COVID-19 Population Risk Assessment transparency notice

The COVID-19 Population Risk Assessment used a risk prediction model developed by the University of Oxford called QCovid®. This combines a number of factors such as age, sex registered at birth, ethnicity, body mass index (BMI) and specific health conditions and treatments to estimate the risk of a person catching coronavirus and becoming seriously unwell. The COVID-19 Population Risk Assessment used patient data held in existing NHS Digital datasets to identify people in England who may be at risk of extreme vulnerability to coronavirus.  It then generated risk assessment results for each person and those people with a result above a threshold set by the Chief Medical Officer for England (CMO) were added to the Shielded Patient List (SPL) in England. The risk prediction model was used in February and March 2021 to add people to the SPL. 

The shielding programme in England has now ended, which means that those who were previously identified as clinically extremely vulnerable are no longer being asked to shield.  

Between September 2021 and June 2022 NHS Digital has been conducting a managed closure of the SPL.  Please see the SPL Transparency Notice which describes how your personal data will be processed upon closure of the SPL.

Full guidance on shielding and protecting people who are high risk (clinically extremely vulnerable (CEV)) can be found online on GOV.UK. More information about the SPL can be found on NHS Digital’s Shielded Patient List (SPL) webpages.

Researchers from across the UK, led by the University of Oxford, produced a risk prediction model called QCovid® as part of a clinical research project. This combines a number of factors such as age, sex registered at birth, ethnicity, BMI and specific health conditions and treatments to estimate the risk of a person catching and becoming seriously unwell with coronavirus.

In February 2021 NHS Digital was asked by the CMO to use QCovid® to identify people in England who may be at high risk of becoming seriously unwell from coronavirus, but who had not previously been identified as high risk (clinically extremely vulnerable). 

NHS Digital developed the COVID-19 Population Risk Assessment, which used QCovid® and patient data held in existing NHS Digital datasets, to identify those people with relevant factors or health issues, to assess their risk. NHS Digital generated risk assessment results for each of these people. Those with a result above an agreed threshold set by the CMO, in consultation with senior clinicians, were considered to be potentially high risk (clinically extremely vulnerable).

A cautious approach was taken, so there was a chance that a person’s risk was lower than the risk assessment indicated. This is because, where data was missing from the NHS Digital datasets, the risk assessment uses default values which may overestimate a person’s risk. This cautious approach was to reduce the risk of underestimating people’s risk and excluding them from the group who were added to SPL. This approach was agreed by the CMO as clinically the most appropriate to ensure that those people who may have been at high risk were able to receive advice and support on how to protect themselves and could be prioritised for vaccination.     

People who were identified as potentially high risk (clinically extremely vulnerable) were prioritised for coronavirus vaccination and were added to the SPL in March 2021, which has now closed. 

The QCovid® Calculation Engine and the COVID-19 Population Risk Assessment are each registered as medical devices with the Medicines and Healthcare products Regulatory Agency (MHRA).

Read more about the COVID-19 Population Risk Assessment and QCovid®, including the research behind it, the data it uses and how it works.

In order to identify people who may be at high risk of catching and becoming seriously unwell with coronavirus, during February and March 2021 we processed the following information about relevant people in England:

• NHS Number
• date of birth
• sex registered at birth
• ethnicity
• height, weight and Body Mass Index
• postcode (to identify a Townsend deprivation score, a well-known way of measuring deprivation based on data from the 2011 Census)
• information about whether you live in your own home, are homeless or resident of a care home (based on your address)  
• health related data (in the form of condition codes held in central NHS records), including data about certain:
  • cardiovascular diseases
  • respiratory diseases and treatment
  • metabolic, renal and liver conditions
  • neurological and psychiatric conditions
  • autoimmune and haematological conditions
  • immunosuppressants, cancer conditions and treatments

Get a full list of health conditions and treatments.

Only information about the following people was processed: 

• people aged 19-100 who could potentially meet the threshold for being considered potentially high risk (clinically extremely vulnerable)
• people who have not previously been identified by existing SPL processes

Records for people who were already identified as CEV and were therefore already on the SPL were not included. Records of people who have previously been removed from the SPL by their GP or hospital doctor were also not included. 

NHS Digital has been directed by the Secretary of State for Health and Social Care under s254 of the Health and Social Care Act 2012 to collect and analyse data for COVID-19 purposes under the  COVID-19 Public Health Directions 2020 (COVID-19 Direction).  This includes identifying people who are potentially high risk (clinically extremely vulnerable) by using the COVID-19 Population Risk Assessment.

We are therefore joint controllers under the UK General Data Protection Regulation (UK GPDR) with the secretary of state for the personal data we are processing for this purpose.

Under the UK General Data Protection Regulation (GDPR), NHS Digital is processing your personal data:

• under Article 6(1)(c) – Legal Obligation – under the COVID-19 Direction
• under Article 9(2)(g)  – because we consider that this processing is necessary for reasons of substantial public interest, to identify those individuals who are most at risk of catching and becoming seriously unwell from coronavirus in order to provide them with advice on how to protect themselves and to prioritise them for the COVID-19 vaccination
• under Paragraph 6, of Part 2 of Schedule 1 of the Data Protection Act 2018 – Statutory and Government Purpose – under the COVID-19 Direction.

GP practices (GPs) and hospitals received information about their own patients who were identified as potentially high risk (clinically extremely vulnerable) by the COVID-19 Population Risk Assessment through the SPL. The SPL is now closed. 

GPs were also able to securely access information held by NHS Digital about their own patients who were assessed as part of the COVID-19 Population Risk Assessment but not identified as high risk (clinically extremely vulnerable), in order to review their risk assessment results.

In March 2022 the Government announced that there will be a COVID-19 Public Inquiry and the associated  COVID-19 Inquiry Terms of Reference includes shielding within its scope.  Your personal data will be held in identifiable form in archive for as long as it is considered necessary to meet the needs of the Public Inquiry. For example, NHS Digital may need to access your personal data in the SPL to respond to queries from the Public Inquiry.

Further to this, your personal data will be held for 8 years from the expiry of the Covid-19 Public Health Directions and in accordance with the  Records Management Code of Practice 2021 and the NHS Digital Records Management Policy.

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.