ARRISA-UK Study data protection and processing
Who we are
The data controller for ARRISA-UK is the University of East Anglia (UEA). This means that we (the ARRISA-UK study team and the Norwich Clinical Trials Unit), as part of the University, determine why and how personal data will be collected and used, either alone, or jointly with others.
UEA is also a data processor for the ARRISA-UK study data received by other organisations. This means we follow the instructions of these organisations when handling certain personal data.
The ARRISA-UK study team abides by the University’s data protection-related policies listed on our webpages.
The research team at the Norwich Clinical Trials Unit can be contacted by email: arrisa-uk.med@uea.ac.uk or telephone: 01603 593309 (Dr Stanley Musgrave) or 01603 597666 (Dr Polly Ashford).
You can contact the University's Data Protection Officer at dataprotection@uea.ac.uk or by telephone: +44 (0)1603 592431.
What is the study about?
Unfortunately, far too many people with asthma are admitted to hospital or die unnecessarily in the UK every year. In the ARRISA-UK study, practices use a new approach to identifying and responding to patients at risk of having severe asthma attacks. Practices search their medical records to identify their asthma patients, and those who may be at risk of a severe asthma event. This list of patients is then reviewed and edited as needed by a practice GP or nurse. An "alert" message then appears on the computerised medical notes whenever any of these ‘at risk’ patients makes contact with or is seen by anyone at the practice. In the study, practice staff receive orientation and the practice team develop their own plan for how to respond to these alerts. It is hoped that this approach will reduce the occurrence of severe asthma attacks.
The study involves over 150,000 patients from 275 GP practices. Practices are randomly allocated to either the intervention group (carrying out the steps above) or the control group (care as usual). As the ARRISA-UK approach is aimed at practice staff (GPs, nurses, reception and administrative staff), patients may not notice any changes to the care they receive.
Jump to further details:
- Information for patients at participating GP practices
- Information for non-patient participants and contacts
Information for patients at participating GP practices
Why we are using your information
To see if the ARRISA approach is effective, we need to understand the characteristics of the asthma patients in GP practices taking part in the study, follow their clinical care, health events and costs, and then to count the number of hospitalisations and deaths due to asthma and overall, over an approximately 3 year period.
What information are we using
GP Practice Data in England, Scotland and Wales
GP practices participating in ARRISA-UK are providing the study team with data from their database about patients with asthma. As this data has had all identifiers (such as name, address etc) removed, we cannot use it to identify you.
The study team does not need to know, and it does not collect ANY identifiers (name address postcode, date of birth, or other identifying codes or data) for analysis. We only need to know the relevant recent prescription and clinical history of individuals as specified in our research ethics approved protocol. We cannot identify you from this information.
Hospital Data in England, Scotland and Wales
The study team will be requesting data about hospital admissions and deaths from NHS Digital (England), NHS Wales Informatics Service and Information Services Division Scotland.
We will then link the routinely collected data from hospital records to records provided by the GP practices.
For hospital admissions/deaths in Scotland and Wales, this linkage will not involve the transfer of patients’ personal data.
For hospital admissions/deaths in England, we will be asking each participating GP practice to provide NHS Digital with asthma patients’ NHS number, date of birth and sex. At no point will names or addresses be provided or transferred. The data transfer will use the secure encrypted NHS broadband network, and data will be uploaded to a secure server hosted by Harvey Walsh Health Informatics before being transferred to NHS Digital. NHS Digital will link the data and remove NHS number, date of birth and sex before releasing it to the research team for analysis. The data temporarily held by Harvey Walsh will then be deleted. The researchers do not receive any data that would identify you individually.
Patient Interviews
In addition to the data collection, as part of a separate study activity, a small number of patients at participating GP practices will be invited to take part in interviews. The information held and how it is processed is detailed in your participant information sheet and consent form. If you have questions about that or do not have your copy to hand please feel free to contact the study office on 01603 593309 or arrisa-uk.med@uea.ac.uk
Lawful Basis for Data Processing
The ARRISA-UK study has received approval from NHS Research Ethics approval (reference: 14/WA/1211) and the Health Research Authority.
The transfer of personal data from GP practices to NHS Digital has been reviewed and approved by the Confidentiality Advisory Group (CAG), an independent body that provides expert advice on the use of confidential patient information. This use of patient information for medical purposes is considered to be in the public interest, under Section 251 (1b) of the NHS Act 2006.
Article 6(1)(e) of the General Data Protection Regulation (GDPR) applies to our processing of any personal data; that is, processing is necessary for the performance of a task carried out in the public interest. Where we have access to your health information or other ‘special category’ data, we will meet the condition in Sch. 1(1) para. 4-(c) of the Data Protection Act 2018, as required by Article 9(2)(j) of the GDPR.
Your Rights
If you do not want your data to be included in the study in the ways described above, you have the option to withdraw from sharing your confidential information. This will not affect the care you receive in any way. Please ask a member of the reception team at your practice about how to do this.
Please note that no data is collected, held or processed for any patient who has a record in their GP data that they have expressed dissent from data sharing. No data is released to researchers by NHS Digital for patients who have registered for the national data opt-out programme.
The study team cannot identify data as coming from any specific person. Therefore we are unable to say what data we hold about any person or to respond to any request to withdraw any person’s information from the study records or restrict the processing.
The study does not have any automated decision-making or profiling.
If you have a concern about the way your data is used for the ARRISA-UK study, you can contact the university’s Data Protection Officer (dataprotection@uea.ac.uk or +44 (0)1603 592431).
You also have the right to raise concerns with the Information Commissioner’s Office (ICO), which is an independent body responsible for making sure that organisations comply with UK data protection legislation. The ICO can be contacted via their website: https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.
How long do we keep your information?
Personal data
Identifiable data transferred from participating GP practices to NHS Digital will be temporarily held on a secure server hosted by Harvey Walsh Health Informatics. This data will be deleted once transfer and linkage is confirmed as complete by NHS Digital, and the study dataset has been received by the study team.
Studydata (a dataset from which personal identifiers have been removed)
We will only hold the data for the time required for the implementation of the study and for the secure archived trial master file. It will then be securely destroyed.
We will not share your information with anyone, or use it for any other purpose outside of analysis for the research protocol, any analysis associated with the review and publication of the study results or as otherwise suggested by the NIHR HTA, Asthma UK or the Asthma UK Centre for Applied Research, or subsequent analyses conducted at Norwich Clinical Trials Unit by the named study collaborators for the purpose of understanding the study results.
Information for non-patient participants and contacts
What information do we hold?
For NHS staff at participating GP practices, and business, research management and administrative contacts, the study team holds personal data including name, role, place of work and contact details (a phone number and email address). NHS staff who complete the online training at http://register.arrisa-training.co.uk/ will be asked to provide their age band and gender. This information is collected to enable the team to administer the study from start to completion.
We will only keep this information in our own study management database, in direct communications (e.g. email or letters) between you and the study team, and if relevant, in the training website database, both of which are stored securely and access controlled. When we prepare the database for the study analysis we will remove your name, any contact details and all other identifiers, and replace them with a separate unique code that does not identify you.
We may share your contact details with specifically named and approved members of the study team, if essential for the implementation of the study (including Optimum Patient Care Ltd and Wellbeing Software Group (Apollo) for data extraction tasks), or appropriate persons in your practice and relevant NHS NIHR research offices to enable administrative communication for the purpose of the study.
Practice Staff Focus Groups and Interviews
A small number of NHS staff at participating GP practices will be invited to take part in focus groups and interviews for the study. The information held and how it is processed is detailed in your participant information sheet and consent form. Please refer to those documents. If you have questions about that or do not have your copy to hand please feel free to contact the study office on 01603 593309 or arrisa-uk.med@uea.ac.uk
How long will we keep your information?
We will only hold your details for the minimum time required for the implementation of the study and for the secure archived trial master file, and will then destroy any directly identifiable personal data. You will never be specifically identified in any report or publication.
We will not share this information with anyone, or use it for any other purpose outside of those specified above.
Your Rights
You have the right to request to see your personal data that we hold, and to request that we modify or withdraw your personal information from the study records.
If you have a concern about the way your data is used for the ARRISA-UK study, you can contact the university’s Data Protection Officer (dataprotection@uea.ac.uk or +44 (0)1603 592431).
You also have the right to raise concerns with the Information Commissioner’s Office (ICO), which is an independent body responsible for making sure that organisations comply with the Data Protection Act and General Data Protection Regulation (GDPR). The ICO can be contacted via their website: https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.
Changes to this notice
This privacy notice was last updated on 20/12/2019.