Hospital Episode Statistics (HES) is an NHS database containing details of all admissions, A and E attendances and outpatient appointments at NHS hospitals in England.
This data is collected during a patient's time at hospital and submitted to NHS England for processing and includes information relating to payment for activity undertaken. It allows hospitals to be paid for the care they deliver.
IQVIA Ltd. receives a cut of HES data from NHS England and applies processes in accordance with the NHS England Data Sharing Agreement. This suppresses small numbers to stop people identifying themselves and others, to ensure that patient confidentiality is maintained. IQVIA Ltd. are the sole data processors under this agreement. HES data is collected in accordance with applicable data protection law. See further: https://digital.nhs.uk/about-nhs-digital/our-work/keeping-patient-data-safe/gdpr/gdpr-register/hospital-episode-statistics-gdpr/hospital-episode-statistics-hes-gdpr-information.
HES data provides non-identified details about patients and healthcare professionals dealing with clinical events that have taken place in hospital. These include:
In addition NHS England provide:
HES Data held by IQVIA Ltd. contains 5 years history data plus current year to date
HES data does NOT include any direct patient identifiers, such as names, addresses, NHS numbers, or full dates of birth.
This data may be processed and used for the purpose of medical research strictly to perform two types of service:
The Legal basis for processing of personal data relating to patient health is under Article 9(2)(j)of the GDPR – Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The data subjects’ interests and fundamental rights are protected through appropriate minimisation of fields; protection of the data in a secure environment and guaranteeing secure destruction at any stage at the request of NHS Digital or after a defined period on completion of the project.
IQVIA Ltd. are processing the data in line with their goals as part of their legitimate interests. This is covered under the GDPR Article 6(1)(f) – This work is necessary for the purposes of the legitimate interests pursued by the controller except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. As set out in the legitimate interest assessment, the data requested is to help achieve the following examples:
Technical and organisation measures are in place to ensure only non-identified data is used.
This data is not used to populate automated decision-making tools.
IQVIA Ltd. makes the non-identified data available to its employees that carry out research on behalf of other research groups, including:
The HES database is not used for commercial purposes such as sales targeting or commercial insurance.
There is no personal data transferred to other third countries or international organisations.
Data Retention:
IQVIA Ltd. retains data in accordance with UK Medical Research Council (MRC) guidelines which recommend basic research data and related material be retained for a minimum of 10 years after the study has been completed. This is to support good research practice which requires research studies to be reproducible.
Security:
IQVIA Ltd. has implemented an Information Security Management System. IQVIA Ltdare accredited to the ISO 27001 standard.
IQVIA Ltd. stores the HES data records on secure servers located in the UK. Appropriate security measures have been put in place to prevent unauthorised access to or disclosure of the HES data. Access to the data is strictly controlled and limited to authorised IQVIA Ltd. personnel.
Changes to this Notice:
We may update this notice from time to time. We encourage you to review this notice periodically to stay informed about how we are using and protecting HES data. Any changes to this notice take effect immediately after being posted or otherwise provided by us.
Contact Details:
Questions and comments regarding this notice should be addressed to Tanith Hjelmbjerg at IQVIA, The Point, 37 North Wharf Road, London, W2 1AF or emailed to our Data Protection Officer Barbara Bressolles at eu.dpo@iqvia.com If you have unresolved concerns, you also have the right to complain to the Information Commissioner´s Office website at https://ico.org.uk/.
About Us:
IQVIA Ltd. (“IQVIA/we/us/our”) is part of the IQVIA Inc. group of companies serving the combined industries of health information technologies and clinical research worldwide. We specialise in the provision of products and services including medical research and analytical solutions to healthcare and life sciences organisations. In the UK, IQVIA has collected and supported the research use of non-identified patient data for over 20 years.
We are registered in England and Wales as: IQVIA Ltd, registration number: 03022416 and our registered office is 3 Forbury Place, 23 Forbury Road, Reading, United Kingdom, RG1 3JH.