Whenever we go to a doctor or a hospital, they collect data about us, our health and our lifestyle. This is recorded and stored in our patient record. It may include our height and weight, whether we smoke, how much we drink, detail of any allergies, what aches, pains or infections we’ve got, and what medications we are taking. It may also include the results of blood tests, images from MRI scans, and any procedures we’ve had, together with contact information, date of birth, and next of kin information.

Other specialists we see, for example dentists, physiotherapists and psychologists, will also create records.

The NHS uses this information to help provide the best clinical care for us. As a patient record contains sensitive information about our health, it must be handled very carefully and accessed safely and securely, to protect confidentiality.

Other types of health data include information collected during clinical trials and cohort studies or data generated by you; for example, health apps, fitness trackers or patient surveys.

If data from many different patients is linked up and pooled, researchers and doctors can look for patterns in the data, helping them develop new ways of predicting or diagnosing illnesses, and identify ways to improve clinical care. The information from health data is extremely valuable to help understand more about disease, to develop new treatments, to monitor safety, to plan services and to evaluate NHS policy.

The Gateway acts a portal for researchers and innovators to discover and enquire about access to UK health datasets. The datasets that are discoverable are from a range of organisations that form the UK Health Data Research Alliance. It also provides information about projects and tools for health data research and a community area where researchers can collaborate on important health questions.

The Gateway does not hold, store or control the data itself but can aid with the data access process. You will be able to see what datasets are available but you will not be able to access and view the data itself. To gain access you will need to log in and follow the access request process and be approved by the data controller.

Before a researcher is granted access, their study is usually assessed by an independent review committee or other decision-making group, who ensure that the reason for using the data is appropriate. If a researcher wants to access a dataset, they can send a request via the Innovation Gateway and this will be considered by the organisation that looks after that dataset. Each of these organisations (who sit within the UK Health Data Research Alliance) will have their own data access requirements and processes.

Wherever possible, identifying information will be removed from that data, and researchers should only be given the minimum amount necessary to answer a question. Data must be stored securely, and a legal contract must be signed before data can be accessed.

Often a study will need to use data about an individual that is held in more than one dataset. When this happens, a trusted third party, usually NHS Digital, links the data using a unique identifier (such as NHS number which is then removed) to make sure the researcher cannot re-identify individuals.

Providing access to health data will never be completely risk-free, but there are appropriate measures in place to make any risks as low as reasonably possible. Evidence suggests there are three key areas that people are concerned about when health data is used and the following provides a brief overview of some of the measures in place to address those key concerns.

1. Invasion of privacy, or information about medical history being revealed to others

Data is anonymised wherever possible and although it is extremely difficult to guarantee individuals could not potentially be identified if data is linked to other sources, there are multiple safeguards in place – both by Health Data Research UK and the organisations that manage the data – to reduce the risk of data being reidentified. There are audit processes to check who is accessing data, and robust penalties can be issued where data is misused.

The General Data Protection Regulation (GDPR) specifically makes it a criminal offence to deliberately attempt to, or to re-identify someone (conditions apply).

2. Loss of control if data is passed outside the NHS

Currently, most of the ‘data breaches’ in the health sector occur when information is accidentally posted, faxed or emailed to the wrong person.

The Gateway does not hold or store any patient or health data. If access is provided by the data controller, research on the data will be carried out in what is known as a Trusted Research Environment or Safe Haven. These are highly secure places – either physical servers often in a locked room or on a Safe Cloud – that can only be used by researchers who have been permitted entry. Any technology companies involved in providing or supporting the Safe Havens will not be able to see or access the data.

This minimises the risk that any data can be downloaded or transferred and then used to identify any individual patient.

3. The possibility of cyber attacks or hacking

The Gateway does not hold or store health data nor does health data flow into it for any processing or analysis. It does hold metadata that describes the datasets but metadata does not contain any personal information. The other data held within the Gateway is user profile information, which is held securely and encrypted, and information about health data research projects and tools. The community forum also holds data relating to members of the health data research community who participate in discussions. These data are subject to the privacy policy of the Gateway.

Key to the development of the Innovation Gateway is that it operates securely and will be subjected to regular security testing including penetration testing. Should these security controls fail and a hacker were to gain access to the site they will not have access to either health data nor to unencrypted user profile information.

There is no identifiable patient data in the Innovation Gateway. Once access has been granted, the various safeguards in place work to reduce the risk of data being re-identifiable. This will include:

• Identifiable information being removed and data being anonymised where possible
• Only linking data through a unique identifier (which is then removed) by a trusted third party (e.g. NHS Digital)
• Providing access through Trusted Research Environments or Safe Havens to minimise the risk of data being downloaded or transferred and used to identify any individual person.

For a helpful description of what is meant by identifiable data, please read Understanding Patient Data’s factsheet.

It is usually possible to opt out of sharing health data held in personal records about you. To do this, contact the organisation that holds the record (such as your GP practice or hospital). If you live in:

• England you can opt out of your data being used for research via the NHS Digital website https://digital.nhs.uk/services/national-data-opt-out
• Scotland, although it doesn’t have an opt out mechanism, contact your GP or hospital to discuss your wishes or visit https://spire.scot/my-choices/ to opt out of sharing GP records only. For further information about use of other data in Scotland you can read the NSS data protection notice
• Wales you can opt out of your summary GP record being shared by visiting http://www.gprecord.wales.nhs.uk/home

The community forum allows people in the health data research community – this could be researchers, technologies, patient representatives, data controllers – to engage in wide ranging discussions about relevant themes or topics. The Gateway uses an open-source forum software called Discourse that is deployed and hosted by Health Data Research UK. No identifiable patient data will be shared or stored in the community forum. Any other data, relating to individual users from the community, and the content of discussions within Discourse are subject to the privacy policy of the Gateway.

The Gateway is a work in progress, and uses metadata from across the UK Health Data Research Alliance and Health Data Research Hubs. A full set of metadata is not yet available for all datasets, and more metadata will be added as the tool is developed.

As a researcher needing health data for your work, a data controller wishing to join the Alliance or a patient or member of the public wanting to find out more information, we want to work with you and provide you with the information you need. If you have a question or would like to get involved in the Gateway development, email Health Data Research UK at [email protected] and we’ll be back in touch.

Open Athens (a JISC Enterprise) is an identity broker that connects identity federations such as the UKFederation (UK Academic institutions) and OpenAthensfederation (which includes small-medium sized enterprises and NHS Trusts, etc.).

Open Athens is used to allow users to use their institutional/affiliated login to access resources in the Gateway. This ensures that your access credentials (username/password) are only transmitted to your affiliated institution/organisation. They would then be able to release certain user characteristics (ID, Affiliation, Role) to allow us to make access decisions within the Gateway.

No personally identifiable information is released to us during the login process. All we would know is that you are in possession of credentials validated by your organisation, who are part of the UKFederation or OpenAthensFederation identity federations.

To ensure that users have the best experience when using the Innovation gateway we have a list of approved browsers which are fully supported.

The supported browsers for the Innovation Gateway are:

• Chrome 80+
• Microsoft Edge
• Microsoft Internet Explorer 11+ - we strongly recommend upgrading to Microsoft Edge for the best experience
• Mozilla Firefox latest ESR

The gateway should also work on any other modern web browser which is compatible with HTML5 and CSS3.

To claim authorship please create an account on the gateway and from the associated email address send an email to mailto:[email protected] with the link to the resource. Our team will get back to once the request is complete.