How we use patient data

Updated February 2022

This notice is to tell you about why and how The Health Foundation processes data about patients.

The Health Foundation is an independent charity committed to bringing about better health and health care for people in the UK. As part of our work, we apply for and are granted access to data about patients and their experiences in the health service, to enable us to conduct in-depth analysis for specific, approved projects. Having access to patient data allows the Health Foundation to analyse the impact of new initiatives and to gain insights on trends in people’s health and care in order to drive learning and improvement.

Our activities extend across three key work streams:

• Improving health service delivery
• Making health policymaking more effective
• Promoting healthier lives for all

The data used as part of our projects comes from different data suppliers. These data suppliers include NHS Digital, NHS England and the Medicines and Healthcare Products Regulatory Agency, among others.

The data we access about patients tells us about:

• when they have visited hospitals and their GP practices
• any operations and treatments they have received 
• experiences of health and social care services such as care homes and the 111 non-emergency phone number for medical help

When we apply to access data about patients from these organisations, we are required to make a formal application. In the application, we have to explain what data we would like to access, why we want to access them, how we will use the data (e.g. analysis techniques) and what our outputs will be (such as journal publications, official reports). We must:

• Demonstrate that we have a legal basis for accessing and using the data, under the UK General Data Protection Regulation (UK GDPR). See legal basis section.
• Describe our robust data protection systems to look after the data
• That at the end of the project, we can and will securely destroy the data; and that we can confirm and demonstrate this

All the information we hold on patients is de-personalised. This means that we can’t tell who the patients are, because we never receive names, addresses or patients’ NHS numbers. We only hold data about patients and their journey in the health service to do our analysis. Examples include data about how long patients stay in hospital, what they are diagnosed with, and some basic demographic information such as age, gender and ethnicity. More information about patient data and how they can be used for analysis can be found at the Understanding Patient Data website.

Maintaining data security

We are committed to keeping the data we analyse about patients safe and secure, therefore we will always use state-of-the-art infrastructure, which is properly assessed, to store and access any sensitive data.  Our secure remote data centre, the Secure Data Environment (SDE), is the key part of this ensuring among others that the data we hold are never transferred outside the UK. The SDE is accredited to two standards: the NHS Digital Data Security and Protection Toolkit and the ISO27001 Information Security Management standard. Both of these standards are about ensuring we have the right controls in place for protecting data.  They also list procedures and policies that we should have in place and follow.  We are audited against both standards every 6 months.  

All staff, contractors and other researchers that support our work by working on these data in our SDE must undergo Information Governance training and sign an appropriate Non-Disclosure Agreement promising to maintain the confidentiality of the data even when they are working from home. We check all of the work produced before it leaves our secure system to make sure that patients can’t be identified. At the end of each project the data will be securely destroyed in accordance with our contract with data owners. 

We employ a number of data professionals to help manage the data we use.  Their job is to receive the data, and make sure that the right analysts have access to data for the correct projects. They are also responsible for ensuring that the data is destroyed when projects have been completed, in line with the Data Sharing Agreements that are in place with the organisations we receive data from.

Who at the Health Foundation uses patient data?

Improvement Analytics Unit

The Improvement Analytics Unit is a partnership between NHS England and the Health Foundation, which provides rigorous data analysis to determine whether new ways of delivering care are having an impact.

The Improvement Analytics Unit analyses patient data through the Secure Data Environment. All staff with access to the environment, whether employed by The Health Foundation or NHS England, have to complete information governance training and are contractually bound to maintain patient confidentiality. View a list of publications where we have used data about patients

In-house analytics team

The In-house analytics team use data about patients for a variety of projects. Our work examines various aspects of health, health care, and social care, for example using data to investigate how well the health service cares for care home residents, patients with multiple health conditions, or those from deprived areas. We also design and create new data initiatives, such as the Networked Data Lab, to ensure that the UK has the data assets it needs to improve health. View a list of publications where we have used data about patients

REAL Centre

The REAL Centre (Research and Economic Analysis for the Long term) provides independent analysis and research to support better long-term decision making in health and social care. The team use data about patients to look at forecasting future demand caused by having a condition (for example diabetes) or a combination of conditions and the pressure this puts on the health service in terms of activity and costs, as well as looking at the cost of providing services in hospitals (e.g. routine operations). View our publications

We do not pass on any of the data we have received to any third-parties, including academic organisations, health care organisations (including public sector) or commercial companies.  We simply do not pass on data to others.

The Health Foundation has restricted access to these data under a Control of Patient Information (COPI) notice. The Secretary of State for Health and Social Care has issued NHS Digital with a Notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) to require NHS Digital to share confidential patient information with organisations entitled to process this under COPI for COVID-19 purposes.

Because all patient information we hold is de-personalised, we cannot identify individuals from the data. For this reason, we cannot respond to subject access requests, or apply one's 'right to be forgotten'. To find out more about what we mean by depersonalisation, please visit this resource on Understanding Patient Data. For information about your rights concerning data, you can visit the Information Commissioners website.

The legal basis for processing the data we hold

In order to work with the data we hold, the Health Foundation is required to have a legal basis for accessing personal and special category data to comply with Article 6 and Article 9 of the General Data Protection Regulation (GDPR). 

Our legal basis under Article 6 is ‘legitimate interest’. Our legitimate interest for using these data is grounded by the fact that as a health research institute, we are interested in using patient and other data to improve health, healthcare, and the health service. We do not think that anybody would be too surprised to find out that an institution such as ours, would apply to access such data for the purposes of improving the healthcare and health outcomes. The purposes stated in all of our applications to access patient data are, broadly, to lead to improved outcomes of health and better delivery of healthcare services.

Our legal basis under Article 9 is condition J, which allows us to work with special category data if it is necessary for scientific research purposes. As part of this condition, we must also have measures in place to protect the patient data; our secure data environment, accreditation, and security policies, are examples of how we meet this requirement.

Often, there may be ethical considerations about how we use patient and other data. This may depend on the subject of the analysis we are attempting to undertake, and therefore the data about the individuals used for these analyses.  Some subjects may be topical, and may be in the news, and therefore there may be some nervousness about the subject we are analysing; however, we will only undertake analyses if they fall into our mission of improving health and healthcare and healthcare delivery. Often, we are trying to provide evidence to add to the debate about how the health service is managed, and therefore the topics we use personal and special category data to analyse may weigh heavily in the public conscious.

Acknowledgements

We would like to thank our patient partners for their help and advice putting the contents of this page together. We are committed to working with the public and patients wherever possible.

Contact us

If you believe that we have misused data or wish to complain about our policies or procedures, you are entitled to lodge a complaint with a supervisory authority. The ICO is the supervisory authority for the use of data in the UK. Please see their website for more information.

If you have any concerns about how your personal data is being collected and processed, or wish to exercise any of your rights detailed in our Privacy Notice please contact:

The Health Foundation Data Protection Officer (DPO)

The Health Foundation

8 Salisbury Square

London

EC4Y 8AP

DPO@health.org.uk