Those completing surveys or questionnaires

Purposes for processing

NHS England uses a range of different surveys as a valuable source of feedback directly from patients, services users and NHS staff about the care that they receive or provide.  The surveys that we conduct involving the processing of personal data are described below.

GP Patient Survey

The GP Patient Survey assesses patients’ experience of healthcare services provided by GP surgeries, including experience of access to GP practices, making appointments, the quality of care received from GPs and practice nurses, satisfaction with opening hours and experience of NHS urgent care services. The survey also includes a number of questions assessing patients’ experience of NHS dental services. The GP Patient Survey is currently conducted by Ipsos MORI who act as a data processor on behalf of NHS England.

Sources and categories of personal data

The mailing list for the GP Patient survey is produced from the registered GP patient list that is held by NHS Digital. A random probability selection of patients (aged 16+) is selected from all eligible GP practices, and the names and addresses of the selected patients are sent to Ipsos MORI who distributes the questionnaire on our behalf.  Once the survey is finished Ipsos MORI destroys the contact details that it has received.

Each survey response has a unique reference number.  Ipsos MORI uses this survey number to (i) identify who has responded to the survey (so they only send reminder letters to people who haven’t responded), (ii) to link responses to GP practices, and (iii) to weight the responses by linking to the age and gender of respondents.  The survey responses are never linked to the patients’ personal details.

Each survey response has a unique reference number.  Ipsos MORI uses this survey number to identify who has responded to the survey (so they only send reminder letters to people who haven’t responded) and to link responses to GP practices. The survey number is not linked to your NHS number.

Subjects’ rights

If someone does not want to receive reminders about this survey, they may send back a blank questionnaire or contact Ipsos MORI on a Freephone number provided with the questionnaire. They may also inform Ipsos MORI that they wish to permanently opt out of the survey.

Categories of recipients

The individual answers to the survey are combined with the answers from other people who have responded so the data can be analysed by approved NHS England staff. They are not linked to names, NHS numbers or health information.  Approved researchers may be granted access to the data for specified uses via an application process.

Aggregated data are published at national, CCG, and GP practice levels.  Small cell counts are suppressed in the published data so that individuals cannot be identified from their responses.

Retention period

All name and address information is destroyed within two months of the end of the survey fieldwork period.

National Cancer Patient Experience Survey

The National Cancer Patient Experience Survey is currently conducted by Quality Health Ltd. who act as a data processor on behalf of NHS England. The aim of the survey is to provide insight on patient experience of cancer care and treatment. It has been designed to monitor national progress as well as to provide information to drive local quality improvements.

Categories of personal data

The data we use for administering the survey includes names and addresses, sex, ethnic group, date of birth, diagnosis code, admission and discharge dates, site treated at, speciality code, referring CCG, admission type, and NHS number. We need the diagnosis code to verify the patients’ diagnosis of cancer.

Sources of the data

Patients (aged 16+) who received cancer care as an inpatient or day case and were discharged in particular months of the survey year receive the questionnaire. Patient details are obtained from the NHS Trusts who have provided the care.

Categories of recipients

Public Health England uses the survey data to carry out further analysis by linking the data to the National Cancer Registration and Analysis Service. NHS Digital use the survey data to carry out further analysis for bowel cancer patients by linking the data to the National Bowel Cancer Audit. These recipients do not receive names and addresses, but do need NHS Numbers for linkage purposes. Approved researchers receive anonymised data under license from NHS England.

Retention period

All name and address information is destroyed after 3 months of completion of the survey, unless an erasure request is made sooner or patients agree in the questionnaire to be contacted again in future.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. For special categories (health) data the basis is Article 9(2)(h) ‘…health or social care…’.

NHS England and Quality Health have obtained section 251 approval (of the NHS Act 2006 and Health Service (Control of Patient Information) Regulations 2002).  This provides a legal basis for patient information to be used to carry out the survey.  Patients consent to the use of the information they provide in the questionnaire.

Subjects’ rights

Patients can opt out of receiving the questionnaire by informing the Trust that has treated them The Trust provides information on how to do this. Patients can also withdraw the information given questionnaire upon request, up to the point at which data are analysed and personal details removed. A helpline number is given on the questionnaire.

NHS Staff Survey

The purpose of the NHS Staff Survey is to collect staff views and experiences of working in the NHS and to provide information for deriving national and local performance indicators relating to staff engagement, diversity and inclusion. The survey is carried out on behalf of trusts and other NHS organisations by third party survey contractors who contract directly with the trust. The contractors submit the data to the NHS Staff Survey Co-ordination Centre who are the national data processor for NHS England and provide benchmarking reports for each organisation along with national reports.  The data is used to improve local working conditions for staff, and ultimately to improve patient care.

Sources and categories of personal data

Information is provided by employing organisations from the entries in the Electronic Staff Record for their employees. This includes name, work address, and/or e-mail address. It also includes full name, age, directorate, department or division, location, job title and staff group, maternity, pay band; ethnicity; long-standing illness, health problem or disability. These variables help verify the representativeness of the staff list, where a sample is being used. Disability/pay band data were requested for the first time in 2017 following requests for this data from the WDES team to monitor equality. Collecting this information allows the monitoring of non-response rates by ethnicity/occupational group

Categories of recipients

The responses to the survey are collated by the survey contractors and the response data are sent to the Staff Survey Co-ordination Centre. The Co-ordination Centre is then able to provide organisations with data to compare their performance with other organisations of a similar type and also produce national statistics for NHS England.  The responses to the survey remain confidential. Completed questionnaires are submitted directly to the independent survey Contractor. The employing organisation does not have access to the completed questionnaires or to any linked personal data (e.g. names and addresses). The report that is sent back to the organisation presents the survey findings in summary form, and does not reveal the identity of the staff sampled. To help preserve anonymity, the Co-ordination Centre will not provide feedback on any group from which there are 10 or fewer responses.

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’. For the processing of special categories (health) data the basis is Article 9(2)(h) – ‘…health or social care…’.