NHS England requirements and conditions#
Last modified: 09 Sep 2024
Approved users are provided with a list of project-specific and general NHS England conditions when their application is approved. Below are details about the points that applicants must address in their applications, the assessment process and the general sub-licensing conditions.
Application requirements#
To use NHS England data users must demonstrate in their application:
How their proposed research clearly articulates ‘benefits to healthcare provision, adult social care and/or the promotion of health’ (this is a legal requirement and condition of access).
A realistic and comprehensive plan for how their findings will be disseminated to relevant stakeholders to achieve the stated benefits.
That the use of NHS data is relevant to the stated purpose. Within this, the applicant must justify how their application requires NHS data linked to LPS data – and why their purpose cannot be satisfied through using either source alone.
Each and all of the requested data are relevant to the stated purpose, i.e. a justification at an item level, where item relates to the broad datasets requested, e.g. primary care records, mortality register records, or to a range of data defined by a code list (e.g. a list of respiratory health codes).
Applicants must clearly and specifically answer each of these points. Applications which do not achieve this cannot be processed.
Application assessment process#
NHS England has delegated the assessment of applications that contain NHS England data to the UK LLC Data Access Committee. Below is a summary of the process followed by the UK LLC DAC.
To consider and define criteria by which application subject matter/data content is determined to have an ‘elevated sensitivity’ and thus requires additional review steps.
To assess applications against the following criteria:
i. Has the applicant demonstrated how their research outputs will lead to public good?
a. Are there clearly articulated scientific and wider societal impacts of the proposed research?
b. Are there clearly articulated benefits to healthcare provision, adult social care or the promotion of health?
c. Is the applicant committing to publish the findings of the research into the free-to-access public domain?
d. Has the applicant provided a realistic and comprehensive plan for how their findings will be disseminated to relevant stakeholders to achieve the stated benefits?
ii. Is the data request proportionate?
a. Is the data request minimised sufficiently so that all requested data are justified by the stated purpose?
b. Is there a clear and specific justification for the use of data of particular sensitivity?
c. Is the request to use linked data justified as being necessary to realise the intended benefits of the application?
d. Has any request to use linked data demonstrated how the intended purpose is only achievable by using NHS data linked to non-NHS data within the UK LLC (i.e. that the request could not be fulfilled by the NHS directly)?
iii. Does the application generate any additional or unacceptable risks of disclosure of participant identity?
iv. Does the proposed research have the potential to bring the UK LLC or the owners of the data deposited in the UK LLC TRE into disrepute?
v. Does the applicant demonstrate adequate levels of data security at their institution? a. Is there organisational security assurance for applicants requesting linked NHS data?
vi. Is there a clear legal basis for this use of UK LLC data? a. Is there a clear legal basis for any processing of linked NHS data?
vii. Has the applicant committed that their proposed data use will not be for profit-making purposes?
viii. Where the applicant is a student/PhD student, has the applicant demonstrated how their use of the data will be adequately supervised?
To consider any emerging risks, issues and/or data access policy issues and to refer these to the UK LLC Executive Group and UK LLC Strategic Advisory Committee for advice.
To, where appropriate, take advice of third-party specialist knowledge to inform decision-making and the evolution of the UK LLC access request process.
To provide regular updates to the UK LLC Executive Group and UK LLC Strategic Advisory Committee, including a summary of applications made, decisions taken, performance metrics and any arising risks, issues or landscape changes that members of the UK LLC Data Access Committee wish to report.
For each onward sharing of the linked NHS data, to publish information about the dissemination on the NHS England release register. This should include the name of the organisation(s) accessing the data, the purpose (summary of the project) and details of the data released.
To provide regular updates to the contributing LPS summarising the applications made, decisions taken, performance metrics and an overview of projects and project outcomes.
To publish information into the public domain about applications made, the decisions relating to these and the name of the organisation(s) accessing the data, the purpose (summary of the project) and details of the data released.
To ensure a clear and reproducible process for decision making is established and made clear to members, applicants, key stakeholders and the public through a ‘Standard Operating Procedure’ and through set Service Standards (quantifiable metrics for service delivery).
General sub-licensing conditions for host organisations#
Where the Recipient Institute is accessing NHS Linked Data, the following additional conditions will apply:
The University [of Bristol] reserves the right to enter any of the premises where the data are accessed at its own discretion and when required by an NHS Contributor.
The NHS Contributors shall benefit from and can enforce the terms of the Licence directly in accordance with the Contracts (Rights of Third Parties) Act 1999 (without the involvement or consent of the University) against the Recipient Institute.
The NHS Contributors shall have the right at any time and at their own discretion to perform an audit of the Recipient Institute, provided that the Recipient Institute is given seven (7) days’ notice where permissible and practicable.
The NHS Contributors shall have the right to suspend, in whole or in part, the Licence in relation to all or part of the Data where:
i. The agreement between the University and the NHS Contributor is suspended in whole or in part; or
ii. The Recipient Institute has not complied, or is not complying with any of its obligations under the Licence, until the breach is resolved to the NHS Contributor’s reasonable satisfaction.
The Recipient Institute shall have no rights in or to the NHS Linked Data other than the right to use the NHS Linked Data in accordance with the express terms of the Licence, which shall not exceed the Sub-licence permitted under the Data Sharing Agreement signed between the University and the NHS Contributor.
The Recipient Institute shall prospectively assign any and all future Intellectual Property Rights in any NHS Contributor Manipulated Data to the relevant NHS Contributor, from creation and shall execute or procure the execution of any document, or shall perform, or procure the performance of any acts as may be required to give this effect.
Where the Recipient Institute does not maintain a registration under the NHS Data Security and Protection Toolkit, the Recipient Institute warrants that the Data Security Policies outlined in the Systems Level Security Policy (available upon request) provide an equivalent level of protection of any Personal Data accessed by the Recipient Institute.
The Recipient Institute shall not have the right to assign, novate, transfer, charge, dispose of or deal in any other manner with the Licence, or any of its rights or beneficial interests under it, or purport to do the same, nor sub-contract any or all of its obligations under the Licence without the prior written consent of both the NHS Contributor and the University.