NHS Digital Data Release Register - reformatted

Novavax, Inc. projects

118 data files in total were disseminated unsafely (information about files used safely is missing for TRE/"system access" projects).

NovaVax - Additional Linkage to Support Vaccine Trial — DARS-NIC-420105-M8Y5X

Type of data: information not disclosed for TRE projects

Opt outs honoured: No - data flow is not identifiable, Anonymised - ICO Code Compliant, No (Statutory exemption to flow confidential data without consent, Consent (Reasonable Expectation))

Legal basis: CV19: Regulation 3 (4) of the Health Service (Control of Patient Information) Regulations 2002, CV19: Regulation 3 (4) of the Health Service (Control of Patient Information) Regulations 2002; Health and Social Care Act 2012 - s261(5)(c), CV19: Regulation 3 (4) of the Health Service (Control of Patient Information) Regulations 2002; Health and Social Care Act 2012 – s261(2)(c)

Purposes: Yes (Private Healthcare)

Sensitive: Sensitive

When:DSA runs 2020-12-22 — 2021-03-31 2021.01 — 2022.01.

Access method: One-Off

Data-controller type: NOVAVAX, INC.

Sublicensing allowed: No

Datasets:

  1. Covid-19 UK Non-hospital Antigen Testing Results (pillar 2)
  2. COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2)

Objectives:

Novavax, Inc. is conducting a Phase 3 clinical trial of the SARS-COV-2 Recombinant spike protein nanoparticle vaccine (SARS-CoV-2 rS) with Matrix-M1TM Adjuvant. The primary objective of the trial is to demonstrate the efficacy of SARS-CoV-rS with Matris-M1 adjuvant in the prevention of virologically confirmed (by PCR) symptomatic COVID-19, when given as a 2-dose vaccination regimen as compared to placebo, in serologically negative (to SARS-CoV-2) adult participants.

The method employed in the trial for identifying virologically confirmed cases of COVID-19 is study participant self-swab upon onset of COVID-19 symptoms and subsequent submission of those swabs for testing via the NHS Test and Trace system. The objective of the requested processing is to connect the results of the self-swab testing with the appropriate study participant in an accurate, traceable manner.

The trial originally recruited its cohort of circa 15,000 members through an application to NHS Digital’s Permission to Contact Service (NIC-411171).

NHS Digital are responding to a request from NIHR and Novavax to assist with the identification of positive covid 19 test results for as many Novavax trial participants as possible utilizing specific data fields provided by Novavax/PPD as set out in the processing section of this agreement. This is an extremely high profile vaccine trial with great potential benefit to the health and wellbeing of the global population in tackling COVID-19. Therefore there is a very strong justification for additional linkage to be carried out in relation to these participants and their test results.

NHS Digital, as collector of the Pillar 2 testing data, are in a position to match up the trial participants with their test kits and the results of those tests. Identifiable data on trial participants will be extracted by PPD Inc. from EDC Medidata system and uploaded into NHS Digital via SEFT accounts, whereby NHS Digital will then link those participants to their testing kits. NHS Digital will then minimise the output from that linkage to flow pseudonymised data to St George’s University Hospitals Foundation Trust, who will distribute the outputs amongst the sites where it will be keyed into the EDC (Medidata system). Medidata is a validated 21CFR part 11 compliant system with unique, password protected access for study staff and complete audit trail. Note that Medidata only holds pseudonymised information.

Expected Benefits:

Supported by the vaccine task force, Novavax seeks to bring a highly efficacious COVID-19 vaccine to the UK population. Adding to the vaccines available to UK citizens will increase the speed of reaching national vaccination goals and bring the UK closer to mitigating the deleterious effects of the unchecked spread of SARS-CoV-2 on the health and wellbeing and economic prospects of the citizens of the UK.

The dissemination of the requested processed data will allow for the quick accurate evaluation of the effectiveness of the Novavax SARS-CoV-rS with Matris-M1 adjuvant. Since the Novavax clinical trial is endpoint driven, rapid identification of endpoints allows for increased certainty of timelines and progress towards accumulation of a sufficient number of endpoints. This is crucial to inform the decision of when to unblind the study for analysis. The goal is to vaccinate roughly half of the UK population which will contribute significantly to the vaccination goals of the UK government. Thus, the impact will be felt primarily by those who can be vaccinated with a safe and effective vaccine. The increased efficiencies realized in the tabulation of endpoints by this automated method will decrease time to market and increase confidence in the final results.

Outputs:

The immediate objective of this processing is to generate a traceable, accurate list of test results for all study participants in the Novavax vaccine trial (using process detailed above). This is expected to take place within 1 week of necessary IG approvals and weekly thereafter. This will enable the delivery of the following study endpoints all of which depend at least in part on PCR test results:

• First occurrence of virologically confirmed (by PCR to SARS-CoV-2), symptomatic mild, moderate or severe COVID-19 with onset at least 7 days after second study vaccination (e.g., Day 28) in serologically negative (to SARS-CoV-2) adult participants at baseline until the endpoint-driven efficacy analysis is triggered by the occurrence of a prespecified number of blinded endpoints.
• First occurrence of virologically confirmed (by PCR to SARS-CoV-2), symptomatic moderate or severe COVID-19 with onset at least 7 days after second study vaccination (e.g., Day 28) in serologically negative (to SARS-CoV-2) adult participants at baseline until the endpoint-driven efficacy analysis is triggered by the occurrence of a prespecified number of blinded endpoints.
• First occurrence of virologically confirmed (by PCR to SARS-CoV-2), symptomatic mild, moderate or severe COVID-19, with onset at least 7 days after second study vaccination (e.g., Day 28) in adult participants regardless of their serostatus at baseline.
• First occurrence of COVID-19 requiring hospitalisation, intensive care unit (ICU) admission or mechanical ventilation linked to any virologically confirmed (by PCR to SARS-CoV-2) COVID-19 with onset at least 7 days after second study vaccination (e.g., Day 28) in adult participants regardless of their serostatus at baseline.
• First occurrence of virologically confirmed (by PCR to SARS-CoV-2), symptomatic mild COVID-19 (with no progression to moderate or severe COVID-19 during the course of the COVID-19 episode) with onset at least 7 days after second study vaccination (e.g., Day 28) in adult participants, regardless of their serostatus at baseline.
• First occurrence of laboratory-confirmed (by PCR or nucleocapsid (N)-protein serology to SARS-CoV-2) symptomatic or asymptomatic COVID-19 with onset at least 7 days after second study vaccination (e.g., Day 28) in adult participants regardless of their serostatus at baseline.
• First occurrence of virologically confirmed (by PCR to SARS-CoV-2), symptomatic mild, moderate or severe COVID-19 with onset at least 14 days after first study vaccination (e.g., Day 14) in serologically negative (to SARS-CoV-2) adult participants at baseline until the endpoint-driven efficacy analysis is triggered by the occurrence of a prespecified number of blinded endpoints.

It is expected that the endpoint driven analysis will be triggered in Q1 2021 .

Once the endpoint driven analysis has been triggered, data (in the form of tables, listings and figures) will be utilized for:
• the final clinical study report which will be used to support the emergency use authorisation application. This output will include the results of statistical analysis to determine the efficacy of the Novavax vaccine in the UK population.
• Manuscript preparation which is planned for Q2 2021 . Peer review of the scientific data generated by this study is important for transparency and demonstration that the study was conducted under rigorous and sound standards.

Processing:

In order to achieve the objective stated above, Novavax is requesting NHS Digital to match the participant’s Unique References (provided by PPD) with the correct trial specific barcode number (e.g. NVX12345678 (‘Specimen ID’)) and Pillar 2 positive non hospital antigen test result. NHS Digital will only be linking against barcodes that begin with ‘NVX’.

This will involve merging study participant lists provided by PPD with study coded information in the NHS digital database including: SubjectID, Date of Birth, Gender, and visit date.

After successfully merging site and NHS digital lists, pseudonymised data will be returned to St Georges only and will be limited to the following fields SubjectID, Barcode number, test result, and test start date.

A more detailed flow of the activities is as follows:

PREPARATION (PPD)
• PPD, acting as a processor on behalf of Novavax, will extract the entire trial cohort data from the electronic system which is currently used for the trial. The data items they will extract are Subject ID, Gender, Date of Birth and Visit Date.
PPD will use the template provided by NHS Digital to add the above data items. Some fields will be left blank where the data items are not available.

ADDING AND SUBMITTING

• The files will be saved in CSV format to be compatible with NHS Digital’s linkage process.
•PPD will upload the files weekly into NHS Digital using SEFT accounts.
• This data flow into NHS Digital is covered by a Data Processing Agreement in place between Novavax and NHS Digital (in addition to existing agreements Novavax has with PPD).

LINKAGE (NHS DIGITAL)
• On a weekly basis NHS Digital, acting as a data processor on behalf of Novavax, will download the files and perform the linkage.
• This file will then be matched against the Pillar 2 dataset using Specimen ID (barcode), Date of birth and gender as supplied by PPD. Test Result and Test Start Date will be extracted and together with the Subject ID will form the combined output file. . Non-matches will be represented in the output file only by the Subject ID.
• NHS Digital will upload the output file to the SEFT account for St. George’s to access.
• This data flow is covered by this Data Sharing Agreement between Novavax and NHS Digital.


DISTRIBUTION AND COMPLETION (St. George’s)
• St. George’s, will download the linked output file from the SEFT account.
• St. George’s will separate the file by recruitment site and send that file to eachsite. Whilst this part of the process is being carried out all the data will be stored and held at St Georges at the specified locations set out in this agreement.
• St. George’s will store the linked output file for two weeks to allow for any queries to be received from the sites, after which time it will be securely deleted by St. George’s.
• When the sites receive their file they will key in the Specimen ID, Test Result and Test Start Date in the appropriate electronic case report form (eCRF) of the relevant participant.
• This data flow is covered by this Data Sharing Agreement and an appropriate agreement between Novavax and St. George’s. Once the data has been keyed into EDC and has been validated with the participant as part of the consenting process and/or on-going communication with the participant such data is considered by NHS Digital to be derived data and hence no longer covered under this data sharing agreement.

The above process will initially be completed to link all of the participants with the testing kits they have used up to the current date. This will include approximately 15 000 swabs performed when they were recruited into the trial (“day zero kits”) and any swabs that have already been used as a result of a new onset of COVID19 symptoms (“surveillance kits”). Following this first linkage and reconciliation, further linkages will take place on a weekly basis, and following the above flow. The purpose of this is to continuously link participants to surveillance kits they use once they have symptoms of COVID19 (up to three swabs per participant).

Note that for Distribution and Completion, although the data will be processed and stored within St. George’s University Hospitals Foundation Trust, it will be processed by University staff, who will all have honorary contracts with the trust to allow them to do this, and which are listed as supporting documents for this application. Any breaches of the data would require suitable disciplinary action to be undertaken by the substantive employer.

All organisations party to this agreement must comply with the data sharing framework contract requirements, including those regarding the use (and purposes of that use) by “personnel” (as defined within the data sharing framework contract i.e. employees, agents and contractors of the data recipient who may have access to that data).
St. George’s are deemed a ‘processor’ of confidential data under regulation 7 (2) of COPI:
(2) No person shall process confidential patient information under these Regulations unless he is a health professional or a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.