NHS Digital Data Sharing Remote Audit: Genomics England

Purpose

This report records the key findings of a remote data sharing audit of Genomics England Limited (GE) between 7 and 14 March 2022. It provides an evaluation of how GE conforms to the requirements of both:

• the data sharing framework contract (DSFC) CON-368648-M3S4Z v2.01
• the data sharing agreement (DSA) DARS-NIC-12784-R8W7V-v8.6

This DSA covers the provision of the following datasets:

The Controller is GE and the Processors are Amazon Web Services (AWS), UKCloud Limited, Lifebit Biotech Limited (Lifebit) and Microsoft UK (undeclared on DSA). AWS, UKCloud Limited and Microsoft UK do not have access to the data and only provide cloud hosting services.

GE was established by the Department of Health and Social Care to deliver the 100,000 Genomes Project. This project has sequenced 100,000 whole genomes from NHS patients with rare diseases and their families, as well as patients with cancers.

The 100,000 Genomes Project has transformed patient outcomes. Patients have received diagnoses of their conditions for the first time. There has been a better understanding of the effectiveness of certain treatments for certain patients, refining NHS treatments and enabling precision medicine. Following completion of the project, GE is now providing the Genomic Medicine Service (GMS) to the NHS, a key component of which is the National Genomic Informatics System (NGIS).

All participants and patients, about whom GE holds information, have opted in for their data to be used for research and have consented to this data being linked with other health data.

The DSA allows GE to sub-license data which has been de-identified to academic and commercial organisations, subject to the terms, checks and controls carried out by GE in relation to sub-licensing. All commercial research has to be approved on a project-by-project basis by the GE Access Review Committee.

All research analysis on the de-identified datasets is only allowed to be carried out within GE’s Research Environment. Movement of files into and out of the Research Environment is governed via an Airlock Policy.

This report also considers whether GE and Lifebit conform to their own policies, processes and procedures.

The interviews during the audit were conducted through video conferencing.

This is an exception report based on the criteria expressed in the NHS Digital Data Sharing Remote Audit Guide version 1.

Audit type and scope

Data recipient’s acceptance statement

GE confirms this report is accurate regarding compliance with the clauses laid out in the DSA. The audit was not a review of GE’s overall strategy, operational performance or approach to data privacy and data security beyond the scope of the DSA with NHS Digital.

GE takes compliance with the DSA seriously and will work closely with NHS Digital to put actions in place to close the findings and anticipates that many findings and required changes to the DSA to be rapidly resolved / implemented.

For finding 1, GE has participant consent to allow PROMS data to be accessed by academic and commercial entities for health research purposes, approved by its independent Access Review Committee. The audit flagged a discrepancy between the terms of consents and what was permitted under the terms of the DSA, so access to PROMS data for commercial researchers will be removed pending any further DSA updates.

Data recipient’s action plan

GE will establish a corrective action plan to address each finding shown in the findings table below. NHS Digital will validate this plan and the resultant actions at a post audit review with the GE to confirm the findings have been satisfactorily addressed. The post audit review will also consider the outstanding evidence at which point the Audit Team may raise further findings.

The following table identifies the 6 agreement nonconformities, 5 opportunities for improvement and 6 points for follow-up raised as part of the audit. 

Use of data

GE confirmed there was one dataset that was not being processed and used for the purposes defined in the DSA (see finding 1). However, the datasets provided by NHS Digital were only being linked with those datasets explicitly allowed in the DSA for participants who have consented for their data to be used for research purposes.

Data location

GE confirmed that processing and storage locations, including disaster recovery and backups, of the datasets were limited to the location shown in the following table. However, de-identified data was being accessed from locations which did not conform with the territory of use defined in clause 2c of the DSA, see finding 6.

Backup retention

The duration for which data may be retained on backup media is:

Good Practice

During the audit, the Audit Team noted the following area of good practice:

• GE were able to clearly demonstrate the value the data supplied under this DSA has had with benefiting health and social care.

The audit was based upon a sample of the data recipient’s activities, as observed by the Audit Team. The findings detailed in this audit report may not include all possible nonconformities which may exist. In addition, as the audit interviews were conducted through a video conference platform, certain controls that would normally be assessed whilst onsite could not be witnessed.

NHS Digital has prepared this audit report for its own purposes. As a result, NHS Digital does not assume any liability to any person or organisation for any loss or damage suffered or costs incurred by it arising out of, or in connection with, this report, however such loss or damage is caused. NHS Digital does not assume liability for any loss occasioned to any person or organisation acting or refraining from acting as a result of any information contained in this report.