The proposal is to set up a near real-time person level linked dataset across Cheshire and Merseyside. This will enable combined intelligence to be produced that can support a set of COVID related population health analytics designed to inform both population level planning and targeting of direct care. The intelligence will be made available to appropriate users across the system in the form of a set of dashboards within an intelligence platform called Power BI.

It is proposed that the linked dataset will be used in three broad areas to produce population health intelligence in support of COVID recovery.

Automated Dashboards to support COVID Recovery: These split down into three ‘use cases’

Use Case 1: Capacity and Demand: This dashboard will monitor the changing demand across acute, community, mental health and local authority services in as near real time as possible, including the ability to understand if there is a possible surge or ‘second wave’ emerging. it will enable understanding of whether there is enough capacity to meet that demand. This dashboard is targeted at those user groups that are responsible for planning system capacity including Cheshire and Merseyside region, sub regional teams i.e. North Mersey, individual CCG’s and Primary Care Networks (PCNs).

Use Case 2: Epidemiology: This dashboard will enable monitoring of mortality and incidence over time at differing levels of geography. It will also provide insight in terms of demographic and health characteristics of individuals most affected by COVID. It will enable identification of geographical ‘hot spots’ of emerging infection. This dashboard is aimed at Public Health departments; The Out of Hospital and Acute Recovery Cells at Cheshire and Mersey Region that are responsible for planning and; those responsible for planning a COVID response with PCN’s.

Use Case 3: Population Stratification: This Dashboard enables GP practices and/or PCN’s responsible for a registered population to identify individuals with certain characteristics that will be vulnerable to adverse outcomes as a result of COVID and target services/interventions appropriately. (This is not the same as risk stratification in general practice that is most commonly used for stratifying the risk of unplanned admission to acute care)

Pseudonymised data for Place Based Intelligence Services (use Case 4); In addition to the reporting above being stepped up, the proposal is to make a set of person level pseudonymised data available to your local placed based intelligence teams that being the CCGs and Local Authorities. This will enable them to support the local system with COVID planning, which includes support to General Practice and PCN’s in intelligence required.

Pseudonymised and non re-identifiable data for COVID Research: In addition to the above, the intention would be to make a pseudonymised non-identifiable extract of the data available to the research community for COVID related research on a project by project basis. Applications to be made and to and approved by a Governance Board. See below sections for a description of Governance and Access Controls in this area.

Pseudonymised data is explained later in the FAQ.

Population stratification enables vulnerable individuals and their needs to be proactively identified and a more targeted individual response to be delivered from services that are available, to improve both their health and socio-economic outcomes.

Cheshire and Mersey region are responsible for planning enough system capacity to respond to any surge in demand due to the COVID pandemic, whilst also reintroducing planned care capacity across both acute, community and mental health providers. The demand and capacity report will enable Cheshire and Merseyside and the sub-regional geographies to be sighted on system demand to respond with capacity accordingly.

System C/Graphnet are a third-party supplier of data services. They offer a service that automates the near real time collection of data from NHS and Local Authority systems into one central warehouse/data store. The data can then be either pushed back to clinical systems to support a shared care record, or it can be used to create Business Intelligence about populations to inform planning and targeting of direct care.

Graphnet currently cover a population of 16 million with their services and are the provider of data services also to Bath and North East Somerset, Berkshire, Buckinghamshire, Cheshire, Greater Manchester, Kent, Northamptonshire, Staffordshire, St Helens, Whittington, Wolverhampton and Walsall.

For more information about Graphnet/System C, please visit their website. 

The data being flowed via Graphnet from GP systems will include patient identifiable data of names, address, date of birth and post code. It will also include other demographic and health information, test results and medications. It will not include free text.

Once the data flow has been switched on the data will be taken automatically, once daily.

Yes. People who opted out of data sharing for purposes other than direct care (Type 1 objections) will be excluded from the flow of data from the GP system into the Graphnet solution.  

Data will be stored on ‘Azure cloud’, which is compliant with Information Governance standards and is safe and secure. Azure is assessed to ISO 27001, ISO 27017, ISO 27018, and many other internationally recognized standards. The scope and proof of certification and assessment reports are published on Microsoft's Trust Centre. Once you're on the Trust Centre page, you can then click to view individual compliance documentation such as that for the ISO/IEC 27001:2013 Information Security Management Standards documentation, the assessment for which was performed by the BSI.

Role Based Access Controls (RBAC) will be implemented, which means the data will be split into four different categories and only those with the appropriate Information Governance approval will be able to access the data in each category. The four categories of data are explained below:

1. Identifiable: Data will be wholly identifiable to the end user.
2. Pseudonymised: This data will still be at person-level, but the identifiable fields will be removed from the data. This includes removal of names and addresses. Date of Birth will be formatted to age; post code will be shortened to the first 4 digits and the NHS number will be encrypted into an alpha-numeric. Pseudonyms will be linkable across datasets. Re-identification will be possible via a set of controlled processes.
3. Pseudonymised not identifiable: This data will be the same as above with two differences. Pseudonyms will not be linkable across datasets and re-identification will not be possible.
4. Anonymised-Aggregate: This data will be fully anonymised and aggregated against the national NHS anonymisation standard, meaning small number suppression (<5) will be implemented and no person level data will be available.

The table below explains who will have access to each category of data and how this will be governed:

The programme will maintain and strictly enforce a Data Access and Data Asset matrix to ensure requests to use the CIPHA regional data sources ensure full compliance to the COVID-19 purposes as outlined in the sharing agreement.

This process will be governed through a regional group that will draw its membership from: the regional Clinical Informatics Advisory Group (CIAG); GP and Local Medical Committees; clinical IG specialists; and the regional Data Services for Commissioners Regional Offices (DSCRO) service.

This matrix will detail projects undertaken with the pseudonymised data by the place-based intelligence teams and be made available to parties within the sharing agreement including GP Practices on a monthly basis, so they are informed of the specific uses of the data.

A process will be put in place for approval of projects on a case by case basis for organisations other than place-based intelligence teams e.g. research bodies using the following principles:

• Purpose aligns with the purpose of this agreement
• Any application includes a separate data sharing agreement where the group acts on behalf of the signatories to this agreement.
• Individual data controllers will have five working days to opt out.

The legal basis under GDPR is 6 (1) (e) Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

9(2)(h) Necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care, or treatment or the management of health or social care systems and service.

9(2)(i) Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Under the COPI notice for COVID-19 all providers of healthcare, GP Practices and Local Authorities have been given legal notice to support the processing and sharing of information to help the COVID-19 response under the Health Service Control of Patient Information Regulations 2002. This is to support the processing and sharing of information to help the COVID-19 response. This sets out that confidential patient information can be used and shared appropriately and lawfully for purposes related to the COVID-19 response.

This allows the processing of confidential patient information, including disseminating to a person or organisation permitted to process confidential patient information, including disseminating to a person or organisation permitted to process confidential patient information under Regulation 3(3) of COPI.

The first ‘Control of Patient Information Notice’ (COPI) for COVID-19 was issued on 17 March 2020, which you can view here.

A further COPI Notice was issued on 20 March 2020, which you can view here.

An extended COPI Notice was issued on 29 July 2020, which you can view here.

A further extended COPI Notice was issued on 27 January 2021, which you can view here.

The Common Law Duty of Confidentiality requires that there should be no use or disclosure of any confidential patient information for any purpose other than the direct clinical care of the patient to whom it relates, however there are some broad exceptions:-

• The patient explicitly consents to the use or disclosure.
• The disclosure is required by law, or the disclosure is permitted under a statutory process that sets aside the duty of confidentiality.
• The disclosure can be justified in the public interest. Whilst the COPI Notice provides the lawful basis to set aside the Common Law Duty of Confidentiality, under this Data Sharing Agreement the Common Law Duty of Confidentiality will be upheld. This is explained below. Uses of data other than for direct care are known as ‘secondary uses’. Secondary uses of data include analysis done for population or service planning purposes that don’t directly relate to the individual. Despite the COPI Notice, the Common Law Duty of Confidentiality will be upheld in this project. This means that people using data for ‘secondary uses’ will only be granted access to the pseudonymised extract of data, therefore upholding the common law duty of confidentiality. Sometimes re-identification of individuals is required. This will be achieved in a controlled way and only to those who have a direct care relationship with the patient.

You will already have a privacy notice that explains to patients how their data is used. You can update your existing notice by adapting the example COVID specific privacy notice from NHS X.

If you adapt this notice, then we suggest you insert the following paragraph where it states ‘[Is there anyone else information will be shared with, for purposes beyond individual care relating to Covid-19?]’

Locally across Cheshire and Merseyside, data is being shared securely with a data processor called System C for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. No data that identifies a person will be used for purposes other than direct care. If you have previously opted out of data sharing your data will not be used.

The Cheshire and Merseyside Data Sharing Agreement (DSA) for COVID-19 specific purposes remains in place whilst the COPI Notice applies (see below). This sets aside the Common Law Duty of Confidentiality. The data flow is UK GDPR compliant as explained in the DSA.

The longer-term aim was to set up a broader (than COVID) population health intelligence approach. However in 2020, we recognised that we were on a journey with data sharing, and an incremental approach was needed to build trust in the system and process.

We returned to data controllers in January 2021 to engage with them on the benefits of the project to date, and also to establish a broader purpose for population intelligence with a new legal basis for data sharing beyond the COPI Notice (currently due to expire on 30 September 2021), that would satisfy both UK GDPR and the Common Law Duty of Confidentiality, negating the need for the use of COPI.

This has now been done, and a new Data Sharing Agreement was issued in July 2021:

Cheshire and Merseyside Health and Care Partnership

Combined Intelligence for Population Health Action (CIPHA): Data Sharing Agreement (Tier Two)

Workstream: Population Health

"Link will be added to pop health DSA"

The Population Stratification report will bring various data sources together to identify vulnerable groups and will give practices and PCN’s a better understanding of vulnerable populations and their needs. Services can then be planned and targeted more appropriately. The epidemiology report will allow PCN’s to understand how COVID related mortality and incidence are changing within their geography and explore the characteristics of people who are affected by COVID in their populations. It will also enable PCNs to identify if infection hotspots are occurring in their local geography and to respond appropriately.

The data being flowed via Graphnet from GP systems will include patient identifiable data of names, address, date of birth and post code. It will also include other demographic and health information, test results and medications. It will not include free text.

Once the data flow has been switched on the data will be taken automatically, once daily.

• Workshops on use case and target operating model design with LA intelligence teams
• Worked with LA IG leads and other officers to provide additional detail for the data sharing agreement that includes;
  • An addendum with a reduced data extract and COVID data extract specification with justification for categories of data and data items
  • An additional data risk assessment table covering data use; data security; protection of client data confidentiality; and respect for opt-out
• Engagement with CHaMPS in unifying an approach to COVID reporting and outbreak prediction.

• Through sharing to become a consumer of regional integrated data and partner with the NHS to support
• Directors of Public Health (CHaMPS) in unifying an approach to COVID reporting and outbreak prediction
• Building upon and augmenting place-based COVID intelligence
• Taking an active role in the use of regional data to support the funded programme for a regional telehealth provision to include care homes
• To receive flu (and future COVID) vaccination data that can be stratified to target at risk groups
• To have a basis for considering the use of regional integrated data sets to support prevention and early intervention.