Data Controller

NHS West Yorkshire Integrated Care Board

Purpose

Population health management uses data about patients to understand the needs of a population, in our case the population of West Yorkshire.  Its main purpose is to help us as commissioners (buyers) and local health and care professionals to understand our current and predict our future health and care needs. This will help us tailor better care and support to people, design more joined up and sustainable health and care services and make better use of public resources.

Population health management  requires health and social care organisations to work together with communities and partner agencies. The information is used to understand and improve the overall health outcomes of a population by addressing broader health needs, identifying at-risk groups, and designing preventive and management strategies. Only de-identified information is made available to the ICB for the purposes of providing evidence-based care interventions.

Our population health management approach is a partnership approach across the NHS and other specific partner organisations, who have a role to play in addressing the complex and inter-connected issues that affect people’s health and wellbeing.   Linking non-NHS data is becoming increasingly important as evidence shows wider social determinants have an impact on an individual’s health. Issues such as poor housing conditions, educational instability and employment all have a direct contribution to wellbeing, including mental health.  During 2024 we therefore successfully sought approval from NHS England for a number of datasets from Wakefield Council, Wakefield Housing, the voluntary community sector and Leeds Council to be pseudonymised and linked by NHS North of England Commissioning Support Unit (NECS) to existing pseudonymised GP and local and national commissioning datasets. This will help us to understand the additional issues affecting the health of our population, focus on preventative work in partnership with our wider stakeholders e.g. local councils, and further address inequalities

Information used 

We use pseudonymised (de-identified) patient level data to understand what factors are driving poor outcomes in different population groups.  We then design new proactive models of care which will improve health and wellbeing.

As part of our population health management approach, we use two key techniques, segmentation and stratification, to help our ICB and local health and care professionals to better understand our West Yorkshire population and to identify patients that may need extra support.  

Population segmentation is the process of dividing a population into groups based on identified criteria to meet the direct care needs of each group. Population segmentation groups together people with similar characteristics.  This could be by common illness, group of illnesses, age or other factors.  By segmenting a population into smaller groups, we can design and implement targeted interventions.

Stratification groups individuals according to their risk of experiencing an adverse event, such as a particular health outcome or their use of healthcare. For example, as well as identifying those most at risk of unplanned hospital admissions, stratification can give us a better understanding about risks associated with certain conditions. 

We only use pseudonymised (de-identified) data from GP health records for data analysis that supports population health management i.e. where information that identified you has been removed and replaced with a pseudonym.  This will only ever be re-identified if we discover that you may benefit from a particular health intervention, to discuss a health outcome and consider preventative care. In such a case, only the relevant staff from your GP practice or health/care provider will be able to see your personal information in order to offer this service to you.

The pseudonymised data is provided to us by a service called the Data Services for Commissioners Regional Office (DSRCO) which is part of NHS England. They specialise in converting patient information, within a secure environment, into a format commissioners can legally use - pseudonymised patient level information. You can find more comprehensive information about this on the NHS England Website.

Pseudonymised primary care data and other local and national NHS data sets are made available to us by NECS so that dataset linkage can take place.

Lawful basis

The ICB’s legal basis for processing this personal data under the UK GDPR is Article 6 1 (e): processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller.

The ICB’s legal basis for processing special category personal data under the UK GDPR is Article 9 2 (h):    processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.

A Section 251 approval under the National Health Service Act 2006 from the Secretary of State for Health, through the Health Research Authority’s Confidentiality Advisory Group enables the extraction of confidential patient data from GP practice clinical systems for pseudonymisation and linkage by NECS to a number of NHS commissioning and local datasets, for the purposes of population health management

Type of information used

Pseudonymised information only (where the NHS number and other identifiers have been removed so that a person can’t be identified) is accessible to the ICB for population health management purposes.

NHS number for the purposes of direct care follow up (however only relevant staff from within your GP practice or health/care provider, like a hospital, will have access to this data.

Who we will share the information with (recipients)

Approved sub licensees with a sub licencing agreement in place have access to agreed pseudonymised data sets. Please see current West Yorkshire ICB sub licencing agreements in place.

Do we use any processors

North of England Commissioning Support (NECS)

The Health Informatics Service (THIS), our IT supplier who store all our information securely on their servers and also process the data for us to create a linked dataset to support population health management.

Microsoft Azure, supported by IT staff, host our data.

We ensure data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed. The ICB is the data controller (the organisation responsible for determining the purposes for which and the manner in which personal data is used under Data Protection Legislation) of such information.

How we collect (the source) and use the information

Our data processor NECS receives data which supports population health management from the following sources, before it is pseudonymised and linked

  • NHS commissioning datasets both national and local, from commissioned health and social care provider organisations. 

  • Primary Care data extracted from individual GP practice clinical systems.

  • Datasets provided by local authorities and voluntary and community sector are pseudonymised before they are transferred to NECS and subsequently linked to existing NHS commissioning and local datasets. 

How long we will keep the information

Datasets will be kept:

  • In line with the expiry date of the NHS England Data Sharing Agreement for commissioning data.

  • In line with any termination or non-renewal of the Data Sharing Agreement between NHS West Yorkshire ICB and each individual GP practice and/or the Data Processing Contract between NECS and each GP practice.

  • In line with an active Health Research Authority Confidentiality Advisory Group Section 251 approval for population health management.  

Once data is no longer required, it will be destroyed securely.

 

Your Rights

With regards to population health management under the UK GDPR, you have the following rights:

For more information about these rights, please visit the Information Commissioner's Office website.

Opt-out

The National Data Opt Out is applied to information provided by GP Practices. Managed by NHS England the national data opt-out is a service that allows patients to opt out of their confidential patient information being used for research and planning. The national data opt-out was introduced in May 2018 and is in line with the recommendations of the National Data Guardian in her Review of Data Security, Consent and Opt-Outs. You can view or change your national data opt-out choice at any time by using the online service or by calling 0300 3035678. You are also able to contact your GP provider and tell them your preference