Risk stratification – How we use patient information

Information from health and social care records, using your NHS Number provided is looked at to identify groups of patients who would benefit from some additional help.

• Information about you is gathered from different sources, including NHS Trusts and your GP practice.
• Any information that could identify you is removed, and then your data is analysed to determine a risk score.
• This score is then shared with your GP practice, who is responsible for your data, and matched back up with your personal information so they can get in contact with you if needed.

Your data is used in two ways by GPs and by Northamptonshire Integrated Care Board directly.

The data available through the risk stratification helps your GP focus on preventing health issues and can use them to spot and support patients with long-term conditions. It can help to prevent unexpected hospital visits or lower the chance of getting other diseases.

Your GP will use computer-based algorithms or calculations to find registered patients who are at most risk. Your GP will do this on a routine basis. It will be done electronically without human intervention and will produce a report that will be reviewed by a multidisciplinary team of staff at your practice. You might then be contacted if changes to your care are identified. If needed, your GP might offer you additional healthcare services.

Health care commissioners need information about the treatment of patients to review and plan current and future health care services. To do this they need to be able to see information about the health care provided to patients which can include patient level data.

Data is sent directly to a risk stratification tool by NHS England and/or GP practices. Once the data is in the tool, ICB staff only have access to anonymised, pseudonymised or aggregated data. You will not be personally identifiable nor will any ICB staff have access to your personal or confidential data.

The Risk Stratification process and application to the Confidentiality Advisory Group was previously managed by NHS England. Responsibility has now been passed to Integrated Care Boards. Northamptonshire, alongside other areas, is engaging with its local population to make them aware of this change and how to opt out if they do not wish for their data to be used in this way.

If you would like to make your views heard on this transfer of agreement, please complete our survey

Personal data which is processed for the purposes of risk stratification:

Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller..’.

Article 9(2)(h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services..’.

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”.  

The use of identifiable data for risk stratification has been approved by the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority (known as Section 251 approval under the Health Services (Control of Patient Information) Regulations 2002, under section 251 of the NHS Act 2006). Further information on Section 251 can be obtained by clicking here. This approval allows your GP or staff within your GP Practice who are responsible for providing your care, to see information that identifies you, but the ICB staff will only be able to see information in a format that does not reveal your identity.

NHS England (formerly NHS Digital) can disseminate data to commissioners under the Health and Social Care Act (2022). The act provides the powers for NHS England to collect, analyse and disseminate national data and statistical information. To access this data, organisations must submit an application and demonstrate that they meet the appropriate governance and security requirements.

NHS England, through its Data Services for Commissioners Regional Offices (DSCROs), is permitted to collect, hold and process Personal Confidential Data (PCD). This is for purposes beyond direct patient care to support NHS commissioning organisations and the commissioning functions within local authorities.

GPs are able to identify individual patients from the risk stratified data when it is necessary to discuss the outcome and consider preventative care, however the ICB can never identify an individual from the risk stratified data that we see. Where the risk stratification process has linked GP data to health data obtained from other sources i.e. NHS England or other health care provider, the GP will ask for your permission to access the details of that information.

Sources of the data 
Personal data is supplied into the national Data Services for Commissioners Regional Offices (DSCRO) arrangements by GPs and NHS England (commissioning data sets).

Data Processors

The ICB has agreements in place with the following organisations to process Risk Stratification Data:

NHS Arden and Greater East Midlands Commissioning Support Unit

Prescribing Services Ltd

Categories of data

Risk stratification tools use historic information about patients, such as age, gender, diagnoses and patterns of hospital attendance and admission collected by NHS England from NHS hospitals and community care services (Secondary Use Services data). This is linked to data collected in GP practices and analysed to produce a risk score.

The Secondary Uses Service (SUS) is the single, comprehensive repository for healthcare data in England which enables a range of reporting and analyses to support the NHS in the delivery of healthcare services. Information on care provided for all patients by Health Care Providers (both NHS and Independent Sector Healthcare Providers for NHS patients only) must be submitted to the Secondary Uses Service according to the Commissioning Data Set Mandated Data Flows guidelines.

Data from the GP practice system will be obtained by using a ‘bulk data extract’, uploaded directly by the risk stratification tool supplier (AGEM CSU) from the practice system. Prior to the upload, the supplier will obtain permission from the practice to request the data from the practice system provider and the practice will notify their system providers that this permission has been granted.

The data extract will EXCLUDE patients who have expressed a wish not to share information. Reports produced from the system, including identifiable data, is only provided back to your GP or member of your care team as data controller in an identifiable form. Your GP can provide more information about any risk stratification programme they are using. Should you have any concerns about how your information is managed at the surgery please contact the Practice Manager at your surgery to discuss how the disclosure of your personal information can be limited.
 

Recipients of data

The combined ICB Secondary Use Service (SUS) data and GP data which contains an identifier (usually NHS number) is made available to clinicians with a legitimate relationship with their patients to enable them to identify which patients should be offered targeted preventative support to reduce those risks. 

The ICB does not have access to identifiable information.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything.

If you do not wish your data to be included in the risk stratification service you can choose to opt-out. You can contact your GP practice who can apply a code which will stop your identifiable information being used for Risk Stratification purposes.