Transparency Notice for Healthcare Operational Data flows for Virtual Wards (Pilot)

NHS England is collecting and analysing information in order to implement automated granular daily data collections to replace and rationalise existing, less regular local and national data flows, and national aggregated data collections, called SitReps.

This will reduce the reporting burden on providers and provide more timely data for the purposes of the NHS, to enable improved data insights to be obtained in order to support NHS delivery plans for the recovery of elective care and urgent and emergency care services. This would be in relation to recovering NHS waiting lists, care co-ordination and improvement in the quality and timeliness of healthcare operational data flows through the health and social care system.

In 2022/23, a Virtual Wards Pilot was undertaken to scope, design, build and implement an automated patient level minimum dataset into a standard data platform. The pilot allowed 5 provider healthcare organisations to test and implement this and was successful in demonstrating that data flows could be automated. The programme successfully showed that, in future, manual situation report (SitRep) submissions would not be required as it demonstrated the ability to collect granular patient-level data on a daily basis.

NHS England is now seeking to extend the pilot with healthcare organisations who agree to take part to inform a national pilot collection of a Virtual Wards Minimum Data Set with the intention to formalise and mandate a virtual wards minimum data collection in the future.

The data collection will release the following benefits for Virtual Wards providers:

• better quality data will allow for improved decision making ensuring decisions about Virtual Wards are evidence based and effective
• support improvement of data quality through data quality dashboards providing an understanding of where data quality issues exist and enabling the development of improvement plans to resolve issues with clinical coding and input
• Enable effective evaluation of Virtual Wards as a tool for Urgent and Emergency Care (UEC) recovery ensuring providers and ICBs are able to measure the effectiveness of Virtual Wards and report on their impact and benefits realisation
• support commissioning decisions at a local and national level providing evidence to support the expansion or contraction of virtual wards

The following legal bases apply to NHS England’s processing of the Healthcare Operational Data flows virtual wards data collection:

We have been issued a legal document, called Directions, from the Secretary of State for Health and Social Care which places a legal obligation on NHS England to collect and analyse information to support NHS delivery plans for the recovery of elective care and emergency and urgent care in relation to recovering NHS waiting lists, care co-ordination and the improvement of managing patient flows through the health and care system. These Directions are issued to NHS England under section 254 of the Health and Social Care Act 2012 and are called the Healthcare Operational Data Flows Directions 2024. 

Under the UK General Data Protection Regulation (UK GDPR), NHS England is a joint controller with the Department of Health and Social Care, which is a government department the Secretary of State for Health and Social Care (Secretary of State) holds responsibility for.  This is because the Secretary of State and NHS England have jointly decided the purposes for processing personal data under the Healthcare Operational Data Flows Directions 2024. NHS England is the sole controller that processes the data collected from Providers for this data collection and is also the sole controller that decides who data can be shared with.

NHS England’s legal basis under the UK GDPR and Data Protection Act 2018 (DPA 2018) is:

• Article 6(1)(c) - legal obligation under the Directions
• Article 9(2)(g) – substantial public interest supplemented plus DPA 2018 Schedule 1, Part 2, para 6 - Statutory and government purposes
• Article 9(2)(h) – Healthcare purposes, plus DPA 2018 Schedule 1, Part 1, paragraph 2 (health or social care purpose)

NHS England’s Common Law Duty of Confidentiality legal basis is:

• legal obligation under the Directions
• NHS England also issues the NHS Trusts in scope of this collection with a legal document called a Data Provision Notice under section 259 of the Health and Social Care Act 2012.  This places a legal obligation on the NHS Trusts to provide the data to NHS England without breaching the Common Law Duty of Confidentiality

Patient identifiable data is collected including:

• NHS number
• date of birth
• postcode of their usual home address
• information about their admission, inpatient stay and discharge from hospital plus any outpatient appointments data

NHS England may collect the data in two ways into NHS England instance of the NHS Federated Data Platform (FDP)

1. Data may be supplied by healthcare organisations who have a local instance of the NHS Federated Data Platform (FDP): or
2. For health care organisations, who do not have a local instance of the FDP, they will submit the data via an API to NHS England Arden and GEM Data Services for Commissioners Regional Office (AGEM DSCRO) which will then run a process to de-identify and submit the data to the NHS England FDP;

The above data collected is pseudonymised (de-identified) as part of the receipt of the data into NHS England, more information is available How we are protecting privacy and confidentiality.

The pseudonymised (de-identified) data which will be used for analytical purposes, will be stored separately within our Unified Data Access Layer (UDAL) and our instance of the NHS England Federated data platform and will not be linked back to the identifiable data set.

NHS England will share information with Integrated Care Boards and the Hospital Trusts that originally provided the data.  

Subject to established NHS England governance procedures and approvals, data providers will be able to view their own data, which is de-identified or aggregated,  via products made available on the NHS England Federated data platform 

Subject to established NHS England governance procedures and approvals, data providers will be able to view their own data, which is de-identified or aggregated,  via products made available on the Records Management Code of Practice and NHS England’s Records management policy.

This data will be stored within the UK. Within NHS England, the identifiable data will be in our AGEM DSCRO infrastructure which uses a mix of cloud applications and applications installed on the virtualised infrastructure.

The pseudonymised data which will be used for analytical purposes will be stored within our Unified Data Access Layer (UDAL) and our instance of the Federated Data Platform.

We follow the NHS England cloud security good practice guide, as well as best practices for security and deployment.

You can read more about the health and care information collected by NHS England, and your choices and rights in:

• how we look after your health and care information
• NHS England general Transparency Notice and its associated GDPR Record of processing entry 
• how to make a subject access request

The National Data Opt-Out introduced on 28 May 2018 enables patients to remove consent for their confidential (identifiable) NHS data to be used for research or planning purposes.

The Directions provide the legal basis for this collection, and NHS England will issue Data Provision Notices under Health and Social Care Act 2012 section 259 to each provider.  The Data Provision Notice is a legal obligation which the providers must comply with. Therefore, we are able to collect your confidential patient information even if you have registered a National Data Opt-Out, because the opt-out does not apply if we are legally required to collect your data.

If you have registered a national data opt out, we will not share your confidential patient information with other organisations for research and planning purposes, unless there is an exemption to this. You can find out more about where your choice does not apply on the NHS website. You can find out more about opting out of sharing your health records.

We take our responsibility to look after your data very seriously. If you have any questions or concerns about how NHS England uses your data, please contact our Data Protection Officer. 

If you are not happy with our response, you have the right to make a complaint about how we are using your data to the Information Commissioner’s Office by calling 0303 123 1113 or through their website

NHS England may make changes to this Transparency Notice. If so, the published date below will also change. Any changes to this notice will apply immediately from the date of any change.