EPMA data for COVID-19 response project

Transparency Notice for Hospital Trusts

Electronic Prescribing Medicines Administration (EPMA) data for COVID-19 response

To support the government response to coronavirus (COVID-19), we are sharing data on the medicines prescribed and administered to patients in hospital settings with NHS Digital.

The health and social care system is facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak of COVID-19. In the current emergency it has become even more important to share health and care information across relevant organisations.

Our legal basis for sharing data with NHS Digital

NHS Digital has been legally directed to collect and analyse patient data to support the government’s response to the COVID-19 pandemic. NHS Digital will become the controller under the General Data Protection Regulation 2016 (GDPR) for the personal data collected and analysed jointly with the Secretary of State for Health and Social Care under the COVID-19 Public Health Directions 2020.

Hospital trusts are legally required to share medicines and prescribing data with NHS Digital under the Health and Social Care Act 2012. More information about this requirement can be found in the Data Provision Notice issued by NHS Digital to hospital trusts

Under the GDPR, our legal basis for sharing this personal data with NHS Digital is Article 6(1)(c) – legal obligation and our legal basis for sharing personal data relating to health (known as special category data) is Article 9(2)(g) – substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the COVID-19 Public Health Directions 2020.

The type of personal data we are sharing with NHS Digital

The data shared with NHS Digital will include what medicines have been prescribed to patients in hospital settings, how and when the medicine was taken by the patient (administration), the reasons for prescribing if this is available (known as indications) and the patient’s NHS number. Where available the data will indicate what stage of the patient’s journey through the hospital the data relates to (admission, inpatient, discharge, outpatient). 

Where the sharing of identifiable patient data is restricted by law, such as the Human Fertilisation and Embryology Act 1990 (as amended by the HFEA 2008) and The NHS Trusts and Primary Care Trusts (Sexually Transmitted Diseases) Directions 2000, this data will not be shared with NHS Digital.

How NHS Digital will use and share your data

NHS Digital will analyse the data they collect and securely and lawfully share the data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only.  These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials.

NHS Digital has various legal powers to share data for purposes relating to the coronavirus response. It is also required to share data in certain circumstances set out in the COVID-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared. Organisations using your data will also need to have a clear legal basis to do so and will enter into a data sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital EPMA data for COVID-19 Transparency Notice

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your rights over your personal data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see:

• NHS Digital Coronavirus (COVID-19) Response Transparency Notice
• NHS Digital General Transparency Notice
• how NHS Digital looks after your health and care information