OPCRD-NEXUS

OPCRD-NEXUS linked HES data will be used to conduct data processing and analyses for ethics approved studies, and only the output is provided to the researcher. Researchers will not have direct access to the data held in OPCRD-NEXUS.

All research must be reviewed and approved by the Anonymised Data Ethics and Protocol Transparency Committee (ADEPT) before OPCRD-NEXUS data can be used for the research. ADEPT is responsible for the independent review of proposed research for scientific quality, public benefit, ethical considerations, and any risks posed to patients or data subjects by the research.

Researchers wishing to conduct research using linked data from OPCRD-NEXUS must submit their study or project protocol to ADEPT; with a completed study application form covering details of the intended research. All proposed research must have intent to publish and must have scientific, medical or public health basis. All applications must also include a copy of the Chief or Principal Investigator’s curriculum vitae (no more than 2 pages long).

ADEPT application form, the application process, the approval process, and further information on ADEPT is available here.

After ADEPT approval, the researcher will be required to enter into a strict Data Sharing & Use Agreement and the payment of data processing fees.

OPCRD-NEXUS is securely hosted by Harvey Walsh Limited, a registered data controller with the Information Commissioner’s Office, registration number: Z9575186. OPC is also a registered data controller with the Information Commissioner’s Office, registration number: ZA197058. OPCRD-NEXUS is protected from unauthorised access, damage or loss, and maintained with industry level security under Harvey Walsh ISO Information Security Standard 27001 Certification.

OPC and Harvey Walsh comply with the NHS Data Security and Protection Toolkit assessment once every year, which is published for transparency across the NHS. The assessment ensures that we comply with the National Data Guardian’s 10 Data Security Standards, including protection of patient confidentiality and respect for patient data rights.

OPCRD-NEXUS does not received any data for patients who have expressed that their data should not be shared, including those who have expressed so through the National Data Opt-out Policy in England.

OPC and Harvey Walsh employees are regularly trained on data protection, including compulsory annual certified training. We conduct regular checks and audits to ensure compliance with the GDPR/Data Protection Act 2018 and our data security policies.

• OPCRD has Section 251 approval from the Confidentiality Advisory Group for Harvey Walsh and NHS Digital to process patient identifiers from GP practices for the sole purpose of linking OPCRD primary care (GP) data to hospital data.
• GP practices send a secure file containing only patient identifiers (NHS number, date of birth and sex) to Harvey Walsh, who collect the files from many practices and send it to NHS Digital.
• NHS Digital conducts a match for the patient identifiers in hospital datasets and then provides only de-identified hospital or HES data for the requested patient identifiers.
• NHS Digital then send the de-identified hospital data to Harvey Walsh.
• Harvey Walsh also receives de-identified GP data from OPCRD.
• Harvey Walsh joins the GP data to hospital data to form the GP-Hospital linked dataset, which is then stored securely in OPCRD-NEXUS.
• OPCRD-NEXUS never receives any patient-identifiable information from GP practices or from NHS Digital at any stage.
• OPCRD-NEXUS data is then used to conduct research for studies which have received ethics approval from an independent body called ADEPT – the Anonymised Data Ethics and Protocol Transparency committee.
• Only outputs (i.e. results or reports) from the research conducted is provided to the researcher. All outputs are fully anonymous and you cannot identify a patient from anonymous data.