NHS England Post Audit Review: University College London
This report provides the formal closure of the remote data sharing audit of the University College London where the interviews were conducted in September 2022.
Audit summary
Purpose
This report provides the formal closure of the remote data sharing audit of the University College London (UCL) where the interviews were conducted between 22 and 27 September 2022. It provides an evaluation of how UCL conforms to the requirements of both:
- the data sharing framework contract (DSFC) CON-321538-B5D8B-v2.02
- the data sharing agreement (DSA) DARS-NIC-381078-Y9C5K-v7.2
This DSA covers the provision of the following datasets:
| Dataset | Classification of data | Dataset period |
|---|---|---|
| Electronic Prescribing and Medicines Administration (EPMA) data in Secondary Care for COVID-19 | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| National Institute for Cardiovascular Outcomes Research (NICOR) Myocardial Ischaemia National Audit Project v10.3.2 | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| NICOR Heart Failure V5.0 | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| NICOR National Audit of Percutaneous Coronary Interventions (NAPCI) V5.6.6 | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| COVID-19 ICNARC Case Mix Programme for Adult Critical Care | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| TRE Secondary Care Data | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Uncurated Low Latency Hospital Data Sets – Critical Care | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Civil Registration - Deaths | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| COVID-19 Hospitalization in England Surveillance System | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| GPES Data for Pandemic Planning and Research (COVID-19) | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Medicines dispensed in Primary Care (NHSBSA data) | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Sentinel Stroke National Audit Programme (SSNAP) | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Uncurated Low Latency Hospital Data Sets - Admitted Patient Care | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Hospital Episode Statistics (HES) Admitted Patient Care | Anonymised/Pseudonymised, Non-sensitive | 1989/90 - 2023/24_M05 |
| HES Critical Care | Anonymised/Pseudonymised, Non-sensitive | 2013/14 - 2023/24_M05 |
| HES Outpatients | Anonymised/Pseudonymised, Non-sensitive | 2019/20 - 2023/24_M05 |
| HES Accident and Emergency | Anonymised/Pseudonymised, Non-sensitive | 2007/08 – 2019/20 |
| COVID-19 Second Generation Surveillance System | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Covid-19 UK Nonhospital Antigen Testing Results (Pillar 2) | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Covid-19 UK Nonhospital Antibody Testing Results (Pillar 3) | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| COVID-19 Vaccination Status | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| COVID-19 Vaccination Adverse Reactions | Anonymised/Pseudonymised, Non-sensitive | Latest available |
| Improving Access to Psychological Therapies Data Set | Anonymised/Pseudonymised, Non-sensitive | 2012/13 – 2022/23 |
Within the DSA, UCL is one of several joint Controllers. UCL is, however, Controller for the study audited.
Further guidance on the terms used in this post audit review report can be found in version 1 of the Data Sharing Remote Audit Guide.
Post audit review
This post audit review comprised of a desk-based assessment and video call of the action plan and supporting evidence supplied by UCL between April and May 2023.
Post audit review outcome
Based on the evidence provided by UCL, the Audit Team has closed the nonconformity and observation. Although no further action is required by the Audit Team, there is 1 point for follow-up still open, and UCL should complete the actions against this finding.
Updated risk statement
Based on the results of this post audit review the risk statement has been reassessed against the options of Critical - High - Medium - Low.
Original Risk Statement: Low
Current Risk Statement: Low
Data recipient’s acceptance statement
UCL has reviewed this report and confirmed that it is accurate.
Status
The following identifies the 1 agreement nonconformity, 1 opportunity for improvement and 1 point for follow-up raised as part of the audit.
| Ref | Finding | Link to area | Update | Designation | Status |
|---|---|---|---|---|---|
| 1 | The named researcher accessing the TRE for the selected study was not a substantive employee of UCL. | Use and Benefits | The DSA, DARS-NIC-381078-Y9C5K-v9.3, has been updated to include the text “A consortium of organisations as listed below are the data controllers and substantive employees, enrolled students and affiliated researchers of these organisations will have access to the record level data within the TRE”. A copy of the researcher contract with UCL was provided to the Audit Team. |
Agreement nonconformity | Closed |
| 2 | The DSA, along with future versions, should be made available within the documentation set maintained on the BHF research platform for the researchers, so users are aware of their obligations and responsibilities. | Operational Management | A copy of the current agreement was shown during the video call as being in the BHF researchers’ shared folder which is accessible by all consortium members. | Opportunity for improvement | Closed |
| 3 | At the post audit review, the Audit Team will review the published deliverable(s) from the study. | Use and Benefits | The following update was provided:
|
Follow-up | Open, but not for follow-up |
Disclaimer
NHS England takes all reasonable care to ensure that this audit report is fair and accurate but cannot accept any liability to any person or organisation, including any third party, for any loss or damage suffered or costs incurred by it arising out of, or in connection with, the use of this report, however such loss or damage is caused. NHS England cannot accept liability for loss occasioned to any person or organisation, including any third party, acting or refraining from acting as a result of any information contained in this report.
Last edited: 3 July 2023 11:44 am