How we use patient data

Updated May 2020: no changes made
Next update scheduled: August 2020.

The Health Foundation is an independent charity committed to bringing about better health and health care for people in the UK. As part of our work, we apply for and are granted access to data about patients and their experiences in the health service, to enable us to conduct in-depth analysis for specific, approved projects. Having access to patient data allows the Health Foundation to analyse the impact of new initiatives and to gain insights on trends in people’s health and care in order to drive learning and improvement.

The data about patients we receive tells us about when they have visited hospitals, their GP practices, operations and treatments they have received, for example, and we also receive data about patients’ experiences in other health and social care services such as care homes and the 111 non-emergency phone number for medical help.

We are only able to gain access to these data after following careful data application procedures laid down by data suppliers. These data suppliers include NHS Digital, NHS England and the Medicines and Healthcare Products Regulatory Agency to access the Clinical Practice Research Datalink. We must demonstrate:

• That we have a sufficient legal basis for accessing and using the data, under the General Data Protection Regulation (GDPR)
• That we have sufficient, robust, informative governance systems in place to look after the data, and that these are regularly tested and audited
• That at the end of the project, we are able to securely destroy the data

All staff, contractors and other researchers that support our work by working on these data in our Secure Data Environment must undergo Information Governance training, and sign an appropriate Non-Disclosure Agreement promising to maintain the confidentiality of the data.

All the information we hold on patients is de-personalised, which means that patients are not directly identifiable from the data. We never receive names, addresses or NHS numbers. We only hold data about patients and their journey in the health service to do our analysis. Examples include data about admission length, diagnosis codes, and some basic demographic code such as age and gender. More information about patient data and how they can be used for analysis can be found at the Understanding Patient Data website.
 

Maintaining data security

Updated: April 2020

Due to the coronavirus (COVID-19) pandemic, we are allowing our analysts to access our Secure Data Environment from their homes, following the government’s guidelines to close offices and for employees to work from home. We are undertaking a number of projects (see below) for which we plan to publish findings in the near future. Find out more about the Health Foundation's response to COVID-19.

Staff have been provided with special equipment which will allow them to securely log on to our system, where we store patient data that we receive from the health service. Staff have also been provided with additional training so that they are prepared to access data safely; and they have also signed an additional agreement to acknowledge that they understand how to access patient data safely when working from home. They will be able to raise any concerns about the security of their equipment, or the data they can access, with their team’s data manager, in the usual way. All patient data we hold is de-personalised, individuals cannot be identified from the data.

To enable this way of working, we have undertaken an additional and robust risk assessment and completed a Data Protection Impact Assessment. We have made changes to our documented procedures to reflect this new arrangement. In doing so, we have acted as organisations such as the Information Commissioner’s Office would expect. If you have any queries, please do contact us at data.management@health.org.uk .

Who at the Health Foundation uses patient data?

Improvement Analytics Unit

The Improvement Analytics Unit is a partnership between NHS England and the Health Foundation, which provides rigorous data analysis to determine whether new ways of delivering care are having an impact.

The Improvement Analytics Unit analyses patient data through the Secure Data Environment. All staff with access to the environment, whether employed by The Health Foundation or NHS England, have to complete information governance training and are contractually bound to maintain patient confidentiality. View a list of publications where we have used data about patients

In-house analytics team

The In-house analytics team use data about patients for a variety of projects. For example, we are investigating households in which members of the same family suffer from multiple health conditions, and how often they request help from the NHS. We are also looking into the relationship between mental and physical health conditions; mental health services and their take up by young people, and menstrual pain in women and their access to health services, and we are looking at how well patients with diabetes are managed by the health service. View a list of publications where we have used data about patients

Economics team

The economics team use data about patients to look at forecasting future demand caused by having a condition (for example diabetes) or a combination of conditions and the pressure this puts on the health service in terms of activity and costs, as well as looking at the cost of providing services in hospitals (e.g. routine operations). View our publications
 

Data we hold

Because all patient information we hold is de-personalised, we cannot identify individuals from the data. For this reason, we cannot respond to subject access requests, or apply one's 'right to be forgotten'. To find out more about what we mean by depersonalisation, please visit this resource on Understanding Patient Data. For information about your rights concerning data, you can visit the Information Commissioners website.