1. Recording Clinical Data
Richard Oliver
Head of Information Governance
Newcastle upon Tyne Hospitals NHS Trust
Additional slides: Professor Rob Pickard
Introduce myself

2. Plan General points to consider Documentation Storage Sharing
What I will be talking about

3. General points to consider
Compliance with Data Protection Act 2018 (GDPR)
Necessary approvals (REC, NHS Trusts)
Where NHS patients, data or facilities are involved:
Compliance with policies and standards of NHS organisation (inc. Caldicott)
Status of data collector with NHS organisation
. Will need R&D approval plus Caldicott guardian.

4. Points to consider: study specific
REC submission and study protocol
Patient information sheets and consent forms
REC asks to set out: what data will be collected, how it will be stored, who can access, how long it will be stored for (need to justify if longer than 12 months)

5. Consent
Research is classed as secondary use of data and where possible should not include identifiable data.
Consent should be a two part process.
The Trust should get initial consent from patients to use their data for research.
Get explicit, informed consent from the patient for the actual study.
However a follow on study wouldn’t necessarily require further consent from the patient.

6. Documentation – What data to record?
Collect enough but no more
From NHS records (can include name, address to contact patient)
Data collected during study
From NHS records – remains their property, cannot share with 3rd party

7. Consent Requirements
The information that must be provided when data is obtained from the data subject includes:
Name of controller and contact details (including of data protection officer)
Purposes of the processing, as well as the legal basis.
The recipients or categories of recipients of the personal data, if any.
The period for which the personal data will be stored.
The data subject’s rights, including, where processing is based on consent, the right to withdraw consent at any time. *

8. Requirements continued
The right to lodge a complaint with the ICO
Whether the provision of personal data is part of a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data
Any automated decision-making, and, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject
How appropriate or suitable safeguards are achieved in relation to any personal data transferred out of Europe

9. Legal Basis Under Article 6, processing is permitted where -
necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (Article 6(1)(e))
Public authorities with research as either an incorporated or statutory purpose (including NHS Trusts, Boards and Universities) may process personal data where necessary to fulfil their public research function.

10. Legal Basis Continued
It is important to be clear that reliance upon Article 6(1)(e), and the need for processing for the performance of a task carried out in the public interest, does not automatically mean that the requirements of the common law duty of confidentiality have been met. The requirements of data protection legislation apply alongside the requirements of the common law duty of confidence: both must be satisfied.

11. Documentation Legible Accurate and complete
Date, time, signature, name and designation
Corrections made with single line strike-through, initialled and dated

12. Storage Medium Identifiers Paper, electronic, audio, samples – BACK-UP
Anonymous (no audit trail)
Pseudoanonymous (audit trial) – most usual
Patient-identifiable data (to be avoided if possible)
PID = names, numbers or other details sufficient enough to identify them. Keep in separate location

13. Storage: University Policy
Adequate, relevant and not excessive
Accurate
Not kept for longer than is necessary
Kept safe from unauthorised access, accidental loss or destruction
Secure rooms/lockable cabinets
Password protected
Lockable filing cabinet/drawer; secure room; password protected; if on disk then disk must be kept securely

14. Sharing – You need permission!
The patient (consent)
Research Ethics Committee
Caldicott Guardian
HTA: anything that contains cells
Caldicott – protection of PID in health service. May allow us to access data but agreement generally not to share with any third party!

15. Key Point Know what you are allowed to do REC application / protocol
Patient information sheets / consent forms
Agreements with NHS bodies
University Policy and legislation:

16. Questions?