Purposes for processing

Commissioning is the process of planning, agreeing and monitoring health services. It is not one action but many, ranging from the health-needs assessment for a population, through the clinically based design of patient pathways, to service specification and contract negotiation or procurement, with continuous quality assessment. NHS England and Integrated Care Boards (ICBs) are the commissioners that conduct these activities.

The Data Services for Commissioners programme has been established to improve NHS commissioning by ensuring that commissioning decisions, and the insights that support them, are based upon robust, standardised data that has been processed efficiently and is accessed legally.

For the purposes of this programme, the Secretary of State has directed NHS England to collect the personal data that we need from the organisations that we commission to provide health care.

Our analytical environments receive pseudonymised personal data which we analyse for our commissioning purposes.

Sources of the data

As a commissioner NHS England uses information from the providers of the services it commissions. These are:

• Specialised services
• Armed Forces and Families Health Care
• Health and justice
• Public Health Services
• Secondary Dental Services

Categories of personal data

For most commissioning purposes NHS England does not process data that identifies individuals directly. This is not necessary for our purposes. The purpose of the Data Services for Commissioners Programme is to enable us to analyse data for our commissioning purposes.

When NHS England collects personal data from providers of health care, the data includes information about the diagnosis, treatment received, postcode and date of birth. It also includes NHS number which is used to link data from several sources. An example of this is where we need information relevant to a Specialised Service, linked to the data submitted routinely by hospitals to NHS England via the Secondary uses service.

Categories of recipients

We provide anonymised and aggregate data (numbers) to ICBs and to the organisations that we commission to provide health care, or their data processors.

Legal basis for processing

For UK GDPR purposes NHS England’s lawful basis for processing when directed by the Secretary of State is article 6(1)(c) – ‘…legal obligation…’.

This applies both to the collection and further processing of identifiable data under directions and to the processing of pseudonymised personal data for analytical purposes, under the Analytics Directions.

For the processing of special categories (health) data the conditions may be one or more of articles

9(2)(h) – ‘…health or social care…’;

9(2)(i) – ‘…public health…’

9(2)(j) – ‘…statistical purposes…’.