NHS England Data Sharing Remote Audit: Adelphi Group Limited​

Purpose

This report records the key findings of a remote data sharing audit of Adelphi Group Limited (Adelphi) between 24 to 28 February 2025. It provides an evaluation of how Adelphi and its Processor conform to the requirements of:

• the data sharing framework contracts (DSFC)
  • CON-670898-F6X6H
  • CON-290527-P5C0Y  
• the data sharing agreements (DSA)
  • DARS-NIC-655446-P9K9Q-v0.7
  • DARS-NIC-682583-Z3V2H-v0.7
• the organisations’ own policies, processes and procedures

 These DSAs cover the provision of the following datasets:

*This dataset is only on DARS-NIC-682583-Z3V2H-v0.7

The joint Controllers are Adelphi and Merck Sharp and Dohme Limited (MSD); the Processor is Box.com (UK) Ltd (Box.com). Box.com do not have access to the data and only provide cloud hosting services. The interviews were limited to Adelphi. Each DSA covered the following:

• DARS-NIC-682583-Z3V2H-v0.7 provides access to NHS England (NHSE) data for the purpose of the following research project: A retrospective observational study of treatment patterns, resource use and outcomes in patients with early-stage Non-Small Cell Lung Cancer (NSCLC) in England.
• DARS-NIC-655446-P9K9Q-v0.7 provides access to National Disease Registration Service (NDRS) National Cancer Registration and Analysis Service (NCRAS) data for the purposes of the following project: A retrospective observational study of Patient Characteristics, treatment patterns and healthcare resource utilisation for stage II Melanoma in England.

The interviews during the audit were conducted through video conferencing.

This is an exception report based on the criteria expressed in the Data Sharing Audit Guide version 4.

Audit type and scope

Data recipient’s acceptance statement

Adelphi has reviewed this report and confirmed that it is accurate.  

Data recipient’s action plan

Adelphi will establish a corrective action plan to address each finding shown in the table below. The Audit Team will validate this plan and the resultant actions will be followed up with Adelphi by the IG Risk and Assurance team at NHS England to confirm the findings have been satisfactorily addressed.

The Audit Team has identified 1 opportunity for improvement which is provided for reference only and will not be followed up.

The following table identifies 1 organisation nonconformity, 1 observation and 2 follow-up items that were raised as part of the audit.

The following table identifies 1 opportunity for improvement which could help an organisation improve its controls and processes.

Use of data

Adelphi confirmed that the datasets were only being processed and used for the purposes defined in the DSAs and were only being linked with those datasets explicitly allowed in the DSAs.     

Data location

Adelphi confirmed that processing and storage locations, including disaster recovery and backups, of the datasets were limited to the locations shown in the following table. These locations conform with the territory of use defined in the DSA.

Backup retention

The duration for which data may be retained on backup media is:

The audit was based upon a sample of the data recipient’s activities, as observed by the Audit Team. The findings detailed in this audit report may not include all possible nonconformities which may exist. In addition, as the audit interviews were conducted through a video conference platform, certain controls that would normally be assessed whilst onsite could not be witnessed. 

NHS England has prepared this audit report for its own purposes. As a result, NHS England does not assume any liability to any person or organisation for any loss or damage suffered or costs incurred by it arising out of, or in connection with, this report, however such loss or damage is caused. NHS England does not assume liability for any loss occasioned to any person or organisation acting or refraining from acting as a result of any information contained in this report.