Research is important to the NHS and benefits us all. It helps improve our understanding of the causes, prevention and treatment of diseases, as well as the quality of care patients receive. Whenever patients visit their healthcare professional  or use an NHS service, their health records are updated. Patient health records contain important information which is vital for medical research.

For more than 10 years, GP practices across the UK have contributed de-identified patient health records to OPCRD for scientific and medical research. This ensures that their local population is represented in research evidence that helps to improve our understanding of health conditions and patient care.

The value of OPCRD is that it provides anonymised data from real-life patients which is used to conduct scientific and medical research including Covid-19 research, that produces evidence relevant to patient care and outcomes.  Researchers from universities, charities, government organisations, NHS organisations     , research institutions and commercial companies from the UK and around the World, come to access anonymised research data from OPCRD to answer their research questions.

The funds we get from OPCRD research is vital for us to continue providing free quality improvement programmes and research support services to GP practices across the UK. To read more about how OPCRD continues to support research that is making a difference in science, clinical practice and patient care please visit OPCRD Publications https://opcrd.co.uk/publications/

Observational research data

Patient-consented research data

OPCRD is approved by the NHS Research Ethics Committee to receive and provide data for scientific, exploratory and public health research. De-identified data in OPCRD and OPCRD-NEXUS is anonymised before it is used for research in accordance with the Information Commissioner’s Office Anonymisation Code of Practice. This means that we do not know who the patients are. You can never identify a patient from the data or from any results or reports from the data. There is no possibility to identify a patient, even from a practice where that data originally came from.

OPCRD is regulated by an independent advisory and governance committee – the Anonymised Data Ethics and Protocols Transparency committee (ADEPT). Anonymised data from OPCRD and OPCRD-NEXUS is provided to researchers who have had their research reviewed and approved by ADEPT. ADEPT is responsible for the independent review of proposed research for scientific quality, public benefit, ethical considerations, and any risks posed to patients or data subjects. If the research involves patient participation, then ADEPT will require the study to have NHS Research Ethics Committee approval.

The anonymised research data is provided to approved researchers for only a limited period of time, usually 12 months. Once they have completed their analysis to answer their research question(s), they must destroy the data and share their findings for public benefit.

OPCRD and OPCRD-NEXUS data is never sold or provided for insurance or marketing purposes.

OPCRD is committed to protecting the confidentiality of patient data it receives from GP practices receiving the OPC quality improvement programme and research support services. OPCRD receives de-identified patient data from GP practices and provides only anonymised data for ethically approved research.

De-identified data is data which has had personal information and sensitive information removed.

The process of how we provide anonymised research data from OPCRD is described below:

• GP practice agrees to contribute their de-identified patient data to OPCRD.
• GP practice is supported by OPC to set-up their electronic health record system to allow only patient data that has been de-identified to flow to OPC. This means patients cannot be identified from the data the GP practice sends to OPC. OPC never receives any patient identifiable information such as name, date of birth, address or NHS number from the GP practice.
• Individual patients who have opted-out of their data being shared are excluded from any data sent by their GP practice to OPCRD.
• OPCRD has ethics approval to receive and provide patient data for research.
• Researchers request access to data from OPCRD for a specific study. Access in this case means to receive an anonymised research dataset from OPCRD required for only that specific study, and not access to the entire OPCRD database.
• All requests by researchers to access data from OPCRD are reviewed by an independent body called ADEPT – the Anonymised Data Ethics and Protocol Transparency committee. Only research approved by ADEPT can receive an anonymised research dataset from OPCRD.
• The de-identified data required for the approved research is then fully anonymised before it is provided to the researcher. Anonymisation involves removing any information which by itself or when combined with other information may possibly identify a patient. You cannot identify a patient from anonymised data or from any results or reports from anonymised data.
• Researchers sign a contract called a Data Sharing Agreement, which ensures researchers adhere to strict terms and conditions governing how the data is used and for how long they can hold the data.

In order to carry out thorough research, we need to be able to analyse patient data from primary care as well as other healthcare settings, such as secondary care (hospitals) and disease registries. When we link primary care data from GP practices who contribute to OPCRD with hospital care data, the linked data is held in a secure platform called OPCRD-NEXUS. The platform is hosted by Harvey Walsh Limited.

The process of how we link GP data and hospital data using England as an example, is described below:

• As part of agreeing to contribute patient data to OPCRD, practices also consent to their patients’ data being linked for research purposes.
• OPCRD must get Section 251approval from the Confidentiality Advisory Group for Harvey Walsh and NHS Digital to process patient identifiers from GP practices for the sole purpose of linking OPCRD primary care (GP) data to hospital data.
• GP practices send a secure file containing only patient identifiers (NHS number, date of birth and sex) to Harvey Walsh, who collect the files from many practices and send it to NHS Digital.
• NHS Digital conducts a match for the patient identifiers in hospital datasets and then provides only de-identified hospital data for the requested patient identifiers.
• NHS Digital then sends the de-identified hospital data to Harvey Walsh.
• Harvey Walsh also receive de-identified GP data from OPCRD.
• Harvey Walsh joins the GP data and hospital data to form the GP-Hospital linked dataset, which is then stored securely in OPCRD-NEXUS.
• Researchers request access  to the linked data for a specific study. All requests from researchers to gain access to linked data must be approved by an independent body called ADEPT – the Anonymised Data Ethics and Protocol Transparency committee.
• The linked data is completely anonymised following ADEPT approval before it is provided to the researcher for a limited period of time. You cannot identify a patient from anonymised data or from any results or reports from anonymised data.
• OPCRD-NEXUS never receives patient-identifiable information.

In order to carry out thorough research, we need to be able to analyse patient data from primary care as well as other healthcare settings, such as secondary care (hospitals) and disease registries. When we link primary care data from GP practices who contribute to OPCRD with hospital care data, the linked data is held in a secure platform called OPCRD-NEXUS. The platform is hosted by Harvey Walsh Limited.

The process of how we link GP data and hospital data using England as an example, is described below:

• As part of agreeing to contribute patient data to OPCRD, practices also consent to their patients’ data being linked for research purposes.
• OPCRD must get Section 251approval from the Confidentiality Advisory Group for Harvey Walsh and NHS Digital to process patient identifiers from GP practices for the sole purpose of linking OPCRD primary care (GP) data to hospital data.
• GP practices send a secure file containing only patient identifiers (NHS number, date of birth and sex) to Harvey Walsh, who collect the files from many practices and send it to NHS Digital.
• NHS Digital conducts a match for the patient identifiers in hospital datasets and then provides only de-identified hospital data for the requested patient identifiers.
• NHS Digital then sends the de-identified hospital data to Harvey Walsh.
• Harvey Walsh also receive de-identified GP data from OPCRD.
• Harvey Walsh joins the GP data and hospital data to form the GP-Hospital linked dataset, which is then stored securely in OPCRD-NEXUS.
• Researchers request access  to the linked data for a specific study. All requests from researchers to gain access to linked data must be approved by an independent body called ADEPT – the Anonymised Data Ethics and Protocol Transparency committee.
• The linked data is completely anonymised following ADEPT approval before it is provided to the researcher for a limited period of time. You cannot identify a patient from anonymised data or from any results or reports from anonymised data.
• OPCRD-NEXUS never receives patient-identifiable information.

OPCRD will continue to hold the de-identified data indefinitely for use in ethically approved research. A GP Practice can request at any time for its de-identified patient data to be removed from OPCRD, subject to any requirements on data retention as set out in the GDPR or Data Protection Act 2018. It is however not possible to remove patient data from anonymised research data because the data is anonymised and the practice or patients cannot be identified.

The anonymised research data is provided to approved researchers for only a limited period of time, usually 12 months. Researchers may request an extension to hold the data they have been provided for longer in order to complete their analysis. Once they have completed their analysis to answer their research question(s), researchers must destroy the data provided and share their research findings for public benefit.

OPCRD and OPCRD-NEXUS does not hold personal data; all research data provided from OPCRD and OPCRD-NEXUS is anonymised in accordance with the Information Commissioner’s Office Anonymisation Code of Practice.

Statutory providers of secondary care data e.g. NHS Digital, NHS Wales Informatics Service, NHS Scotland Information Services Division, may process personal data as an accredited trusted third-party within the NHS when linking GP data with data from other sources such as hospital data.

The legal basis for processing personal data where applicable are:

• Medical research and statistics – Article 6(e) and Article 9(2)(j) – for public interest and scientific research purposes.
• Medicines and medical device monitoring – Article 6(e) and Article 9(2)(i) – for public interest in the area of public health

OPCRD and OPCRD-NEXUS does not hold personal data; all research data provided from OPCRD and OPCRD-NEXUS is anonymised in accordance with the Information Commissioner’s Office Anonymisation Code of Practice.

Statutory providers of secondary care data e.g. NHS Digital, NHS Wales Informatics Service, NHS Scotland Information Services Division, may process personal data as an accredited trusted third-party within the NHS when linking GP data with data from other sources such as hospital data.

The legal basis for processing personal data where applicable are:

• Medical research and statistics – Article 6(e) and Article 9(2)(j) – for public interest and scientific research purposes.
• Medicines and medical device monitoring – Article 6(e) and Article 9(2)(i) – for public interest in the area of public health

The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 provide every individual with data rights and these are:

• the right to be informed about the processing of any data about you;
• the right of access to see or receive a printed copy of any personal data relating to you;
• the right to rectification i.e. to correct any material errors in the personal data we may hold about you;
• the right to erasure i.e. where appropriate, to ask that all personal data about you is erased;
• the right to restrict processing i.e. to ask that some or all processing ceases – this would generally involve you requesting this through your GP or through the National Data Opt-out scheme if you live in England, or withdrawing from a clinical research study directly;
• the right to data portability – this only applies to data you have provided directly;
• the right to object to and not to be subject to automated decision-making, including profiling. We do not have any automated decision-making.

As the data held in OPCRD and OPCRD-NEXUS is de-identified data, we are not required to support the exercise of these rights because we have no means of establishing anyone’s identity from data held in OPCRD or OPCRD-NEXUS. You can exercise your data rights through your GP practice.

Any identifiable data of patients taking part in OPCRD-supported clinical research study is collected or processed with the patient’s informed consent at their GP practice. If you have questions about the use of your data in a clinical research study, please contact your GP practice who will hold records about your involvement.

The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 provide every individual with data rights and these are:

• the right to be informed about the processing of any data about you;
• the right of access to see or receive a printed copy of any personal data relating to you;
• the right to rectification i.e. to correct any material errors in the personal data we may hold about you;
• the right to erasure i.e. where appropriate, to ask that all personal data about you is erased;
• the right to restrict processing i.e. to ask that some or all processing ceases – this would generally involve you requesting this through your GP or through the National Data Opt-out scheme if you live in England, or withdrawing from a clinical research study directly;
• the right to data portability – this only applies to data you have provided directly;
• the right to object to and not to be subject to automated decision-making, including profiling. We do not have any automated decision-making.

As the data held in OPCRD and OPCRD-NEXUS is de-identified data, we are not required to support the exercise of these rights because we have no means of establishing anyone’s identity from data held in OPCRD or OPCRD-NEXUS. You can exercise your data rights through your GP practice.

Any identifiable data of patients taking part in OPCRD-supported clinical research study is collected or processed with the patient’s informed consent at their GP practice. If you have questions about the use of your data in a clinical research study, please contact your GP practice who will hold records about your involvement.

You have the right to opt out of the sharing of your confidential patient health information by your GP practice. Opting out of sharing your health information will not affect the direct care that you receive.

If you do not wish for your data to be collected, processed or used for any purpose including research and planning, please contact and inform your GP practice. Individuals in England can also opt-out of data sharing through the National Data Opt-out Policy in England: https://digital.nhs.uk/services/national-data-opt-out

There is also information on the Understanding Patient Data website about how and why data is vital for patient care, and to improve health, care and services across the NHS. It explains how and why data can be used for care and research, what is allowed and what is not, and how personal information is kept safe.

OPCRD is managed under a strict research database management protocol approved by NHS Health Research Authority Research Ethics Committee (reference number: 20/EM/0148). OPCRD is managed under strict data security and protection policies to assure patients, practices, researchers and collaborators that we collect and use data securely and lawfully in compliance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018.

OPCRD is managed by Optimum Patient Care Limited (OPC). OPC is a registered data controller with the Information Commissioner’s Office, registration number: ZA197058.

OPCRD-NEXUS platform is securely hosted by Harvey Walsh Limited, a registered data controller with the Information Commissioner’s Office, registration number: Z9575186. OPCRD-NEXUS is protected from unauthorised access, damage or loss, and maintained with industry level security under Harvey Walsh ISO Information Security Standard 27001 Certification.

OPC and Harvey Walsh comply with the NHS Data Security and Protection Toolkit assessment once every year, which is published for transparency     . The assessment ensures that we comply with the National Data Guardian’s 10 Data Security Standards, including protection of patient confidentiality and respect for patient data rights.

OPC and Harvey Walsh employees are regularly trained on data protection, including compulsory annual certified training. OPC and Harvey Walsh conduct regular checks and audits to ensure compliance with the GDPR and Data Protection Act 2018.

OPCRD and OPCRD-NEXUS do not receive any data for patients who have expressed that their data should not be shared, including those who have opted out through the National Data Opt-out Policy in England.