Privacy Notice for Research Patients

Summary

As a NHS organisation we may use personally-identifiable information to conduct research to improve health, care and services. If you agree to take part in a research study we will use information provided by yourself, your medical records and your GP. We will only use information that we need for the research study. We will let very few people know your name or contact details, and only if they really need it for this study.

Everyone involved in this study will keep your data safe and secure. We will also follow all privacy rules.

At the end of the study we will save some of the data in case we need to check it and with your permission in some cases it may be retained for future research.

We will make sure no-one can work out who you are from the reports we write. The following information gives you more detail.

Patient information and health and care research

All NHS organisations are expected to participate and support health and care research. The Health Research Authority (HRA) set standards for NHS organisations to make sure they protect your privacy and comply with the law when they are involved in research. HRA research ethics committees review research studies to make sure that the research uses of data about you are in the public interest, and meet ethical standards.

Health and care research may be exploring prevention, diagnosis or treatment of disease, which includes health and social factors in any disease area. Research may be sponsored by companies developing new medicines or medical devices, NHS organisations, universities or medical research charities. The research sponsor decides what information will be collected for the study and how it will be used.

Health and care research should serve the public interest, which means that research sponsors have to demonstrate that their research serves the interests of society as a whole. They do this by following the UK Policy Framework for Health and Social Care Research. They also have to have a legal basis for any use of personally-identifiable information.

Why does health and care research use information from patients?

In clinical trials, the researchers are collecting data that will tell them whether one treatment is better or worse than other. The information they collect will show how safe a treatment is, or whether it is making a difference to your health. Different people can respond differently to a treatment. By collecting information from lots of people, researchers can use statistics to work out what effect a treatment is having.

Other types of research will collect data from lots of health records to look for patterns. It might be looking to see if any problems happen more in patients taking a medicine. Or to see if people who have screening tests are more likely to stay healthier.

Some research will use blood tests or samples along with information about the patient’s health. Researchers may be looking at changes in cells or chemicals due to a disease.

All research should only use the patient data that it really needs to do the research. The type data collected during a research study will be described to you in a participant information sheet.

Next of kin, guardian, carer or friend’s details

Your next of kin, relative, guardian, carer or friend’s details are collected for emergency contact, the study research team and Study Sponsor (UHP) has a legitimate interest in processing this personal data throughout the duration of the study. Processing this information allows the study

research team and the Trust, as Sponsor of the research, to maintain accurate and up-to-date contact details to specifically identify who to contact in the event of a concern or an emergency related to your participation in a research study. ‘Task in public interest’ is the legal basis for storing your next of kin, relative, guardian, carer or friend’s information and you should always inform your next of kin, relative, guardian, carer or friend that their details have been given to the study research team so they are aware they may be contacted in the future. All personal data is stored securely with access limited to only the appropriate study and Trust personnel. Once the study is complete their details will be archived and destroyed after the completion of the study archive period. For more information on what Task in public interest is, visit the ICO website: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection- regulation-gdpr/lawful-basis-for-processing/public-task/

How patient information may be used for research

When you agree to take part in a research study, the sponsor will collect the minimum personally-identifiable information needed for the purposes of the research project. Information about you will be used in the ways needed to conduct and analyse the research study. NHS organisations may keep a copy of the information collected about you. Depending on the needs of the study, the information that is passed to the research sponsor may include personal data that could identify you. You can find out more about the use of patient information for the study you are taking part in from the research team or the study sponsor. You can find out who the study sponsor is from the information you were given when you agreed to take part in the study.

For some research studies, you may be asked to provide information about your health to the research team, for example in a questionnaire. Sometimes information about you will be collected for research at the same time as for your clinical care, for example when a blood test is taken. In other cases, information may be copied from your health records. Information from your health records may be linked to information from other places such as central NHS records, or information about you collected by other organisations. You will be told about this when you agree to take part in the study.

How does research use patient data?

If you take part in some types of research, like clinical trials, some of the research team will need to know your name and contact details so they can contact you about your research appointments, or to send you questionnaires. Researchers must always make sure that as few people as possible can see this sort of information that can show who you are.

In lots of research, most of the research team will not need to know your name. In these cases, someone will remove your name from the research data and replace it with a code number. This is called coded data, or the technical term is pseudonymised data. For example, your blood test might be labelled with your code number instead of your name. It can be matched up with the rest of the data relating to you by the code number.

In other research, only the doctor copying the data from your health records will know your name. They will replace your name with a code number. They will also make sure that any other information that could show who you are is removed. For example, instead of using your date of birth they will give the research team your age. When there is no information that could show who you are, this is called anonymous data.

Where will my data go?

Sometimes your own doctor or care team will be involved in doing a research study. Often, they will be part of a bigger research team. This may involve other hospitals, or universities or companies developing new treatments. Sometimes parts of the research team will be in other countries. You can ask about where your data will go. You can also check whether the data they get will include information that could show who you are. Research teams in other countries must stick to the rules that the UK uses.

All the computers storing patient data must meet special security arrangements.

If you want to find out more about how companies develop and sell new medicines, the Association of the British Pharmaceutical Industry has information on its website.

What are my choices about my patient data?

• You can stop being part of a research study at any time, without giving a reason, but the research team will keep the research data about you that they already have. You can find out what would happen with your data before you agree to take part in a study.
• In some studies, once you have finished treatment the research team will continue to collect some information from your doctor or from central NHS records over a few months or years so the research team can track your health. If you do not want this to happen, you can say you want to stop any more information being collected.
• Researchers need to manage your records in specific ways for the research to be reliable. This means that they won’t be able to let you see or change the data they hold about you. Research could go wrong if data is removed or changed.

What happens to my research data after the study?

Researchers must make sure they write the reports about the study in a way that no-one can work out that you took part in the study.

Once they have finished the study, the research team will keep the research data for several years (a legal requirement for clinical trials), in case the researchers or government regulators need to check it. You can ask about who will keep it, whether it includes your name, and how long they will keep it.

Usually your hospital or GP where you are taking part in the study will keep a copy of the research data along with your name. The organisation running the research will usually only keep a coded copy of your research data, without your name included. This is kept so the results can be checked.

If you agree to take part in a research study, you may get the choice to give your research data from this study for future research. Sometimes this future research may use research data that has had your name and NHS number removed (this would make the data anonymous so other future researchers won’t be able to contact you). Or it may use research data that could show who you are (in which case future researchers maybe able to contact you). You will be told what options there are. You will get details if your research data will be joined up with other information about you or your health, such as from your GP or social services.

On rare occasions NHS organisations may provide researchers with confidential patient information from your health records when we are not able to seek your agreement to take part in the study, for example because the number of patients involved is too large or the NHS organisation no longer has your contact details. Researchers must have special approval before they can do this.

Any information that could show who you are will be held safely with strict limits on who can access it.

Researchers may not be able to specify all the possible future uses of the information they keep. It could include providing the information to other researchers from NHS organisations, universities or companies developing new treatments or care. Wherever this happens it will be done under strict legal agreements. The information about you will be depersonalised (either pseudonymised or anonymised) wherever possible so that you cannot be identified. Where there is a risk that you can be identified your data will only be used in research that has been independently reviewed by an ethics committee.

Data Protection Legislation

The Trust must manage your personal information in line with the:

• UK Data Protection Act 2018

• UK General Data Protection Regulation (GDPR)

We must be clear about the legal basis for processing your information and we record this.

As a public authority the Trust has been authorised by the government to carry out research. The legal basis for processing personal identifiable data under GDPR is Article 6 (1) (e) ‘… exercise of official authority…’ and for special category data Article 9 (2) (j) ‘… research purposes…’

Researchers must show that their research takes account of the views of patients and ordinary members of the public. They must also show how they protect the privacy of the people who take part. An NHS research ethics committee checks this before the research starts.

What are your information rights?

You have a number of rights under the Data Protection Legislation:

1. To be informed why, where and how we use your information
2. To ask for access to your information, Access to Medical Records
3. To ask for your information to be corrected if it is inaccurate or incomplete
4. To ask for your information to be deleted or removed where there is no need for us to continue processing it
5. To ask us to restrict the use of your information in certain circumstances
6. In limited circumstances to ask us to copy or transfer your information from one IT system to another
7. To object to how your information is used
8. To challenge decisions made without human intervention (automated decision making)

What if I don't want my patient data used for research?

You will have a choice about taking part in a clinical trial testing a treatment. If you choose not to take part, that is fine.

In most cases you will also have a choice about your patient data being used for other types of research. There are two cases where this might not happen:

1. When the research is using anonymous information. Because it’s anonymous, the research team don’t know whose data it is and can’t ask you.
2. When it would not be possible for the research team to ask everyone. This would usually be because of the number of people who would have to be contacted. Sometimes it will be because the research could be biased if some people chose not to agree. In this case a special NHS group will check that the reasons are valid. You can opt-out of your data being used for this sort of research. In England you can register your choice to opt out via the NHS website. If you do choose to opt out you can still agree to take part in any research study you want to, without affecting your ability to opt out of other research. You can also change your choice about opting out at any time.

Your choices about health and care research

If you are asked about taking part in research, usually someone in the care team looking after you will contact you. People in your care team may look at your health records to check whether you are suitable to take part in a research study, before asking you whether you are interested or sending you a letter on behalf of the researcher.

In some hospitals and GP practices, you may have the opportunity to sign up to a register to hear about suitable research studies that you could take part in. In this case the hospital or researchers would keep your contact details and some of your health information, so they can invite you to take part in future clinical trials or other studies. Your data will not be used to sell you anything and only be used for health and care research. If you agree to this, then research

nurses, researchers or administrative staff authorised by the Trust may look at your health records to see if you are suitable for any research studies.

It’s important for you to be aware that if you are taking part in research, or information about you is used for research, your rights to access, change or move information about you are limited. This is because researchers need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from a study, the sponsor will keep the information about you that it has already obtained. They may also keep information from research indefinitely.

If you would like to find out more about why and how patient data is used in research, please visit the Understanding Patient Data website.

Public Records Act 1958

Additionally we are required by law, under the Public Records Act 1958 (as amended), to transfer records to the National Archives (TNA) for permanent preservation. Some of these records may include the personal data from our archived research studies. Full consideration will be given to Data Protection and Freedom of Information legislation when making decisions about whether such records should be open to the public. More information about the records the TNA collect can be found at: https://www.nationalarchives.gov.uk/documents/records-collection-policy- 2012.pdf

Who can I contact if I have a complaint?

If you want to complain about how researchers have handled your information, you should contact the research team. If you are not happy after that, you can contact the Trust’s Data Protection Officer and they will investigate the matter. If you are not satisfied with their response or believe they are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).

Please address any questions or concerns to the Trusts Data Protection Officer:-

Data Protection Officer

University Hospitals Plymouth NHS Trust Information Governance Team

1st Floor Bircham House William Prance Road Derriford

Plymouth PL6 5WR

Tel: 01752 437284

Email: informationgovernancepht@nhs.net

If you remain dissatisfied then you have the right to apply directly to the Information Commissioner for a decision. The Information Commissioner can be contacted at: -

Information Commissioner’s Office,

Wycliffe House, Water Lane, Wilmslow, Cheshire,

SK9 5AF

www.ico.org.uk