PRIVACY NOTICE – THE NATIONAL DIABETES AUDIT

Data about individual patients is collected and analysed but the outputs (the reports produced) do not identify individuals.

The following identifiable data for people with diabetes are collected by the audit:

NHS number, postcode, gender, date of birth, GP practice code.

Names are not collected.

Why is data collected?

These fields are used to link multiple records across the care pathway (how patients are assessed, treated and followed-up), to account for duplicate records, understand complication rates (the proportion of patients that experience adverse events or problems during a medical procedure or treatment) and to link to Office for National Statistics data to determine mortality rates (the number of deaths in a particular population).

Following the linkage of data, the minimum amount of identifiable data required is used in subsequent analysis. For example, postcode is converted to Lower Super Output Area (LSOA – a statistical area that allows local insights but avoids identifying individuals). GP practice codes are used to identify patients registered to specific practices and to group patients by practice or Local Health Board to allow comparisons of patient outcomes (the results or effects of care and treatment).  This helps the NHS in Wales to understand whether patients in certain areas are treated in line with national guidelines and whether patients in certain areas have better health outcomes.

From 2026, DHCW will also receive patient level data back from NHS England. This will allow the NHS in Wales to undertake analysis that can be used to improve diabetes care across Wales, such as linking the data collected  to deliver the NDA, with other information held. For example,  data can be used to determine if people with diabetes in certain areas are more likely to be admitted to hospital, how long they stay and how likely it is that they develop serious complications. This information will not be used to make decisions about your individual care and treatment.

The analysis will be used to improve co-ordination of diabetes services and provide better outcomes for patients. Reports will be anonymised (meaning you cannot be identified from them) and aggregated before they are shared with people responsible for making decisions about how and where services are provided. The aim is to provided better quality care that makes the most of the resource available to the NHS in Wales.

GPs are responsible for data held on GP systems. When they have lawfully disclosed data (as they do for the NDA) other organisations take responsibility:

·         DHCW for the data collection and provision of data to NHS England and the data it receives back from NHS England.

·         NHS England for the security and confidentiality of the data they hold for analysis purposes. NHS England’s role in the NDA is established by a formal request, known as a ‘section 255 request’.[i]

As the commissioners of primary care services in their area, LHBs have instructed GP practices to allow DHCW to extract data relevant to the NDA. Without this data the NDA could not be delivered. GPs are required to allow access under the provisions of the Regulations that govern their contracts with LHBs[ii].

DHCW is directed to collect and process the relevant information from GPs for the purposes of delivering the NDA, and to receive the audit information from NHS England for analysis.  DHCW’s role is consistent with its Establishment Order and Ministerial Directions[iii].

The UK General Data Protection Regulation (UK GDPR) allows organisations to process data that identifies individuals (personal data) and special categories of personal data (including health data) when certain conditions are met. These are commonly referred to as the ‘lawful basis’ for processing. In relation to the NDA, your GP’s lawful basis for processing this information is:

·         For personal data, Article 6(1)(e) of the UK GDPR; the performance of a tasks carried out in the public interest or in the exercise of official authority, and

·         For special categories of personal data, Article 9(2)(h) of the UK GDPR; the provision of health or social care, or treatment, or the management of health and social care systems.

Data is transferred to NHS England by secure mechanisms, which has its own systems that are secure and protected from viruses and hacking, and returned via the same mechanism.

Only staff who have been specifically trained in data protection and confidentiality will access data and controls are in place to make sure all these people can only see the minimum amount of personal information they need to do their job.

–          ask for a copy of any information we hold about you

–          ask for any information we hold about you that you think is inaccurate to be changed

–          ask us to restrict our use of your information, for example, where you think the information we are using is inaccurate

–          object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case

–          delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case

–          ask us not to use your information to make automated decisions about you without the involvement of one of our staff

You can access any of your rights by contacting your GP practice.