Data is not effectively anonymised and relates to NHS service users or NHS staff
The data you plan on using for your study is not effectively anonymised from a legal standpoint. It is considered ‘personal data’ and is therefore subject to the UK General Data Privacy Regulation (UK GDPR).
The data relates to NHS service users or NHS staff. It is therefore under the remit of relevant approval authorities.
If it is medical data from NHS service users, it is also confidential patient information and is therefore subject to the Common Law Duty of Confidentiality.
What we recommend
Your usage of data raises privacy and ethical risks. You will need to seek approval from the relevant approval authorities. Please note, there are national differences in approvals applications.
England and Wales
For data relating to living people and receiving care and treatment in England and Wales without consent, you will need to seek approval from the Health Research Authority (HRA) and an application should be made to the Confidentiality Advisory Group (CAG) where patients are not being approached for consent. The CAG is an independent body that provides expert advice to the HRA and Secretary of State for Health and Social Care on whether an application to process patient information without consent should or should not be approved.
Please refer directly to the HRA website for details of the Section 251 of the NHS Act 2006 and supporting Health Service (Consent of Patient Information) Regulations 2002, and how it may impact on your research.
For further information, researchers wishing to conduct research in the NHS led from England or Wales should refer to Health Research Authority (HRA) and Health and Care Research Wales (HCRW) Approval (‘HRA/HCRW Approval').
Scotland
If your project is a multi-centre study and involves access to identifiable patient data, you will need to obtain permission through the Public Benefit and Privacy Panel for Health and Social Care (HSC-PBPP). The HSC-PBPP is a governance structure of NHS Scotland (NHSS) to scrutinise and consider your application purpose for public benefit and information governance requirements. For further information please visit NHSS HSC-PBPP.
For single centre projects, applicants should go to their local Caldicott Guardian (a senior person responsible for protecting the confidentiality of an individual’s health and care information and to ensure that it is used properly). For further information please visit NHS Research Scotland, National Services Scotland and / or contact the lead R&D office for advice.
Northern Ireland
There is currently no legal basis to process patient identifiable data outside the care team. You will need to gain agreement from the local care team to support activity. For further information please visit Health and Social Care Northern Ireland. Full guidance is available on the Integrated Research Application System (IRAS) Website. For further advice, contact the HSC R&D Office (details of offices are available via the HSC website) or the Gateway (phone: (028) 7161 1126; email: research.gateway@hscni.net).
Understanding the data requirements for your project is the first step in your research journey. This tool should have assisted you in thinking about the essential considerations on the use of data for health and social care research. Please do ensure that you think about the most appropriate data you need for your study and whether your data access needs would meet the statutory and legal governance requirements in the UK. It is imperative that data used for the development of AI and data-driven interventions is accessed with the highest privacy and ethical standards. Spending time to identify the data you need, understand what data is available and consult the relevant people and organisations, may ensure that your project can get started as soon as possible with minimal delays.
Resources on data anonymisation
We value all feedback
If you would like to tell us about your experience of our Data Tool, then please complete our feedback form:
HRA Data Decision Tool Feedback Form