Information governance guidance

The complete cancer pathway for all patients seen, diagnosed, and treated in NHS trusts in England is compiled by the National Cancer Registration and Analysis Service (NCRAS), which is part of the National Disease Registration Service (NDRS). The NDRS has legal permission to collect patient data to use it to protect the health of the population.

On the 1st October 2021, permission was provided to NHS Digital under legal instructions known as Directions, from the Secretary of State for Health and Social Care, under section 254 of the Health and Social Care Act 2012 (2012 Act). The Directions are called the National Disease Registries Directions 2021. They instruct NHS Digital to collect and use confidential patient information to operate the NDRS.

NHS Digital have published a transparency notice outlining how and why NHS Digital operates the National Disease Registration Service.

The NDRS has powers to publish anonymous statistical data under section 260 of the 2012 Act and to share data under section 261 of the 2012 Act. It also has powers to share data, subject to security and privacy safeguards outlined above, under other laws, for example under Regulations 2, 3 and 5 of the Control Of Patient Information (COPI) notice.

Under UK General Data Protection Regulation (GDPR), NDRS can only collect and use personal data if they have a legal basis under Articles 6 and 9 of the UK GDPR. The legal basis for NDRS collecting and analysing personal data is Article 6(1)(c) of the UK GDPR, as they are required to do this to operate the National Disease Registration Services under the National Disease Registries Directions 2021.

As the data collected is health data, which is a special category of data under UK GDPR, the NDRS also have an additional legal basis under Article 9(2)(g). The processing of the data is substantially in the public interest and in accordance with the law, for the purposes of NHS Digital exercising its statutory functions under the National Disease Registries Directions 2021. It is substantially in the public interest to improve NHS cancer treatment and care, improve patient outcomes in England and how these are affected by sex, ethnicity, disease type and geographic region. This is also permitted under paragraph 6 of Schedule 1 of the Data Protection Act 2018.

On the 1st February 2023 NHS Digital merged with NHS England. Any information referring to NHS Digital in this document will be updated once NHS England update their guidance.

Data for patients that meet the Post Endoscopy Upper Gastrointestinal Cancer (PEUGIC) root cause analysis form criteria are extracted from the NCRAS database.

NCRAS and Health Data Insight have developed a web-based root cause analysis portal, within the NCRAS environment which is NHS Data Protection and Security Toolkit (DPST) approved, to collect the additional data items required for this project. Access to the portal is subject to stringent security standards, including an account verification process, mobile phone SMS password confirmation system and access must be using a computer on the NHS N3/HSCN network. The data collected about the users is used to created accounts and is stored within an NDRS server.

Once logged in, organisations can only view and input data for patients who had an endoscopy or cancer diagnosed at their organisation. The data collected in the root cause analysis form are stored within the cancer registration database.

The data collected in the portal and other cancer registry data items will be pseudonymised prior to release for analysis. The PEUGIC root cause analysis teams from Sandwell and West Birmingham NHS Trust will request this data via NHS England’s Data Access Request Service and Data Sharing Agreements will be established.

If a patient has chosen to opt out of the cancer registration database, their data will not be included in this project.

A Data Protection Impact Assessment (DPIA) has been produced for the PEUGIC root cause analysis project.

If you have any queries on the PEUGIC root cause analysis project, please contact england.peugic.project@nhs.net.