How we use your data

Health care commissioners need information about the treatment of patients to review and plan current and future health care services. To do this they need to be able to see information about the health care provided to patients which can include patient level data.

The law says commissioners are not allowed to access Personal Confidential Data (PCD) because they are not providing direct patient care. As such, they need an intermediary service called Data Services for Commissioners Regional Office (DSCRO), that specialise in processing, analysing and packaging patient information within a secure environment into a format that commissioners can legally use, anonymised patient level data. You can find more comprehensive information about this on the former NHS Digital website.

Lawful basis

Personal data which is processed for the purposes of risk stratification:

Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller..’.

Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services..’.

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”.  

The use of identifiable data for risk stratification has been approved by the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority (known as Section 251 approval under the Health Services (Control of Patient Information) Regulations 2002, under section 251 of the NHS Act 2006). Further information on Section 251 can be obtained by clicking here. This approval allows your GP or staff within your GP Practice who are responsible for providing your care, to see information that identifies you, but the ICB staff will only be able to see information in a format that does not reveal your identity.

NHS England (formerly NHS Digital) can disseminate data to commissioners under the Health and Social Care Act (2022). The act provides the powers for NHS England to collect, analyse and disseminate national data and statistical information. To access this data, organisations must submit an application and demonstrate that they meet the appropriate governance and security requirements.

NHS England, through its DSCROs, is permitted to collect, hold and process Personal Confidential Data (PCD). This is for purposes beyond direct patient care to support NHS commissioning organisations and the commissioning functions within local authorities.

GPs are able to identify individual patients from the risk stratified data when it is necessary to discuss the outcome and consider preventative care, however the ICB can never identify an individual from the risk stratified data that we see. Where the risk stratification process has linked GP data to health data obtained from other sources i.e. NHS England or other health care provider, the GP will ask for your permission to access the details of that information.

Sources of the data

Personal data is supplied into the national DSCRO arrangements by GPs and NHS England (commissioning data sets).

Data Processors

The ICB has agreements in place with the following organisations to process Risk Stratification Data:

NHS Arden and Greater East Midlands Commissioning Support Unit

Prescribing Services Ltd

Categories of data

Risk stratification tools use historic information about patients, such as age, gender, diagnoses and patterns of hospital attendance and admission collected by NHS England from NHS hospitals and community care services (Secondary Use Services data). This is linked to data collected in GP practices and analysed to produce a risk score.

The Secondary Uses Service (SUS) is the single, comprehensive repository for healthcare data in England which enables a range of reporting and analyses to support the NHS in the delivery of healthcare services. Information on care provided for all patients by Health Care Providers (both NHS and Independent Sector Healthcare Providers for NHS patients only) must be submitted to the Secondary Uses Service according to the Commissioning Data Set Mandated Data Flows guidelines.

Data from the GP practice system will be obtained by using a ‘bulk data extract’, uploaded directly by the risk stratification tool supplier (AGEM CSU) from the practice system. Prior to the upload, the supplier will obtain permission from the practice to request the data from the practice system provider and the practice will notify their system providers that this permission has been granted.

The data extract will EXCLUDE patients who have expressed a wish not to share information. Reports produced from the system, including identifiable data, is only provided back to your GP or member of your care team as data controller in an identifiable form. Your GP can provide more information about any risk stratification programme they are using. Should you have any concerns about how your information is managed at the surgery please contact the Practice Manager at your surgery to discuss how the disclosure of your personal information can be limited.

Recipients of data

The combined ICB Secondary Use Service (SUS) data and GP data which contains an identifier (usually NHS number) is made available to clinicians with a legitimate relationship with their patients to enable them to identify which patients should be offered targeted preventative support to reduce those risks. 

The ICB does not have access to identifiable information.

Opt out details

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do not wish your data to be included in the risk stratification service you can choose to opt-out. You can contact your GP practice who can apply a code which will stop your identifiable information being used for Risk Stratification purposes or you can contact the ICB who will inform your GP practice and ask them to apply the opt-out code to ensure that your information is not used in the programme.

You can contact the ICB by email, phone or post: