RCGP RSC network of GP practices Clinical Informatics and Health outcomes Research Group: Generic Data flow diagram RCGP RSC network of GP practices Data collection using MIQUEST NHS Digital Pseudonymised data is collected on-site using encrypted external drives or laptops Web-transfer or upload of large encrypted and password protected data files by third party provider Pseudonymised data - downloaded from NHS Digital on-line portal Server within the dedicated secure network of the Research Group Data collection in other specific projects Pseudonymised data is collected on-site using encrypted devices or transferred between NHSmail accounts Out-put only reports, graphs & aggregated tables (data is retained and disposed of in line with University Research Data Management Guidelines) NHS Project funders Other Project funders Participating GP practices Last up-dated: 02/01/18 Author: Dr Tom Chan Version 1.1

Data flow analysis Generic data flow diagram All major inbound and outbound data flows are represented in the diagram Major inbound data sources are: NHS Digital RCGP RSC (Royal college of General Practitioners, Research and Surveillance Centre) On-site data collection using MIQUEST (Morbidity Information QUery and Export SynTax) Ad hoc data transfer from study participants Outbound data are in the form of reports, publications, graphs and/or aggregated tables Secure network of the Research Group The Research Group’s dedicated secure network is diagrammatically represented in the Surrey Secure Network The secure network is sited behind a firewall within the University’s network, all in-bounded connections are block, but out-bounded connections are allowed All staff members of the research group working within the team base work from secure workstations or secure laptops with encrypted drive