How we use personal data to evaluate the effectiveness of a centralised hub to provide Artificial Intelligence (AI) diagnostic support for radiological imaging in trusts.

Purposes for processing

NHS England and the Department of Health and Social Care (DHSC) are implementing a pilot NHS Artificial Intelligence Deployment Platform (AIDP) for medical imaging diagnostic technologies.

The AIDP will provide a hub to receive radiological images submitted by trusts, route them for diagnostic interpretation by an appropriate AI product, and (in live mode – see below) return them to trusts with marked-up diagnoses for onward transfer to local systems. Radiologists will then be able to view images with AI generated diagnoses, which they can use to inform their diagnoses.

The programme goals are to test whether having a centralised platform and deployment processes:

1. Accelerates the safe and ethical deployment of trusted AI products (class IIa and class IIb) at multiple hospital sites.
2. Provides a cost and time-effective standard deployment process of AI products for NHS organisations and AI innovators.
3. Provides reasonable access to post-market surveillance resources of AI vendors.
4. Provides the case study for accelerating the broader adoption of technologies across NHS organisations.

To test this approach, several mature AI products from leading vendors will be deployed into the two trust imaging networks initially in shadow (test) mode, before being potentially switched on live if deemed appropriate.

The AIDP programme is working with Trusts in East Midlands Radiology Consortium (EMRAD) and Thames Valley Radiology Network (TVRN) to facilitate the pilot.

How NHS England / DHSC uses personal data to provide AI diagnostics and for evaluation

Trusts will submit radiological images from their local systems to the AIDP. The AIDP will forward them to the AI diagnostic product appropriate to the type of image – disease, area of the body, type of image (X-ray, CT, MRI). The AI product will then return diagnostically interpreted images to the AIDP.

This process will initially facilitate shadow mode testing, which may involve the comparison of diagnoses made by radiologists (also submitted to the AIDP) with AI generated diagnoses. In shadow mode, results will not be returned to trusts for clinical decision making. The purpose here is to test the pathway and verify the operation of AI products as accessed by the trust.

Subject to performance checks in shadow mode, a decision will be made in collaboration with the trusts to move to live mode, in which the results will be returned to trusts and transferred to hospital systems so they can be used by radiologists to support their clinical diagnoses.

Patient and imaging attributes will be analysed on the AIDP for the purposes of post-market surveillance – for presentation in user dashboards and for model validation reporting. This will include analysing by gender, weight and size, locality of residence, smoking status and ethnic group.

Images and associated data submitted by trusts will be pseudonymised before they are uploaded to the AIDP. In live mode the results will be re-identified by the trust when they are returned from the AIDP. Trusts will use a dedicated router to pseudonymise, transfer and re-identify the data.

Organisations and their roles

NHS England and DHSC will be responsible as joint controllers for the processing to deliver the AIDP.

Faculty Science Ltd. will act as a processor for the delivery of the AIDP and will instruct the following as sub-processors:

• Cimar – for the provision of the core AI Deployment Platform, as well as maintenance and support
• Royal Surrey NHS Foundation Trust (RSNFT) – for the development of the post market surveillance system
• AI product vendors. For the provision of AI diagnostic services in support of the following disciplines:
  • Chest X-Ray
  • Chest CT
  • Musculo-Skeletal X-Ray
  • Prostate MRI

Trusts will be responsible as controllers for processing to extract data from local radiology systems, to pseudonymise and submit images with associated data to the AIDP, and in live mode to receive and re-identify images with marked up diagnoses and associated data. RSNFT acts as a processor to provide and support the pseudonymisation and re-identification router that transfers data to and from the AIDP.

AI diagnostic products – procurement and assurance

AI products are being selected by a DHSC / NHS England-led tender process for the four disciplines.

As part of their tender submission, prospective AI vendors must complete the Digital Technology Assessment Criteria (DTAC). This includes compulsory requirements on clinical safety, data protection, technical security and interoperability. Bidders must pass all of these requirements to be considered further.

In order to be eligible for procurement, AI products must be approved class IIa or class IIb medical devices and CE/UKCA marked. AI product vendors can only place a UKCA mark on their product and place it on the market when they have received a certificate from the Approved Body. This means that AI products must conform with the relevant requirements in the Medical Devices Regulations 2002.

The procurement evaluation process requires bidders to respond to extensive questions that are assessed and given an evaluation score. These include questions on how the AI product was developed and trained, ensuring fairness and an ethical approach, risks of bias and how the algorithm’s fairness is tested over time.

Categories of personal data

The data processed on the AIDP and by AI vendors’ diagnostic products will be pseudonymised radiological images including x-rays, CT and MRI scans.

As the personal data processed on the AIDP and by connecting AI products will be pseudonymised by submitting trusts, it will be anonymous to NHS England, DHSC and their processor / sub-processors.

Data fields that directly identify individuals will be converted to pseudonyms which can only be reversed by trusts. Many fields other than direct identifiers are cleared or modified to reinforce anonymity.

Data fields that are retained for post-market surveillance purposes include gender, patient weight and size, locality of residence, smoking status and ethnic group.

Special Categories of Personal Data include health data and racial or ethnic origin.

Retention period

Pseudonymised images and results from the AI data will have a fixed retention period. Initially this will be no more than 30 days, though this may be subject to change depending on how the pilot scope evolves.

The following meta data related to studies will be retained for the duration of the pilot to monitor and validate the AI models as well as support post market surveillance activity:

• Ground truth results – i.e. the radiologist verdict or patient outcome for each pseudonymised study
• AI output results – i.e. a description of what the AI detected on the image and the location on the image
• Aggregated AI product performance data e.g. sensitivity, specificity, recall rate etc.
• Aggregated study processing data e.g. number of studies processed / failed / excluded etc.

Legal basis for processing

For UK GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’

For the processing of special categories data the bases are:

For health data

9(2)(h) – ‘…health or social care…’ – for the provision of the testing service

For racial or ethnic origin

9(2)(b) – ‘…necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’