Purposes for processing

NHS England uses a range of different surveys as a valuable source of feedback directly from patients, services users and NHS staff about the care that they receive or provide.  The surveys that we conduct annually involving the processing of personal data are described below. For other surveys, please refer to the privacy notice provided with the survey.

GP Patient Survey

The GP Patient Survey assesses patients’ experience of healthcare services provided by GP surgeries, including experience of access to GP practices, making appointments, the quality of care received from GPs and practice nurses, satisfaction with opening hours and experience of NHS urgent care services. The survey also includes a number of questions assessing patients’ experience of NHS dental services. The GP Patient Survey is currently conducted by Ipsos MORI who act as a data processor on behalf of NHS England.

Sources and categories of personal data

The mailing list for the GP Patient survey is produced from the registered GP patient list that is held by NHS Digital. A random probability selection of patients (aged 16+) is selected from all eligible GP practices, and the names and addresses of the selected patients are sent to Ipsos MORI who distributes the questionnaire on our behalf. Once the survey is finished Ipsos MORI destroys the contact details that it has received.

Each survey response has a unique reference number. Ipsos MORI uses this survey number to (i) identify who has responded to the survey (so they only send reminder letters to people who haven’t responded), (ii) to link responses to GP practices, and (iii) to weight the responses by linking to the age and gender of respondents. The survey responses are never linked to the patients’ personal details.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

Subjects’ rights

If someone does not want to receive reminders about this survey, they may send back a blank questionnaire or contact Ipsos MORI on a Freephone number provided with the questionnaire. They may also inform Ipsos MORI that they wish to permanently opt out of the survey.

Categories of recipients

The individual answers to the survey are combined with the answers from other people who have responded so the data can be analysed by approved NHS England staff. They are not linked to names, NHS numbers or health information. Approved researchers may be granted access to the data for specified uses via an application process.

Aggregated data are published at national, CCG, and GP practice levels. Small cell counts are suppressed in the published data so that individuals cannot be identified from their responses.

Retention period

All name and address information is destroyed after three months of completion of the survey, unless an erasure request is made sooner or patients agree in the questionnaire to be contacted again in future.

National Cancer Patient Experience Survey

The National Cancer Patient Experience Survey is currently conducted by Picker Institute Europe who act as a data processor on behalf of NHS England. The aim of the survey is to provide insight on patient experience of cancer care and treatment. It has been designed to monitor national progress as well as to provide information to drive local quality improvements.

Categories of personal data

The data we use for administering the survey includes names and addresses, sex, ethnic group, date of birth, diagnosis code, admission and discharge dates, site treated at, speciality code, referring CCG, admission type, and NHS number. We need the diagnosis code to verify the patients’ diagnosis of cancer.

Sources of the data

Patients (aged 16+) who received cancer care as an inpatient or day case and were discharged in particular months of the survey year receive the questionnaire. Patient details are obtained from the NHS Trusts who have provided the care.

Categories of recipients

Public Health England uses the survey data to carry out further analysis by linking the data to the National Cancer Registration and Analysis Service. NHS Digital use the survey data to carry out further analysis for bowel cancer patients by linking the data to the National Bowel Cancer Audit. These recipients do not receive names and addresses, but do need NHS Numbers for linkage purposes. Approved researchers receive anonymised data under license from NHS England.

Retention period

All name and address information is destroyed after 3 months of completion of the survey, unless an erasure request is made sooner or patients agree in the questionnaire to be contacted again in future.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

NHS England and Picker Institute Europe have obtained section 251 approval (of the NHS Act 2006 and Health Service (Control of Patient Information) Regulations 2002).  This provides a legal basis for patient information to be used to carry out the survey.  Patients consent to the use of the information they provide in the questionnaire.

Subjects’ rights

Patients can opt out of receiving the questionnaire by informing the Trust that has treated them The Trust provides information on how to do this. Patients can also withdraw the information given in the questionnaire upon request, up to the point at which data are analysed and personal details removed. A helpline number is given on the questionnaire.

Under 16 Cancer Patient Experience Survey

The Under 16 Cancer Patient Experience Survey is currently conducted by Picker Institute Europe who act as a data processor on behalf of NHS England. The purpose of the survey is to collect patient experience feedback from children and young people with cancer. The aim of the survey is to provide insight and gain a better understanding of children and young people cancer patient experience. The survey has been designed to monitor national progress as well as to provide information to drive local quality improvements.

Categories of personal data

The data we use for administering the survey includes names and addresses, sex, ethnic group, date of birth, diagnosis code, discharge dates, site treated at, speciality code, admission type, and NHS number. The parent/carer email address and mobile phone number are also collected.

Sources of the data

Patients (aged under 16) who received cancer care or treatment as an inpatient or day case and have been discharged within a recent twelve-month period. Patients must have a confirmed primary diagnosis of cancer or a non-malignant brain, other central nervous system or intracranial tumour. Patient details are obtained from the NHS Trusts who have provided the care.

Categories of recipients

Public Health England uses the survey data to carry out further analysis by linking the data to the National Cancer Registration and Analysis Service. The recipients do not receive names and addresses but do need NHS Numbers for linkage purposes. Approved researchers receive anonymised data under license from NHS England.

Retention period

The name and address information relating to this survey will be destroyed within twelve months of publication of the survey results, unless an erasure request is made sooner.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

NHS England and Picker Institute Europe have obtained section 251 approval (of the NHS Act 2006 and Health Service (Control of Patient Information) Regulations 2002).  This provides a legal basis for patient information to be used to carry out the survey.  Patients consent to the use of the information they provide in the questionnaire.

Subjects’ rights

Patients or their parents can opt out of receiving the questionnaire by informing the Trust that has treated them. The Trust provides information on how to do this. Patients or their parents can also withdraw the information given in the questionnaire upon request, up to the point at which data are analysed and personal details removed. A helpline number is given on the questionnaire.

NHS Staff Survey

The purpose of the NHS Staff Survey is to collect staff views and experiences of working in the NHS and to provide information for deriving national and local performance indicators relating to staff engagement, diversity and inclusion. The survey is carried out on behalf of trusts and other NHS organisations by third party survey contractors who contract directly with the trust. The contractors submit the data to the NHS Staff Survey Co-ordination Centre who are the national data processor for NHS England and provide benchmarking reports for each organisation along with national reports. The data is used to improve local working conditions for staff, and ultimately to improve patient care.

Sources and categories of personal data

Information is provided by employing organisations from the entries in the Electronic Staff Record for their employees. This includes name, work address, and/or e-mail address. It also includes full name, age, directorate, department or division, location, job title and staff group, maternity, pay band; ethnicity; long-standing illness, health problem or disability. These variables help verify the representativeness of the staff list, where a sample is being used. Disability/pay band data were requested for the first time in 2017 following requests for this data from the WDES team to monitor equality. Collecting this information allows the monitoring of non-response rates by ethnicity/occupational group

Categories of recipients

The responses to the survey are collated by the survey contractors and the response data are sent to the Staff Survey Co-ordination Centre. The Co-ordination Centre is then able to provide organisations with data to compare their performance with other organisations of a similar type and also produce national statistics for NHS England. The responses to the survey remain confidential. Completed questionnaires are submitted directly to the independent survey Contractor. The employing organisation does not have access to the completed questionnaires or to any linked personal data (e.g. names and addresses). The report that is sent back to the organisation presents the survey findings in summary form, and does not reveal the identity of the staff sampled. To help preserve anonymity, the Co-ordination Centre will not provide feedback on any group from which there are 10 or fewer responses.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’. For the processing of special categories (health) data the basis is Article 9(2)(h) – ‘…health or social care…’.

International Survey of Health Experience (ISHE)

Purposes for processing

The International Survey of Health Experience (ISHE) is otherwise known as the Patient-Reported Indicator Surveys (PaRIS) and is an initiative of the Organisation for Economic Cooperation and Development (OECD). Countries are working together to develop, standardise and implement a new generation of indicators that measure the outcomes and experiences of health care that matter most to people.

ISHE will assess the outcomes and experiences of patients with long-term conditions managed in primary care across countries. The survey aims to fill a critical gap in primary health care, by asking primary care providers (in England that will be GP practices) and patients about aspects like access to healthcare and waiting times, as well as quality of life, pain, physical functioning and psychological wellbeing.

Sources of the data

The mailing list for the ISHE is produced from the registered GP patient list that is held by NHS Digital. A random probability selection of patients (aged 16+) is selected from all eligible GP practices, and the names and addresses of the selected patients are sent to Ipsos who distributes the questionnaire on our behalf. Once the survey is finished Ipsos destroys the contact details that it has received.

Each survey response has a unique reference number. Ipsos uses this survey number to (i) identify who has responded to the survey (so they only send reminder letters to people who haven’t responded), (ii) to link responses to GP practices, (iii) to weight the responses by linking to the age and gender of respondents. The survey responses are never linked to the patients’ personal details.

Categories of personal data and recipients

The data we use for administering the survey includes names and addresses, sex, NHS number, GP practice code, phone number (if available), partial date of birth and sex.

Legal basis for processing

For UK GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’.