Security
Security and the protection of people’s personal data is at the heart of the design and requirement of the NHS Federated Data Platform. We are working closely with the National Cyber Security Centre and all data will be held in line with the Office for National Statistics Five Data Safes and NHS England’s secure data environment principles.
Five data safes
- Safe people – individuals accessing the data are trained and authorised to use it appropriately.
- Safe projects – projects are approved by data owners for the public good.
- Safe settings – preventing inappropriate access, or misuse.
- Safe outputs – summarised data taken away is checked to ensure it protects privacy.
- Safe data – information is protected and is treated to protect confidentiality.
Secure data environments
The Data Saves Lives Strategy includes a core set of commitments to move the NHS from a model of data sharing, to data access through Secure Data Environments. These are data access and storage platforms that enable the use of NHS health and social care data in research and analysis.
We identify these platforms based on their primary users and requirements for access:
- The NHS Federated Data Platform is for the NHS, or those commissioned by them, to access data for direct care and population health planning purposes.
- The NHS Research SDE Network is for external users and/or those conducting research to access data
All of these platforms will comply with the published Secure Data Environment guidelines.
The NHS Federated Data Platform will ensure:
- NHS control: Each NHS organisation will be the data controller for their federated platform and will make decisions about how their local data is used. The use of the data will always remain under the full control and protection of the NHS.
- There will be role-based access controls in place to ensure that only people who meet specific requirements, and to need to access relevant data as part of their role, have access to do so.
- Audit and accountability: the platform will create and maintain an audit trail documenting all individuals’ users’ access, including the data they access. Those audit trails will be reviewed to ensure that data is being accessed and used for legitimate purposes. The contracts between data controllers (NHS) and data processors (software provider) will contain specific clauses relating to inappropriate use of data, and all contracts in relation to the federated data platform will be published.
- Confidentiality: there will be strict rules for when data and information can leave the secure environment of the platform and all access to the data and analysis is monitored.