NHS Digital Data Release Register - reformatted

Office For National Statistics projects

5 data files in total were disseminated unsafely (information about files used safely is missing for TRE/"system access" projects).

Health & Labour Market project — DARS-NIC-764470-N9W3S

Type of data: information not disclosed for TRE projects

Opt outs honoured: Identifiable (Statutory exemption to flow confidential data without consent)

Legal basis: Other-(section 45C of the SRSA 2007, as amended by the Digital Economy Act (2017)), Other-(Section 45a of the Statistics and Registration Service Act (2007) as amended by the Digital Economy Act (2017)

Purposes: No (Research)

Sensitive: Sensitive, and Non-Sensitive

When:DSA runs 2024-11-05 — 2025-11-04

Access method: One-Off, Ongoing

Data-controller type: OFFICE FOR NATIONAL STATISTICS (ONS)

Sublicensing allowed: Yes

Datasets:

  1. Hospital Episode Statistics Accident and Emergency (HES A and E)
  2. Hospital Episode Statistics Admitted Patient Care (HES APC)
  3. Hospital Episode Statistics Critical Care (HES Critical Care)
  4. Hospital Episode Statistics Outpatients (HES OP)

Objectives:

The Office for National Statistics (ONS) obtains NHS England Data for its statutory functions.

Data is obtained under Data Sharing Agreement reference DARS-NIC-175120-W5G2X using ONS’ statutory powers to require disclosure of Data from a public authority under section 45(c) of the Statistics and Registration Service Act (SRSA) 2007.

Data is also obtained under Data Sharing Agreement reference DARS-NIC-400304-S1P1B using ONS’ statutory powers to request disclosure of Data from a public authority under section 45(a) of the Statistics and Registration Service Act (SRSA) 2007.

Those Data Sharing Agreements form part of a contract which limits the purposes for which ONS can use the Data obtained under them.

ONS have statutory powers to onwardly disclose personal information to approved researchers under section 39(4)(i) of the Statistics and Registration Service Act (SRSA) 2007. An “approved researcher” means an individual to whom the Statistics Board (known as the Office for National Statistics) has granted access, for the purposes of statistical research, to personal information held by it.

This Data Sharing Agreement (DSA) authorises ONS to grant access to approved researchers (as defined above) for statistical purposes approved by ONS subject to the following limitations:
• Under this DSA, the purpose for processing is limited to a specific project (‘the Health & Labour Market project’) described below.
• Under this DSA, access is restricted to (i) substantive employees of ONS and (ii) substantive employees of NHS England with ‘approved researcher’ accreditation.

‘Approved researchers’ must be assessed as meeting specific Accreditation Criteria and receive approval from the UK Statistics Authority Research Accreditation Panel (RAP). RAP includes a number of independent members, as well senior civil servants representing key public sector data owners . Each research application will be assessed and must be approved by RAP before ONS provides access to the data for that purpose. Projects require an Ethics Assessment, and where necessary, are reviewed by the National Statistician’s Data Ethics Advisory Committee (NSDEC). Further information on the approval process can be accessed at the following web address:
https://uksa.statisticsauthority.gov.uk/digitaleconomyact-research-statistics/research-accreditation-panel/ and NSDEC: National Statistician’s Data Ethics Advisory Committee – UK Statistics Authority.

To build confidence that review by RAP provides adequate oversight and assurance for new project applications for the IDS, ONS is proposing that AGD will review project proposals in parallel with RAP for the first 12 months – after which point RAP will operate as the sole review body (if all parties agree). RAP already acts as the sole project accreditation mechanism for researchers looking to access the ONS and NHSE jointly-owned Public Health Research Database, available through ONS’ legacy TRE the Secure Research Service.

The first project that will test this new governance process – ‘the Health & Labour Market project’ - will focus on exploring the link between obesity health interventions and labour market outcomes, more specifically assessing the economic impacts and benefits of bariatric surgery versus the costs to the NHS. Initial analysis demonstrates that targeted government investment in bariatric surgery could have huge impacts on getting people back into work, earning an income and paying taxes, and that this economic benefit significantly offsets the cost to the NHS.

More work is needed to provide a better body of evidence to HM Treasury and to NHS decision-makers to help -allocate public funds to where those funds could have the greatest impact. This project presents a unique opportunity to combine health and economic data in a way that has never been possible before and it marks the beginning of a programme of work that has huge potential to transform funding models across government. This could ultimately lead to a more efficient and effective health service and a stronger UK economy.

The approved researchers accessing the data for this first project will be NHS England employees.

The following NHS England Data will be accessed:
• Hospital Episode Statistics
o Admitted Patient Care
o Accident & Emergency
o Critical Care
o Outpatients

The level of the Data will be:
• Pseudonymised

ONS receives and deidentifies the data under other DSAs prior to depositing the pseudonymised subset in the IDS for use under this DSA.

The Data will be minimised as follows:
• The project accreditation process together with the technical controls in the system ensure that the minimum necessary personal data is made available by ONS to each researcher to achieve the stated research outcomes.
• This is achieved by restricting researcher access to their own project storage areas and ensuring that only a limited number of ONS support staff are able to transfer pre-approved data into those folders.

ONS is the controller as the organisation responsible for ensuring that the Data will only be processed for the purpose described above.

The lawful basis for processing personal data under the UK GDPR is:
Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

The lawful basis for processing special category data under the UK GDPR is:
Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

ONS has engaged with the public on attitudes to the use of health data and published several online National Statistical blogs illustrating the use of UK health statistics data and our collaborative relationships with NHSE, DHSC and DWP.
• Bringing together UK Health Statistics (ONS 2024)
• Celebrating 75 years of the NHS and a history of ONS Collaboration (ONS 2023)
• Creating a coherent picture of health in the UK (ONS 2023)
• Linking health and non-health administrative data (ONS 2023)

On September 16th 2024, ONS launched a new and substantive programme of public communication and engagement activity to ensure we maintain high levels of public trust and awareness in building public support for the better use of data. This programme includes an area dedicated to health and wellbeing statistics, demonstrating how ONS statistics deliver public benefit in addressing inequalities and recognising where people and communities need help and support. In addition, ONS has developed a webinar series, called Bringing data to life including an interactive session in December 2024 focussed on how health in the UK is measured in numbers These explainer webinars are designed to have universal appeal using simple content in accessible language. The webinars will not be targeted to professional users of statistics but rather to interested citizens.

In response to feedback from AGD and NSDEC, ONS plan to complement this broader engagement programme through an immediate partnership with the public engagement team at the University of Leicester to create bespoke and rapid PPIE linked to NIC-748645-R5G3D-v0.2 NHS Diabetes Prevention Programme (DPP). Beyond this, and to provide further focus on the use of linked health and non-health data, ONS are holding a workshop with PEDRI in October 2024 to gain best practice support and insight to develop and refine its PPIE plans and materials and how best to engage with the public and industry experts such as the Society of Occupational Medicine and Association of British Insurers. ONS anticipates that this workshop event will provide a firm platform for partnership with other government departments, including NHSE, with whom ONS are beginning to explore joint citizen engagement events.

Expected Benefits:

The principle aim of facilitating data access for approved researchers is to deliver public good from the utilisation of linked health and non-health data. ONS believes that the IDS is uniquely placed to capitalise on the latest technology and methods to deliver maximum value from public data, while also ensuring that security, privacy and data protection risks are mitigated and managed in line with best practice and full transparency.

A robust and independent governance and scrutiny process is in place to ensure a clear public benefit from each research use of the data is demonstrated. Data are only used for valuable, ethical research projects that deliver clear public benefits.

Initially, this DSA will be limited in scope to permitting access for a project exploring the link between obesity health interventions and labour market outcomes - more specifically assessing the economic impacts and benefits of bariatric surgery vs. the costs to the NHS. Initial analysis demonstrates that targeted government investment in bariatric surgery could have huge impacts on getting people back into work, earning an income and paying taxes (and that this economic benefit significantly offsets the cost to the NHS).

More work is needed to provide a better body of evidence to Treasury and NHS decisions makers to help them better allocate public funds to where it could have the greatest impact. This project presents a unique opportunity to combine health and economic data in a way that's never been possible before, and it marks the beginning of a programme of work that has huge potential to transform funding models across government. This could ultimately lead to better health services and a stronger UK economy.

https://www.ons.gov.uk/releases/theimpactofbariatricsurgeryonmonthlyemployeepayandemployeestatusenglandapril2014todecember2022 covers work conducted by ONS analysts internally on the same wider research programme (conducted under DARS-NIC-175120). The underlying dataset used for this analysis is the same dataset that NHS researchers will shortly be able to access via IDS through this new DSA DARS-NIC-764470, so it's highly relevant in demonstrating the type of outcomes and benefits to the health and social care system that could be achieved through this DSA.

Outputs:

The outputs will vary per approved project but the expected outputs of the processing will commonly be:
• Data models
• Reports
• Submissions to peer reviewed journals
• Presentations at conferences
• Publications of dashboards
• Statistics

The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.

For the Health & Labour Market project the expected outputs will take the form of data models showing the economic impacts of bariatric surgery and other related obesity interventions. These models will help estimate the holistic costs versus benefits of targeted NHS investment when taking into account the wider impact on labour market outcomes and tax receipts if/when individuals are able to return to work.

These outputs could both be used to assess the need for investment into obesity interventions but also will provide a proof of concept for future modelling and analysis that could be conducted in a similar fashion focused on other health conditions.

This is a highly exploratory area and it is difficult to predict in advance what insights may be gleaned from the analysis and what outputs may be produced from these insights. However, as part of project and researcher accreditation for access to the ONS' Trusted Research Environment (TRE) the Integrated Data Service (IDS) there is an expectation that any outputs will be published, both for the benefit of the wider research community but also to maintain utmost transparency with the public about how their data is being used for the public good.

Processing:

No data will flow to NHS England for the purposes of this Data Sharing Agreement (DSA). Under this DSA, ONS will reuse NHS England Data provided under other Data Sharing Agreements between ONS and NHS England.

ONS will create a person-level dataset linking NHS England Data and non-health data from other sources. This processing will be undertaken by a small team of data engineers and linkage experts within ONS’ secure internal data platform. Only this team has access to identifiable data. Once the datasets have been indexed, linked and a new ONS generated unique ID attached any other identifiable information is removed.

The linked, deidentified data is then transferred to ONS’ Trusted Research Environments (TREs) where it will only be accessed by approved researchers and be anonymous in the context of the TRE controls. The ONS TREs are the Secure Research Service (SRS) and the Integrated Data Service (IDS).

For Secure Research Service (SRS): The servers used to store data, and to host the analysis environment are located within a Pan-Government and National Cyber Security Centre (NCSC) Accredited (PGA) data centre, based in the UK. Data in use are stored in a file format compatible with most statistical software packages available in the ONS TRE. The data are stored on an encrypted drive before it is loaded in line with government security standards.

For Integrated Data Service (IDS): The data resides within Google Cloud Platform (GCP). All cloud services consumed for the storage and use of the data are scoped to securely managed GCP Projects. GCP Projects in scope for this project are not connected to ONS corporate networks. GCP Projects in scope for this project are accessible via the internet for administration/analytical work. Access is securely bound up with Google identity services, internet authentication proxies and multi-factor authentication. All platform infrastructure and storage is deployed into the Europe-west2 region (London) and in any of the 3 available zones for redundancy and high availability (where applicable). Processing of data can only be carried out on GCP infrastructure within the deployed region. Access to GCP platform is region locked to UK IP addresses only. Access to IDS and any data it holds is not permitted from outside the UK. Overseas connections are monitored, and connection attempts will lead to account suspension.

Once in the TRE it is stored in a data holding area accessible only to selected and security cleared ONS support staff. When placed in project folders, for access by the researchers, the data are made available as a read-only copy ensuring that researchers cannot edit or tamper with the original dataset in any way.

Access to the data will be limited to:
• approved researchers accessing the data for this first project will be NHS England employees
• approved researchers under the approved researcher framework are carrying out statistical research for the public good, and
• ONS support staff who have appropriate training and security clearance (at least ‘Security Clearance’) to access the data to review and prepare it before making it available to researchers. These support staff also check the research outputs to ensure that they are safe to publish.

The Data will be accessed by authorised personnel via remote access.

The Controller(s) must confirm and provide evidence upon audit by NHS England that access via any remote device complies with the data security obligations within this DSA and the Data Sharing Framework Contract.

For remote access:
- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;
- Access controls granting users the minimum level of access required are in place;
- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;
- Multifactor authentication (MFA) is required for remote access;
- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;
- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

The Data will not leave the UK at any time, and remote access from outside the UK is not possible or permitted.

The ONS TRE does not, as a standard, provide a way for a researcher to ingest their data. The researcher must explicitly specify in their project application what data they wish to ingest for their specific project and ONS will then assess their application and provide specific permission on a case-by-case basis with consent from NHS England. The frequency of this occurring is likely to be low based on other ONS TRE past usage.

Any information removed from the TRE follows a strict governance process to ensure it is not possible to identify a respondent from the output. Specially trained statistical officers check and double check each output to give data owners the assurance that the use of their data are controlled and confidentiality of respondents is protected at all times.

For individual research project, after the end of the research project, the specific data used in that research will be kept for a period of 2 years to allow validation of the research results and then it will be destroyed unless ONS specifies otherwise. At that time the project is moved to a data archive. ONS will destroy the data from the archive after 5 years.

Researchers who request access to data are vetted. Their experience and qualifications are scrutinised. Only those applicants that demonstrate their suitability to handle personal data then undergo a rigorous training course focusing on safe behaviours, attitudes, ethical considerations, their obligations within law and statistical methods to ensure research outcomes do not identify respondents within the data. After the training course, researchers also undergo an assessment test.

Researchers also, as part of their application, must be endorsed by their organisation. The organisation signs an agreement to support that each researcher will behave and adhere to the controls in place before access to data is granted.

Approved researchers are not authorised to attempt to reidentify individuals when using the data.

NHS Diabetes Prevention Program (DPP) - for the purposes of Statistics and Statistical Research, under section 45 of the Statistics and Registration Services Act 2007 as amended by the Digital Economy Act 2017 — DARS-NIC-748645-R5G3D

Type of data: information not disclosed for TRE projects

Opt outs honoured: Identifiable (Statutory exemption to flow confidential data without consent)

Legal basis: Other-Other(Data dissemination is mandated under section 45c of the Statistics and Registration Service Act (2007) as amended by the Digital Economy Act 2017), Other-(Data dissemination is mandated under section 45c of the Statistics and Registration Service Act (2007) as amended by the Digital Economy Act 2017), Other-Data dissemination is mandated under section 45c of the Statistics and Registration Service Act (2007) as amended by the Digital Economy Act 2017, Other-Section 45a of the Statistics and Registration Service Act (2007) as amended by the Digital Economy Act (2017)

Purposes: No (Research)

Sensitive: Sensitive

When:DSA runs 2024-10-02 — 2025-10-01

Access method: One-Off, Ongoing

Data-controller type: OFFICE FOR NATIONAL STATISTICS (ONS)

Sublicensing allowed: No

Datasets:

  1. Diabetes Prevention Programme for ONS
  2. Emergency Care Data Set (ECDS)
  3. Hospital Episode Statistics Accident and Emergency (HES A and E)
  4. Hospital Episode Statistics Admitted Patient Care (HES APC)
  5. Hospital Episode Statistics Critical Care (HES Critical Care)
  6. Hospital Episode Statistics Outpatients (HES OP)

Objectives:

Statutory purpose:

The Statistics Board requires an extract from the Diabetes Prevention Programme (DPP) Dataset held by NHS England, in order to carry out its functions in accordance with section 20 of the Statistics and Registration Service Act 2007 (SRSA). The legal gateway for this will be Section 45C of the SRSA 2007 (as inserted by section 80 of the Digital Economy Act 2017) which permits The Board to serve a Notice on a public authority requiring it to disclose information it holds in connection with its functions:

http://www.legislation.gov.uk/ukpga/2007/18/section/45C

To do so, the information so disclosed must be required by the Statistics Board for one or more of its functions as set out in the SRSA 2007 and the Census Act 1920. The Office for National Statistics (ONS), as executive arm of the Statistics Board, is described as the body exercising those functions and is Data Controller for the uses outlined in this agreement.

The SRSA (2007) states that the ONS’s objectives include ‘promoting and safeguarding the production and publication of official statistics that serve the public good, where serving public good includes informing the public about social and economic matters and assisting in the development and evaluation of public policy’. It also sets out the Board’s functions, which are the specifically referred to in section 45c of the amended SRSA. Notably they include, under section 20, that ONS ‘may produce and publish statistics relating to any matter relating to the United Kingdom or any part of it’. This includes the production of official statistics, experimental statistics and statistical research. Any use of the word research in this agreement is in this specific context, and does not imply otherwise.

Requirements made under section 45 must also be in line with a statistical statement of principles that has been approved by parliament:

https://www.gov.uk/government/publications/digital-economy-act-2017-part-5-codes-of-practice/statistics-statement-of-principles-and-code-of-practice-on-changes-to-data-systems

This states that ‘We will only seek access to data for the purposes of fulfilling one or more of our statutory functions, including to produce official statistics and undertake statistical research that meets identifiable user needs for the public good.’

The statement also sets out six principles to which ONS will adhere when requiring information under section 45; they state that ONS will:
• safeguard confidentiality
• be transparent about what data it is accessing and why
• ensure accessing the data is lawful and meet strict ethical standards
• ensure that accessing the data is in the public interest - for example that the data are fit for purpose for the statistical use which ONS intends
• ensure requiring that the data be supplied is proportionate – for example, ONS will have exhausted possible alternatives
• seek to collaborate with suppliers at all times

Using robust information governance processes, ONS has determined that the conditions associated with requiring data under section 45c of the amended SRSA have been met for the information in this data sharing agreement. This process included working closely with NHS England’s experts to help determine that the data would be fit for purpose to meet the proposed statistical purposes. This work guided ONS’s assessment against some of the principles underpinning its legal powers – for example whether sharing the data is in the public interest, and proportionate in terms of burden on the supplier. In addition, as part of its commitment to transparency, ONS will publish full details of the reasons for acquiring the information, and ONS notes that NHS England will also publish this data sharing agreement. In terms of public interest, it is worth noting that the benefits gained from the statistics enabled by this data share do not need to be specific to health and social care when data are flowing under section 45 of the SRSA, although for this particular project the benefits should meet such a test.

To protect patient confidentiality, ONS has conducted a full Data Protection Impact Assessment (DPIA) for all of the NHS England health data that it controls and processes. This will apply to these data which are similar in nature and sensitivity to the NHS England health data that ONS already holds.

The following are some of the key mitigations ONS employs for the data protection risks identified:
• The technical and procedural protections of the ONS secure data environment
• ONS staff have high levels of training and security clearance, and it is a criminal offence under the Statistics and Registration Service Act 2007 to disclose personal information held by ONS
• The data will be de-identified at the earliest opportunity and those conducting data linkage will be separate from those conducting analysis using linked de-identified attribute information
• Analysts will never seek to re-identify subjects and
• ONS is only interested in producing aggregate statistics for the public good

The data shared with ONS under this agreement will not be onwardly disseminated or shared, except as disclosure controlled aggregate statistics and/or analysis as aggregated data with small numbers suppressed, in line with the relevant disclosure rules for the dataset(s) from which the information was derived. Any exceptions to this would require additional NHS England approval. It would also require an appropriate alternative legal gateway, because section 45c of the SRSA as amended by the Digital Economy Act only enables data to be shared with ONS (not for example, other Government departments or academic researchers).

The rest of this section will set out the specific purposes for which ONS requires the dataset under this data sharing agreement.

In future, should ONS decide to put the dataset to new uses not explained below, the new use will be in line with ONS’s legally defined functions, and ONS will inform NHS England and enter into an amended Data Sharing Agreement before proceeding with that new purpose.

The statistics ONS produces are driven by user needs. Often these user needs come from Government departments who are seeking better evidence to inform decision making in an emerging or increasingly high priority policy area. During and since the pandemic, there has been an increase in economic inactivity – particularly due to ill health – and ONS are uniquely placed to produce statistics that will provide better evidence about what is happening. This includes the impact of health on labour market participation, and vice versa. The ONS intends to use the Data for its health and labour market statistical work programme. Stakeholders such as the Treasury, Cabinet Office, DWP and DHSC are interested in ONS producing such statistics, and ONS has initiated a programme of work to produce new statistics in response. Part of this work programme requires the acquisition, linkage and analysis of the diabetes prevention programme (DPP) data.

The DPP, also known as the Healthier You programme, identifies people at risk of developing type 2 diabetes and refers them onto a nine-month, evidence-based lifestyle change programme. Participants receive personalised support to manage their weight, eat more healthily and be more physically active – which together have been proven to reduce a person’s risk of developing type 2 diabetes. Research shows the Healthier You NHS Diabetes Prevention Programme has reduced new diagnoses of type 2 diabetes in England, saving thousands of people from the potentially serious consequences of the condition. It cuts the risk of developing type 2 diabetes by more than a third for people completing the programme.

DHSC and NHS England would also like to understand whether the programme impacts on the labour market participation of subjects, mediated by improved health status. ONS can produce statistics on this by combining the DPP data with other data it holds on employment and benefits – this will allow ONS to produce figures on changes in labour market participation for those who successfully completed the programme, vs a control group of people who did not complete the programme.

The other data that will be integrated with the DPP data to determine the labour market outcomes are the Benefits and Income Dataset (BIDS), which the Department for Work and Pensions share with ONS, and Pay As You Earn (PAYE) data which HMRC shares with ONS. In both cases, the data are shared with ONS under section 45A of the SRSA for the production of official statistics. And in both cases, these data are deidentified and linked to the ONS demographic index (a method to enable onward linking to other sources without the need for direct identifiers) before any integration with other data sources (including health data sources as per this agreement) occurs.

The following NHS England Data will also be accessed and integrated to enable ONS to fulfil the purpose outlined above:
- Diabetes Prevention Programme
- HES Admitted Patient Care
- HES Accident & Emergency
- HES Outpatients
- HES Critical Care
- Emergency Care Data Set

The level of Data will be identifiable – Linkage to other sources at a record level is a prerequisite to success for the proposed uses, and therefore identifiers are required; as a minimum, NHS number, but other identifiers such as date of birth will be included where available as these will help quality assure whether links made with other datasets based on NHS number matching are indeed the same subject.

ONS sought advice from NHS England analysts who work with the DPP dataset and have established that all variables collected by NHS England on the Diabetes Prevention Programme are required to fulfil the purpose outlined in this agreement. Data is required from the start of the collection of DPP to latest available at time of extraction.

ONS is the controller as the organisation responsible for ensuring that the Data will only be processed for the purpose described above. Although the health and labour market statistical work programme is currently sponsored by the Treasury, the Treasury will not carry out any controllership activities. The Cabinet Office, Department for Work and Pensions and Department for Health and Social Care are all stakeholders in this work. Analysts and data experts from these Departments may provide advice, but will never access the data. ONS retains its independence to ultimately determine what statistics are produced and how they are presented and published. Data will be accessed by substantive employees of ONS who have the relevant security clearance.

The purpose and use of these datasets, has been approved by the independent National Statistics Data Ethics Advisory Committee (NS-DEC).

The lawful basis for processing personal data under UK GDPR is:

Article 6(1)(e) - The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Where the official authority for ONS to produce, promote and safeguard official statistics is found in the Statistics and Registration Service Act 2007.

Article 9(2)(j) - The processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The health and labour market statistical work programme is currently funded by the Treasury and potentially other funding bodies in the future. Some of the costs incurred will be covered by bespoke additional funding from the Treasury, which is additional funding beyond standard ONS baseline funding from the Treasury, for example, the Treasury’s Shared Outcome Fund. The Cabinet Office, Department for Work and Pensions and Department for Health and Social Care are all stakeholders in this work. Analysts and data experts from these departments may provide advice, but will never access the data.

Crown Hosting Data Centres Limited (CHDC) is a processor acting under the instruction of ONS. CHDS role is limited to the supply of infrastructure on which the Data is stored. CHDC do not access the Data.

Expected Benefits:

As per section 5a, the legal gateway under which data will flow from NHS England to ONS will be Section 45c of the SRSA 2007 (as amended by the Digital Economy Act 2017). This means ONS can require that data are shared as long as the data are required for its functions, and the share is in line with the statistical statement of principles that underpins these powers.

These considerations include that the purposes to which ONS puts the data must be in the public interest and serve the public good. However, for this legal gateway, the benefits do not need to be to health and social care specifically. This is unlike some other legal gateways under which NHS England data can be disseminated, for example section 251 of the NHS Act 2006, when research outcomes must benefit health and social care.

In the above context, the following will briefly cover the potential benefits:

The statistics produced are expected to provide better evidence on the impact of health on labour market participation, and vice versa, to policy and decision makers at the stakeholder Government departments (Treasury, DHSC, DWP). They will then use this evidence as part of their decision making about policy development/change. For the Diabetes Prevention Programme, this could provide better evidence of the impact of the programme and help optimise its design moving forward, for the benefit of patients – e.g. by helping them back into work.

The mechanism by which these benefits could be achieved is as described – by providing better evidence to policy makers, this could affect decisions made about policy design, thereby changing (improving) relevant public/health service provision.

ONS has a wide range of stakeholders and partners in the health statistics arena beyond Government departments. For example, think tanks and charities. ONS will ensure all relevant partners are made aware of these statistics once produced. As noted in section 5c, the outputs may include blogs and social media for the general audience, as well as papers in academic journals aimed at the scientific community, which will assist in maximising reach.

Outputs:

The data will be used to produce official statistics. These will be released on the ONS website in the form of a statistical bulletin and statistically disclosure controlled aggregate data tables, and potentially in peer-reviewed scientific journals. Headline results may also be published on social media, and within a blog on the ONS website.

The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.

These projects are funded until March 2025. Some outputs may be released before then. Some outputs may also be released later than this – e.g. if most /all of the statistical work is complete and all that is required is finalising the figures and arranging for publication.

However, notwithstanding that plan, it is possible additional/extended funding for the wider health and labour market work programme will be received. If that occurs, and the projects and use of these data are extended, then ONS will inform NHS England.

Processing:

No Data will flow to NHS England for the purposes of this Data Sharing Agreement.

NHS England, via the South West Data Services for Commissioners Regional Office (DSCRO), will provide the relevant records from the Diabetes Prevention Programme. The Data will contain directly identifying data items including (NHS Number, postcode and date of birth) which are required to link the Data at record level with data already held by ONS.

The Data will be stored on servers at ONS within an assured ONS data analysis environment that includes the following elements of security control:
• Need to know access applied through user account access and management.
• Access to the data is restricted to individuals granted access on the basis of a justified need to access the data
• Controlled ingest and export of data into/out from the environment
• Controlled account access using unique credentials based on job role
• Logged and monitored access of user activity within the environment
• Secure build configuration for infrastructure
• Vulnerability tested infrastructure with appropriate remediation and patching
• Compliance checks against security enforcing controls
• Architectural review against standards and best practice
• Staff security cleared to the appropriate level based on their supervised and/or unsupervised access to sensitive data in accordance with ONS clearance policies and data access processes
• Education and awareness of environment users covering security policies and secure working practices
• Operational support processes to securely manage the environment
• Risk assessment to identify security risks and mitigation actions to reduce this risk.

ONS Secure Data Environment users set up 'project spaces' and apply for access to data through the Information Asset Owner. Each 'project space' includes only the data required to carry out their analysis and only the users who require access to that data. Users will not be permitted to access identifiers for the purposes of analysis. ONS will keep the number of staff permitted to process identifiers to an absolute minimum, and these staff will have a higher level of clearance. All other staff will only be permitted to access non-identifying data.

Access is via the ONS Secure Data Environment will only do so via their ONS issued hardware. This may include access on ONS sites, or when working from home via VPN. All ONS users of the ONS Secure Data Environment have high levels of clearance, training and sign an auditable SyOps document with conditions of use of the environment.

For remote access:
- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;
- Access controls granting users the minimum level of access required are in place;
- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;
- Multifactor authentication (MFA) is required for remote access;
- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;
- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

The Data will not leave the UK at any time.

Access is restricted to employees of ONS. Following policy specified by the ONS Chief Security Officer, ONS user access to the data environment is only after approval of an application by the Information Asset Owner. A list of approved users is available for NHS England to request as required. All personnel accessing the Data have been appropriately trained in data protection and confidentiality. Staff accessing identifiable data have a higher level of security clearance.

The Data will be linked at person record level with HES and ECDS Data provided under separate Agreements with NHS England (DARS-NIC-175120-W5G2X and DARS-NIC-400304-S1P1B), ONS mortality data, Census data, and data on employment and benefits from the Benefits and Income Dataset (BIDS) provisioned to ONS by the Department for Work and Pensions (DWP), and the Pay As You Earn (PAYE) dataset provisioned to ONS by the HMRC, to achieve the statistical purposes. The key derived variables that ONS will link include: PAYE employee status, gross employee pay and maybe working hours (from HMRC) and benefits status and amount of benefits received (from DWP). These would be linked using Census ID to encrypted NINo (HMRC) and Census ID to CIS ID (DWP) look-up tables.

ONS is only interested in producing aggregate statistics and using these to uncover trends and other useful insights based on the non-identifiable 'attribute' information.

Only statistical disclosure controlled aggregate outputs will be exportable from the secure data analysis environment. Other than the initial transfer of the data from NHS England to ONS, the identifiable data will never be in transit and will always be protected by procedural controls in place.

To protect patient confidentiality, ONS has conducted a full Data Protection Impact Assessment (DPIA) for the NHS England health data that it controls and processes. This will apply to these data which are similar in nature and sensitivity to the NHS England health data that ONS already holds. The following are some of the key mitigations for the risks identified:
• The protections of the ONS secure data environment
• ONS staff have high levels of training and security clearance, and it is a criminal offence under the Statistics and Registration Service Act 2007 to disclose personal information held by ONS
• The data will be de-identified at the earliest opportunity and those conducting data linkage will be separate from those conducting analysis using linked de-identified attribute information
• Analysts will never seek to re-identify subjects and
• ONS is only interested in producing aggregate statistics for the public good

Analysts from the ONS will analyse the Data for the purposes described above.

COVID-19 Vaccinations Survey – Over 80s — DARS-NIC-434738-K7Z9L

Type of data: information not disclosed for TRE projects

Opt outs honoured: Yes - patient objections upheld, Identifiable, Yes (Statutory exemption to flow confidential data without consent)

Legal basis: Other - COPI Notice - Regulation 3(3) and 3(1), Other-COPI Notice - Regulation 3(3) and 3(1)

Purposes: No (Research, Agency/Public Body)

Sensitive: Non Sensitive, and Non-Sensitive

When:DSA runs 2021-02-10 — 2021-09-30 2021.01 — 2021.02.

Access method: One-Off

Data-controller type: OFFICE FOR NATIONAL STATISTICS (ONS)

Sublicensing allowed: No

Datasets:

  1. Demographics

Objectives:

During the national COVID-19 - SARS-CoV-2 vaccinations programme, patients in England who are aged 80 years or over were offered a vaccination as part of cohort 2, as detailed in the JCVI Greenbook Chapter 14a.

The Office for National Statistics (ONS) would like to survey a sample of persons aged 80 years or over in order to gather behavioural insight and attitude information of individuals that are likely to have been offered the vaccines, to inform public messaging around vaccinations and public health strategies.

ONS are requesting demographics data from NHS Digital to enable sampling for the COVID-19 vaccination survey. ONS do not have patient contact details. The data provided to ONS will be used to invite individuals to take part in the survey. This is a non-direct care purpose, to inform vaccination policy which is an important part of the COVID-19 pandemic response.

The COVID-19 Vaccination Survey will collect behavioural insight and attitude information of individuals that are likely to have been offered the vaccines. There is a need for timely information research in this area to inform public messaging around vaccinations and public health strategies.

Policy questions:
• Has being vaccinated, affected behaviours and adherence to guidance? For example, meeting grandchildren
• Attitudes to risk once vaccinated (control group being OPN)
• What are the reasons why a vaccine was not accepted?
• What are the characteristics of those accepting or rejecting the vaccine?

The purpose of the data collection is covered by the COVID-19 Public Health Directions 2020, 17th March 2020:
•understanding information about patient access to health services and adult social care services as a direct or indirect result of COVID-19 and the availability and capacity of those services
•monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
•delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services

ONS are data controller who will also process the data. The GDPR legal bases for dissemination are Article 6(1)(c) - legal obligation by virtue of COPI notice, Article 6(1)(e) - public task (statutory function for delivery of NHS Service Pharmacy, Services, Charges and Processing) and Article 9(2)(g) - substantial public interest (plus Part 2 Sched 1 DPA18, para 6 statutory and governmental purpose).

Data items and the number of records provided have been limited to the minimum required through consultation between NHS Digital and ONS.

Expected Benefits:

ONS will provide survey results to the Department of Health and Social Care who will use the survey outputs for policy planning/vaccination planning in relation to Covid-19.

There is a significant public benefit to this research. It will provide evidence of the opinions held and the current behaviours being exhibited by those in the over 80-year-old cohort. It will provide evidence of what this cohort is thinking and experiencing in relation to the vaccine, reasons for getting vaccinated or not getting vaccinated and whether they are continuing to comply with self-isolation guidance etc.

Understanding more about this demographic will allow policies to be created to support them further in staying safe during the Covid-19 pandemic. It will enable greater understanding of the reasons held by and the characteristics of those refusing the vaccine. This will help the government to understand what factors may be preventing individuals in this age group from obtaining a vaccination, who they need to target and how to increase uptake of the vaccine. This is all for the purpose of trying to reduce the transmission of the Covid-19 virus.

Outputs:

The NHS Digital data will be used to send surveys to participants.

Processing:

A subset of the PDS will be disseminated dependent on matching to the criteria provided by ONS. Data to be disseminated - for persons aged 80 and over only:
• Title
• First name
• Surname
• Age
• Gender
• Home address (including postcode)
• City
• Region
• Telephone number(s)

Exclusions: records with formal and informal deaths will be excluded from the sample provided to ONS.

Title, name and home address are required for the ONS to be able to send invitation letters and check that they are in contact with the correct person. Telephone number is required in order to contact the individual for the actual interview. Age is required to ensure that the individual is over 80 years of age. Gender, age and city/region are used to sort and stratify the sample to ensure that it is representative. Gender and age will also be used for weighting responses.

In order to achieve a sample of 2-3,000 and 30% response-rate, 7,000 surveys will need to be issued. To ensure the survey delivers statistically viable results ONS are preparing a suitable methodology and will advise on the number they require. To avoid strain on care staff and maximise the sample that have good levels of mental capacity care home residents will be avoided if possible. Therefore, those where residence indicates care home or age is less than 80 will be removed from the frame before sampling.

This information relates to health only by virtue of the sampled persons being called for vaccination as part of the COVID19 vaccination programme.

Data subjects may be concerned about the risks of identification or the disclosure of information. There is a low risk of the misuse of data accessed by individuals working within ONS. To mitigate the risk of data misuse, ONS will:
• Limit access to personal data to members of ONS involved in survey
• Limited personal data shared with telephone interviewers to names and contact details of participants
• Ensure all individuals with access are bound by their duty of confidentiality and have undergone relevant IG training;
• Staff contracts and mandatory training
• All data processors have GDPR compliant DPAs or equivalent contractual arrangements with the data controller
• Contract/MOU in place regarding research study
• All ONS staff are cleared through advanced vetting. Security Check (SC) level for people regularly working with sensitive data, especially in bulk through large extracts or entire data sets.
• Mandatory Hut Six training on information security.

This record level data is being disseminated to the Office of National Statistics (ONS).

Data will be stored and processed in the UK only. There will be no onward sharing of the data by the recipient.

ONS will need to have access to a sample extract each wave. The frequency and number of waves is to be confirmed however the cohort spec and sample size will remain the same in each wave. Data will be disseminated to ONS as soon as approval is provided. Future requirements to be confirmed and the agreement will be amended to reflect any further releases of data.