Privacy Notice - OpenSAFELY COVID-19 and Data Analytics Services

Summary of how data will be used

The NHS OpenSAFELY Data Analytics Service Pilot (referred to as the Service) provides a secure analytics service for Approved Users (academics, analysts and data scientists) to access pseudonymised GP and NHS England patient data for Approved Projects, this includes:

1. 1. 1. 1. clinical audit;
         2. service evaluation;
         3. health surveillance;
         4. research;
         5. evaluation of the Service; and
         6. health and social care policy, planning and commissioning purposes and public health purposes, where agreed on a project specific basis by or on behalf of:
            1. 1. 1. the Department of Health and Social Care,
                  2. NHS England, and
                  3. and a nominated representative of each of the Royal College of General Practitioners and the British Medical Association on behalf of the Joint GP IT Committee

The Service uses OpenSAFELY open-source software tools (OpenSAFELY Platform), a Trusted Research Environment, which was developed by the Bennett Institute in collaboration with the Electronic Health Record (EHR) research group at the London School of Hygiene and Tropical Medicine, NHS England, and the GP System Suppliers (GPSS). The Service uses the OpenSAFELY Platform to run project analysis code on pseudonymised GP, pseudonymised NHS England patient data and specific external data providers’ pseudonymised data, which is held within TPP or Optum (formerly EMIS).

Data Controller contact details

Flansham Park Health Centre, 109 Flansham Park, Felpham, Bognor Regis , West Sussex, PO22 6DH

Data Protection Officer contact details

The Practice Data Protection Officer role is covered by the NHS South, Central and West (NHS SCW) Information Governance team who can be contacted via the Surgery.

Purpose of the processing

NHS England has been directed by the government to establish and operate the OpenSAFELY COVID-19 Service and the OpenSAFELY Data Analytics Service. These services provide a secure environment that supports research, clinical audit, service evaluation and health surveillance for COVID-19 and other purposes.

Each GP practice remains the controller of its own GP patient data but is required to let approved users run queries on pseudonymised patient data. This means identifiers are removed and replaced with a pseudonym.

Only approved users are allowed to run these queries, and they will not be able to access information that directly or indirectly identifies individuals.

Lawful basis for processing

UK GDPR – Article 6 basis:

UK GDPR Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject (the Directions).

UK GDPR Article 9 basis:

UK GDPR Article 9(2)(g) - processing is necessary for reasons of substantial public interest, on the basis of domestic law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject, by virtue of compliance with a direction  supplemented by:

Patients who do not wish for their data to be used as part of this process can register a type 1 opt out with their GP.

Here you can find additional information about OpenSAFELY."

Processor

NHS England, The Phoenix Partnership (TPP)