University of Oxford

Academic Institute

No

DARS-NIC-381632-M4D9L-v1.2

Background and Aims The University of Oxford are requesting access to the Shielded Patient List (SPL) to support the development and validation of a new risk prediction tool to identify people in the England at high risk of severe outcomes from COVID-19 infection. The first cases of infection caused by coronavirus SARS-CoV-2 (COVID-19) in the UK were confirmed on 24th January 2020 and the first UK death on 28th Feb 2020. Since then the disease has spread rapidly through the population. There are no vaccines, preventative or curative treatments for COVID-19 disease and only one possible disease modifying treatment so the government has used social distancing as a population-level intervention to limit the rate of increase in cases. Case series of confirmed COVID-19 have identified age, sex, certain co-morbidities, and ethnicity as potentially important risk factors for susceptibility to infection, hospitalisation, or death due to infection. In addition chronic use of some medications at the time of exposure has been suggested as a potential risk factor for infection or severe adverse outcomes due to infection, although the evidence is currently too limited to confirm or refute these concerns. Understanding these risk factors is important especially where exposure, risk factors or medication could be modified in individuals or at a population scale to alter the likelihood of infection or adverse outcomes. Furthermore, associations between medications and improved outcomes, if confirmed from large cohorts, might provide important insights into disease mechanisms and pathogenesis. As illustrated by a recent systematic review, prediction models for COVID-19 are quickly entering the academic literature to support medical decision making at a time when they are urgently needed. Three models have been identified that predict hospital admission from pneumonia and other events (as proxy outcomes for COVID-19 pneumonia) in the general population. Eighteen diagnostic models were identified for detecting COVID-19 infection (13 were machine learning based on CT scans); and 10 prognostic models for predicting mortality risk, progression to severe disease, or length of hospital stay. The systematic review indicated that proposed models are poorly reported, at high risk of bias, and their reported performance is probably optimistic8. Thus, the Data Controller proposes to develop and validate a new risk prediction tool to identify people in England at high risk of severe outcomes from COVID-19 infection. This research will form the basis for a rapid research study to inform national COVID-19 and shielding policy. The study will describe the development and validation of novel COVID-19 risk prediction equations for initial use in the NHS in the UK but potentially available internationally (subject to local validation). It is anticipated that the equations will be widely available for use and that the equations will be updated regularly as understanding of COVID-19 increases, better data become available and as the underlying population changes or the virus itself mutates The purposes for sharing the requested data are set out below (Agreed Purposes): • NHS Digital has agreed to share a pseudonymised identifier (Pseudonymised NHS Number) and COVID 19 risk code (High or moderate if present) for each patient on the SPL (the Disclosed Data) with the Data Controller for the research purposes below. • The Data Controller proposes to develop and validate a new risk prediction tool to identify people in England at high risk of severe outcomes from COVID-19 infection. This research will form the basis for a rapid research study to inform national COVID-19 and shielding policy. The study will describe the development and validation of novel COVID-19 risk prediction equations for initial use in the NHS in the UK but potentially available internationally (subject to local validation). It is anticipated that the equations will be widely available for use and that the equations will be updated regularly as understanding of COVID-19 increases, better data become available and as the underlying population changes or the virus itself mutates. Cohort University of Oxford will undertake a cohort study in a large population of primary care patients using the QResearch® database (version 44). They will include all practices in England who had been using their EMIS computer system for at least a year. The University of Oxford will randomly allocate three quarters of QResearch practices to the derivation dataset and the remaining quarter to a validation dataset. The University of oxford will identify a second validation dataset from GP practices using a different system (e.g. using the TPP clinical system). This could either be achieved through (a) the new OpenSafely platform or (b) an extract provided by TPP to Oxford to link to QResearch (in line with REC approvals ref 18/EM/0400 obtained 01.04.2020) The advantage of (a) is that it available now and accessible by one of the investigators. The advantage of (b) is that it will allow TPP data to be linked to mortality, HES, ICNARC and COVID-19 national datasets since these datasets are already held by the QResearch team at Oxford and updated regularly (weekly or monthly). Open cohorts of patients aged 0-100 years registered with practices on or after 1st January 2020 will be identified. Patients who do not have a valid NHS number will be excluded. Patients will enter the cohort on 1st Jan 2020. Patients will be censored at the earliest date of the diagnosis of the relevant outcome of interest, death (non-COVI-19) or the date of most recent data for each outcome. It is relevant to note here that Data which is being anonymised by NHS Digital to share with the University of Oxford for QResearch includes data which has been collected from GPs about patients who may have registered a Type 1 as the data was shared for a direct care purpose – namely to identify those who are extremely clinically vulnerable and who need to shield. However, there is no mechanism to identify those patients to exclude them from this dissemination. Given their data will be anonymised when shared with University of Oxford, the public interest in those individuals who are on the SPL being given appropriate advice on how to protect themselves from COVID-19 and that this research is directly about identifying those who are at most risk, it is considered the objective of the research and the benefits it will bring to those what are shielding and others who may need to shield, overrides any objection registered by a patient. Legal Basis The SPL data was obtained by NHS Digital under the COVID-19 Public Health Directions 2020 which permit NHS Digital to collect and analyse data for COVID-19 Purposes and to share the Disclosed Data with the Data Controller for the Agreed Purposes under section 261(1) and s261(2)(e) of the Health and Social Care Act 2012 (2012 Act). The Agreed Purposes are COVID-19 purposes for the promotion of health as required by s261(1A)(b) of the 2012 Act as the study will inform policy in relation to shielding and will develop a tool that will provide information about the COVID-19 risks to individuals. Under the General Data Protection Regulation 2016 (GDPR), NHS Digital is relying on Article 6(1)(c) Legal obligation: the processing is necessary for complying with the law (not including contractual obligationswith the Data Controller for the Agreed Purposes above. As this is health information and therefore special category personal data NHS Digital is also relying on Article 9(2)(g) – substantial public interest and para 6 of Schedule 1 DPA – statutory purpose, to share the Disclosed Data for the Agreed Purposes. Oxford University does not have a s251 approval for the data it holds for QResearch as it is considered to be anonymised data (in context) and HRA have confirmed that CAG approval is not required. The data in the QResearch database is not considered to be confidential patient information and the Confidentiality Advisory Group (CAG) has confirmed to the Data Controller, including in March 2020 in relation to its COVID-19 research, that section 251 support from CAG is not required. As the NHS number for patients from the SPL will be replaced with a pseudonymised identifier by NHS Digital, the Disclosed Data when shared with the Data Controller and used with other data in the QResearch Database will also be anonymised data, as the Data Controller and those who will process the Disclosed Data for the Agreed Purposes will not be able to identify the individuals to whom the Disclosed Data relates. As the Disclosed Data will be anonymised data, there will be no breach of the common law duty of confidence through the processing by the t Data Controller of the Disclosed Data for the Agreed Purposes. As the Disclosed Data will by anonymised data when processed by the Data Controller, it will not be regarded as personal data and therefore is not subject to GDPR and the Data Protection Act 2018. NHS Digital will publish details about the sharing of the Disclosed Data with the Data Controller in its Data Release Register and on its website page about the SPL List here https://digital.nhs.uk/coronavirus/shielded-patient-list/distribution. Data Requested NHS Digital has produced a Shielded Patient List (SPL) which contains details of those individuals who have been identified by clinicians as being extremely vulnerable in relation to the COVID-19 virus as a result of their pre-existing medical conditions. The University of Oxford has requested NHS Digital to share with it certain anonymised information identified below as Disclosed Data from the SPL, for the development and validation of a risk prediction algorithm to estimate short term adverse outcomes from COVID-19 disease which can be used as a risk stratification tool and to inform national shielding policy as more fully detailed below. Data to be disclosed will come from the Shielded Patient List (SLP): Shielded Patient List (SPL) Versions 1.0, 2.0, 3.0, 5.0 and 7 The data refers to list records of who have been identified as Clinically Extremely Vulnerable (CEV) and added to the Shielded Patient List. The data to be disseminated is: • Pseudonymised Identifier (Pseudonymised NHS Number) • COVID 19 risk code (High or moderate if present) The sole data controller and processor is the University of Oxford.

It is important for patients, staff and the NHS that there is one widely used, validated tool which is consistently implemented across the service and which is supported by the academic, NHS and patient communities. This will then help ensure consistent policy and clear communication between policy makers, professionals and the public. The risk algorithms can be used in various ways (examples below are based on the various ways which www.qrisk.org has been implemented and used across the NHS over the last 12 years). 1. Within a consultation between the patient and a clinician with the intention of sharing the information with the patient to assess management options. For example, a 54-year old Asian man wishes to know his risk of serious COVID-19 disease in order to modify risk factors (lifestyle, medication, occupational exposure etc). This could be achieved through development of a risk calculator for use within a consultation. 2. To risk electronically stratify populations to target clinical interventions towards different groups of patients based on levels of risk. For example, a GP practice needs to identify patients shielding or prioritisation for vaccination (once one is available). This could be achieved through the implementation of the equations as risk stratification software embedded in GP clinical computer systems. This will ensure the tool can be applied to up-to-date electronic health records for direct clinical care purposes. 3. To model impact of interventions or changing policy (e.g. shielding, prioritisation for vaccination, occupational health, health economic analyses) through the analysis of the equations are applied to consolidated research databases. For example, DH/PHE/NHS Digital need to assess the impact of changing guidelines on the risk categories or thresholds at a national or regional level e.g. how many patients would be reclassified as high/medium/low risk and what would the resource implications be? 4. Adapted for use by the general public to improve communication and understanding of risk (David S to add more) through implementation into web-based tools. For example, a school or community needs to highlight risk factors and link to recommendations in behaviours to help reduce transmission of COVID-19. 5. Use by researchers to help generate new knowledge or insights. For example, a risk stratification tool could be used to identify high risk patients to be invited to join a clinical trial or to adjust an analysis for baseline risk factors.

10/02/2020

De-Personalised

Other-Health and Social Care Act 2012 Section 261(1) and Section 262(2)(e)

Not applicable

One-Off

TRE