Purposes and controllers
NHS England is commissioning an NHS Genomic Medicine Service. This service is available to clinicians anywhere in England and it gives them a facility to order tests based on the analysis of their patients’ whole genome – their genetic makeup.
The service is provided by seven Genomic Lab Hubs each of which is made up of number of NHS Trusts or NHS Foundation Trusts (“GMS NHS Trusts”) which provide testing, interpretation and reporting services.
The GMS NHS Trusts together with NHS England are responsible as joint controllers under data protection legislation for the processing of personal data to provide the NHS Genomic Medicine Service. A list of the GMS NHS Trusts with links to their online privacy notices is presented below.
The labs use a computer system called the National Genomic Information System (NGIS), which NHS England has commissioned for them from Genomics England Ltd. Genomics England is a processor for the provision of the NGIS, acting on the instructions of NHS England for the Trusts that provide lab services.
How personal data is used for your genomic test
The human genome is made up of 3 billion letters of DNA (A, T, C and G). Whole genome sequencing is a technique that is used to ‘read’ these letters and finds their order one by one. The digital record of this sequence can be then analysed by computers to produce information to inform the diagnosis and treatment of rare conditions or cancer.
When a clinician orders a whole genome sequence test using the new service, he or she will send a blood or tissue sample with an order form to a pathology laboratory that has been designated to perform the type of test being requested in the local area. This lab will extract the DNA from the sample and send it to a specialist lab that puts the DNA into a tube or “well” in a rack or “plate” of other samples. In this way the samples are organised so that they are matched to the right patient when they are analysed, ensuring that the patient gets the result that relates to their test. As a double check the lab that extracted the DNA keeps a DNA signature from the sample, which is then compared to the sequenced DNA.
The plates of samples are sent to a company called Illumina that carries out the whole genome sequencing process. Illumina is contracted to Genomics England to provide this service.
A digital file is created with the unique 3 billion letters, and this is sent to Genomics England’s Bioinformatic Pipeline. This system analyses the DNA sequence, guided by the type of test that has been ordered, and creates an automatic interpretation of parts of the genome that are relevant to the patient’s condition. The facts that are presented in this automatic interpretation are further interpreted by clinical scientists in the Genomic Lab Hubs.
The NGIS is accessed by lab staff who have access permissions enabled that are appropriate to their role. As this is a national service, lab staff with access enabled can see the genomic records of any patient that has had a test requested for them. This enables clinical scientists that specialise in a particular condition to provide interpretation services for patients outside their area.
Managing and improving the service
Personal data is processed for the following purposes by the GMS NHS Trusts and NHS England
- The improvement of delivery of direct care (clinical care), which includes supporting the development of knowledge of genomic variants as well as maintaining and improving the quality of the service;
- The improvement of the service, driving improvements in access, effectiveness and efficiency.
Data that identifies patients directly is not disclosed outside the team providing care for these purposes. The data is de-identified or aggregate numbers.
NHS England receives a monthly Patient Level Contract Monitoring Dataset from each of the GMS NHS Trusts for its commissioning purposes. This is collected by NHS Digital and provided to NHS England in de-identified form – see Data Services for Commissioners.
Every patient that is offered a whole genome test is asked if they want to donate your sample (blood / saliva / tissue, etc.), genome sequence and health data for research co-ordinated by Genomics England.
For patients who agree, NHS England, on behalf of the Trusts that provided that provided the genomic test will allow Genomics England to access personal data held in the NGIS for inclusion in the National Genomic Research Library. This is a secure national database of genomic and health data managed by Genomics England.
Genomics England Ltd is controller under data protection legislation for the purposes of the National Genomic Research Library. See the Genomics England website
Categories of personal data
The following types of personal data are processed:
- Patient Identifiers including NHS Number
- Demographics – name, address, date of birth, ethnicity, registered GP
- Clinical pathway
- Family identifiers – where relevant
- Clinical Indicators – nature of condition, details of condition
- Clinical measurements and observations relevant to condition specific to cancer or rare and heritable disease pathways
- Clinical ethnicity and clinical sex details
- Details of genomic testing and related procedures – e.g. the type of test performed
- Link to previous requests and tests
- Whole Genome Sequence
- Special Categories of Personal Data include
- Racial or ethnic origin
- Genetic data
- Health data
Joint Controller Agreement
NHS England and the GMS NHS Trusts have entered into a Joint Controller Agreement which provides a framework for how they will work together to ensure that they comply with data protection requirements when they process personal data for the purposes of the Genomic Medicine Service. In this agreement they make the following commitments
- They will make sure that they are transparent about their joint purposes for Processing Personal Data
- They will make sure that anyone who wants access to their Personal Data, or to exercise other rights under Data Protection Law, have an easily accessible point of contact to make their request (see the GMS NHS Trusts privacy notices below)
- They will make sure that their data protection policies and procedures properly govern their processing of personal data
- They will make sure that personal data that they process, or is processed on their behalf by processors, is protected by appropriate technical and organisational security measures
- They will make sure that their personnel have a confident understanding of their data protection responsibilities
- They will not transfer personal data outside the European Economic Area unless appropriate legal safeguards are in place in accordance with data protection law.
The GMS NHS Trusts and privacy notices
North West Genomic Laboratory Hub
- Manchester University NHS Foundation Trust
- The Christie NHS Foundation Trust
- Liverpool Women’s NHS Foundation Trust
North East and Yorkshire Genomic Laboratory Hub
- The Newcastle Upon Tyne Hospitals NHS Foundation Trust
- The Leeds Teaching Hospitals NHS Trust
- Sheffield Children’s NHS Foundation Trust
South West Genomic Laboratory Hub
Central and South Genomic Laboratory Hub
- Birmingham Women’s and Children’s NHS Foundation Trust
- University Hospitals Birmingham NHS Foundation Trust
- Oxford University Hospitals NHS Foundation Trust
- Salisbury NHS Foundation Trust
- University Hospital Southampton NHS Foundation Trust
East Genomic Laboratory Hub
- Cambridge University Hospitals NHS Foundation Trust
- Nottingham University Hospitals NHS Foundation Trust
- University Hospitals of Leicester NHS Trust
London North Genomic Laboratory Hub
- Great Ormond Street Hospital for Children NHS Foundation Trust
- The Royal Marsden NHS Foundation TrustThe Royal Marsden NHS Foundation Trust
- Imperial College Healthcare NHS Trust
- Barts Health NHS Trust
- University College London Hospitals NHS Foundation Trust
- Royal National Orthopaedic Hospital NHS Trust
- Royal Free London NHS Foundation Trust
South East Genomic Laboratory Hub
- Guy’s and St Thomas’ NHS Foundation Trust
- King’s College Hospital NHS Foundation Trust
- St George’s University Hospitals NHS Foundation Trust
- Royal Brompton and Harefield NHS Foundation Trust
Legal basis for processing
For GDPR purposes NHS England’s and the GMS NHS Trusts’ lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’
For the processing of special categories (health) data the bases are
9(2)(h) – ‘…health or social care…’ – for the provision of the testing service
9(2)(g) – ‘…necessary for reasons of substantial public interest…’ Underpinned by paragraph 8 (Equality of opportunity or treatment) of Schedule 1 to the Data Protection Act 2018 – for processing of racial or ethnic origin
9(2)(j) – ‘…research purposes…’ – for dissemination to Genomics England Ltd. for inclusion in the National Genomic Research Library