Data Decision Tool

Guidance on data usage for Artificial Intelligence and Data-Driven projects

About this tool

The tool applies to studies that involve the reuse of data held by health and care service provider organisations.

This data decision tool helps you understand the privacy, legal, ethical and regulatory considerations associated with the use of health and social care data. It is designed to help you consider the right type of data for your study and to provide first insights into your regulatory approval requirements.

This tool is primarily aimed at early-stage innovators and developers in artificial intelligence (AI) and machine learning, as well as new researchers in health and social care.

The tool provides a generalised overview of the regulatory and data governance landscape and is not intended to offer solutions to complex and intricate scenarios associated with the development or adoption of AI and data-driven research, nor provide specific advice on your research study protocols.

Recommended Preparation

Review our short data reference to familiarise yourself with terminology and legal definitions related to health and care data
Write up a description of the data you need (for example parameters, variables and fields that are required for your study) and contact data controllers and information asset owners you have already identified to assess what is required to access their data.
Explore health data catalogues e.g. Health Data Research Innovation Gateway to assess the availability of curated datasets for your research study.

Start now

Across the UK there are national differences in the approvals application framework that you must consider depending on the geography of your intended study.

England and Wales

If your project involves access to identifiable patient or social care data relating to living people and receiving care and treatment, in England and Wales without consent, you may need to apply to the Health Research Authority (HRA) to process data without consent involving review by the Confidentiality Advisory Group (CAG).

The CAG is an independent body that provides expert advice to the HRA and Secretary of State for Health and Social Care on whether an application to process confidential information without consent should or should not be approved.

For details of the Section 251 of the NHS Act 2006 and supporting Health Service (Consent of Patient Information) Regulations 2002, and how it may impact on your research, please see the CAG section of the HRA website.

For further information, researchers wishing to conduct research in the NHS led from England or Wales should refer to the HRA website.

Scotland

If your project is a multi-centre study and involves access to identifiable patient data, you will need to obtain permission through the Public Benefit and Privacy Panel for Health and Social Care (HSC-PBPP). The HSC-PBPP is a governance structure of NHS Scotland (NHSS) to scrutinise and consider your application purpose for public benefit and information governance requirements. For further information please visit NHSS HSC-PBPP.

For single centre projects, applicants should go to their local Caldicott Guardian (a senior person responsible for protecting the confidentiality of an individual’s health and care information and to ensure that it is used properly). For further information please visit NHS Research Scotland, National Services Scotland and / or contact the lead R&D office for advice.

Northern Ireland

There is currently no legal basis to process patient identifiable data outside the care team. You will need to gain agreement from the local care team to support activity. For further information please visit Health and Social Care Northern Ireland. Full guidance is available on the Integrated Research Application System (IRAS) Website. For further advice, contact the HSC R&D Office (details of offices are available via the HSC website) or the Gateway (phone: (028) 7161 1126; email: research.gateway@hscni.net).