NHS Digital Data Release Register - reformatted

Digital Health And Care Wales projects

15 data files in total were disseminated unsafely (information about files used safely is missing for TRE/"system access" projects).

Application for transfer of data from NHS Digital to NHS Wales Informatics Service — DARS-NIC-660630-L4H3T

Type of data: information not disclosed for TRE projects

Opt outs honoured: Identifiable, No (Consent (Reasonable Expectation))

Legal basis: Health and Social Care Act 2012 - s261(5)(d)

Purposes: No (Specialised Commissioning Hub)

Sensitive: Sensitive

When:DSA runs 2023-11-06 — 2024-11-05 2024.05 — 2024.05.

Access method: Ongoing


Sublicensing allowed: No


  1. Uncurated Low Latency Hospital Data Sets - Admitted Patient Care
  2. Uncurated Low Latency Hospital Data Sets - Emergency Care
  3. Uncurated Low Latency Hospital Data Sets - Outpatient


Digital Health and Care Wales (DHCW) requires access to NHS England data specifically for Welsh residents treated in England.

DHCW requires episodic information on Welsh residents as processed by Health & Care establishments outside of NHS Wales for the purpose of:

• Direct care
• Healthcare planning
• Commissioning and validation of services
• Value based healthcare
• National Tariff reimbursement
• The development of national policy
• Supporting the information needs of the Health Boards in the management of their
• resources and services.
• Support the management and planning of health services
• Enable general medical research and statistical functions
• Identify public health issues
• Monitor improvements in public health on behalf of other organisations responsible
• for public health provision
• Develop, monitor and evaluate government policies, and otherwise support the
• work of the Health & Social Services Group of the Welsh Government
• Contribute to the production of Welsh Government statistical publications
• Improve the patient or carer experience
• In support of information processed as part of the collection and remuneration of
• dispensed drugs by Community Pharmacies
• In support of information processed as part of transactions through the delivery of
• additional services by Community Pharmacies
• National Clinical Audits data

These purposes fall under DHCW’s powers of which is reflected in a Direction issued by the Welsh Government:
Welsh Government issued general powers:
• https://www.gov.wales/digital-health-and-care-wales-establishment-and-functions

General power set out in the following directions:
• https://www.gov.wales/digital-health-and-care-wales-directions-2020
• https://www.gov.wales/digital-health-and-care-wales-no2-directions-2021

Directing letter describing these functions:
• https://www.gov.wales/digital-health-and-care-wales-dhcw-direction-use-health-service-data?_ga=2.197054255.2062409619.1680265872-1268629993.1655389813

DHCW relies on the specific provision in Section 23(3) of the National Health Service (Wales) Act 2006 which provides that nothing in provision made by or under this or any other Act affects the generality of any direction made under section 23(1).

This agreement is to permit the flow of identifiable Secondary Use Service (SUS) data back into Wales following Welsh residents being treated in NHS England established healthcare providers.

Identifiable data is required as it is part of the purposes previously defined and as described within DHCW’s functions and powers. As part of DHCW’s responsibilities DHCW have robust processes of ensuring that the data is rendered unidentifiable where appropriate for any secondary purpose for onwards disclosure if there is no corresponding lawful basis to provide identifiably to any other agency or statutory body.

DHCW also require the data in identifiable form in order to respond to any direct care requirements. A centralised copy of all Welsh residents is maintained in the data warehouse.

In many respects the secondary use of data determined by Digital Health and Care Wales is just part of the collective responsibility that includes Welsh Ministers. Welsh Government (and Welsh Ministers) are responsible for the resident population of Wales wherever treated, with DHCW having the legal responsibility for the wider collection, processing and dissemination of said Welsh resident information.

To address the Common Law Duty of Confidentiality the data is disseminated for the purposes of direct care. DHCW must satisfy themselves that they have an appropriate legal basis to then utilise that same data for their non-direct care / secondary use purposes.

The data will be minimised to Welsh residents who were treated in England.
DHCW is the sole Controller who will also (solely) process the data. Data will only be processed by substantive employees of DHCW. Direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patients.

The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject;

The lawful basis for processing special category data under the UK GDPR is:
Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.

Yielded Benefits:

From data already provided under the current agreement / Provision of Services Arrangement (POSA) the following expected benefits have been achieved. • Improved patient Care • Improved delivery of Health Services • Joined up Health Care • Funding benefits / financial • Health protection and prevention including Covid-19 data

Expected Benefits:

There are three main direct & indirect healthcare implications for DHCW:

• Managing patient pathways across boundaries, particularly the management of the Single Cancer Pathway and determining those patients that are waiting for treatment.
• Managing complications where patients treated in England present back at their local hospital with infections and other complications.
• Preventing recall of patients unnecessarily when they have had treatment in English Hospitals

For indirect healthcare provisions and additional to that described above other benefits of receiving the SUS data are to:

Enable the management of individual SLAs with English providers in relation to:

• Identification of the patterns of patient flows for each Local Health Board;
• Assess the appropriateness of the care pathway

Performance planning

• Facilitate the development of key performance/efficiency/clinical indicators
• Monitor geographical equity of access/provision;
• Facilitate evidence based commissioning.

Financial governance, planning and improved expenditure

Quality of care provision

• Identification of inappropriate activity
• Identification of variations in clinical outcomes


Outputs will be varied, but are expected to cover at least the following:

1. Commissioner reporting.
2. Readmissions analysis.
3. Production of project / programme level dashboards.
4. Monitoring of acute / community / mental health quality.
5. Responding to ad-hoc request from NHS Wales organisations and Welsh government
6. Data Quality and Validation measures allowing data quality checks on the submitted data
7. Patient Stratification, such as:
o Patients at highest risk of admission
o Most expensive patients (top 15%)
o Frail and elderly
o Patients that are currently in hospital
o Patients with most referrals to secondary care
o Patients with most emergency activity
o Patients with most expensive prescriptions
o Patients recently moving from one care setting to another
i. Discharged from hospital
ii. Discharged from community
8. Analysis of Clinical and Patient Outcomes


No data will flow to NHS England for the purposes of this Agreement.

NHS England data will provide the relevant records from the SUS datasets to DHCW. The data will contain directly identifying data items.
The data will not be transferred to any other location.

DHCW may, at any time, receive requests for data from medical professionals for Direct Care purposes. In this case direct care requests will only be shared with the medical professionals who have a responsibility in providing care to said patient(s).

The data will be stored on servers at DHCW.

The data will be accessed onsite at the premises of DHCW only.

The data will not leave England/Wales at any time.

Access is restricted to employees or agents of DHCW

All such individuals are substantive employees of DHCW.

All personnel accessing the data have been appropriately trained in data protection and confidentiality.

The data will be linked at person record level with Welsh medical data.

DHCW will only process/analyse the data for the purposes described above.