Notice
- Important: This guidance is under active development by NHS England and content may be added or updated on a regular basis.
- This Implementation Guide is currently in Draft and SHOULD NOT be used for development or active implementation without express direction from the NHS England Genomics Unit.
Genomic Data Reuse
One of the key aims of the UGR is to enable reuse of data across different health contexts: Direct Care; Population Health Management; Management Information; and Research. To support each context, slightly different data access approaches are needed.
Genomic data in direct care is mostly used as a diagnostic source. Data is shared using national standards and provider systems directly interact with the UGR via APIs. All direct care data is shared through legitimate access, managed by national RBAC, although data redaction and other minimisation approaches can be built into the API.
Population health management and management information requires access to groups of patient genomic records. This can be achieved in two ways:
- Separate API calls to the PDM via APIM per patient record.
- Bulk Query API calls to the PDM using GA4GH Beacon API requesting sets of data across multiple patients.
Purpose-Based Access Control (PBAC) is implemented for each patient, respecting their preferences for secondary data sharing. Data returned via the API is pseudonymised using NHS England's national pseudonymisation system or in the clear if used for commissioning purposes.
Using genomic data for research requires request-specific data processing. The UGR utilises Purpose-Based Access Control to ensure legitimacy of all data requests regardless of the clinical context. For research, the request must be supported by a PBAC policy within each patient’s UGR for the ability to query their data as part of a cohort search. The PBAC rules can be defined to be as explicit as required. For example, a patient may permit their data to be used for cancer research, but request to be asked for permission for other types of research. The rules are defined, and patient preferences managed via the NHS App.
The returned data may be modified depending on the PBAC policies and the context:
- Data minimisation – only return what is necessary for the functionality required.
- Data redaction – make requester aware of data existing but respond with ‘data redacted’ in fields as defined in the PBAC rules.
- Pseudonymisation – remove all patient identifiable information and provide an NHS England derived pseudonym for the patient ID.
- Anonymisation - remove all patient identifiable information and ensure patient identity is unable to be derived from the patient data returned.