HES data

Hospital Episode Statistics (HES) is an NHS database containing details of all admissions, A and E attendances and outpatient appointments at NHS hospitals in England.

This data is collected during a patient's time at hospital and submitted to NHS England for processing and includes information relating to payment for activity undertaken. It allows hospitals to be paid for the care they deliver.

IQVIA Ltd. receives a cut of HES data from NHS England and applies processes in accordance with the NHS England Data Sharing Agreement. This suppresses small numbers to stop people identifying themselves and others, to ensure that patient confidentiality is maintained. IQVIA Ltd. are the sole data processors under this agreement. HES data is collected in accordance with applicable data protection law. See further: https://digital.nhs.uk/about-nhs-digital/our-work/keeping-patient-data-safe/gdpr/gdpr-register/hospital-episode-statistics-gdpr/hospital-episode-statistics-hes-gdpr-information.

What information is included in IQVIA HES?

HES data provides non-identified details about patients and healthcare professionals dealing with clinical events that have taken place in hospital. These include:

• Clinical information: diagnoses, procedures, operations
• Additional key information about the patient: year of birth, gender, ethnicity
• Administrative information: waiting times, dates and methods of admission / discharge
• Maternity information: gestation, method and date of delivery, complications, birth weight, length of stay
• Adult Critical Care: high dependency and intensive care dates
• Outpatient attendance: appointment dates, diagnoses, procedures
• Accident and Emergency: attendance dates, diagnoses
• Healthcare Professionals: Type of health care professional dealing with outpatient attendance and main specialty of consultant for inpatient episode

In addition NHS England provide:

• Mortality data: Date, location and underlying cause of death
• Summary Hospital Mortality Indicator data

HES Data held by IQVIA Ltd. contains 5 years history data plus current year to date

HES data does NOT include any direct patient identifiers, such as names, addresses, NHS numbers, or full dates of birth.

The purpose for which HES data is processed:

This data may be processed and used for the purpose of medical research strictly to perform two types of service:

1. Data visualisation and benchmarking tools which include:
• Care Pathway Analyser (CPA) presents users with simple views of aggregated care pathways. This allows investigation of the causes of variation in patient pathways and the subsequent impact on service delivery.
• Hospital Feedback Services (HFS): a dashboard allowing Chief Pharmacists to optimise their use of medicines. It also allows them to monitor their own performance against internal targets and benchmark against similar hospitals. NHS Trusts are granted access to HFS in exchange for continued supply of non-identifiable prescription data and agreement that IQVIA can use the data for further research.
• Visualise Healthcare Data (VHD): a suite of software tools /reports / dashboards, that allows users to perform queries on aggregated HES Data and data from other sources then view graphs and tables. The Data can be used to enable a Trust to compare its performance to other Trusts against a range of clinical indicators and identify where it could make improvements in the delivery of care to patients.
2. Clinical trial site identification (CTSI): IQVIA will use the HES data to perform Clinical Trial Site Identification (CTSI) services. CTSI consists of the production of lists of hospital sites with estimates of the size of the patient population at those sites. The purpose of these analyses is to determine whether clinical trials, aimed at improving public health, are feasible based on site and patient availability. For this purpose, only aggregated and small number-suppressed data are used, and technical and organisational measures are in place to ensure only non-identified data is used.

The Legal basis for processing of personal data relating to patient health is under Article 9(2)(j)of the GDPR – Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The data subjects’ interests and fundamental rights are protected through appropriate minimisation of fields; protection of the data in a secure environment and guaranteeing secure destruction at any stage at the request of NHS Digital or after a defined period on completion of the project.

IQVIA Ltd. are processing the data in line with their goals as part of their legitimate interests. This is covered under the GDPR Article 6(1)(f) – This work is necessary for the purposes of the legitimate interests pursued by the controller except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. As set out in the legitimate interest assessment, the data requested is to help achieve the following examples:

• Care Pathway Analysis
• Hospital Feedback services
• Benchmarking
• Services to support the planning and development of epidemiology, health economics and outcomes research studies
• Trust data quality reviews
• Clinical trial analysis

Technical and organisation measures are in place to ensure only non-identified data is used.

This data is not used to populate automated decision-making tools.

Who is the data made available to?

IQVIA Ltd. makes the non-identified data available to its employees that carry out research on behalf of other research groups, including:

• Providers of healthcare services including but not limited to:
• NHS secondary, community and mental health care providers
• Integrated Care Systems
• Primary care providers
• Private secondary care providers
• Commissioning Support Units (CSU’s)
• Pharmacies
• NHS England
• Government and government-aligned organisations (e.g. DHSC, NICE)
• Health and Wellbeing Boards
• Life science industry
• Pharmaceutical companies
• Medical Device companies
• Patient groups, charities, and not-for-profit organisations
• Industry bodies – limited to the Association of the British Pharmaceutical Industry (ABPI), Ethical Medicines Industry Group (EMIG) and the Proprietary Associated of Great Britain (PAGB)
• Universities
• Life science industry

The HES database is not used for commercial purposes such as sales targeting or commercial insurance.

There is no personal data transferred to other third countries or international organisations.

Data Retention:

IQVIA Ltd. retains data in accordance with UK Medical Research Council (MRC) guidelines which recommend basic research data and related material be retained for a minimum of 10 years after the study has been completed. This is to support good research practice which requires research studies to be reproducible.

Security:

IQVIA Ltd. has implemented an Information Security Management System. IQVIA Ltdare accredited to the ISO 27001 standard.

IQVIA Ltd. stores the HES data records on secure servers located in the UK. Appropriate security measures have been put in place to prevent unauthorised access to or disclosure of the HES data. Access to the data is strictly controlled and limited to authorised IQVIA Ltd. personnel.

Changes to this Notice:

We may update this notice from time to time. We encourage you to review this notice periodically to stay informed about how we are using and protecting HES data. Any changes to this notice take effect immediately after being posted or otherwise provided by us.

Contact Details:

Questions and comments regarding this notice should be addressed to Tanith Hjelmbjerg at IQVIA, The Point, 37 North Wharf Road, London, W2 1AF or emailed to our Data Protection Officer Barbara Bressolles at eu.dpo@iqvia.com If you have unresolved concerns, you also have the right to complain to the Information Commissioner´s Office website at https://ico.org.uk/.

About Us:

IQVIA Ltd. (“IQVIA/we/us/our”) is part of the IQVIA Inc. group of companies serving the combined industries of health information technologies and clinical research worldwide. We specialise in the provision of products and services including medical research and analytical solutions to healthcare and life sciences organisations. In the UK, IQVIA has collected and supported the research use of non-identified patient data for over 20 years.

We are registered in England and Wales as: IQVIA Ltd, registration number: 03022416 and our registered office is 3 Forbury Place, 23 Forbury Road, Reading, United Kingdom, RG1 3JH.