Skip to main content

UCLH Data Science Training Resources

9 Access to health data at UCLH - 5 safes

Contents

Five Safes at UCLH overview
Safe people
Safe projects
  UCL UCLH Joint Research Office checklist
Safe settings
Safe outputs
Safe data
Data access checklist

9.1 Five Safes at UCLH overview

Data access at UCLH is judged using the ‘5 safes’ framework. This summarises our local implementation.

Safe people

  • all individuals have substantive contracts or educational relationships with higher education or NHS institutions

  • those working need to have evidence of experience of working with such data (e.g. previous training, previous work with ONS, data safe havens etc.) or they need a supervisor who can has similar experience

  • those working need to undergo training in information governance and issues with statistical disclosure control (SDC)

Safe projects

  • projects must serve the public good

  • projects must meet relevant HRA and UCLH research and ethics approvals

  • service delivery work mandated as per usual trust processes

Safe settings

  • working at UCLH in the NHS on approved infrastructure

  • UCLH local and remote desktops

  • UCLH Data Science Desktop

  • EMAP

Safe outputs

  • outputs (e.g. reports, figures and tables) must be non-disclosing

  • outputs should remain on NHS systems initially

  • a copy of all outputs that are released externally (documents) should be stored in one central location so that there is visibility for all

Safe data

  • direct identifiers (hospital numbers, NHS numbers, names etc) should be masked unless there is an explicit justification for their use

  • data releases are proportionate (e.g. limited by calendar periods, by patient cohort etc.)

  • further work to obscure or mask the data is not necessary given the other safe guards (as per the recommendation by the UK data service)

We will now give more details for each of the 5 safes.

9.2 Safe people

We suggest you measure yourself against the following criteria. When you are ready, then please submit your evidence here

9.2.1 Your role

A user should either

  1. Hold an Honorary or Substantive contract with UCLH
  2. An NHS research passport or a letter of access

9.2.2 Your technical skills

A user should either

  1. hold a clinical qualification (in medicine, nursing, or the allied health professions) and have demonstrable experience in the management and analysis of health care data
  2. or hold a relevant undergraduate degree (or higher) in a field of study using quantitative data
  3. or be able to demonstrate at least three years quantitative research, audit or business intelligence experience
  4. or have a named supervisor who meets the above criteria and confirms sufficient time to support the user

9.2.3 Your training

A user should demonstrate all of the following

  1. Current information governance training
  1. Good Clinical Practice training

Microdata is information at the level of individual. All data derived from an electronic health record is by definition microdata unless later aggregated.

9.2.4 Your microdata experience

A user should demonstrate one of the following 1. Demonstrable experience using microdata. Suggested supporting evidence would include: - the microdata used (e.g. ONS list cleaning, EHRS queries on Caboodle/Clarity) - the source of the microdata (e.g. UCLH) - the project - your role in the project (e.g. analyst, Chief Investigator) - statistical techniques used - measures used to protect confidentiality (e.g. examples of statistical disclosure control) - statistical or development software used - Completed assessments from the Data access training module derived from material provided by the Safe Data Access Professionals Working Group

9.3 Safe projects

We have adopted and adapted the ONS Data Ethics Advisory Committee’s application form.

Where you have an existing IRAS form, we have indicated the sections that can be directly copy-and-pasted into this application.

The UCLH version can be downloaded here.

The project application headings are summarised below

  1. Application Type: Research or Exploratory analysis Most applications will require formal research approval, but there are circumstances where the work will be exploratory. This will need to be justified to the UCLH data access committee.

  2. Project Lead Name and details with comment on whether the lead will also view the data or just the derived outputs

  3. Researcher Team Name and details of all members plus guidance as to whom the project lead is deputising

  4. Research Sponsor Have you been commissioned to perform this research for another organisation?

  5. Title of the research project And estimated duration of the project

  6. Abstract of the research project Include a short description of the project and its benefits, in no more than 100 words. or IRAS Section A6-1 “Summary of the study” (300 words)

  7. Purpose of Research Project Provide a detailed description of the purpose for which the data are requested, describing the aims of the study/research in no more than 500 words. Where research is part of a larger programme please include details below. or IRAS Section A12. “What is the scientific justification for the research?”

  8. Research Methodology Provide details of the research protocol or methodology (e.g. data linkage or matching, statistical modelling etc) and how you intend to use the data, in no more than 1000 words. or IRAS Section A13. “Please give a full summary of your design and methodology”

  9. Data Required

    1. List the data sources, the patient cohorts and the timer periods you wish to examine. Give as much detail as possible on the exact data items you require.

    2. Describe what portions of the data will be or might be identifiable using the framework below. For example, you might require hospital number to link to other data items (a direct identifier). However, you might also require date of birth to define age, this might be an identifying with other information.

      1. Direct identifiers e.g. names, NHS number, hospital number etc.

      2. Indirect identifiers e.g. date of birth, diagnosis, the first 3 letters of a postcode etc.

      3. Non-identifying variables e.g. heart rate, creatinine, urine volume

      4. Free text Where under normal circumstances de-identification is not guaranteed

    3. Other data sources If you intend to bring in any data for your project, give details of the data including who the owner is and provide evidence that the owner has given permission for their data to be used by you for this research.

    4. Justification for access to this rather than existing or public data Explain why access to legally protected (unpublished) data is needed. Please state what other data sources have been considered and why they are not sufficient for your purposes.

  10. Data linkage Does your project include any linking of data sources (as defined within the application guidance)? If yes, provide the following details below:

    • description of the data sources(s) to be linked
    • summary of the key variables;
    • summary of the linking methodology; and
    • the justification for the linking.

  11. Ethics You will need to provide evidence of an ethics consideration for your research project. Have you had ethical approval for this project from your organisation or elsewhere?

  12. Public Good

    1. Please describe how your research project will provide a public good. Complete all the sections that apply (e.g. Provide an evidence base for health care including direct patient or health system benefit)

    2. Have any risks to public benefit been identified? What are they and how have they been mitigated?

  13. Duration of access What is your best estimate of the last time you will need access to the unpublished data? Note: if applying for exploratory analysis, access will be granted for a maximum of 12 months

  14. Publications In order to access unpublished data for research purposes, you must promise that your findings will be made publicly available. Exemptions may only be granted in exceptional circumstances. Note: If you are applying for exploratory analysis, no publications are permitted.

    • How do you intend to make your research available to the public?
    • Which specific journals, websites or reports do you intend to use to publish this research?
    • What is your best estimate of the project publication date. - What, if any, are the circumstances that mean you need an exemption from making your results publicly available? or IRAS Section A51. “How do you intend to report and disseminate the results of the study”

9.3.1 UCL UCLH Joint Research Office checklist

Starting a new study There are typically three stages of approval that must be considered before conducting clinical research:

Links

9.4 Safe settings

You should confirm that you are working at UCLH on approved infrastructure. For example,

  • UCLH local and remote desktops

  • or UCLH Data Science Desktop

  • or a Generic Application Environment provisioned through EMAP

9.5 Safe outputs

You should confirm that

  • outputs must be non-disclosing

  • outputs must remain on UCLH systems until suitable publication clearance can be demonstrated

  • outputs will be archived as per any internal processes mandated by any of UCLH Information Services, Clinical Research Informatics Unit or the UCL/UCLH Joint Research Office

Outputs include

  • manuscripts or reports containing prose, tables and figures

  • software applications

  • statistical models (e.g. machine learning, artificial intelligence or similar)

  • data (electronic or otherwise)

9.6 Safe data

You are expected to explain in your Safe projects application :

  • any requirement for access to

    • direct or indirect identifiers otherwise a pseudonymised identifier will be provided

    • sensitive information (e.g. HIV status, drug and alcohol history, mental health history etc.)

  • how your data request is proportionate. We suggest you provide clear limits by

    • calendar period

    • patient cohort

    • data content

Further work to obscure or mask the data should not be necessary given the other safeguards.

9.7 Data access checklist

Safe people

  • all individuals have substantive contracts or educational relationships with higher education or NHS institutions

  • those working need to have evidence of experience of working with such data (e.g. previous training, previous work with ONS, data safe havens etc.) or they need a supervisor who can has similar experience

  • those working need to undergo training in information governance and issues with statistical disclosure control (SDC)

Safe projects

  • projects must 'serve the public good'

  • projects must meet relevant HRA and UCLH research and ethics approvals

  • service delivery work mandated as per usual trust processes

Safe settings

  • working at UCLH in the NHS on approved infrastructure

    • UCLH local and remote desktops

    • UCLH Data Science Desktop

    • EMAP

Safe outputs

  • outputs (e.g. reports, figures and tables) must be non-disclosing

  • outputs should remain on NHS systems initially

  • a copy of all outputs that are released externally (documents) should be stored in one central location so that there is visibility for all

Safe data

  • direct identifiers (hospital numbers, NHS numbers, names etc) should be masked unless there is an explicit justification for their use

  • data releases are proportionate (e.g. limited by calendar periods, by patient cohort etc.)

  • further work to obscure or mask the data is not necessary given the other safe guards (as per the recommendation by the UK data service)