Guidance

Accessing UKHSA protected data

Updated 15 September 2023

The UK Health Security Agency (UKHSA) generates, curates and integrates high quality data on infectious diseases and other external public health threats to prepare for, prevent and respond to threats to health, as well as deliver world-class research with partners in our research networks.

UKHSA is a data steward acting on behalf of the Department of Health and Social Care (DHSC) – the data controller. This means that we are responsible for ensuring the safe and effective use of this data for individual and public benefit, while also managing and mitigating any harms that may emerge from using the data.

This includes operating mechanisms to approve external access to the data.

Improving access to data

Open data

A lot of the data UKHSA curates has been transformed to be anonymous and provided in the form of dashboards, reports and data tables. This data is publically accessible and adopts an Open Government Licence, so it can be accessed without any financial, legal or technical barriers. This data is often referred to as ‘open data’.

UKHSA is working with system partners to broaden access to open data to meet the needs of citizens and users in the public health ecosystem.

Protected data

Not all data in the stewardship of UKHSA can be made available as open data. This is because the data is considered personal or special category personal data, or there is risk of ‘re-identification’ of data that has been anonymised by data matching, inference or deductive disclosure. We refer to this data as ‘protected data’.

The sharing of protected data is an essential component to our work to strengthen health security and to act as a catalyst for change and innovation.

We work closely with scientific expertise in local and national public health organisations, the NHS, academia and industry to appropriately use protected data to put the UK in the strongest possible position to protect the public from new and existing threats to health that may emerge and ensure effective emergency preparedness, resilience and response for health emergencies.

Access to protected data is made possible subject to robust governance protocols, where it is lawful, ethical and safe to do so.

This includes making sure the uses of this data are controlled through legally binding data sharing contracts that set out the nature of the processing and any conditions on the organisation about how, when and for what purposes the data can be used.

Applying to access protected data

UKHSA operates a robust governance process for applying to access protected data that considers:

• the benefits and risks of how the data will be used
• compliance with policy, regulatory and ethical obligations
• data minimisation
• how the confidentiality, integrity, and availability will be maintained
• retention, archival, and disposal requirements
• best practice for protecting data, including the application of ‘privacy by design and by default’, emerging privacy conserving technologies and contractual controls

Access to protected data is always strictly controlled using legally binding data sharing contracts.

UKHSA welcomes data applications from organisations looking to use protected data for public health purposes.

All applications will be rigorously reviewed using an objective, standards-based process.

To request an application pack or discuss a request for UKHSA data you would like to submit, contact DataAccess@ukhsa.gov.uk

Download the UKHSA data application form, approval standards and guidelines.

How to submit an expression of interest (EOI)

An EOI is not an application, but an indication of your interest in applying to access protected data and an opportunity to discuss with specialists the feasibility of your project, the availability of data and what standards must be met when preparing your data application.

EOIs can be made by emailing DataAccess@ukhsa.gov.uk

Your EOI must include the following minimum information:

• your name
• your organisation name
• a synopsis of your project, including the data that would be necessary to fulfil the project, aims and objectives
• the names of any UKHSA specialists you have spoken to about your project so far
• the nature of the advice you are seeking

To expedite response time, you are asked to only submit one ticket per project consolidating the minimum information.

When an EOI is received, we will assign an EOI reference. This will be included in the subject line of our response and in the body of the text.

You are asked to only reply to the email chain you receive from UKHSA rather than creating new emails. This will help UKHSA track your EOI using the assigned reference and expedite our response.

Please note that if multiple project team members contact UKHSA regarding the same issue, this will slow the response time and may result in a slower response time.

Completing an EOI does not guarantee approval of your application or access to data but enables you access to technical and domain-specific experts within UKHSA.

How to submit a data application

To apply to access protected data you must submit a detailed data application. Your application will be managed following the application process described in application process summary.

You must complete the UKHSA data application form and submit supporting evidence. The evidence required is dependent on the nature of your project; including if you require access to personally identifiable data, if your organisation will instruct one or more data processors, or if your project requires ethical approval.

The data application form uses conditional logic to assist you in identifying what evidence is mandatory dependent on the nature of your project.

When you submit an application, UKHSA will use the information you supply in the data application form and your supporting evidence to evaluate your request for access to protected data. You can read more about how we process the information included in your application in our privacy notice.

All applications are evaluated against the approval standards to ensure that:

• all processing will be fair, lawful, and transparent
• all processing will be for an acceptable specific, explicit, and legitimate purpose(s) and the data will not be processed in a manner that is incompatible with those purposes
• the purpose(s) provides direct and tangible benefits to individuals or the health system, and a deliver positive social outcome
• the data requested is necessary and proportionate to fulfilling the purpose(s)
• all processing will be conducted within safe settings with appropriate safeguards in place to protect against unlawful or unauthorised processing, access, loss, destruction or damage for their own organisation, or any person or organisation acting under their instruction
• where appropriate, compliance with good standards of ethical and research integrity, including public involvement, Findable Accessible Interoperable Reusable (FAIR) data, and Open Science principles

Each approval standard is accompanied by guidelines. These guidelines are intended to describe the general rules and principles around the standard and provide advice that will enable you to address each standard successfully.

Once your application is submitted, you will be notified via email to confirm whether your application is incomplete or complete.

If incomplete, UKHSA will provide feedback about the evidence which must be supplied to complete the application and you will be invited to resubmit. Resubmissions will be handled as new applications.

Complete applications will be scheduled for formal assessment against the approval standards. During this formal assessment, UKHSA will review your application in detail and where applicable, a data privacy impact assessment will be conducted.

Application process summary

Step 1: Submission

Submit your application to DataAccess@ukhsa.gov.uk

Step 2: Triage and assessment

Once received, your applications will be acknowledged within 3 business days. If you do not receive an acknowledgement contact us via email.

Your application will be assigned a data application reference. This will be unique.

Your application will be triaged and UKHSA will inform you that we have received all required evidence to commence assessment of your application against the approval standards. Where our triage identifies omissions in your application, feedback will be supplied and resubmission offered.

If your application is complete, your application will be evaluated against approval standards and where applicable, a data protection impact assessment conducted.

During this assessment by UKHSA, queries may be raised with the primary applicant or their delegated point of contact to aid understanding of the application.

Step 3: Decision

The outcome of the application will be communicated by email to the primary applicant or the named point of contact in section A of the UKHSA data application form.

If the application is positively assessed, UKHSA will explain any conditions that must be met to support data access, including execution of a data sharing agreement and if applicable, payment for services to prepare the data. This constitutes UKHSA’s provisional approval.

Should your application be rejected in whole or in part, you will be informed of the grounds for rejection.

Step 4: Access

Final approval will be provided once all conditions are met.

On final approval, UKHSA analytical team(s) will begin preparation of the data for access. The mode of access to the data will be set out in the data sharing agreement.

Access to data following final approval will be dependent on the mode of access (the data access environment), the complexity of the data, frequency of delivery, as well as other business demands. Every effort will be made to communicate with the primary applicant about anticipated delivery dates; however, it is acknowledged that due to the nature of UKHSA’s work, there are occasions where timescales may alter at short notice.

Following UKHSA’s evaluation of the application against the approval standards, a decision will be communicated to the primary applicant. Where applications demonstrate the approval standards are met, access to any protected data will be contingent on signing a legally binding data sharing contract, covering the responsibilities that recipients agree to abide by.

The contract will set out the exact terms and conditions that must be followed when processing the data. This includes strict provisions for maintaining the confidentiality of the data, only processing the data for the agreed purpose(s), data retention and data destruction.

The contract may also include provisions specific to the circumstances of the project, such as reporting publications to UKHSA or the return of derived variable syntax, new data, and associated metadata.

There are no fixed deadlines for submitting your data application; however, we strongly recommend that you submit your application by the earliest possible date to allow sufficient time for a decision to be reached before your project’s start date.

Updating an application after submission

Once an application has been submitted, you will not be able to make changes to your application. If you wish to amend your application, you or your nominated point of contact may request that it be rescinded. This request must be made by email.

To rescind an application, contact us and we will arrange this on your behalf.

Once the request for a withdrawal has been processed, this will be confirmed by email.

The revised application will not be prioritised over other applications received by UKHSA. It is therefore imperative that when preparing your application, you ensure that all relevant information is supplied to UKHSA and there are no omissions, misrepresentations or inconsistencies that could extend the time to reach a decision.

Amendments to approved applications

For information about how to submit a data application amendment to an approved application, see the data application amendment form.

Service charges

We may charge for services to cover the costs of managing applications or amendments, processing data and providing access. Where charges are applicable, details will be communicated.

Helpdesk

If you encounter difficulty when preparing your application, we suggest the following steps:

1. Refer to the approval standards and guidelines. These documents outline all of the required approval standards that must be demonstrated within an application and confirm the additional evidence you must submit within your application, dependent on the circumstances of your project.

2. If the advice needed cannot be obtained in the approval standards and guidelines, contact the helpdesk. If you are unable to resolve your issue, email the helpdesk at DataAccess@ukhsa.gov.uk

Data access approvals register

When data is shared with other organisations for research, clinical audit, service evaluation, or surveillance, UKHSA is committed to improving transparency of data use by publishing information about the type of data it shares, the purpose, date of approval, and name of the organisation or individual using (or receiving) the data. We will do this through a data access approvals register.

We are working with stakeholders to design the format of the data access approvals register. Updates will be shared with you on this page about progress and when the first register will be published.