Recording Clinical Data Richard Oliver Head of Information Governance Newcastle upon Tyne Hospitals NHS Trust Additional slides: Professor Rob Pickard Introduce myself

Plan General points to consider Documentation Storage Sharing What I will be talking about

General points to consider Compliance with Data Protection Act 2018 (GDPR) Necessary approvals (REC, NHS Trusts) Where NHS patients, data or facilities are involved: Compliance with policies and standards of NHS organisation (inc. Caldicott) Status of data collector with NHS organisation . Will need R&D approval plus Caldicott guardian.

Points to consider: study specific REC submission and study protocol Patient information sheets and consent forms REC asks to set out: what data will be collected, how it will be stored, who can access, how long it will be stored for (need to justify if longer than 12 months)

Documentation – What data to record? Collect enough but no more From NHS records (can include name, address to contact patient) Data collected during study From NHS records – remains their property, cannot share with 3rd party

Consent Research is classed as secondary use of data and where possible should not include identifiable data. Consent should be a two part process. The Trust should get initial consent from patients to use their data for research. Get explicit, informed consent from the patient for the actual study. However a follow on study wouldn’t necessarily require further consent from the patient.

Consent Requirements The information that must be provided when data is obtained from the data subject includes:   Name of controller and contact details (including of data protection officer) Purposes of the processing, as well as the legal basis. The recipients or categories of recipients of the personal data, if any. The period for which the personal data will be stored. The data subject’s rights, including, where processing is based on consent, the right to withdraw consent at any time. *

Requirements continued The right to lodge a complaint with the ICO Whether the provision of personal data is part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data Any automated decision-making, and, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject How appropriate or suitable safeguards are achieved in relation to any personal data transferred out of Europe

Legal Basis Under Article 6, processing is permitted where - necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e)) Public authorities with research as either an incorporated or statutory purpose (including NHS Trusts, Boards and Universities) may process personal data where necessary to fulfil their public research function.

Legal Basis Continued It is important to be clear that reliance upon Article 6(1)(e), and the need for processing for the performance of a task carried out in the public interest, does not automatically mean that the requirements of the common law duty of confidentiality have been met. The requirements of data protection legislation apply alongside the requirements of the common law duty of confidence: both must be satisfied.

Storage Medium Identifiers Paper, electronic, audio, samples – BACK-UP Anonymous (no audit trail) Pseudoanonymous (audit trial) – most usual Patient-identifiable data (to be avoided if possible) PID = names, numbers or other details sufficient enough to identify them. Keep in separate location

Storage: University Policy Adequate, relevant and not excessive Accurate Not kept for longer than is necessary Kept safe from unauthorised access, accidental loss or destruction Secure rooms/lockable cabinets Password protected Lockable filing cabinet/drawer; secure room; password protected; if on disk then disk must be kept securely

Sharing – You need permission! The patient (consent) Research Ethics Committee Caldicott Guardian HTA: anything that contains cells Caldicott – protection of PID in health service. May allow us to access data but agreement generally not to share with any third party!

Key Point Know what you are allowed to do REC application / protocol Patient information sheets / consent forms Agreements with NHS bodies University Policy and legislation: http://www.ncl.ac.uk/res/research/ethics_governance/ethics/toolkit/data/

Questions?