of the University of Oxford Medical Science Division who is not a member of the ORCHID staff.
2. When a data linkage is required, the encryption salt holder sends the encryption salt to the data provider (NHS Digital).
3. The data provider will hash personal identifiers (in the data requested by ORCHID) using a hashing algorithm.
5. To make this key unique, an encryption salt is added at the end of the NHS number (e.g. NHS number= 12345678 ; SALT (held by someone other than ORCHID staff) = bob. So, hashing would take place using the hashing algorithm by 12345678bob = return pseudonymised data).

The data received from NHS Digital is processed by study team members who are substantive employees of the University of Oxford. Additionally, For the purpose of this study, given the tight turnaround and the urgency in providing these analyses in the interest of public health, University of Oxford have subcontracted a part of the analysis to Momentum data who will solely be acting as data processors on the instructions from University of Oxford and AstraZeneca (joint data controllers). Analysts from Momentum data will first have to complete the IG training in order to get access to the ORCHID secure environment. Although acting as data processors, all the analysis and processing will take place within the secure environment at University of Oxford.

University of Oxford staff are mandated to complete information governance training. The team work from secure workstations or secure laptops with encrypted drives within the group’s secure network.

Data will only be accessed by individuals within the University of Oxford who have authorisation. The authorisation process includes:
(1) Contractual requirement to follow IG principles;
(2) Using the email registered with Human Resources to complete IG training and to return the certificate;
(3) Staff email is authorised by the IT department for one year to access the secure network and staff computers are configured to allow this;
(4) At any point the project managers or Head can have access to the secure network turned off.

There is special authorisation to have access to the main database. Only three developers and one senior project manager can access the main database. All computational work on the data can only be performed within this secure network, there is no ability to copy or move source data out of the service. End users are only able to access the necessary remote desktop resources they have been granted permission for, and this access is provided for the shortest period of time possible. End users must access the system using a Multi-Factor Authentication (MFA) service, without which access cannot be obtained. Access is available only to registered users, with access via the University VPN service or a separate OpenVPN service via separate username or certificate based authentication. No direct access to the remote desktops is possible without using the VPN connection.

The developers create separate databases for individual projects only including the required variables, for the required time interval. The additional linkages will be added to the data that the University of Oxford already receives from the RCGP RSC network practices and PHE reference laboratories. This process for previous projects linking different sets of data, and the linkage has been successful, provided both parties use the same pseudonymisation algorithm (SHA-512).

The steps below indicate the process that is followed in order to obtain data from NHS Digital.
1. The agreed study protocol includes the list of all the variables required for completing the analysis to satisfy the primary and secondary objectives of the study.
2. In parallel, the senior SQL database administrator prepares the cohort (including the pseudonymised NHS numbers) and uploads to the NHS Digital SEFT environment using a log-in details that is specifically provided to that individual by NHS Digital.
3. NHS Digital perform necessary checks, link the necessary datasets to the cohort and send back the cohort information/datasets via the SEFT system to the SQL administrator.
4. The administrator at University of Oxford then securely transfer the linked datasets within the ORCHID database which is then prepared by the SQL developers for further analysis.

There is no onward sharing and linking of the data for other studies unless specified in the data sharing agreements with NHS Digital.

Additionally, there will be no requirement nor attempt to re-identify individuals from the data.

The data will not be made available to any third parties other than those specified except in the form of aggregated outputs with small numbers suppressed in line with the HES Analysis Guide. Record-level data is not permitted to be transferred outside of the UK.

DISCLOSURE CONTROL RULES AND SMALL NUMBER SUPPRESSION
For HES and Mortality data - In order to protect patient confidentiality, when presenting results calculated from HES record level data, outputs will contain only aggregate level data with small numbers suppressed in line with HES Analysis Guide. When publishing HES data, you must make sure that:
· cell values from 1 to 7 are suppressed at a local level to prevent possible identification of individuals from small counts within the table.
· Zeros (0) do not need to be suppressed.
· All other counts will be rounded to the nearest 5.
Data will not be made available to any third parties other than those specified except in the form of aggregated outputs with small numbers suppressed in line with the HES Analysis Guide.

For COVID-19 Second Generation Surveillance System (SGSS), COVID-19 UK Non-hospital Antibody Testing Results (Pillar 3), COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2) and Vaccination data - As standard, all disseminations for this data set will adhere to the following business rules, as agreed with the NHS Digital, on top of normal exclusion criteria:
1. Always filter the extract to be England only. This should be applied using the subjects home postcode, or country (if derived from subjects home postcode)**
2. Exclude any record that includes Organisation type = PRI – Prison will be excluded [Cant be applied to sgss]
3. Exclude any record that includes “justice” in the email address (emailaddress and/or MPSemailaddress)
4. Exclude any record that has “mpsgpcode” or “gpcode” = “A91” [Military GP code] [Cant be applied to sgss]
5. Exclude any record that has a British armed forces postcode, these start with BF (postcode and/or MPSpostcode]
6. Exclude contact details (P2_Landline / LandlineNumber, P2_mobile / MobileNumber and/or MPSMobileNumber, P2_email / EmailAddress and/or MPSEmailAddress) where the following criteria apply:
a. TestCentreID = “CHO” or “PRI” OR OrganisationType = “CHO” or “PRI” AND OrganisationRole = “resident” [Cant be applied to sgss]
Or
b. care_home = xxxxx [Cant be applied to npex]
7. ODS location code - Filter out the following site codes: 'XUL', 'XXA', 'XBN', 'XYL', 'YIM', 'XPJ' ; Exclude the following test centre postcodes - 'G84 8HL', 'PO1 3NH', 'GL7 5RD' [Cant be applied to npex]