HES Data Protection Notice

HES data

Hospital Episode Statistics (HES) is a NHS database containing details of all admissions, A and E attendances and outpatient appointments at NHS hospitals in England.

Initially this data is collected during a patient's time at hospital as part of the Commissioning Data Set (CDS). This is submitted to NHS Digital for processing and is returned to healthcare providers as the Secondary Uses Service (SUS) data set and includes information relating to payment for activity undertaken. It allows hospitals to be paid for the care they deliver.

This same data can also be processed and used for non-clinical purposes, such as research and planning health services. Because these uses are not to do with direct patient care, they are called 'secondary uses'. This is the HES data set.

HES data covers all NHS Clinical Commissioning Groups (CCGs) in England, including:

  • private patients treated in NHS hospitals
  • patients resident outside of England
  • care delivered by treatment centres (including those in the independent sector) funded by the NHS

Each HES record contains a range of information about an individual patient admitted to an NHS hospital, including:

  • clinical information about diagnoses and operations
  • patient information, such as age group, gender and ethnicity
  • administrative information, such as dates and methods of admission and discharge
  • geographical information such as where patients are treated and the area where they live

We apply a strict statistical disclosure control in accordance with the NHS Digital protocol, to all published HES data. This suppresses small numbers to stop people identifying themselves and others, to ensure that patient confidentiality is maintained.

HES data is collected in accordance with applicable data protection law. See further: https://digital.nhs.uk/about-nhs-digital/our-work/keeping-patient-data-safe/gdpr/gdpr-register/hospital-episode-statistics-gdpr/hospital-episode-statistics-hes-gdpr-information.


What information is included in HES data?
HES data provides non-identified details about patients and healthcare professionals dealing with clinical events which have taken place in hospital. These include:

  • Clinical information: diagnoses, procedures, operations
  • Additional key information about the patient: year of birth, gender, ethnicity
  • Administrative information: waiting times, dates and methods of admission / discharge
  • Maternity information: gestation, method and date of delivery, complications, birth weight, length of stay
  • Adult Critical Care: high dependency and intensive care dates
  • Outpatient attendance: appointment dates, diagnoses, procedures
  • Accident and Emergency: attendance dates, diagnoses
  • Healthcare Professionals: Type of health care professional dealing with outpatient attendance and main speciality of consultant for inpatient episode
  • Data held contains 5 years history data plus current year to date.

HES data does NOT include any direct patient identifiers such as names, addresses, NHS numbers, or full dates of birth.


The purpose for which HES data is processed
This data may be processed and used for the purpose of medical research strictly to perform three types of service:

1) Data visualisation and benchmarking tools which includes:

  • Care Pathway Analyser presents users with simple views of aggregated care pathways. This allows investigation of the causes of variation in patient pathways and the subsequent impact on service delivery.
  • Hospital Feedback Services (HFS). A dashboard allowing chief pharmacists to optimise their use of medicines. It will also allow them to monitor their own performance against internal targets and benchmark against similar hospitals. This service is still in development. NHS Trusts are granted access to HFS in exchange for continued supply to non-identifiable prescription data and agreement that IQVIA can use the data for more further research.
  • Visualise Healthcare Data. A suite of tools/reports, including Healthcare Optimisation Benchmarking that allows users to perform queries on aggregated HES data and data from other sources then view graphs and tables. E360™ A software platform for delivering Real-World Insights from large longitudinal healthcare data sources. The platform allows descriptive analysis of the data.

2) Advanced Statistical Analysis includes: diagnostic algorithm development, epidemiology, health economics and outcomes research studies.

IQVIA processes the HES data on the basis of legitimate interests in supporting medical research and because it is necessary for the above scientific research purposes, subject always to appropriate safeguards. Technical and organisation measures are in place to ensure only non-identified data is used.

3) Clinical trial site identification (CTSI): IQVIA will use the HES data to perform Clinical Trial Site Identification (CTSI) services. CTSI consists of the production of lists of hospital sites with estimates of the size of the patient population at those sites. The purpose of these analyses is to determine whether clinical trials, aimed at improving public health, are feasible based on site and patient availability. For this purpose, only aggregated and small number-suppressed data are used, and technical and organisational measures are in place to ensure only non-identified data is used.


Who is the data made available to?
IQVIA carries out research on behalf of or makes data available to, the following research groups only:

  • Providers of healthcare services including but not limited to:
  • Universities
  • Life science industry
  • Pharmaceutical companies
  • Medical Device companies
  • Industry bodies – limited to the Association of the British Pharmaceutical Industry (ABPI), Ethical Medicines Industry Group (EMIG) and the Proprietary Associated of Great Britain (PAGB)

The HES database is not used for commercial purposes such as sales targeting or commercial insurance.


HES Study Protocol Review
For advanced scientific analysis, IQVIA produce bespoke analysis for external organisations on a project by project basis. All requests for bespoke analysis are subject to review by an independent scientific advisory committee (ISEAC) who review the proposed study design. If ISEAC approves the study, it is logged on an access control register and the IQVIA researchers are allowed to access the relevant subset of HES data. The researchers will present the results of their analysis to external organisations in the form of aggregated, small number suppressed tables compliant with the HES Analysis Guide. These outputs may also take the form of counts, proportions or formulae.

ISEAC is a group of medical and scientific advisors who are independent of IQVIA . For studies based on HES data the role of this committee is to ensure that any study performed is complaint with the data sharing agreement and by extension the Care Act 2014. All ISEAC decisions are binding, and any studies not approved will not be performed unless revised and subsequently approved. ISEAC records of decisions can be made available to NHS Digital under the caveat that they will remain commercial in confidence.


Data Retention
IQVIA retains data in accordance with UK Medical Research Council (MRC) guidelines which recommend basic research data and related material be retained for a minimum of 10 years after the study has been completed. This is to support good research practice which requires research studies to be reproducible.


IQVIA has implemented an Information Security Management System. IQVIA Solutions UK Ltd and IQVIA Technology Services Ltd is accredited to the ISO 27001 standard.

IQVIA stores the HES data records on secure servers located in the UK. We have put in place appropriate security measures to prevent unauthorised access to or disclosure of the HES data. Access to the data is strictly controlled and limited to authorised IQVIA personnel.


Patient rights
Patients have the right to withdraw consent or opt out via NHS. Patients have the right to request from NHS the rectification of their personal data, or restriction of processing of personal data concerning the data subject, or to object to the processing of such personal data, as well as the right to data portability. Patients would need to contact NHS to exercise these rights (https://www.nhs.uk/your-nhs-data-matters/).


Changes to this Notice
We may update this notice from time to time. We encourage you to review this notice periodically to stay informed about how we are using and protecting HES data. Any changes to this notice take effect immediately after being posted or otherwise provided by us.


Contact Details
Questions and comments regarding this notice should be addressed to Amanda Culley at IQVIA, 210 Pentonville Road, London, N1 9JY or to eu.dpo@iqvia.com.


About Us

IQVIA Solutions UK Limited and IQVIA Technology Services Ltd (“IQVIA/we/us/our”) are part of the IQVIA Inc. group of companies serving the combined industries of health information technologies and clinical research worldwide. We specialise in the provision of products and services including medical research and analytical solutions to healthcare and life sciences organisations. In the UK, IQVIA has collected and supported the research use of non-identified patient data for over 20 years.


For the purpose of this notice and pursuant to data protection legislation, IQVIA is the data controller of the HES data.

We are registered in England and Wales as: IQVIA Technology Services Ltd, registration number: 03566800 and IQVIA Solutions UK Limited, registration number: 00634325 and our registered office is 210 Pentonville Road, London, N1 9JY.