NHS England Data Sharing Remote Audit: University of Glasgow

Purpose

This report records the key findings of a remote data sharing audit of the University of Glasgow (UoG) and the Nottingham University Hospitals NHS Trust (NUH) between 12 and 15 December 2022. It provides an evaluation of how the UoG and the NUH conform to the requirements of:

• the data sharing framework contracts (DSFC):
  • CON-329582-W2T4D-v2.01 (UoG)
  • CON-303563-Q4S3W-v2.01 (NUM)
• the data sharing agreement (DSA) DARS-NIC-72626-V4P9B-v4.2 

This DSA covers the provision of the following datasets:

The joint Controllers are the UoG and the NUH. The NUH does not store or process any data supplied under this DSA.

The DSA relates to a research study on a sub-group of hepatitis C virus (HCV) infected individuals with cirrhosis (the STOP-HCV Cirrhosis Cohort) in the HCV Research UK cohort. To enhance the study, the number of patients was expanded to include data from a further 2500 individuals provided by HCV Research UK. HCV Research UK is a consortium of clinicians and scientists with particular interest in HCV that was funded by the Medical Research Foundation to establish a national cohort to facilitate research into all aspects of this infection. STOP-HCV was a Medical Research Council funded study, underpinned by clinical data and samples provided by HCV Research UK, that focussed on developing stratification models to enhance clinical decisions on treatment options to cure infection and understand mechanisms of disease that may affect treatment outcome. The UoG and the HUH were critical partners for HCV Research UK and both were members of the STOP-HCV consortium. The NUH is the clinical sponsor of both HCV Research UK and the STOP-HCV Cirrhosis study and oversees the ethical execution of these studies.

The data requested under this agreement is disseminated to and stored at the Robertson Centre for Biostatistics (RCB) at the UoG.

This report also considers whether the UoG, the NUH and the RCB conform to their own policies, processes and procedures, as appropriate.

The interviews during the audit were conducted through video conferencing.

This is an exception report based on the criteria expressed in the Data Sharing Remote Audit Guide version 1.

Audit type and scope

As the RCB is responsible for the storage and processing of data, the audit focussed primarily on the RCB.

Data recipient’s acceptance statement

The UoG, the NUH and the RCB have reviewed this report and confirmed that it is accurate.

Data recipient’s action plan

The UoG, the NUH and the RCB will establish a corrective action plan to address each finding shown in the findings tables below. The Audit Team will validate this plan and the resultant actions at a post audit review with the UoG, the NUH and the RCB to confirm the findings have been satisfactorily addressed. The post audit review will also consider the outstanding evidence at which point the Audit Team may raise further findings.

The following tables identify the 9 agreement nonconformities, 1 organisation nonconformity, 1 observation, 3 opportunities for improvement and 1 point for follow-up raised as part of the audit.

In addressing a finding, the data recipient must take account of any referenced supplementary notes.

Supplementary notes

The following note refers to the tables above and provides additional commentary on the linked finding.

Note 1.

One option to progress this finding, is for a risk assessment to be completed. The risk assessment shall assess the threats to and the vulnerabilities of the un-encrypted connection and identify the mitigating controls in place. This assessment shall be signed off by the organisation’s Senior Information Risk Officer (or equivalent). If the risk is considered acceptable and all aspects of the connection are inside the area of direct control by the Auditee, then the link need not be encrypted. NHS England reserves the right to review this assessment.

Use of data

The RCB confirmed that the datasets were only being processed and used for the purposes defined in the DSA and were only being linked with those datasets explicitly allowed in the DSA.

Data location

The RCB confirmed that processing and storage locations, including disaster recovery and backups, of the datasets were limited to the location shown in the following table. These locations conform with the territory of use defined in section 2c of the DSA.

Backup retention

The duration for which data may be retained on backup media is:

Good Practice

During the audit, the Audit Team noted the following area of good practice:

• the value of the data supplied under this DSA was demonstrated through the projects they have undertaken with NHS organisations.

The audit was based upon a sample of the data recipient’s activities, as observed by the Audit Team. The findings detailed in this audit report may not include all possible nonconformities which may exist. In addition, as the audit interviews were conducted through a video conference platform, certain controls that would normally be assessed whilst onsite could not be witnessed.

NHS England has prepared this audit report for its own purposes. As a result, NHS England does not assume any liability to any person or organisation for any loss or damage suffered or costs incurred by it arising out of, or in connection with, this report, however such loss or damage is caused. NHS England does not assume liability for any loss occasioned to any person or organisation acting or refraining from acting as a result of any information contained in this report.