What is patient data?

SCAS staff will record information about your health. This will include your health problems, and the tests and treatment you have had. They might want to know about family history, if you smoke or what work you do. All this information that is recorded about you is called patient data or patient information.

When information about your health care joins together with information that can show who you are (like your name or NHS number) it is called identifiable patient information. It’s important to all of us that this identifiable patient information is kept confidential to the patient and the people who need to know relevant bits of that information to look after the patient. There are special rules to keep confidential patient information safe and secure.

What sort of patient data does health and care research use?

There are lots of different types of health and care research.

If you take part in a clinical trial, researchers will be testing a medicine or other treatment. Or you may take part in a research study where you have some health tests or answer some questions. When you have agreed to take part in the study, the research team may look at your medical history and ask you questions to see if you are suitable for the study. During the study you may have blood tests or other health checks, and you may complete questionnaires. The research team will record this data in special forms and combine it with the information from everyone else in the study. This recorded information is research data.

In other types of research, you won’t need to do anything different, but the research team will be looking at some of your health records. This sort of research may use some data from your GP, hospital or central NHS records. Some research will combine these records with information from other places, like schools or social care. The information that the researcher collects from the health records is research data.

Why does health and care research use information from patients?

In clinical trials, the researchers are collecting data that will tell them whether one treatment is better or worse than other. The information they collect will show how safe a treatment is, or whether it is making a difference to your health. Different people can respond differently to a treatment. By collecting information from lots of people, researchers can use statistics to work out what effect a treatment is having.

Other types of research will collect data from lots of health records to look for patterns. It might be looking to see if any problems happen more in patients taking a medicine. Or to see if people who have screening tests are more likely to stay healthier.

Some research will use blood tests or samples along with information about the patient’s health. Researchers may be looking at changes in cells or chemicals due to a disease.

All research should only use the patient data that it really needs to do the research. You can ask what parts of your health records will be looked at.

How does research use patient data?

If you take part in some types of research, like clinical trials, some of the research team will need to know your name and contact details so they can contact you about your research appointments, or to send you questionnaires. Researchers must always make sure that as few people as possible can see this sort of information that can show who you are.

In lots of research, most of the research team will not need to know your name. In these cases, someone will remove your name from the research data and replace it with a code number. This is called coded data, or the technical term is pseudonymised data. For example, your blood test might be labelled with your code number instead of your name. It can be matched up with the rest of the data relating to you by the code number.

In other research, only the doctor copying the data from your health records will know your name. They will replace your name with a code number. They will also make sure that any other information that could show who you are is removed. For example, instead of using your date of birth they will give the research team your age. When there is no information that could show who you are, this is called anonymous data.

Where will my data go?

Sometimes your own doctor or care team will be involved in doing a research study. Often, they will be part of a bigger research team. This may involve other hospitals, or universities or companies developing new treatments. Sometimes parts of the research team will be in other countries. You can ask about where your data will go. You can also check whether the data they get will include information that could show who you are. Research teams in other countries must stick to the rules that the UK uses.

All the computers storing patient data must meet special security arrangements.

If you want to find out more about how companies develop and sell new medicines, the Association of the British Pharmaceutical Industry has information on its website.

What are my choices about my patient data?

• You can stop being part of a research study at any time, without giving a reason, but the research team will keep the research data about you that they already have. You can find out what would happen with your data before you agree to take part in a study.
• In some studies, once you have finished treatment the research team will continue to collect some information from your doctor or from central NHS records over a few months or years so the research team can track your health. If you do not want this to happen, you can say you want to stop any more information being collected.
• Researchers need to manage your records in specific ways for the research to be reliable. This means that they won’t be able to let you see or change the data they hold about you. Research could go wrong if data is removed or changed.

What happens to my research data after the study?

Researchers must make sure they write the reports about the study in a way that no-one can work out that you took part in the study.

Once they have finished the study, the research team will keep the research data for several years, in case they need to check it. You can ask about who will keep it, whether it includes your name, and how long they will keep it.

Usually your hospital or GP where you are taking part in the study will keep a copy of the research data along with your name. The organisation running the research will usually only keep a coded copy of your research data, without your name included. This is kept so the results can be checked.

If you agree to take part in a research study, you may get the choice to give your research data from this study for future research. Sometimes this future research may use research data that has had your name and NHS number removed. Or it may use research data that could show who you are. You will be told what options there are. You will get details if your research data will be joined up with other information about you or your health, such as from your GP or social services.

Once your details like your name or NHS number have been removed, other researchers won’t be able to contact you to ask you about future research.

Any information that could show who you are will be held safely with strict limits on who can access it.

You may also have the choice for the hospital or researchers to keep your contact details and some of your health information, so they can invite you to take part in future clinical trials or other studies. Your data will not be used to sell you anything. It will not be given to other organisations or companies except for research.

Will the use of my data meet GDPR rules?

GDPR stands for the General Data Protection Regulation. In the UK we follow the GDPR rules and have a law called the Data Protection Act. All research using patient data must follow UK laws and rules.

Universities, NHS organisations and companies may use patient data to do research to make health and care better.

When companies do research to develop new treatments, they need to be able to prove that they need to use patient data for the research, and that they need to do the research to develop new treatments. In legal terms this means that they have a ‘legitimate interest’ in using patient data.

Universities and the NHS are funded from taxes and they are expected to do research as part of their job. They still need to be able to prove that they need to use patient data for the research. In legal terms this means that they use patient data as part of ‘a task in the public interest’.

If they could do the research without using patient data they would not be allowed to get your data.

Researchers must show that their research takes account of the views of patients and ordinary members of the public. They must also show how they protect the privacy of the people who take part. An NHS research ethics committee checks this before the research starts.

What if I don’t want my patient data used for research?

To invite you to take part in a research trial we use personalised letters, send an email or an SMS, call you directly on your phone or invite you at a point of contact we have with you. We also use posters and social media to disseminate an invitation. You will have a choice about taking part in a clinical trial testing a treatment. If you choose not to take part, that is fine.

In most cases you will also have a choice about your patient data being used for other types of research. There are two cases where this might not happen:

• When the research is using anonymous information. Because it’s anonymous, the research team don’t know whose data it is and can’t ask you.
• When it would not be possible for the research team to ask everyone. This would usually be because of the number of people who would have to be contacted. Sometimes it will be because the research could be biased if some people chose not to agree. In this case a special NHS group will check that the reasons are valid. You can opt-out of your data being used for this sort of research. You can ask your GP about opting-out, or you can find out more.

Who can I contact if I have a complaint?

If you want to complain about how researchers have handled your information, you should contact the research team ( research@scas.nhs.uk ). If you are not happy with their response you have the right to contact the Trust’s Data Protection Officer (DPA@scas.nhs.uk).

Should you still have concerns or believe they are processing your data in a way that is not right or lawful, you can raise a concern or complain to the Information Commissioner’s Office (ICO) (www.ico.org.uk  or 0303 123 1113).

All NHS organisations (including Health & Social Care in Northern Ireland) are expected to participate and support health and care research. The Health Research Authority and government departments in Northern Ireland, Scotland and Wales set standards for NHS organisations to make sure they protect your privacy and comply with the law when they are involved in research. Our research ethics committees review research studies to make sure that the research uses of data about you are in the public interest, and meet ethical standards.

Health and care research may be exploring prevention, diagnosis or treatment of disease, which includes health and social factors in any disease area. Research may be sponsored by companies developing new medicines or medical devices, NHS organisations, universities or medical research charities. The research sponsor decides what information will be collected for the study and how it will be used.

Health and care research should serve the public interest, which means that research sponsors have to demonstrate that their research serves the interests of society as a whole. They do this by following the UK Policy Framework for Health and Social Care Research. They also have to have a legal basis for any use of personally-identifiable information.

How patient information may be used for research

When you agree to take part in a research study, the sponsor will collect the minimum personally-identifiable information needed for the purposes of the research project. Information about you will be used in the ways needed to conduct and analyse the research study. NHS organisations may keep a copy of the information collected about you. Depending on the needs of the study, the information that is passed to the research sponsor may include personal data that could identify you. You can find out more about the use of patient information for the study you are taking part in from the research team or the study sponsor. You can find out who the study sponsor is from the information you were given when you agreed to take part in the study.

For some research studies, you may be asked to provide information about your health to the research team, for example in a questionnaire. Sometimes information about you will be collected for research at the same time as for your clinical care, for example when a blood test is taken. In other cases, information may be copied from your health records. Information from your health records may be linked to information from other places such as central NHS records, or information about you collected by other organisations. You will be told about this when you agree to take part in the study.

Keeping information for future research

Information about you that is collected during a research study may be kept securely to be used in future research in any disease area, including research looking at social and economic factors affecting health. This may include combining it with information about you held by other health or government organisations such as NHS Digital. Usually the information is combined together by matching information that has the same NHS number. Doing this makes maximum use of the information you have provided and allows researchers to discover more.

Researchers may not be able to specify all the possible future uses of the information they keep. It could include providing the information to other researchers from NHS organisations, universities or companies developing new treatments or care. Wherever this happens it will be done under strict legal agreements. The information about you will be depersonalised wherever possible so that you cannot be identified. Where there is a risk that you can be identified your data will only be used in research that has been independently reviewed by an ethics committee.

On rare occasions NHS organisations may provide researchers with confidential patient information from your health records when we are not able to seek your agreement to take part in the study, for example because the number of patients involved is too large or the NHS organisation no longer has your contact details. Researchers must have special approval before they can do this.

Your choices about health and care research

If you are asked about taking part in research, usually someone in the care team looking after you will contact you. People in your care team may look at your health records to check whether you are suitable to take part in a research study, before asking you whether you are interested or sending you a letter on behalf of the researcher.

In some hospitals and GP practices, you may have the opportunity to sign up to a register to hear about suitable research studies that you could take part in. If you agree to this, then research nurses, researchers or administrative staff authorised by the organisation may look at your health records to see if you are suitable for any research studies.

It’s important for you to be aware that if you are taking part in research, or information about you is used for research, your rights to access, change or move information about you are limited. This is because researchers need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from a study, the sponsor will keep the information about you that it has already obtained. They may also keep information from research indefinitely.

If you would like to find out more about why and how patient data is used in research, please visit the Understanding Patient Data website.

Further information is available, depending on where in the UK you live:

England

In England you can register your choice to opt out via the NHS website . If you do choose to opt out you can still agree to take part in any research study you want to, without affecting your ability to opt out of other research. You can also change your choice about opting out at any time.

Northern Ireland

If you would like to find out more about how and why your information is used, including for research purposes, please visit the Department of Health website.

Scotland

Members of the public in Scotland have their rights and responsibilities set out in the Patients Rights (Scotland) Act 2011. For information on confidentiality of data (including in research) please visit the NHS Inform website.

Wales

If you would like to find out more about how and why your information is used, including for research purposes, please visit NHS Direct Wales.

What to do if there is a problem

If you wish to raise a complaint on how any research organisation has handled your personal data, you can contact the relevant Data Protection Officer who will investigate the matter. If you are not satisfied with their response or believe they are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).