Medical Device Outcomes Registry transparency notice

Medical devices and implants data is collected from NHS and independent sector health and care organisations.

This collection supports the development of a single Outcome Registries Platform, to enable the national reporting of the use of any surgical device or implant.

The data will help improve patient safety by making it easier and quicker to identify adverse outcomes with particular devices, so that any issues can be investigated promptly. This will include

• comparing surgical device and implant outcomes to the outcomes where patients have had alternative procedures that did not involve a surgical device or implant for the same medical conditions
• supporting the identification of patients and verifying their latest address to enable patients to be contacted by their health care organisation if their implanted device needs to be reviewed or removed if an issue with a particular device has been discovered

Your personal data, including data related to your health will be collected if you have had a surgical device or implant for a medical condition or if you have had an alternative procedure carried out for the same condition but which did not involve a surgical device or implant. This data will include:

• your NHS number
• your family name
• your first name
• your current postcode
• your date of birth
• the surgeon, and other clinicians involved in your care
• the details of the surgical procedure you had
• the details of the implant used in your surgery
• information about your state of health pre and post treatment
• post-operative outcome information collected from you by your clinicians or submitted by you as part of the review of your care

Data is submitted securely to NHS England by NHS and independent sector health and care organisations and clinical registries documented in the Data Provision Notice. These organisations are legally obliged to provide us with the information as set out in the Data Provision Notice (DPN) issued to them under section 259(1)(a) of the Health and Social Care Act 2012. The Medical Devices Outcomes Registry Data Provision Notice is published. 

Improving patient safety

Patient identifiable data collected from health care providers will be limited to use and stored within the Outcome Registries Platform and will only be accessed where it is necessary to provide direct patient care or to support public functions related to patient safety and the improvement of patient outcomes. These include;

• access to submitted data for clinical data validation, practice review and appraisal
• patient-event linkage across settings and providers for continuity of care
• recall/alert flagging and feedback to providers
• clinical direct care feedback
• patient feedback and GP continuity of care

Quality checking

The data we collect is checked and quality assured by skilled analysts. If necessary, they will check with the organisation who sent us the data to make sure it is correct and complete.

Analysis and linkage

We analyse and link the data we collect to other patient data NHS England already holds, so that we can identify how well your device is working and investigate the longer-term effects of surgical devices and implants on your health.

Publishing statistics

We will use the data to publish national statistics and data outputs that contain only anonymous data which cannot be used to identify individuals. We never publish any data that could identify you.

NHS England treats the data with great care. All data which is shared by NHS England is subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the relevant health and social care purpose will ever be shared.

Wherever possible, de-personalised data or anonymous data is used and shared to protect patient confidentiality. We also apply the National Data Guardian’s Caldicott Principles to ensure we only provide the minimum amount of data necessary for the purpose for which it is to be used. To support your direct care, personally identifiable data can be shared, but this is always done in accordance with the law and subject to safeguards to ensure that the data is kept safe and secure.

Data is shared or is expected to be shared with organisations such as health care organisations, clinicians, commissioners of NHS services.

For example the organisation that provided your care: to assess the effectiveness of your care, to improve the services they offer and in the event you need to be contacted about issues affecting your device that require follow-up action, and for the purposes of:

• correcting data validation errors to ensure the completeness and quality of the submitted data: and
• direct care, including enabling local monitoring of key care metrics for trauma patients such as measuring outcomes and to support local benchmarking for assurance of safe and high-quality care and treatment through local audit, the management of untoward or adverse incidents, person satisfaction including measurement of outcomes undertaken by one or more registered and regulated health or social care professionals and their team with whom the individual has a legitimate relationship for care

Data is also shared or is expected to be shared with organisations such as health care organisations, clinicians, commissioners of NHS services, and the Medicines and Healthcare products Regulatory Agency (MHRA), for example:

• the organisation that provided your care: to assess the effectiveness of your care, to improve the services they offer and in the event you need to be contacted about issues affecting your device that require follow-up action
• MHRA: to support analysis of patient outcomes relating to surgical devices and implants to identify possible incidents requiring investigation alongside intelligence they receive through the Yellow Card Scheme
• Integrated Care Boards and other bodies which are responsible for arranging the provision of health services in England: to help plan and improve NHS healthcare services
• research organisations, including universities and charities: to carry out research

Other organisations may be able to apply to access the data we have collected, linked and analysed under the Directions following an application through NHS England’s Data Access Request Service (DARS). Any data sharing will be subject to the organisations applying to access the data having a lawful basis to process it, and NHS England having a lawful basis to disclose it. Each organisation we share data with must sign a Data Sharing Framework Contract and a Data Sharing Agreement and we carry out audits to check they are using the data as agreed. Where a DARS application is approved, data may be shared for analysis through the Data Access Request Service and NHS England Secure Data Environments, in line with NHS policy on Secure Data Environments

We may also publish anonymised data we have. This enables the NHS and other organisations to use this anonymous data for statistical analysis and for planning, commissioning and research purposes. We never publish any data that could identify you.

Details about the medical devices and implants data shared with other organisations, except for anonymous data, are published in the Data Uses register. 

If you have registered a National Data Opt-Out, NHS England can still collect your data under the Outcomes and Registries data collection Direction 2024 

When NHS England shares Outcomes and Registries data

For any data we share with other organisations through our Data Access Request Service, we will apply the national data opt-out in line with the National Data Opt-Out Operational Policy Guidance

You can find out more about and register a national data opt-out or change your choice on nhs.uk/your-nhs-data-matters

The minimum retention period for Outcomes and Registries data is 8 years after the closure of the Outcomes and Registries programme. This retention period will be reviewed regularly to ensure that the data is only held as long as is necessary our purposes in accordance with the Records Management Code of Practice 2021 and our Records Management Policy. 

Other organisations we share your personal data with must only keep it for as long as is necessary and as set out in their Data Sharing Agreement. Information about this will be provided in their privacy notices on their websites.

Medical devices and implants data will be stored and processed within the United Kingdom (UK).

We have been given a legal instruction to collect and analyse data about surgical devices and implants, and to collect and analyse data about alternative procedures for the same medical conditions which do not result in a surgical device or implant.

This legal instruction is known as a direction, which we received from the Secretary of State for Health and Social Care, under section 254 of the Health and Social Care Act 2012. The direction is called the  Outcomes and Registries Directions 2024, which has replaced the Surgical Devices and Implants Directions 2020. It provides the legal basis for NHS England to collect and use medical devices and implants data for the purposes set out above. The scope of the medical devices and implants data collected is set out in the DPN

Under the UK General Data Protection Regulation (GDPR), NHS England can only collect and use personal data if there is a legal basis under Articles 6 and 9 of the UK GDPR.

Our legal basis for collecting and analysing personal data is Article 6(1)(c) - legal obligation: the processing is necessary to comply with the law, as NHS England is required to do this by the direction.

Our basis for processing personal data related to health (special category data) is Article 9(2)(g). This is because the processing of the data is substantially in the public interest and in accordance with the law, for the purposes of NHS England exercising its statutory functions under the direction. It is substantially in the public interest to collect and use medical devices and implants data as the aims are to improve patient safety, to improve future treatments, and to enable patients to be traced in the event of a safety concern relating to an implant or treatment. This processing is also permitted under paragraph 6 of Schedule 1 of the Data Protection Act 2018.

You can read more about the health and care information collected by NHS England, and your choices and rights in

• The Outcomes and Registries Transparency Notice
• How we look after your health and care information
• Transparency Notice: how we use your personal data and its MDOR GDPR Registry Entry

Our Data Protection Officer is Jon Moore who can be contacted at [email protected]

NHS England may make changes to this Transparency Notice. If so, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.