Predispose HEME privacy notice

PROJECT: STUDY ASSESSING THE PREVALENCE OF CIRRHOSIS AND ITS RELATED COMPLICATIONS AMONGST PATIENTS WITH HEREDITARY HAEMOCHROMATOSIS IN ENGLAND (PREDISOPOSE HEME)

This notice relates only to personal data obtained from NHS Digital in the above-named project. The project has the following NHS Digital reference: DARS-NIC-706945-F6W2C-v0.3

A table of abbreviations can be found in Appendix 2

I have questions or want further information. Who do I talk to?

If you have any questions or concerns about how your data will be processed within this project, please contact the project lead:

Dr Robert Driver, Consultant Hepatologist.

Address:
3rd Floor,
Junction 8 Hepatology Department
York and Scarborough Teaching Hospital NHS Foundation Trust,
York Hospital
Wigginton Road
York
North Yorkshire
YO31 8HE

Email: robertdriver@nhs.net

Telephone: (01904) 724905 or 725346

If you are unhappy with the response, please contact the York and Scarborough Teaching Hospitals NHS Foundation Trust Data Protection Officer (DPO):

Address:
York and Scarborough Teaching Hospital NHS Foundation Trust
York Hospital
Wigginton Road
York
North Yorkshire
YO31 8HE
Email: yhs-tr.Information.Governance@nhs.net

What is this project about?

Hereditary haemochromatosis (HH) is a genetic condition characterised by excess iron deposition in various organs such as the liver, pancreas, joints and pituitary gland. HH is one of the commonest genetic conditions amongst populations of northern European ancestry.

Due to excess iron deposition in the liver, patients with HH can develop liver stiffness (fibrosis) and progress towards scarring (cirrhosis). Once cirrhosis develops, patients are at increased risk of complications such as fluid in the abdomen (ascites), yellowing of skin (jaundice), confusion (hepatic encephalopathy), vomiting blood (variceal bleeding) and liver cancer (hepatocellular carcinoma).

Amongst HH patients, not all have raised iron levels (biochemical penetrance), or symptoms related to haemochromatosis (clinical penetrance). However, some individuals develop significant morbidity such as liver cirrhosis and its related complications. In addition, despite venesection being an efficacious treatment for iron overload, liver cirrhosis and hepatocellular carcinoma (HCC) still occurs with a varying frequency reported in research studies. Why this variation exists remains unknown yet but the role of cofactors in the form of alcohol, diabetes and viral hepatitis have been implicated. Harmful alcohol consumption, diabetes, raised BMI and viral hepatitis are well established risk factors in the pathogenesis of chronic liver disease.

The absence of large prevalence data regarding cirrhosis in HH creates a void in understanding the burden of advanced liver disease in this population and its effects on the healthcare system. The study aims to review a large dataset of patients with HH in England obtained from NHS Digital. Through this database, the presence of cirrhosis, HCC, cirrhosis related complications and cause of death in the HH population in England can be established. We will also assess the risk factors that are associated with cirrhosis in this group of patients.

Who is working on the project?

Colleagues within the Hepatology Department at York and Scarborough Teaching Hospital NHS Foundation Trust, Hull York Medical School and University of Hull are working together in this study bringing their experience in managing liver diseases and statistical analysis of large datasets to deliver this project.

What data are you using?

As part of routine NHS care an individual receives in hospital, the healthcare system (NHS) collects data with the aim of improving patient care, designing clinical services and carrying out research. Data is collated nationally by NHS Digital who are under the purview of NHS England. This data is referred to Hospital Episode Statistics. Various datasets exist depending on how an individual accesses hospital services. For this study, we will use the HES Admitted Patient Care dataset which records information when an individual is admitted to hospital in England. More information on HES data can be found here.

Our research project looks at data from HES Admitted Patient Care (APC) records for patients with HH from 1st April 2007 to 31st March 2023. Whilst the HES dataset contains many data items, we have selected only the relevant data items required for the purpose of our study. These items are listed in appendix 1 at the end of this notice.

We will also link ONS Mortality data to the HES APC dataset to identify the cause of death in HH patients. This will be done by the NHS Digital team. The study team will not be able to identify you using this information and linkage.

Under GDPR we need to confirm to you if the data we receive will be used to inform automated decision making or profiling. We confirm that the data we receive as part of this project cannot and will not, be used for either automated decision making or profiling.

Am I in this dataset?

If you are diagnosed with HH or any other ‘disorders of iron metabolism’ and were admitted to any hospital in England between April 1st 2007 and March 31st 2023 your data will be in this dataset. However, we have not requested any identifiable information, so all researchers involved in this project, do not know and have no way of finding out which individual is in the dataset. A unique identifier is generated by NHS Digital in the dataset provided to the study team, but this cannot be used to link to any other datasets in NHS Digital to identify you.

NHS Digital hold both the identifier and the full data. This means they can identify you from the data we hold. We would work with them to meet any request you might make using your rights under GDPR as described below. Your data will not be included in the dataset if you have opted out of your data being used for research via the national data opt-out process.

How are you able to access this data?

A detailed application is made to NHS Digital following ethical approval which has been obtained from the Health Research Authority (HRA). NHS Digital have robust systems in place to ensure who can have access to patient data. Access to patient data is managed via a process called a Data Access Request Service (DARS). This means we need to meet very detailed data governance standards and can demonstrate we are able to look after the data appropriately. More information about the DARS process can be found here.

Where will you store the data?

The data will be stored and analysed in the Data Safe Haven (DSH), Hull Health Trials Unit. The DSH is a secure research environment with appropriate technical and information governance controls for the storage and processing of sensitive research data. DSH are compliant with the NHS Data Security Protection Toolkit (DSPT). This means they meet strict requirements set out by the NHS to store and manage patient data.

The data resides within a secured data centre. The research team will access the data via secured connections which means the data never leaves the secured data centre. We also confirm the data for our study and analysis will not be transferred outside DSH to any other countries or third-party organisations.

More information about the DSPT can be found here.

How long will you keep it?

We will keep the data within the DSH for the period of our data sharing agreement contract with NHS Digital. At the end of the contract all patient data must be deleted in keeping with NHS Digital requirements A data destruction agreement will be completed by the research team with DSH and NHS Digital. We will retain summary data for the purposes of publications in journals but this will not be individual data

Data Protection

Under the terms of our contract with NHS Digital we (York and Scarborough Teaching Hospitals NHS Foundation Trust) are the data controller of your data for the time we hold it. As a data controller we have the core legal responsibility to safeguard the information and ensure it is processed lawfully. The law is set out in the EU General Data Protection Regulation (called “GDPR”) and the Data Protection Act 2018 in the United Kingdom. In particular, the ‘data controller’ must:

Take steps to ensure that the data it processes is accurate and up-to-date;
Give you clear information about its processing of your data, in one or more privacy notices like this one;
Only process your data for specific purposes described to you in a Privacy Notice, and only share your data with third parties as provided for in a Privacy Notice; and
Keep your data secure.

Lawful Basis

The law states that we can only process your personal data if it meets one of the conditions of processing in Article 6 GDPR. As we are processing special category data, we also must meet one of the conditions in Article 9 GDPR. Special Category data includes personal data which relates to your ethnicity, sex life or sexual orientation, health or disability, biometric or genetic data, religious or philosophical beliefs, political opinions or trade union membership. Under data protection legislation, we need to explain the legal basis for holding your data, i.e. which of these conditions apply.

For our research project the following conditions apply:

Article 6.1(e) of the GDPR, i.e. our processing is necessary for the performance of a task carried out in the public interest. Research is a task that York and Scarborough Teaching Hospitals NHS Foundation Trust performs in the public interest.
Article 9.2(j) of the GDPR, i.e. our processing is necessary for research purposes or statistical purposes. This condition applies as long as we are applying appropriate protections to keep your data secure and safeguard your interests.

Your rights as a data subject

Under the data protection laws you have a number of rights in relation to the processing of your data. These are limited by the lawful basis under which we hold your data. Your rights are:

The right to request access to your data as processed by York and Scarborough Teaching Hospitals NHS Foundation Trust and information about that processing;
The right to rectify any inaccuracies in your data; and
The right to place restrictions on our processing of your data.

Please note that we are unable to identify you ourselves within the data we hold. As such we would need to work with NHS Digital to identify if you are in any of the datasets.

If you would like to exercise any of your rights as outlined above, you can contact the DPO as above or visit the Data Protection page on our website:

https://www.yorkhospitals.nhs.uk/about-us/information-governance/privacy-notices/

We will always aim to respond clearly and fully to any concerns you have about our processing and requests to exercise the rights set out above. However, as a data subject, if you have concerns about our data processing or consider that we have failed to comply with the data protection legislation, then you have the right to lodge a complaint with the data protection regulator, the Information Commissioner:

Online reporting: https://ico.org.uk/concerns/

Email: casework@ico.org.uk

Tel: 0303 123 1113

Post:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF