Risk stratification – How we use patient information engagement

Risk stratification tools are becoming more common in the NHS. They help assess:-

  • How likely a person is to develop a medical condition.
  • Prevent unexpected hospital visits or
  • Identify the need for preventive measures.

How it works

  • Information about you is gathered from different sources, including NHS Trusts and your GP practice.
  • Any information that could identify you is removed, and then your data is analysed to determine a risk score.
  • This score is then shared with your GP practice, who is responsible for your data, and matched back up with your personal information so they can get in contact with you if needed.

Risk stratification helps your GP focus on preventing health issues, not just treating illnesses. If needed, your GP might offer you additional healthcare services. Keep in mind that you can usually choose not to have your data used for this purpose. Patients can contact their practice for more information about how to opt out. Individual risk management at your GP practice is considered part of your personal healthcare and is subject to legal rules.

At Lincolnshire Integrated Care Board, we take your privacy very seriously, when you complete our survey your information will only be used for medical and health care related purposes and will not be shared with other organisations (with the exception of NHS England, details below), companies or individuals, for marketing purposes or any other reasons.  Your data will remain confidential.

  • Risk stratification - further information

    How we use your data

    Health care commissioners need information about the treatment of patients to review and plan current and future health care services. To do this they need to be able to see information about the health care provided to patients which can include patient level data.

    The law says commissioners are not allowed to access Personal Confidential Data (PCD) because they are not providing direct patient care. As such, they need an intermediary service called Data Services for Commissioners Regional Office (DSCRO), that specialise in processing, analysing and packaging patient information within a secure environment into a format that commissioners can legally use, anonymised patient level data. You can find more comprehensive information about this on the former NHS Digital website.

    Lawful basis

    Personal data which is processed for the purposes of risk stratification:

    Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller..’.

    Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services..’.

    We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”.  

    The use of identifiable data for risk stratification has been approved by the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority (known as Section 251 approval under the Health Services (Control of Patient Information) Regulations 2002, under section 251 of the NHS Act 2006). Further information on Section 251 can be obtained by clicking here. This approval allows your GP or staff within your GP Practice who are responsible for providing your care, to see information that identifies you, but the ICB staff will only be able to see information in a format that does not reveal your identity.

    NHS England (formerly NHS Digital) can disseminate data to commissioners under the Health and Social Care Act (2022). The act provides the powers for NHS England to collect, analyse and disseminate national data and statistical information. To access this data, organisations must submit an application and demonstrate that they meet the appropriate governance and security requirements.

    NHS England, through its DSCROs, is permitted to collect, hold and process Personal Confidential Data (PCD). This is for purposes beyond direct patient care to support NHS commissioning organisations and the commissioning functions within local authorities.

    GPs are able to identify individual patients from the risk stratified data when it is necessary to discuss the outcome and consider preventative care, however the ICB can never identify an individual from the risk stratified data that we see. Where the risk stratification process has linked GP data to health data obtained from other sources i.e. NHS England or other health care provider, the GP will ask for your permission to access the details of that information.

    Sources of the data

    Personal data is supplied into the national DSCRO arrangements by GPs and NHS England (commissioning data sets).

    Data Processors

    The ICB has agreements in place with the following organisations to process Risk Stratification Data:

    NHS Arden and Greater East Midlands Commissioning Support Unit

    Prescribing Services Ltd

    Categories of data

    Risk stratification tools use historic information about patients, such as age, gender, diagnoses and patterns of hospital attendance and admission collected by NHS England from NHS hospitals and community care services (Secondary Use Services data). This is linked to data collected in GP practices and analysed to produce a risk score.

    The Secondary Uses Service (SUS) is the single, comprehensive repository for healthcare data in England which enables a range of reporting and analyses to support the NHS in the delivery of healthcare services. Information on care provided for all patients by Health Care Providers (both NHS and Independent Sector Healthcare Providers for NHS patients only) must be submitted to the Secondary Uses Service according to the Commissioning Data Set Mandated Data Flows guidelines.

    Data from the GP practice system will be obtained by using a ‘bulk data extract’, uploaded directly by the risk stratification tool supplier (AGEM CSU) from the practice system. Prior to the upload, the supplier will obtain permission from the practice to request the data from the practice system provider and the practice will notify their system providers that this permission has been granted.

    The data extract will EXCLUDE patients who have expressed a wish not to share information. Reports produced from the system, including identifiable data, is only provided back to your GP or member of your care team as data controller in an identifiable form. Your GP can provide more information about any risk stratification programme they are using. Should you have any concerns about how your information is managed at the surgery please contact the Practice Manager at your surgery to discuss how the disclosure of your personal information can be limited.

    Recipients of data

    The combined ICB Secondary Use Service (SUS) data and GP data which contains an identifier (usually NHS number) is made available to clinicians with a legitimate relationship with their patients to enable them to identify which patients should be offered targeted preventative support to reduce those risks. 

    The ICB does not have access to identifiable information.

    Opt out details

    You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do not wish your data to be included in the risk stratification service you can choose to opt-out. You can contact your GP practice who can apply a code which will stop your identifiable information being used for Risk Stratification purposes or you can contact the ICB who will inform your GP practice and ask them to apply the opt-out code to ensure that your information is not used in the programme.

    You can contact the ICB by email, phone or post:

    NHS Lincolnshire Integrated Care Board (ICB)

    HQ Bridge House The Point Lions Way Sleaford NG34 8GG

    Tel: 01522 573939

    Opening hours: Monday – Friday 8.30am to 5pm

This consultation is now closed but you can still have your say. Please contact us to share your experiences and/or feedback, licb.involveus@nhs.net.