NHS Digital Data Release Register - reformatted

Uk Haemophilia Centre Doctors' Organisation projects

6 data files in total were disseminated unsafely (information about files used safely is missing for TRE/"system access" projects).


MR328 - HAEMOPHILIA MORTALITY STUDY — DARS-NIC-148030-Q5N4D

Opt outs honoured: Identifiable, Yes (Consent (Reasonable Expectation), Section 251 NHS Act 2006)

Legal basis: , Health and Social Care Act 2012 - s261(5)(d), Health and Social Care Act 2012 – s261(2)(c), Health and Social Care Act 2012 – s261(7)

Purposes: (Society)

Sensitive: Sensitive

When:2021.12 — 2022.03. DSA runs 2013-07-31 — 2020-06-30

Access method: Ongoing, One-Off

Data-controller type: UK HAEMOPHILIA CENTRE DOCTORS' ORGANISATION

Sublicensing allowed: No

Datasets:

  1. MRIS - Cause of Death Report
  2. MRIS - Cohort Event Notification Report
  3. MRIS - Flagging Current Status Report
  4. MRIS - Members and Postings Report
  5. Civil Registration - Deaths

Yielded Benefits:

Expected Benefits:

In adherence with UKHCDO's service level agreement with NHS England, Scotland and Wales (policy makers), UKHCDO/NHD is required to provide annual cyclical reporting on mortality data to assist these organisations with national strategic healthcare planning and disease monitoring.

There are a number of outputs which include reports and academic studies that will provide direct benefit to patients and those clinicians that are treating them, in meeting their objective to identify groups at risk. These reports and studies will also show which treatments are most beneficial to patients and cost effective. The benefits will be measured in terms of reduced morbidity, mortality and treatment costs.

The death certification data allows UKHCDO to study trends in causes of death and in life expectancy as improvements in treatment are introduced. This would help to evaluate and justify therapeutic developments. Death is also an important end-point in pharmacovigilance since some treatments, for example, Emicizumab, currently being widely introduced as prophylaxis against bleeding in Haemophilia A, may increase deaths from heart attack and stroke whilst reducing the risk of death from haemorrhage.

Further, the Health Protection Agency expect UKHCDO to provide a report to them every six months on any cases of Jacob Kreuzfeld Disease or variant Jacob Kreutzfeld disease. Furthermore, UKHCDO also have to collate data on deaths from complications of other blood born viruses such as hepatitis B and C and HIV and report these to NHS England, various public Inquiries and publish this data in anonymised aggregate form.

The NHD has provided information to the Infected Blood Inquiry investigating morbidity and mortality due to HIV and hepatitis C in patients treated with certain blood products.
Products to treat bleeding disorders are amongst the most expensive in the NHS, therefore potential savings that can be realised would be extremely significant. UKHCDO works closely with NHS England through the Clinical Reference Group (CRG) for Haemophilia. In collaboration with the CRG and the Commercial Medicines Unit, UKHCDO have been very successful in securing national contracts for factor concentrates and, in so doing, have achieved substantial savings for the NHS.

The continuation of these activities relies on the continued collection of complete and accurate data, including reliable mortality data.

Outputs:

UKHCDO plan to submit a full renewal to this agreement to receive further data once the application has been amended in line with the current NHS Digital DARS Standards. Over the course of this renewed agreement, NHD will continue to report to the Department of Health, Health Protection Agency, NHS England and NHS Scotland and Wales on mortality and causes of death for patients with bleeding disorders.

Reports to Health Protection Agency are produced every six months. Reports submitted to NHS England, Scotland and Wales are produced quarterly in our annual report and through Dashboards. All reports are on anonymised aggregate data (with censorship of low numbers in line with Caldicott guidelines).

UKHCDO expect to be able to analyse and report in peer review journals the effect of new therapeutic developments on the natural history, life expectancy and causes of death. Examples of these new developments are as follows: -
a. Introduction of intensive factor VIII and IX prophylaxis.
b. Introduction of extended half-life factor VIII and IX products.
c. Introduction of effective antiviral therapy for hepatitis C.
d. Introduction of Emicizumab, factor VIII mimetic haemophilia A prophylaxis.
e. The introduction of gene therapy.

See previous publications below
References (Previous publications using Death Certification Data):
1. Darby SC, Kan SW, Spooner RJ, Giangrande PL, Hill FGH, Hay CRM, Lee, CA, Ludlam CA, Williams M. Mortality Rates, Life expectancy and causes of death in people with haemophilia A or B in the United Kingdom who were not infected with HIV. Blood 2007, 110 (3), 815-25.

2. Darby SC, Keeling DM, Spooner RJ, Wan Kan S, Giangrande PL, Collins PW, Hill FGH, Hay CRM. UK Haemophilia Centre Doctors Organisation. The incidence of factor VIII and Factor IX inhibitors in the haemophilia population of the UK and their effect on subsequent mortality 1977-99. J Thrombosis and Haemostasis 2004, 2 (7): 1047-54.

3. Darby SC et al. Multiple authors including Hay CRM. Mortality before and after HIV infection in the complete UK population of haemophiliacs. Nature 1995, 377 (6544) 79-82.

4. Darby SC et al. Incidence of AIDS and excess of mortality associated with HIV in haemophiliacs in the United Kingdom: report on behalf of the directors of haemophilia centres in the United Kingdom. BMJ 1989; 298: 1064-68.

Processing:

This is a short-term extension to retain, but not otherwise process the data that is already held. The description of processing here covers historic processing.

UKHCDO received flows of mortality data for patients held within NHD where consent has been received for the collection of this data. UKHCDO have previously received this data under the dataflows described below on a quarterly basis:

a) UKHCDO provide NHS Digital, securely, with the following identifiers for all consented NHD registrants with bleeding disorders:

• NHD registration number - Unique identifier to enable linkage between a patient
• NHS number or CHI (Scotland NHS equivalent) number (to identify patient and perform linkage)
• Forename – to confirm identity of patient (complementary to or in absence of NHS number)
• Surname – to confirm identity of patient (complementary to or in absence of NHS number)
• Date of Birth – (to calculate age at diagnosis and age at death)

b) NHS Digital traced patients using UKHCDO identifiers and provide UKHCDO with mortality data for patients where an instance of mortality has been recorded since the previous quarterly drop.

c) NHS Digital data was transferred to UKHCDO via secure file transfer and stored on N3 servers hosted at Leigh NHS Data Centre operated by Greater Manchester Shared Services.

• There are four levels of security before you can physically reach the servers:-
o Secured Perimeter
o Facility Building Access Control
o Computer Rooms with secured access
o Secured server cabinets

• All access to NHS Digital data was performed by substantive employees of the Data Controller via restricted access to approved processors.

• VPN restricted access control with all data transferred from sites encrypted using industry standard SSL 4096 bit encryption

• Access to data held on servers is restricted to authorised personnel who undergo information governance training in accordance to the NHS DSPT toolkit. This is reviewed and reassessed on an annual basis as required by the DSPT toolkit. Caldecott inspection of the database and its security arrangements is regularly carried out see UKHCDO website for details.

• Restricted VPN access for authorised personnel only. High entropy password protected and only accessible via the NHS network (N3)

• Data is only accessed directly from the N3 servers and is not transferred

• Staff are trained on access to data and backups are kept in the event of an error occurring

• All systems and operating systems automatically patched with the latest windows updates incorporating inbuilt virus protection

• Systems and their databases (Inc. updates) are replicated across mirrored servers held in separate data centres at 15 minute intervals. In addition to this full SQL database backups are carried out nightly and these are also mirrored across the servers

d. The data is pseudonymised using NHD registration number prior to it being presented to statisticians for analysis. Access to the pseudonymised data is by named individuals within NHD and all are employees of the UKHCDO. Once the data has been pseudonymised, no attempt will be made by UKHCDO to reidentify any patients using the data.

e. Once pseudonymised, factors influencing mortality are studied using incident rate ratios estimated using Poisson regression. Death rates from specific causes are compared with national mortality rates (derived from World Health Organization data) using standardised mortality ratios.

Necessary steps have been taken with the identifiable data being released by NHS Digital to minimise the risk of identification. Prior to NHS Digital releasing the identifiable data it has been minimised to cohort participants and data periods. Once the data is released to the NHD it is pseudonymised prior to presentation to our statisticians for analysis and only fully anonymised aggregate reports are disseminated or published. NHD and NHS Digital data is not accessed by the Regional Health Authority at Leigh Infirmary and is only held on their systems to be accessed by UKHCDO staff.

Our data sharing agreement does not permit sharing of the data with third parties except in the form of aggregated anonymised outputs with small numbers suppressed.

Processing
This agreement permits continued retention of the data only. The agreement does not permit any other processing of the data.

UKHCDO must inform NHS Digital DARS team if, when the DSPT is reviewed by NHS Digital, it is deemed to have not passed or if any issues are raised with the submission.
If, after a DSPT review by NHS Digital, UKHCDO are required to carry out improvements (as stipulated in the review) these will be carried out within 3 months of the review date.
UKHCDO must subsequently maintain their DSPT (or subsequent versions / successors) during the period of this DSA.
Meeting these security controls as set out within these special conditions is a requirement of this Data Sharing Agreement, and UKHCDO must inform NHS Digital if these criteria are not met

NHS Digital reminds all organisations party to this agreement of the need to comply with the Data Sharing Framework Contract requirements, including those regarding the use (and purposes of that use) by “Personnel” (as defined within the Data Sharing Framework Contract ie: employees, agents and contractors of the Data Recipient who may have access to that data).