Future registry research

Trauma and Orthopaedics has long been established as a leader in the collection and analysis of high-quality patient data for the purposes of quality improvement and research. The scale and scope of registry data across several patient groups and procedures are the envy of colleagues around the world. The ability to link these data to other routinely held clinical information (e.g. patient health records held within the Hospital Episode Statistics (HES) data warehouse) allows us to enrich these data with important information that is not present in the original database, and would otherwise be a substantial burden to collect for every patient.

The main strength of mandatory national registries is the data completeness (or coverage) of the study population. The drawback, however, is that regular changing of the collected data (or minimum dataset) makes any analysis cumbersome and becomes a burden to those submitting data. As a result, if variables are not collected in the registry, we must look to other sources to supplement it when needed for a study. An example of this is if a researcher wants to investigate mortality outcomes of patients undergoing joint arthroplasties (included within the UK National Joint Registry (NJR)), while adjusting for specific comorbidities (not included within the NJR).

Requests to link datasets to routinely collected information (which is typically held by a national central organization, e.g. NHS Digital) are typically done through a formal application process. For instance, for the UK this is through the Data Access Request Service (DARS) in England and Wales, the Electronic Data Research and Innovation Service (eDRIS) in Scotland, and the Northern Ireland Statistics and Research Agency (NISRA) in Northern Ireland.

Specific registries may have pre-existing established linkage to routinely collected data (e.g. the NJR and HES), which means that applications can be made direct to the registry without having to go through the centralized service. Any application to link registry data to routinely collected healthcare data would typically be undertaken in combination with members of the registry committee or research team (such as the UK NJR research sub-committee), who will have specific expertise and understanding as to the vagaries of their particular dataset that are important for the linkage process.

As an example, there must be a common feature of both datasets (such as NHS number) that allows us to ensure that the data in each source relate to the same patient; people experienced in data linkage of individual datasets will understand how this is best achieved.

When datasets are linked, there are regulations that need to be followed: in particular, for any application to link data there are some key components of the General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA) (which govern appropriate use of patient data) to be aware of.

Firstly, there is the role of the Data Controller (the organization(s)/person(s) with ultimate control of, and responsibility for, the data in question) and the Data Processor (the organization(s)/person(s) performing data processing (e.g. obtaining, recording, or holding data) on behalf of the Data Controller). Both are integral to any data application and will need to be clearly defined as part of the application process.

Secondly, there is the lawful basis for data processing. This is covered by Article 6 (1) of the GDPR, which sets out six potential reasons that can be used for lawful data processing.¹ Most healthcare-related linkage applications from NHS or academic institutions will be covered under Article 6 (1) –I - “performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.” Healthcare applications are also considered “special category data”, which require further additional justification under Article 9 of the GDPR. In most cases this will be covered under Article 9 (2)(j) – where “processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes,” or Article 9 (2) (h) – “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.”

Another consideration is the common law duty of confidentiality. This governs the requirements for appropriate informed consent for the use of potentially identifiable confidential information. Given that most datasets use “pseudoanonymised” (the use of fictional identifiers to categorize individuals and link data together) data, the common law duty of confidentiality is applicable. In the case of truly anonymized data, consent is not required. The legal obligations specified in the common law duty of confidentiality (requirement for informed consent) for national datasets can be set aside through application to the Confidentiality Advisory Group (CAG), to allow application of Section 251 of the NHS Act 2006. A similar process also exists in Scotland through application to the Public Benefit and Privacy Panel (PBPP) for Health and Social Care. Local and regional data applications come under the consideration of the local Caldicott Guardianship governance structure.

Ethical and Health Research Authority (HRA) approval is a separate consideration and typically depends on the nature of the study. This is typically completed through the Integrated Research Application Service (IRAS). Decision tools regarding the requirement for ethical and HRA approval are available on the HRA website.² Evidence of appropriate Information Governance training is also required, typically in the form of completion of the Medical Research Council (MRC) Research, GDPR and confidentiality Quiz.³