The Christie Charity
The purpose of this notice is to inform relevant populations that the legal basis for the GM COVID Cancer project is changing. Confidential patient data will continue to be processed without consent after the expiry of the Notice issued under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002. Instead, the legal basis will be Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002.
What is GM COVID Cancer?
The GM COVID Cancer project aims to improve our understanding of the risk COVID-19 infection poses to cancer patients. We are doing this by comparing the rate of complications and death, as well as vaccination levels, other co-occurring illnesses and conditions, and medications prescribed, in a group of 65,000 cancer patients and a group of 325,000 patients who do not have cancer.
Most of the data used in this project come from the Greater Manchester Integrated Digital Care Record (GMIDCR), and a small amount (for example, information about chemotherapy and radiotherapy) come from patient records at The Christie.
How is confidential patient data being processed?
Confidential patient data are processed by Graphnet, on behalf of the GM Integrated Care System (GM ICS) to generate the GM-IDCR and provide data within a secure portal for research purposes.
For the purposes of this study, data on chemotherapy and radiotherapy performed at The Christie will be securely transferred to Graphnet. Graphnet will use patients’ national insurance numbers to link The Christie data to the data held in the GM-IDCR on the 65,000 cancer patients that are included in this study. Graphnet will then strip national insurance numbers from the linked data and allocate a non-identifiable study ID for each patient. The key linking national insurance number to
study ID will be held by Graphnet.
Will the research team be able to work out who data has come from?
No. The research team will only have access to the de-identified data – that is, the dataset that has had national insurance numbers removed. It is this dataset that will be analysed.
Why is the legal basis for processing changing?
Until 30 June 2022, the legal basis was the Notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI), which was sent to NHS Digital by the Secretary of State for Health and Social Care early in the COVID-19 pandemic. This notice compelled NHS Digital to share confidential patient information so that research into COVID-19 could be carried out.
The COPI notice expires on 30 June 2022 and therefore an alternative legal basis is required from this date. After 30 June, the legal basis is Regulation 5 of the Health Service (Control of Patient Information Regulations) 2002, under which the Confidentiality Advisory Group (CAG) has advised the Health Research Authority (HRA) to support GM COVID Cancer. This permits The Christie to share confidential patient data with Graphnet to enable Christie data to be linked with Graphnet data for the linkage purposes of this project.
Why are you processing data without consent?
This project involves data from about 350,000 patients, some of whom may now have died. It would therefore be very impractical to contact every individual and ask for consent to use their data. In addition no identifiable data will be accessible to the research team undertaking the study.
What if I don’t want you to process my data?
While this project’s legal basis for processing data is the COPI Notice, it is not possible to opt out of your data being included in this study.
Once the legal basis has changed to support under Regulation 5 (that is, after 30th June 2022), this project is subject to the National Data Opt-Out. You can opt out of your data being processed by visiting the NHS.uk website. This will opt you out of all studies performed in the future by any research team.
If you opt out before your data are linked and de-identified your data will be removed and not used in this study. If however your data have already been linked and de-identified it will not be possible to identify and remove the data that relate to you.
Who has approved this study?
This study has been approved by the Research Ethics Committee (ref: 21/WA/0240) and by The Christie’s Research Governance and Integrity team. It has also been reviewed by the Confidentiality Advisory Group (21/CAG/0144), which recommended that the HRA support this project conditional on provision of a project-specific privacy notice on the Trust website.
If you are interested in learning more about how your anonymised data is used for research purposes, please visit the Manchester Cancer Research Centre website and read our Patient Data Statement.