Purposes for processing

Commissioning is the process of planning, agreeing and monitoring health services. It is not one action but many, ranging from the health-needs assessment for a population, through the clinically based design of patient pathways, to service specification and contract negotiation or procurement, with continuous quality assessment. NHS England and Clinical Commissioning Groups (CCGs) are the commissioners that conduct these activities.

The Data Services for Commissioners programme has been established to improve NHS commissioning by ensuring that commissioning decisions, and the insights that support them, are based upon robust, standardised data that has been processed efficiently and is accessed legally. For the purposes of this programme, NHS England has directed NHS Digital to collect the personal data that we need from the organisations that we commission to provide health care. NHS Digital provides us with data that is anonymised in accordance with the Information Commissioner’s Anonymisation code of practice which we analyse for our commissioning purposes. NHS England and NHS Digital are joint data controllers for the data with each having specific responsibilities in line with their statutory functions.

Sources of the data

As a commissioner NHS England uses information from the providers of the services it commissions. These are:

• Specialised services
• Armed Forces and Families Health Care
• Health and justice
• Public Health Services
• Secondary Dental Services

Categories of personal data

For most commissioning purposes NHS England does not receive or process data that identifies individuals directly. This is not necessary for our purposes. The purpose of the Data Services for Commissioners Programme is to enable us to analyse data for our commissioning purposes, without our needing to see personal data. We use data that has been anonymised by NHS Digital in accordance with the Information Commissioner’s Anonymisation code of practice.

NHS Digital processes personal data collected from providers of health care on our behalf. This includes information about the diagnosis, treatment received, postcode and date of birth. It also includes NHS number which is used by NHS Digital to link data from several sources. An example of this is where we need information relevant to a Specialised Service, linked to the data submitted routinely by hospitals to NHS Digital via the Secondary Uses Service.

Categories of recipients

We provide anonymised and aggregate data (numbers) to CCGs and to the organisations that we commission to provide health care, or their data processors.

All requests for data from NHS Digital are dealt with by the Data Access Request Service.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For the processing of special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.