NHS Digital Data Release Register - reformatted

Northgate Public Services (UK) Limited

🚩 Northgate Public Services (UK) Limited received multiple copies of from the same dataset, in the same month, both with optouts respected and with optouts ignored. Northgate Public Services (UK) Limited may not have compared the two datasets, but the identifiers are consistent between datasets and NHS Digital does not know what their recipients actually do.

Project 1 — DARS-NIC-321226-T4B8S

Opt outs honoured: No - data flow is not identifiable

Sensitive: Non Sensitive

When: 2016/12 — 2019/10.

Repeats: Ongoing

Legal basis: Health and Social Care Act 2012, Health and Social Care Act 2012 – s261(1) and s261(2)(b)(ii)

Categories: Anonymised - ICO code compliant

Datasets:

  • Hospital Episode Statistics Admitted Patient Care

Yielded Benefits:

HES data has enabled the NJR to identify organisations where compliance does not meet expected levels and to work with those organisations to improve submission rates. By using the HES data as the basis of an audit within a hospital, data missing from the NJR has been added retrospectively. Audits have also improved the quality of data submitted by hospitals to HES. The use of HES data to report compliance publicly has provided a clear focus on those organisations who are not reaching the required levels of compliance and, hence, the quality of outcomes reporting for those organisations will not be as reliable as it could be. This public visibility of compliance rates has led to an improvement in the submission of data to the NJR by a number of hospitals with previously poor rates of compliance. Inclusion of NJR submissions (and patient consent rates) in the BPT by QIPP has also improved compliance with the NJR. HES data is used to report compliance rates to QIPP.

Objectives:

1. Compliance Monitoring - Internal. The number of hip, knee, ankle, elbow, and shoulder joint replacement procedures submitted to HES are compared with the number of procedures submitted to the National Joint Registry (NJR) so that compliance rates with the NJR (a mandatory data collection) can be calculated. The NJR exists to monitor the performance of implants, hospitals, and surgeons with the aim of improving patient outcomes and patient safety. It is important that the data received by the NJR is as complete as possible, and monitoring compliance rates of Trusts is a key indicator of data quality. 2. Compliance Monitoring - External. Again, the count of hip, knee, ankle, elbow. and shoulder replacements in HES are compared, at a Trust level, to those submitted to the NJR in order to calculate Trust compliance rates. This information is reported via Annual Clinical Trust Reports so that Trust senior management can ensure that the completeness of the data submitted to the NJR will enable the NJR to report accurately on the outcomes of joint replacement surgery at a hospital and trust level. The compliance rate is also reported as part of NHS England's Clinical Outcomes Programme and made available via patient-focused websites: www.njrsurgeonhospitalprofile.org.uk and NHS Choices. Compliance with the NJR, as a data quality indicator, enables Trust management, surgeons, and patients to assess the NJR's ability to monitor patient outcomes and patient safety, with regards to joint replacement, at a hospital and trust level. 3. Best Practice Tariff - External Reporting. In order to encourage compliance with the NJR, NHS trusts are offered financial incentives under the Best Practice Tariff programme. These tariffs are intended to improve quality in the NHS by reducing variation in the outcomes of care and to promote best practice. In order to receive those financial rewards, trusts have to meet annually set target rates for compliance for hip and knee joint replacement surgery. The NJR compares the count of procedures in HES to those in the NJR and reports the compliance rates to the Best Practice Tariff team.

Expected Benefits:

By Objective:- 1. Without complete data, the NJR's effectiveness at monitoring performance is significantly reduced and the risks to patients increase. 2. Compliance with the NJR, as a data quality indicator, enables Trust management, surgeons, and patients to assess the NJR's ability to monitor patient outcomes and patient safety, with regards to joint replacement, at a hospital and trust level. 3. Increased compliance leads to improved data quality. If the NJR is unable to report those compliance rates to NHS England, trusts may be financially disadvantaged. This could have an indirect impact on a trust's ability to submit procedure data to the NJR, reducing the NJR's ability to effectively monitor the outcomes of joint replacement surgery and thus leading to a reduction in patient safety. The NJR publishes Trust mortality rates and revision rates. If compliance is high Northgate can be sure of these patient outcome measures. By driving up compliance (and having a measure for it) Northgate are able to give the Trusts a measure of data quality.

Outputs:

By Objective:- 1. Specific Outputs. The Trust Compliance rate are published on the NJR Website and refreshed on a quarterly basis. 2. The Trust receives an Annual Report based on the data from that Trust, including performance outcomes (mortality rates and revision rates). The compliance for the Trust is shown for the previous 3 fiscal years and is a measure of the quality of data submitted to NJR for that Trust. 3. The NJR Centre monitors Trust Compliance in order to ensure the data it receives is fit for purpose.

Processing:

Record level data is processed within Northgate’s ISO27001 compliant data centre. Only measure values, based on aggregate data are presented through a series of internet enabled reports. There is no physical connection between the values on the website and the record level data that is used to produce them. For NJR, the compliance rate is not affected by the issue of small numbers and therefore will not need to be suppressed. For other products, no data linkage occurs between HES and any different datasets and the HES rules on small number suppression are applied throughout. By objective:- 1. HES episodes are counted based on specific OPCS4 codes, Episode Dates and ProcCode3. These counts are compared to NJR Submissions for a Trust. 2. HES episodes are counted based on specific OPCS4 codes, Episode Dates and ProcCode3. These counts are compared to NJR Submissions for a Trust. 3. HES episodes are counted based on specific OPCS4 codes, Episode Dates and ProcCode3. These counts are compared to NJR Submissions for a Trust.


Project 2 — DARS-NIC-233512-B7C4W

Opt outs honoured: No - data flow is not identifiable (Does not include the flow of confidential data)

Sensitive: Sensitive, and Non Sensitive

When: 2019/09 — 2019/09.

Repeats: One-Off

Legal basis: Health and Social Care Act 2012 – s261(1) and s261(2)(b)(ii)

Categories: Anonymised - ICO code compliant

Datasets:

  • Hospital Episode Statistics Admitted Patient Care
  • HES:Civil Registration (Deaths) bridge
  • Civil Registration - Deaths

Objectives:

The Neurosurgical National Audit Programme (NNAP) was established by the Society of British Neurological Surgeons (SBNS) in 2013 as part of a major quality improvement initiative. The programme aims to support neurosurgical units in the UK to improve patient care, outcomes, safety, and experience by providing high quality, robust audit data that is analysed and presented in a consistent and clinically relevant way. Currently the only data available to achieve this is HES data linked to Civil Registration/Mortality data. SBNS has a responsibility to ensure that all twenty four NHS trusts undertaking neurosurgery in England are doing so safely. The linkage requested is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests of fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child) - covered by Article 6 (1)(F) of the GDPR. The Society of British Neurological Surgeons (SBNS) has established the NNAP to promote improvements in the quality of neurosurgical services and patient care by providing neurosurgical units in the UK and Ireland with a comprehensive audit programme that reflects the full range of elective and emergency neurosurgical activity. The Society promotes safe and effective Neurosurgical treatment for patients throughout Great Britain and Ireland. The Society has developed and maintains the National Neurosurgical Audit Programme (NNAP), which produces outcome data for all neurosurgical in patients in England. It is also fully engaged with the Getting It Right First Time (GIRFT) project, aiming to improve patient care while reducing costs in all specialities. High standards of professional practice are promoted through the Society's involvement in the education and the examination of Neurosurgeons and through its scientific meetings and associated activities in the continuing professional development of Neurosurgeons and Neurosurgery. Therefore the Society of British Neurosurgeons requires data from NHS Digital the purposes of it's legitimate interests to do the above. There is evidence from other national audits that the publication of activity and audit data, when carefully analysed and interpreted, leads to improvements in patient outcomes. The SBNS supports the publication of outcome data that will promote the understanding of the range and complexity of neurosurgical services and the steps being taken to improve those services. NNAP was established to provide both patients and surgeons with information about the outcomes of neurosurgery and surgeon and hospital level information is published annually as part of the Clinical Outcomes Publication (COP). COP is an NHS England initiative designed to increase transparency within the NHS and to provide the public with information on surgical outcomes. This forms only 10% of the overall audit work. Individual consultant and unit level reports may be accessed through this website. Currently, the key indicator is 30- day mortality although additional indicators may be added in the future. The consultant code is essential to enable the publication of information at the surgeon-level. Consultant neurosurgeons will have secure access to data relating to their own practice. This will enable surgeons to preview and validate the information that is intended for publication on the NNAP COP website. Surgeons will also be provided with a secure online reporting service, via the NNAP website, that will enable them to review their own clinical practice. Whilst record-level data will be available to surgeons, it will include only that data necessary to enable them to identify the patient in local PAS and/or theatre systems, i.e. date of procedure, procedure type, etc. The data requested under this agreement is to enable consultants to validate the outcome data relating to the procedures they performed. Consultants nominated by SBNS will have access to data for the purposes of investigating potential outlier performance. The risk-based methodology used to determine performance against the key indicator of mortality will identify potential outlier performance. That surgeon's data will be made available to the investigating surgeon to determine if there is a case to answer and to take any action necessary, i.e. patient pseudo-identifiers will be removed and dates - if required, summarised. However, it is essential that any surgeon whose data indicates outlier performance can be identified using the Consultant Code so that Trust Chief Executives can be informed and a plan for further, local audit and follow-up action can be initiated. The data published for COP is also required for publication via the Choices website. All data that will be published on public websites will be aggregated with small number suppression applied. This audit is not commissioned by HQIP but NHS England provided the funding to HQIP to cover the COP work for all clinical audits irrespective of the data controllership. HQIP therefore are only funding the work to produce the COP for this audit. The financial support is for costs of data processing for this work only - not the other 90% of the audit. The data will also be used for specific analyses to be undertaken at the request of SBNS, the data controller. The results of the analysis will take the form of aggregated data, not record level data. SBNS also receive queries about surgeon and hospital level performance from NHS England and the regulator, Care Quality Commission (CQC). The data will also be used to answer these queries. The head of SBNS is employed as a neurosurgeon at Leeds NHS FT however access to data will be as a substantive employee of SBNS. There is no access to data or no project team at LTH NHS FT.

Expected Benefits:

The benefits to health care are in the improvement of patient outcomes and patient safety through the ability to identify outlier performance against the key indicator of mortality and the ability for surgeons to assess the outcomes of their own clinical practice by comparing it to the outcomes of their colleagues. Updated data and information will be provided to patients annually via the NNAP COP website. Patients will be better informed on the NHS Choices website about procedures undertaken by their consultant. It is in the legitimate interest of patients that that the quality and effectiveness of their care is being monitored and assessed. The detection of potential outlier performance will ensure clinical and management review of clinical practice to identify systemic or individual issues to ensure the necessary corrective action is taken. The potential number of patients affected is in the tens of thousands. The cost savings are difficult to quantify. However, savings will be made by reducing the number of repeat, or revision, procedures. This would be achieved by the identification of those procedure types with less good outcomes or using case-mix adjustment to improve patient and procedure selection. Patients are the main beneficiaries of the data processing, as clinicians will be able to monitor the outcomes of surgery and assess their own clinical practice. Outcomes will be monitored on an annual basis and, as NNAP has already been in existence for three years, the benefits of processing the data will be realised immediately.

Outputs:

The following outputs will be produced. Website Dashboard and Reports: One output of NNAP is the COP publication, the date of which changes each year. It is expected that the COP publication will be complete in December of each year, with the data being published on Choices in the following February or March. The publication will not contain any patient level data - it will only contain aggregated data with small number suppression applied. Information will also be shared with the Get it Right First Time (GiRFT) programme for publication on the GiRFT dashboard. Again, only aggregated data with small number suppression will be supplied. All data published on the NNAP website for COP, the GiRFT Dashboad, and Choices will be aggregated data. Surgeon Validation: Surgeons taking part in the audit will have access to record level data for the purpose of validating the information due to be published as part of COP. Surgeons will only have access to those procedures where they are indicated as 'Consultant' - as indicated by the CONSULT field in the HES product. Reports. Ad Hoc reports will be made available to NHS England, NHS Improvement and other NHS bodies as requested. These reports will be based on aggregated data and normally at Trust or Hospital Level. Presentations: The outcomes of the analysis will be presented at professional meetings and conferences. These will be based on aggregated data. All published outputs will only contain aggregated data with small number suppression applied as in line with the HES Analysis Guide.

Processing:

All organisations party to this agreement will comply with the Data Sharing Framework Contract, including requirements on the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract i.e.: employees, agents and contractors of the Data Recipient who may have access to that data). There will be no flow of identifiable or confidential data from any of the data controllers/processors named in this agreement into NHS Digital. NPS will provide NHS Digital with a list of OPCS4 codes and the speciality codes for neurosurgical and paediatric neurosurgical procedures. These are just codes in the dataset, and not record level data. NHS Digital are to use these codes to filter the HES APC product from 2013/14 onwards and extract records accordingly. NHS Digital are then to extract mortality records for people included in the HES extract. The data will then be transferred back to Northgate Public Services (NPS), on an annual basis. Upon receipt, the data requested will be held by Northgate Public Services (NPS) in its secure data centre. NPS' Health Analysts will then clean the data prior to undertaking risk adjusted mortality analyses for the purposes of producing funnel plots in order to identify potential outlier performance. The data will also be adjusted so that the multiplicity of OPCS4 procedures from the HES APC product requested are grouped into a manageable number of procedure categories. Once the cleansing, mortality analysis, and grouping of data is complete, the data will be loaded onto a database server so that it can be previewed by consultants prior to publication. Surgeons will have access to record level data for only those procedures which they are indicated as 'Consultant' - ie surgeons will only access record level data pertaining to their own patients - they will not view data on patients of other surgeons. Once the preview process is complete and any adjustments to the data (e.g reassignment of a procedure to another surgeon) the data will be published on the COP website. The finalised data-set will also be uploaded to the surgeon-level reporting service. Surgeons only have access to the data relating to their own patents. An SBNS surgeon will have access to record level data, for the purposes of undertaking outlier analyses and to respond to ad-hoc queries from organisations such as NHS England, NHS Improvement, and individual Trust Medical Directors. SBNS are the data controller for this project. The data will also be used for ad-hoc queries and analysis requested by the data controller, SBNS. This work will be undertaken by NPS health data analysts and, where necessary, an SBNS surgeon nominated by the data controller. All data will be processed by substantive employees of either SBNS, NPS, Sungard (who act in a processing capacity as data centre host), and Iron Mountain (as off-site backup storage provider). The data held by NPS will be stored on a secure server in the SunGard data centre which is only accessible to a limited number of users. The reduced data-set completed as a result of the cleansing and categorisation of the supplied data-set will be held on a protected database server, also hosted with NPS' data centre. NPS staff will access the data held in the data centre either directly from an NPS office or via a secure VPN which requires two factor authentication, including the use of an RSA token. The VPN is an extension of the NPS secure network and does not provide direct access to the server. Access to the server is subject to additional controls. In order to ensure that the data remains in a secure location, SBNS access to the data will be by remote desktop via NPS' VPN. A single, dedicated folder will be made available to the SBNS, and the remote desktop will include all those tools necessary to manipulate the data. Account holders will be required to sign to accept NPS' terms and conditions for access to the network and the data. It is expected that no more than one surgeon will require such access. Logging onto the VPN will not be permitted in public locations or via public, insecure WiFi connections. The Terms and Conditions that an SBNS surgeon will be required to sign will explicitly include this condition, restricting access to be either from within an office located in a hospital or using a secure home connection. There will no linkage permitted to other data sets apart from what is detailed in this agreement. There will be no attempts by employees of the named data processors or controllers to re-identify participants in the audit.


Project 3 — DARS-NIC-07289-G8J6C

Opt outs honoured: Yes - patient objections upheld (Section 251)

Sensitive: Sensitive

When: 2017/12 — 2019/05.

Repeats: One-Off

Legal basis: Section 251 approval is in place for the flow of identifiable data, Section 42(4) of the Statistics and Registration Service Act (2007) as amended by section 287 of the Health and Social Care Act (2012), Health and Social Care Act 2012 – s261(7)

Categories: Identifiable

Datasets:

  • Hospital Episode Statistics Admitted Patient Care
  • Office for National Statistics Mortality Data
  • Bridge file: Hospital Episode Statistics to Mortality Data from the Office of National Statistics
  • Patient Reported Outcome Measures (Linkable to HES)
  • HES:Civil Registration (Deaths) bridge
  • Civil Registration - Deaths

Yielded Benefits:

• Identifying a higher than normal failure rate of hip resurfacing procedures in women over the age of fifty, leading to an immediate change in clinical practice. • Identification of the DePuy ASR hip replacement system as an outlier leading to its immediate withdrawal from the market. • The identification of a higher than normal failure rate of large head, metal on metal, stemmed hip replacements. • Research, using NJR and HES data, looking at the risk of cancer following a metal on metal hip replacement compared to other bearing surfaces and the general population.

Objectives:

The NJR was established in 2002 by the Department of Health following a National Audit Office (NAO) report into the higher than expected failure rate of the 3M hip replacement device. The NAO report concluded that, had a national register of hip replacements been in existence, the failure rate would have been detected earlier. Earlier identification would have meant less patients were affected and the costs of revision surgery for the NHS would have been considerably less. The NJR went live in April 2003. Since its establishment, the responsibility for delivering the NJR has passed to HQIP who are contracted by the Department of Health to deliver the National Clinical Audit and Outcomes Programme (NCAPOP). The NJR is an audit within NCAPOP. HQIP acts as the data controller for the NJR and contracts to two other organisations for the delivery of the programme, both of which are data processors: • Northgate Public Services (NPS) is responsible for the NJR’s data collection and processing activities, including data storage and the provision of stakeholder reporting services. • The University of Bristol (UoB)is also a data processor with responsibilities for statistical analysis and reporting. HQIP, as the data controller, has no access to the record level data. Northgate has access to record level data, including patient identifiers, in order to link the data provided to patient records held by the NJR. The linked dataset is pseudo-anonymised by NPS before it is made available to the statistical analysis team at the UoB. Although the UoB team has access to record level data, it does not have access to patient identifiers. The work undertaken by the NJR is to monitor the outcomes of hip, knee, shoulder, ankle, and elbow joint replacement surgery with regards to the performance of devices, surgical teams, and Trusts and hospitals. The monitoring is necessary to ensure patient safety, improve patient outcomes. The overall purpose of the NJR is summarised in its mission statement: ‘The purpose of the National Joint Registry for England, Wales, Northern Ireland, and the Isle of Man is to collect high quality and relevant data about joint replacement surgery in order to provide an early warning of issues relating to patient safety. In a continuous drive to improve the quality of outcomes and ensure the quality and cost effectiveness of joint replacement surgery, the NJR will monitor and report on outcomes, and support and enable related research.’ The strategic goals of the NJR are as follows: • To monitor in real time the outcomes achieved by brand of prosthesis, hospital and surgeon, and highlight where these fall below an expected performance in order to allow prompt investigation and to support follow-up action. • To inform patients, clinicians, providers and commissioners of healthcare, regulators and implant suppliers of the outcomes achieved in joint replacement surgery. • To evidence variations in outcome achieved across surgical practice in order to inform best practice. • To enhance patient awareness of joint replacement outcomes to better inform patient choice and patients’ quality of experience through engagement with patients and patient organisations. • To support evidence-based purchasing of joint replacement implants for healthcare providers to support quality and cost effectiveness. • To support suppliers in the routine post-market surveillance of implants and provide information to clinicians, patients, hospital management and the regulatory authorities. The NJR has been collecting data since 2002 and is an ongoing audit with no planned end date. The NJR’s Steering Committee reviews the NJR’s mission statement and strategic goals annually to ensure that they remain relevant to existing stakeholder priorities, clinical guidance, and legislation. Data has been supplied to the NJR by NHSD annually from 2006 to 2015. The last data was received in 2015 for data to 31 December 2013. The NJR requires record level data from HES, PROMs and ONS in order to help it achieve some of its strategic goals. The NJR creates of an annual, linked dataset comprising of data from the NJR, HES, Patient Episode Database Wales (PEDW), PROMs (NHS England programme), and the ONS. This dataset is used primarily for the production of the NJR’s Annual Report, its associated analyses, and in some reporting services provided to stakeholders. By linking to HES, PROMs and ONS Mortality data, the NJR is able to enhance the quality and type of analyses that it undertakes. The priorities for NJR analyses and research are set by the NJR’s Research Committee and Editorial Board, both of which report to the NJR Steering Committee. • Linkage to HES data enables the NJR to improve the type and quality of the analyses that it can undertake without having to collect the data itself. Such linkage may be length of stay linked to outcomes or co-morbidities linked to outcomes. The NJR has, for example, published a paper examining the increased risk of cancer to patients who have had hip replacement procedures involving the use of metal on metal bearing surfaces, i.e. the femoral head and the acetabular cup or liner are both made of metal. • By linking to PROMs outcomes analyses will improve as poor performance will be detected even if the primary joint replacement procedure has not been revised. A patient’s view of the outcome of joint replacement is a key indicator to the reporting of outcomes and provides an additional endpoint in addition to revision and death. Linkage to PROMs and analysis at the record level enables the NJR to monitor the performance of hospitals, surgeons, and individual implants. • The NJR is required to publish 90 day mortality rates for all those NHS England Trusts undertaking joint replacement surgery in its Annual Clinical Reports to Trusts, the NJR’s Annual Report and as part of the NHS England Clinical Outcomes Programme. This latter information is also re-published by NHS Choices. Date of death and any associated co-morbidities are essential for outcomes analyses and for risk-adjusting mortality analyses. The data required by the NJR are HES inpatient episodes relating to a defined set of OPCS procedure codes, linked to ONS death data and any pre- or post-operative PROMs data. The data are required to be at the record, i.e. patient, level and to include identifiers so that the data can be linked to data held by the NJR. This application requests the data for the defined cohort for; • Records where there is no corresponding record in the NJR. • Records where a patient has declined consent for the NJR to hold their personal identifiers. Where ‘No’ is recorded for consent, the NJR data entry system prevents a user from entering personal identifiers so these records cannot, in any case, be included in any linkage activity, but are necessary for patient safety purposes. This will enable the NJR to continue to improve its analysis and data quality audits, activities which are expressly intended to improve patient outcomes and patient safety. Data from the Isle of Man and Northern Ireland is sourced from elsewhere and not provided by NHS Digital.

Expected Benefits:

The NJR is an ongoing clinical audit which started to collect data in April 2003. It has no specific target date for the delivery of benefits: these are provided on an ongoing basis. The main benefits associated with the data requested from NHSD are the ability of the NJR to undertake a broader range and type of analyses, and improved monitoring of clinical, patient, and implant-related outcomes by being able to risk-adjust analyses using additional data. A register, such as the NJR, will only ever collect data such that it can identify potential issues: it may not necessarily be able to determine the cause of those issues. The use of the data provided by NHSD, coupled to other research, enables the NJR to begin the process of identifying the cause of potential issues, e.g does early discharge of patients following joint replacement surgery lead to increases in returns to theatre? The work undertaken by the NJR is published as widely as possible, including internationally. The outputs may lead to changes in clinical practice which are, ultimately, to the benefit of patients. The financial cost savings to the NHS are through a reduction in the need to undertake revision procedures or certain types of primary procedure. The NJR has already had a number of notable successes: It is difficult to accurately measure or quantify the benefits arising out of the work of the NJR, but there is evidence to show that its outputs to lead to changes in clinical practice for the benefit of all stakeholders, including patients, Trusts and hospitals, clinicians, suppliers, and the regulatory authorities such as CQC, NICE, and the MHRA. Whilst patient outcomes continue to improve, the NHS is making potential savings through a reduction in the need to undertake as many revision procedures in the future.

Outputs:

The outputs from the use of the data will vary each year, dependent upon the research and analysis priorities set by the NJR’s Research Committee and NJR’s Editorial Board and agreed by the NJR Steering Committee. a) The main vehicle for publication is the NJR’s Annual Report which is published annually in September. In addition to the Annual Report, a Patient’s Guide to the Annual Report is also published and made available in both hard and electronic copy. The Annual Report and the patients guide can be accessed at http://www.njrreports.org.uk. b) Additional analyses are undertaken throughout the year and these are published either on the NJR website or in relevant, professional medical journals. To date those journals have included The Lancet, the British Medical Journal, and the Journal of Bone and Joint Surgery. The NJR maintains a dedicated research section on its website and details of planned, approved, completed, and published analysis can be found at: http://www.njrcentre.org.uk/njrcentre/Research/ResearchPortfolio/tabid/313/Default.aspx. c) The outcomes of analyses are also disseminated at conferences and meetings of professional societies. These include the British Orthopaedic Association, the British Hip Society, the British Association for Surgery of the Knee, the British Elbow and Shoulder Society, and the British Orthopaedic Foot and Ankle Society. The NJR also holds two regional events per year which are aimed at those hospital staff responsible for collecting the data, providing them with an update on the work of the NJR, including its outputs. d) Some outputs are also published through the NJR’s secure online reporting services. These services include NJR Clinician Feedback and NJR Management Feedback which provide information for clinicians and trust/hospital management respectively. All outputs are aggregated and small numbers suppressed in line with the HES analysis guide

Processing:

a) Data Flows. Data is provided by NHSD to NPS for a defined set of OPCS procedure codes related to hip, knee, shoulder, elbow, and ankle joint replacement surgery. This data includes record level HES in-patient episode data linked to ONS and PROMs data. The data is stored, encrypted, in NPS’ secure data centre. All processing activities take place on the server, not on client PCs/Laptops. The data is subsequently linked to NJR data using patient identifiers, principally the NHS number. Once the linked data set has been created, all patient identifiers are removed to create a pseudonymised data set. The data which is received by the NJR from NHS Digital for the people who have consented "No" to the NJR is destroyed by the NJR once it's identified that they are not able to link them into the registry. This dataset is encrypted and transferred securely to the UoB who then use the data for analyses as directed by the NJR Steering Committee. All reporting is based on the publication of aggregated data with small numbers being supressed in line with the HES analysis guide: no record-level reports are published. The data flows have support under Section 251 of the NHS Act 2006. b) Access to the data. Only three, substantive employees of NPS have access to the data provided by NHSD. Those three individuals work within NPS’ NJR team. That access is for the purposes of linking the data to NJR data and producing an annual, NJR/HES/ONS/PROMs linked dataset. The UoB receive, from NPS, a pseudo-anonymised dataset which is held on a server within the UoB. Based on the requirements of specific analyses, the UoB team will create sub-sets of the data which are for use by the UoB team only. NHSD supplied data is not made available to external researchers or analysts. All individuals requiring access to ONS data are individually identified as part of the application process. c) What will not happen to the data. The team at the UoB have no requirement to identify individuals in the linked dataset nor will any attempt be made to do so. This would, in any instance, require NPS to provide the identifiers necessary to do so. Subsets of linked data which include data supplied by NHSD will not be made available to third parties without the prior agreement of NHSD. All outputs from use of the data will be based on aggregated data and small numbers suppressed in line with the HES analysis guide. d) Justification for the data required. In order to accurately determine the outcomes of joint replacement surgery it is necessary to collect as much data as possible over as long a period as possible. For example, data provided from the NJR to the study into the potential increased risk of cancer associated with metal on metal hip replacement had access to a very large cohort of patient data. The conclusions of the study were diametrically different to a similar study that had been published earlier but had only had access to a small set (by comparison) of local data. In order to ensure as much data as possible is available, national data is required. Deprivation analysis and comparison also requires the collection of national data. It is also necessary for the NJR to collect all available longitudinal data, i.e. all data since the NJR started to collect data in 2003. Although NICE guidance is based on ten year survivorship, it is necessary to look further than ten years when assessing outcomes. Some specific issues may not manifest themselves until some considerable time after implantation. Longitudinal data also enables the NJR to look at changes over time, whether it is changes in patient demographics or comorbidities or the effects of changes in clinical practice. Only data related to patients with specific joint replacement are requested and these include patient identifiers. The identifiers are necessary to link NHSD supplied data to corresponding NJR records and are removed once the linkage is complete. Patient identifiers are not used in, or available for, any analysis of the linked dataset. All organisations party to this agreement must comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data). No other data processor or storage location can access or share the data, including sub-licencing other than those already noted within the agreement. ONS and PROMS terms and conditions will be adhered to by all persons accessing the data. All data previously supplied to the applicant and held by Northgate Public Services has been destroyed as this did not have patient objections applied due to these not being required at the time that data was disseminated. This application will resupply all historical data with objections applied. The pseudo-anonymised data set derived from previously provided data and held by the University of Bristol may be retained.