Data sharing standard 12– Honorary contracts

Under NHS England’s data sharing framework, a Recipient¹ NHS England data is prohibited from sharing the data with a third party other than:

• a processor named in the Data Sharing Agreement (DSA), or
• a sublicensee where the DSA permits such sublicensing

Aside from those two exceptions, data may only be accessed by personnel – defined as “employees, agents and contractors of the Recipient”.

It is permissible for a Recipient or a named processor to grant access to individuals who are not their substantive employees or paid contractors where the relevant individuals have an honorary contract with the Recipient or processor for the purpose of them undertaking a period of work/research within the organisation and not being paid directly by the Recipient or processor. 

Such arrangements are only appropriate when the person(s) under honorary contract are legitimately acting as agents of the relevant organisation, meaning they are undertaking processing activities determined by the Recipient or processor and not processing data for other purposes.

Honorary contracts cannot be used:

• for numerous individuals employed by the same organisation as an alternative to a Data Processing Agreement (DPA); or
• to grant access to third parties to process data for their own purposes as an alternative to a sublicensing arrangement; or
• for individuals with no employer², or
• to grant access to third parties outside of the UK territory

An organisation named in the DSA as either a controller or a processor may grant access to the data to an individual who holds an honorary contract with that organisation if the following criteria apply:

1. The DSA includes relevant details of the access by individuals under an honorary contract.

2. The honorary contract holder will access the data solely for the purposes specified in the DSA and will do so on behalf of an organisation named as a controller or processor in the DSA.

3. The organisation providing the honorary contract provides confirmation that an appropriate contract is in place which follows the relevant guidance including, insofar as relevant and applicable, the NHS’s published Guidance for employing clinical academics.

4. The Recipient must be able to provide a copy of the fully executed honorary contract on request to NHS England and/or its auditors.

5. The substantive employer of the honorary contract holder countersigns the contract to confirm that it agrees to undertake any necessary disciplinary procedures if the holder’s activity or omission leads to a breach of the DSA.

To request permission to give access to personnel under honorary contracts, the applicant must provide to NHS England the following details of the individual(s) to be given access under an honorary contract:

6. Their substantive employer;

7. Their role in respect of the purpose for processing specified in the DSA;

8. The necessity for the data to be accessed by the person(s) holding an honorary contract instead of by a substantive employee of an organisation named as a Data Controller or Data Processor in the DSA;

9. Confirmation that an appropriate contract is in place which follows the relevant guidance and that is countersigned by the substantive employer of the honorary contract holder.

NHS England’s Data Access Request Service (DARS) will undertake the following:

10. Record the information provided;

11. Assess whether the proposed use of the honorary contract is appropriate for the circumstances described, requesting further evidence as needed, and document the conclusion;

12. (Subject to agreeing the proposed use of the honorary contract is appropriate) include relevant details of the access by the person(s) holding the honorary contract in section 5a. Objectives for Processing in the application form;

13. Add a standard special condition to the DSA.

NHS England will not, as a matter of course, undertake to assess the contents of the Honorary Contract and will rely on the affirmative statement from the applicant that the terms within offer the requisite controls and recourse to punitive measures following misuse of the data.  If the Honorary Contract holder is carrying out a role of substantial impact such as that of a Chief or Principal Investigator³, NHS England will undertake to assess the contents of the Honorary Contract to assure itself that the terms set out above are being met.  The obligation to meet the conditions above however remain with the DSA signatories.

Students have a contractual relationship with their higher education institution.  An honorary contract is not required if their higher education institution is named in the DSA as a Data Controller or a Data Processor.  If their higher education institution is not a party named in the DSA, students require the same contractual arrangements as other categories of workers such as clinical academics, with their home educational institution as a counter signatory. A contract with a student should not refer to them as an “employee”, unless they also hold an employee role at their home institution, such as a tutor or lab tech.

Where an organisation is engaging someone under an honorary contract, the organisation providing the honorary contract will remain liable for all acts and omissions of the individual under honorary contract. The substantive employer (or higher educational institution where the individual is enrolled, in the case of a student) retains responsibility for undertaking any disciplinary action necessary against the contract holder if that individual’s acts or omissions lead to a breach of the DSA.