Purposes for processing

NHS England uses a range of different surveys as a valuable source of feedback directly from patients, services users and NHS staff about the care that they receive or provide.  The surveys that we conduct annually involving the processing of personal data are described below. For other surveys, please refer to the privacy notice provided with the survey.

GP patient survey

The GP Patient Survey assesses patients’ experience of general practice services , including experience of access to GP practices,  the quality of care received from healthcare professionals  and experience of NHS urgent care services. The survey also includes a number of questions assessing patients’ experience of NHS dental and pharmacy services. The GP Patient Survey is currently conducted by Ipsos  who act as a data processor on behalf of NHS England.

Sources and categories of personal data

The mailing list for the GP Patient survey is produced from the registered GP patient list that is held by NHS England. A random probability selection of patients (aged 16+) is selected from all eligible GP practices, and the names and addresses, and where available, mobile phone numbers and emails of the selected patients are sent to Ipsos  who distributes the questionnaire on our behalf.  Once the survey is finished Ipsos  destroys the contact details that it has received. Unless patients have consented to be contacted again for future research.

Each survey response has a unique reference number.  Ipsos  uses this survey number to (i) identify who has responded to the survey (so they only send reminders  to people who haven’t responded), (ii) to link responses to GP practices, and (iii) to weight the responses by linking to the age and gender of respondents.  The survey responses are never linked to the patients’ personal details, unless patients have consented to have their contact details linked to their survey responses in order to be contacted again for future research.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

Subjects’ rights

If someone does not want to receive reminders about this survey, they may send back a blank questionnaire or contact Ipsos on a Freephone number provided with the questionnaire. They may also inform Ipsos that they wish to permanently opt out of the survey.

Categories of recipients

The individual answers to the survey are combined with the answers from other people who have responded so the data can be analysed by approved NHS England staff. They are not linked to names, NHS numbers or health information. Approved researchers may be granted access to the data for specified uses via an application process.

Aggregated data are published at national, ICS, PCN and GP practice levels. Small cell counts are suppressed in the published data so that individuals cannot be identified from their responses.

Retention period

All name and address information is destroyed within six months of the end of the survey fieldwork period.

National cancer patient experience survey

The National Cancer Patient Experience Survey is currently conducted by Picker Institute Europe who act as a data processor on behalf of NHS England. The aim of the survey is to provide insight on patient experience of cancer care and treatment. It has been designed to monitor national progress as well as to provide information to drive local quality improvements.

Categories of personal data

The data we use for administering the survey includes names and addresses, sex, ethnic group, date of birth, diagnosis code, admission and discharge dates, site treated at, speciality code, referring ICBs, admission type, and NHS number, and where available the patients email address and mobile phone number are also collected. We need the diagnosis code to verify the patients’ diagnosis of cancer.

Sources of the data

Patients (aged 16+) who received cancer care as an inpatient or day case and were discharged in particular months of the survey year receive the questionnaire. Patient details are obtained from the NHS Trusts who have provided the care.

Categories of recipients

Public Health England uses the survey data to carry out further analysis by linking the data to the National Cancer Registration and Analysis Service. NHS England use the survey data to carry out further analysis for bowel cancer patients by linking the data to the National Bowel Cancer Audit. These recipients do not receive names and addresses, but do need NHS Numbers for linkage purposes. Approved researchers receive anonymised data under license from NHS England.

Retention period

The name, address, date of birth, NHS number and the last part of the patient’s postcode is used to identify patients to take part in the survey. This will be destroyed within 12 months, after publication, unless patients have consented to be contacted again for future surveys.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

NHS England and Picker Institute Europe have obtained section 251 approval (of the NHS Act 2006 and Health Service (Control of Patient Information) Regulations 2002).  This provides a legal basis for patient information to be used to carry out the survey.  Patients consent to the use of the information they provide in the questionnaire.

This survey has been granted exemption from the National Data Guardian opt-out by the Department of Health and Social Care. For more information visit the NHS Digital website.

Subjects’ rights

Patients can opt out of receiving the questionnaire by informing the Trust that has treated them The Trust provides information on how to do this. Patients can also withdraw the information given in the questionnaire upon request, up to the point at which data are analysed and personal details removed. A helpline number is given on the questionnaire.

Under 16 cancer patient experience survey

The Under 16 Cancer Patient Experience Survey is currently conducted by Picker Institute Europe who act as a data processor on behalf of NHS England. The purpose of the survey is to collect patient experience feedback from children and young people with cancer. The aim of the survey is to provide insight and gain a better understanding of children and young people cancer patient experience. The survey has been designed to monitor national progress as well as to provide information to drive local quality improvements.

Categories of personal data

The data we use for administering the survey includes names and addresses, sex, ethnic group, date of birth, diagnosis code, discharge dates, site treated at, speciality code, admission type, and NHS number.

Sources of the data

Patients (aged under 16) who received cancer care or treatment as an inpatient or day case and have been discharged within a recent twelve-month period. Patients must have a confirmed primary diagnosis of cancer or a non-malignant brain, other central nervous system or intracranial tumour. Patient details are obtained from the NHS Trusts who have provided the care.

Categories of recipients

NHS England uses the survey data to carry out further analysis by linking the data to the National Cancer Registration and Analysis Service. The recipients do not receive names and addresses but do need NHS Numbers for linkage purposes. Approved researchers receive anonymised data under license from NHS England.

Retention period

The name and address information relating to this survey will be destroyed within twelve months of publication of the survey results, unless an erasure request is made sooner.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

NHS England and Picker Institute Europe have obtained section 251 approval (of the NHS Act 2006 and Health Service (Control of Patient Information) Regulations 2002).  This provides a legal basis for patient information to be used to carry out the survey.  Patients consent to the use of the information they provide in the questionnaire.

This survey has been granted exemption from the National Data Guardian opt-out by the Department of Health and Social Care. For more information visit the NHS Digital website.

Subjects’ rights

Patients or their parents can opt out of receiving the questionnaire by informing the Trust that has treated them. The Trust provides information on how to do this. Patients or their parents can also withdraw the information given in the questionnaire upon request, up to the point at which data are analysed and personal details removed. A helpline number is given on the questionnaire.

NHS staff survey

The purpose of the NHS Staff Survey is to collect staff views and experiences of working in the NHS and to provide information for deriving national and local performance indicators relating to staff engagement, diversity and inclusion. The survey is carried out on behalf of trusts and other NHS organisations by third party survey contractors who contract directly with the trust. The contractors submit the data to the NHS Staff Survey Co-ordination Centre who are the national data processor for NHS England and provide benchmarking reports for each organisation along with national reports. The data is used to improve local working conditions for staff, and ultimately to improve patient care.

Sources and categories of personal data

Information is provided by employing organisations from the entries in the Electronic Staff Record for their employees. This includes name, work address, and/or e-mail address. It also includes full name, age, directorate, department or division, location, job title and staff group, maternity, pay band; ethnicity; long-standing illness, health problem or disability. These variables help verify the representativeness of the staff list, where a sample is being used. Disability/pay band data were requested for the first time in 2017 following requests for this data from the WDES team to monitor equality. Collecting this information allows the monitoring of non-response rates by ethnicity/occupational group

Categories of recipients

The responses to the survey are collated by the survey contractors and the response data are sent to the Staff Survey Co-ordination Centre. The Co-ordination Centre is then able to provide organisations with data to compare their performance with other organisations of a similar type and also produce national statistics for NHS England. The responses to the survey remain confidential. Completed questionnaires are submitted directly to the independent survey Contractor. The employing organisation does not have access to the completed questionnaires or to any linked personal data (e.g. names and addresses). The report that is sent back to the organisation presents the survey findings in summary form, and does not reveal the identity of the staff sampled. To help preserve anonymity, the Co-ordination Centre will not provide feedback on any group from which there are 10 or fewer responses.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’. For the processing of special categories (health) data the basis is Article 9(2)(h) – ‘…health or social care…’.

International survey of health experience (ISHE)

Purposes for processing

The International Survey of Health Experience (ISHE) is otherwise known as the Patient-Reported Indicator Surveys (PaRIS) and is an initiative of the Organisation for Economic Cooperation and Development (OECD). Countries are working together to develop, standardise and implement a new generation of indicators that measure the outcomes and experiences of health care that matter most to people.

ISHE will assess the outcomes and experiences of patients with long-term conditions managed in primary care across countries. The survey aims to fill a critical gap in primary health care, by asking primary care providers (in England that will be GP practices) and patients about aspects like access to healthcare and waiting times, as well as quality of life, pain, physical functioning and psychological wellbeing.

Sources of the data

The mailing list for the ISHE is produced from the registered GP patient list that is held by NHS England. A random probability selection of patients (aged 16+) is selected from all eligible GP practices, and the names and addresses of the selected patients are sent to Ipsos who distributes the questionnaire on our behalf. Once the survey is finished Ipsos destroys the contact details that it has received.

Each survey response has a unique reference number. Ipsos uses this survey number to (i) identify who has responded to the survey (so they only send reminder letters to people who haven’t responded), (ii) to link responses to GP practices, (iii) to weight the responses by linking to the age and gender of respondents. The survey responses are never linked to the patients’ personal details.

Categories of personal data and recipients

The data we use for administering the survey includes names and addresses, sex, NHS number, GP practice code, phone number (if available), partial date of birth and sex.

Legal basis for processing

For UK GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’.

National diabetes experience survey

Purposes for processing

The National Diabetes Experience Survey is currently conducted by Ipsos who act as a data processor on behalf of NHS England. The aim of the survey is to provide insight on experiences of care and self-management for people living with diabetes. It has been designed to provide national insight and data for Integrated Care Systems (ICS) to support a person-centred policy to delivering care for people living with diabetes.

Sources of the data

The sample is drawn from the National Diabetes Audit (NDA), a list of people who are living with diabetes. This list was matched with the Personal Demographic Service (PDS) database, a list of patients registered with a GP, to obtain contact details.

Categories of personal data

People are eligible for the survey if they are recorded as living with type 1 or type 2 diabetes in the NDA, aged 18 or over, diagnosed at least 12 months ago, and living in England.

The data we use to select people to take part in the survey includes sex, age band, ethnicity, type of diabetes, date of diagnosis, care processes/clinical outcomes, treatment targets, treatment type, GP practice code, Lower Layer Super Output Area (LSOA), and NHS number. The data we use for those invited to take part in the survey includes name, address, mobile number (where available), and month and year of birth.

Each survey response has a unique reference number. Ipsos uses this survey number to (i) identify who has responded to the survey (so they only send reminder letters to people who haven’t responded), (ii) to link responses to Integrated Care Systems (ICS), and (iii) to weight the responses by linking to the age and gender of respondents. The survey responses are never linked to the patients’ personal details.

Recipients of personal data

The individual answers to the survey are combined with the answers from other people who have responded so the data can be analysed by approved NHS England staff. AGEM DSCRO will use the survey data to carry out further analysis by linking the data to the National Diabetes Audit and other healthcare databases. AGEM DSCRO will not receive the name or address of any individuals, but will require NHS number for linkage purposes. Approved researchers may be granted access to the data for specified uses via an application process.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

NHS England and Ipsos have obtained section 251 approval (of the NHS Act 2006 and Health Service (Control of Patient Information) Regulations 2002). This provides a legal basis for patient information to be used to carry out the survey. Patients consent to the use of the information they provide in the questionnaire.

The Department of Health and Social Care has confirmed that this survey has been made exempt from the National Data Opt Out. The list of exemptions and policy postponements provides more information: https://digital.nhs.uk/services/national-data-opt-out/programmes-to-which-the-national-data-opt-out-should-not-be-applied

Subjects’ rights

An analytical team within NHS England (AGEM DSCRO) are responsible for sharing the NDA and PDS data with Ipsos. People living with diabetes can opt-out of their data being shared with Ipsos, before sampling takes place, by contacting AGEM DSCRO. Information on how to do this will be advertised by NHS England before sampling takes place.

If someone has been invited to take part and does not want to receive reminders about this survey, they can contact Ipsos on a Freephone number provided in the invitation letter. They may also inform Ipsos that they wish to permanently opt out of the survey.

Patients can also withdraw the information given in the questionnaire upon request, up to the point at which data are analysed and personal details removed.

Retention period

All name and address information is destroyed by Ipsos after 2 months of publication of the survey, unless an erasure request is made sooner.

Integrated Care Experience Survey (ICES) Purposes for processing

The ICE Survey is currently conducted by Ipsos who act as a data processor on behalf of NHS England. The aim of the survey is to provide insight on experiences of care and to help understand the extent to which integrated care is working from a service user and their unpaid carers’ perspective. It has been designed to provide national insight and data for Integrated Care Boards (ICB) to understand where joined-up care is working well and where experience of care can be improved.

Sources of the data

The sample will be identified though GP records (via the data processor for each ICB) based on the eFI score. This a score that is derived from a measure of frailty based on the accumulation of a range of 36 deficits.

Categories of personal data

The survey will initially target service users with clinically complex needs identified though GP records (via the data processor for each participating ICB) based on their eFI score as this is seen as a cohort with complex clinical health and care needs and likely to be in contact with multiple health and care providers.

People are eligible for the survey if they are recorded as aged 18+ and have moderate or severe frailty score. The data items set out below are required for each of the ICB data processors to identify the cohort and draw the survey sample:

NHS number, Title, Full name, Address, Postcode, Mobile number, Date of birth, Gender, Ethnic category, GP Practice code, Data sharing flag, Registrations status, Registration date, Code type, Clinical Code, Clinical Term.

Initial invitees will be provided with a letter to pass to their carer, if they have one, with informal carers then also having the opportunity to provide feedback through a separate informal carers’ questionnaire.

Each survey response has a unique reference number. Ipsos uses this survey number to (i) identify who has responded to the survey (so they only send reminder letters to people who haven’t responded), (ii) to link responses to Integrated Care Systems (ICS), and (iii) to weight the responses by linking to the age and gender of respondents. The survey responses are never linked to the patients’ personal details.

Recipients of personal data

Once the survey fieldwork has finished, the programme will be using the data to recontact people (where the survey respondent has consented for this to happen) for future iterations of the survey. The following data items will used for that purpose:

Full name, address, email, mobile number.

Once the survey fieldwork has finished, the programme will be using the survey dataset to link the responses to other datasets (where the survey respondent has consented for this to happen). Along with survey responses, the following data items will be used for that purpose:

NHS number, date of birth, postcode.

Legal basis for processing

For UK GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

NHS England and Ipsos have obtained section 251 approval (of the NHS Act 2006 and Health Service (Control of Patient Information) Regulations 2002). This provides a legal basis for patient information to be used to carry out the survey. Patients consent to the use of the information they provide in the questionnaire.

The Department of Health and Social Care has confirmed that this survey has been made exempt from the National Data Opt-Out. The list of exemptions and policy postponements provides more information. Programmes to which the National Data Opt-Out should not be applied – NHS Digital