Patient data and research leaflet

What is patient data?

When you go to your GP, hospital or other care providers, those looking after you will record data (information) about you. This can include your health problems, and the tests and treatment you have had. They might also want to know about family history, if you smoke, or what work you do. If you have a carer, they might need some of their information such as contact details. This is to help provide you with the right care. All this information that is recorded about you is called ‘patient and service user data’.

When data about your health and care identifies you (being linked to your name, NHS number, or other identifying information) it is called ‘confidential patient ata’. It is confidential to you and to those people who need to know relevant bits of that data to look after you, who must all follow special rules to keep it private, safe and secure.

Why does health and care research use your data?

All NHS organisations (including Health & Social Care in Northern Ireland) are expected to participate in and support health and care research. The Health Research Authority and government departments in Northern Ireland, Scotland and Wales set standards for NHS organisations to make sure they protect your privacy and comply with the law when they are involved in research. Our research ethics committees review research studies to make sure that the research uses of data about you are in the public interest, and meet ethical standards.

There are lots of different types of health and care research. Research may be sponsored by companies developing new medicines or medical devices, NHS organisations, universities or medical research charities. Research may be exploring prevention, diagnosis or treatment of disease, which includes health and social factors in any disease area. Other types of research will collect data from lots of health records to look for patterns. It might be looking to see if any problems happen more in patients taking a medicine. Or to see if people who have screening tests are more likely to stay healthier. Or you may take part in a research study where you have some health tests or answer some questions. Some research will use blood tests or samples along with information about your health. Researchers may be looking at changes in cells or chemicals due to a disease.

The research sponsor decides what information will be collected for the study and how it will be used. All research should only use data about you essential to do the research. You can ask what parts of your health records will be looked at. Health and care research should also serve the public interest. This means that research sponsors have to show that their research serves the interests of society as a whole. This is a requirement of law and the UK Policy Framework for Health and Social Care Research.

When you have agreed to take part in a study, the research team may look at your medical history and ask you questions to see if you are suitable to join. During the study you may have blood tests or other health checks, and you may complete questionnaires. The research team will record this data in special forms and combine it with the information from everyone else in the study. This recorded information is called ‘research data’.

In other types of research, you won’t need to do anything different, but the research team may need to look at some of your health records. This sort of research may use some data from your GP, hospital or central NHS records. Some research will combine these records with information from other places, like schools or social care. The information that the researcher views from health and other records is also research data.

In clinical trials, researchers collect data that will tell them whether one treatment is better or worse than another treatment. The research data they collect can help show how safe a treatment is, or whether it is making a difference to your health. Different people can respond differently to a treatment. By collecting data from lots of people, researchers can use statistics to work out what effect a treatment is having.

How does research use your data?

If you take part in some types of research, like clinical trials, some of the research team will need to know your name and contact details so they can contact you about your research appointments, or to send you questionnaires. Researchers must always make sure that this information can only be seen by those who absolutely need to contact you.

In lots of research, the research team will not need to know your name. In these cases, someone will first remove your name, or any other information that could show who you are, from the research data and replace it with a code number. This is called ‘coded data’. For example, your blood test might be labelled with your code number instead of your name. It can be matched up with the rest of the data relating to you by the code number.

In other research, only the doctor copying the data from your health records will know your name. They will also assign your data with a code number so that any information that could show the research team who you are can be removed. For example, instead of using your date of birth they will give the research team your age or year of birth. When there is no information that could reveal to researchers who you are, this is called ‘anonymous research data’.

When you agree to take part in a research study, the research team will collect the minimum information that can identify you needed to do the research project. This information will only be used in the ways needed to conduct and analyse the research study.

Where will your data go?

Sometimes your own doctor or care team will be involved in doing a research study. Often, they will be part of a bigger research team. This may involve other hospitals, or universities or companies developing new treatments. Sometimes parts of the research team will be in other countries. You can ask about where your data will go. You can also check whether the data they get will include information that could show who you are. Research teams in other countries must stick to the rules that the UK uses.

Your research data may also be seen by professionals who check the quality of the research. Regulators might need to check the research. They will compare the recorded research data with your health records to monitor accuracy. They might read your health records through a secure internet connection or at the hospital or clinic. All the computers storing your data must meet special security arrangements. People who need to view research data must follow strict processes when looking at your health records.

You can find out more about these use of your data for the study you are taking part in from the research team.

What does the research team do with your research data when the study completes?

Researchers must make sure they write the reports about the study in a way that no-one who reads them can work out that you took part in the study.

Once they have finished the study, the research team will keep the research data for several years in case they need to check it. You can ask about who will keep it, why they keep it, whether it includes your name and other information that identifies you, and how long they will keep it.

Usually, your hospital, GP, or other care provider where you are taking part in the study will also keep a copy of research data with your records when it is relevant to your care provision. NHS organisations may keep a copy of your anonymous research data for their records where this is necessary to comply with the law.

The sponsor running the research will usually only need to keep a coded copy of your research data, without your name included. This is kept so the results can be checked. Depending on the needs of the study, the data that is passed to the research sponsor may occasionally also include some personal details that could identify you (such as on your consent form) to evidence that the study was done properly. You can find out who the study sponsor is from the information you were given when you agreed to take part in the study.

Keeping your data for future research

Research data may be used in future research, in which case it must be stored securely until that time and always with strict limits on who can access it. Your data will not be used to sell you anything. It will not be given to other organisations or companies except for research.

Your research team may tell you about possible future research purposes at the time you join the research study. The future research may be in any disease area, including research looking at social and economic factors affecting health. However, researchers may not be able to specify all the possible future uses of the data they keep. It could include providing the information to other researchers from NHS organisations, universities or companies developing new treatments or care. Wherever this happens it will be done under strict legal agreements.

Only anonymous research data will be used wherever possible so that you cannot be identified. Where there is a risk that you can be identified, your data will only be used in research that has been independently reviewed by an ethics committee.

You will be told what options there are if other researchers want to be able to contact you to ask you about future research. You may have the choice for the hospital or researchers to keep your contact details and some of your health information, so they can invite you to take part in future clinical trials or other studies.

On rare occasions NHS organisations may provide researchers with confidential data from your health and care records when it is not possible to seek your agreement to take part in a future study. This might be because the number of people involved is too large or the NHS organisation no longer has your contact details. The purpose may be to combine it with data about you held by other health or government organisations such as NHS England. Usually, the information is combined by matching data that has the same NHS number. Doing this makes maximum use of research data and allows researchers to discover more. Researchers must have special approval before they can do this subject to very strict safeguards. There is more information about this special approval below and your ability to opt out.

Will the use of your data meet UK GDPR rules?

GDPR stands for the General Data Protection Regulation. In the UK we follow data protection law rules set out in the UK GDPR and the Data Protection Act (2018). All research using your personal data (information that identifies you as a living person) must follow these rules, including research using your confidential data.

Universities, NHS organisations and companies may use your data to do research to make health and care better, but they must have a legal basis under UK GDPR to use personal data.

When companies and charities do research to develop new treatments or deliver better healthcare, they need to be able to prove that they need to use your data for the research, and that they need to do the research to develop new treatments or deliver better healthcare. In legal terms this means that they have a ‘legitimate interest’ in using your data.

UK universities and the NHS are funded from taxes and they are expected to do research as part of their job. They still need to be able to prove that they need to use your data for the research. In legal terms this means that they use your data as part of ‘a task in the public interest’.

If they could do the research without using your data they would not be allowed to see or use it.

What if you don't want your data used for research?

You will have a choice about taking part in a clinical trial testing a treatment. If you choose not to take part, that is fine.

In most cases you will also have a choice about your data being used for other types of research. There are two cases where this might not happen:

1. When the research is using anonymous data. Because it’s anonymous, the research team don’t know whose data it is and can’t ask you
2. When it would not be possible or practical for the research team to ask everyone. This would usually be because of the number of people who would have to be contacted. Sometimes it will be because the research could be biased if some people chose not to agree. In this case a special NHS group will check that the reasons are valid before they provide special approval for this research to take place. Researchers must show that their research takes account of the views of patients and ordinary members of the public. They must also show how they protect the privacy of the people who take part. An NHS research ethics committee checks this before the research starts. In England you can opt out of your data being used for this sort of research. There is more information about how to opt out below

Who can you contact if you have a complaint?

If you want to complain about how researchers have handled your information, you should contact the research team. If you are not happy after that, you can contact the Data Protection Officer. The research team can give you details of the right Data Protection Officer.

If you are not happy with their response or believe they are processing your data in a way that is not right or lawful, you can complain to the Information Commissioner’s Office (ICO) (www.ico.org.uk or 0303 123 1113).

Where can you find more information about how your data is used?

If you would like to find out more about why and how your data is used in research, please visit the Understanding Patient Data website.

Further information is available, depending on where you live in the UK:

England

In England you can register your choice to opt out of your information being used for research via the ’My Data Choice’ NHS website. You can also ask your GP to opt out of data from your GP record being shared. If you choose to opt out you can still agree to take part in any research study you want to, without affecting your ability to opt out of other research. You can also change your choice about opting out at any time.

Northern Ireland

If you would like to find out more about how and why your information is used, including for research purposes, please visit the Department of Health website.

Scotland

Members of the public in Scotland have their rights and responsibilities set out in the Patients Rights (Scotland) Act 2011. For information on confidentiality of data (including in research) please visit the NHS Inform website.

Wales

If you would like to find out more about how and why your information is used, including for research purposes, please visit NHS 111 Wales.