IQVIA HES Data Protection Notice

HES data

Hospital Episode Statistics (HES) is a NHS database containing details of all admissions, A and E attendances and outpatient appointments at NHS hospitals in England.

Initially this data is collected during a patient's time at hospital and submitted to NHS Digital for processing and includes information relating to payment for activity undertaken. It allows hospitals to be paid for the care they deliver.

IQVIA gets a cut of HES data from NHS Digital and applies processes in accordance with the NHS Digital Data Sharing Agreement. This suppresses small numbers to stop people identifying themselves and others, to ensure that patient confidentiality is maintained.

HES data is collected in accordance with applicable data protection law. See further:

What information is included in IQVIA HES?

HES data provides non-identified details about patients and healthcare professionals dealing with clinical events which have taken place in hospital. These include:

  • Clinical information: diagnoses, procedures, operations,
  • Additional key information about the patient: year of birth, gender, ethnicity,
  • Administrative information: waiting times, dates and methods of admission / discharge,
  • Maternity information: gestation, method and date of delivery, complications, birth weight, length of stay,
  • Adult Critical Care: high dependency and intensive care dates,
  • Outpatient attendance: appointment dates, diagnoses, procedures,
  • Accident and Emergency: attendance dates, diagnoses,
  • Healthcare Professionals: Type of health care professional dealing with outpatient attendance and main specialty of consultant for inpatient episode,
  • Mortality data: Date, location and underlying cause of death

HES Data held by IQVIA contains 5 years history data plus current year to date, with the exception of a specific study into nose polyps which will contain 10 years data for a small subset of HES Data that is restricted to this specific disease area only.

HES data does NOT include any direct patient identifiers such as names, addresses, NHS numbers, or full dates of birth.

The purpose for which HES data is processed:

This data may be processed and used for the purpose of medical research strictly to perform three types of service:

1) Data visualisation and benchmarking tools which includes:

  • Care Pathway Analyser (CPA) presents users with simple views of aggregated care pathways. This allows investigation of the causes of variation in patient pathways and the subsequent impact on service delivery.
  • Hospital Feedback Services (HFS): a dashboard allowing chief pharmacists to optimise their use of medicines. It also allows them to monitor their own performance against internal targets and benchmark against similar hospitals. NHS Trusts are granted access to HFS in exchange for continued supply of non-identifiable prescription data and agreement that IQVIA can use the data for further research.
  • Visualise Healthcare Data (VHD): a suite of software tools /reports / dashboards, that allows users to perform queries on aggregated HES Data and data from other sources then view graphs and tables. The Data can be used to enable a Trust to compare its performance to other Trusts against a range of clinical indicators and identify where it could make improvements in the delivery of care to patients.

2) Advanced Statistical Analysis includes:

  • Diagnostic algorithm development studies (machine learning and artificial intelligence to develop algorithms to diagnose patients),
  • Epidemiology studies (analysis of the distribution patterns and determinants of health & disease conditions in defined populations),
  • Health economics and outcomes research studies (study of the value of treatments and the health benefits they deliver to enable doctors to make decisions about the best treatment pathways for patients),
  • Trust data quality reviews (review of a Trust’s coding data quality against recognised NHS standards),
  • Clinical trial analysis (to identify trial sites and understand therapies for patients).

3) Clinical trial site identification (CTSI): IQVIA will use the HES data to perform Clinical Trial Site Identification (CTSI) services. CTSI consists of the production of lists of hospital sites with estimates of the size of the patient population at those sites. The purpose of these analyses is to determine whether clinical trials, aimed at improving public health, are feasible based on site and patient availability. For this purpose, only aggregated and small number-suppressed data are used, and technical and organisational measures are in place to ensure only non-identified data is used.

The Legal basis for processing of personal data relating to patient health is under Article 9(2)(j)of the GDPR - Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The data subjects’ interests and fundamental rights are protected through appropriate minimisation of fields; protection of the data in a secure environment and guaranteeing secure destruction at any stage at the request of NHS Digital or after a defined period on completion of the project.

IQVIA are processing the data in line with their goals as part of their legitimate interests. This is covered under the GDPR Article 6(1)(f) - This work is necessary for the purposes of the legitimate interests pursued by the controller except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. As set out in the legitimate interest assessment - the data requested is to help achieve the following examples:

Care Pathway Analysis,
Hospital Feedback services,
Diagnostic algorithm development studies,
Epidemiology studies,
Health economics and outcomes research studies,
Trust data quality reviews,
Clinical trial analysis.

Technical and organisation measures are in place to ensure only non-identified data is used.

This data is not used to populate automated decision making tools.

Who is the data made available to?

IQVIA makes the non-identified data available to its employees and carries out research on behalf of other research groups, including:

- Providers of healthcare services including but not limited to:

- Clinical Commissioning Groups (CCGs)

- Commissioning Support Units (CSUs)

- Hospital Trusts

- Private secondary care providers

- Mental Health Trusts

- Community Providers Trusts

- Pharmacies

- NHS England

- Public Health England

- Sustainability and Transformation Partnerships (STPs)

- Health and Wellbeing Boards

- Universities

- Life science industry

- Pharmaceutical companies

- Medical Device companies

- Industry bodies – limited to the Association of the British Pharmaceutical Industry (ABPI), Ethical Medicines Industry Group (EMIG) and the Proprietary Associated of Great Britain (PAGB)

The HES database is not used for commercial purposes such as sales targeting or commercial insurance.

There is no personal data transferred to other third countries or international organisations

HES Study Protocol Review:

For Advanced Scientific Analysis, IQVIA produces bespoke analysis for external organisations on a project by project basis.

Research Studies provided via Advanced Scientific Analysis are subject to review by an Independent Scientific Advisory Committee (ISEAC), which is a group of medical and scientific advisors who are independent of IQVIA. Its role is to ensure that any study performed using HES data is scientifically robust and compliant with the data sharing agreement. If ISEAC approves the study, it is logged on an access control register and the IQVIA researchers are allowed to access the relevant subset of HES data. The researchers will present the results of their analysis to external organisations in the form of aggregated, small number suppressed tables, compliant with the HES Analysis Guide. These outputs may also take the form of counts, proportions or formulae.

All ISEAC decisions are binding, and any studies not approved will not be performed unless revised and subsequently approved.

ISEAC records of decisions can be made available to NHS Digital on a confidential basis.

Data Retention:

IQVIA retains data in accordance with UK Medical Research Council (MRC) guidelines which recommend basic research data and related material be retained for a minimum of 10 years after the study has been completed. This is to support good research practice which requires research studies to be reproducible.


IQVIA has implemented an Information Security Management System. IQVIA Ltd, IQVIA Solutions UK Limited and IQVIA Technology Services Ltd are accredited to the ISO 27001 standard.

IQVIA stores the HES data records on secure servers located in the UK. Appropriate security measures have been put in place to prevent unauthorised access to or disclosure of the HES data. Access to the data is strictly controlled and limited to authorised IQVIA personnel.

Patient rights:

Patients are not under a statutory or contractual obligation to provide the personal data. Patients have the right to withdraw consent or opt out via NHS. Patients also have the right to request from NHS the rectification of their data, or restriction of processing of personal data concerning the data subject, or to object to the processing of such personal data, as well as the right to data portability. Patients would need to contact NHS to exercise these rights (

Changes to this Notice:

We may update this notice from time to time. We encourage you to review this notice periodically to stay informed about how we are using and protecting HES data. Any changes to this notice take effect immediately after being posted or otherwise provided by us.

Contact Details:

Questions and comments regarding this notice should be addressed to Amanda Culley at IQVIA, 210 Pentonville Road, London, N1 9JY or emailed to our Data Protection Officer Barbara Bressolles at If you have unresolved concerns, you also have the right to complain to the Information Commissioner´s Office website at

About Us:

IQVIA Ltd and IQVIA Technology Services Ltd (“IQVIA/we/us/our”) are part of the IQVIA Inc. group of companies serving the combined industries of health information technologies and clinical research worldwide. We specialise in the provision of products and services including medical research and analytical solutions to healthcare and life sciences organisations. In the UK, IQVIA has collected and supported the research use of non-identified patient data for over 20 years.

We are registered in England and Wales as: IQVIA Ltd, registration number: 03022416 and our registered office is 3 Forbury Place, 23 Forbury Road, Reading, United Kingdom, RG1 3JH.