Q – Can data truly predict the likelihood of future illness in a population?
A – The concept of risk stratification tools is simple: predict the risk of future adverse events so that efforts can be targeted to avoid or mitigate them.
A comprehensive dataset of patient information is essential for accurate risk stratification to assess the potential scale of future adverse events among patients at high, medium, and low risk. Although no advanced prediction can ever be 100% accurate, by identifying these groups, health planning may be adapted to meet their needs by providing interventions to avoid these adverse events happening.
Q – Why is risk stratification important?
A – The data can be used to make care management decisions. It helps GP Practices to focus on those patients identified as being at higher risk and offer appropriate interventions, and it helps health care commissioners to plan for current and future care needs, whilst reducing costs and improving care.
Q – Who has access to risk stratification data?
A – People who have access to data will only have access to that which they need to fulfil their roles:
- The Processor uses their risk stratification tool to analyse the data and produce non-identifiable risk scores.
- Your GP Practice is allowed to re-identify individuals by matching risk scores against the patients on their system. GP Practice staff require access to this re-identified data so that they may provide patients, who are assessed as being at high risk of future adverse events, with appropriate interventions.
- The ICB will only ever have access to non-identifiable risk score data. They do not need individual patient data to enable them to plan for current and future care needs, or to commission services.
Q – Will data be shared with third parties outside of the NHS?
A – Personal identifiable data will not be shared with third parties unless there is a valid legal basis for the disclosure.
Data that is anonymised or is aggregated may be shared with other parties. Individuals would not be identifiable from these data sets.
Q – How does risk stratification work?
A – A Processor operates the risk stratification tool and they feed a mix of information about patients (age, gender, diagnoses, admissions to hospital, etc.) into the tool. The tool analyses the data to produce risk scores. The risk scores are a non-identifiable data set.
For GP Practices the non-identifiable risk scores will be linked to data held within their system so they can identify patients and offer them additional care or interventions.
The ICB will only ever have access to non-identifiable risk scores for their commissioning and planning purposes.
Q – How will data be kept secure during the risk stratification process?
A – Strict security protocols are in place, including:
- Processors, GP Practices, and ICBs must submit an annual self-assessment to meet conditions of the Data Security and Protection Toolkit (DSPT) to measure their performance against the National Data Guardian’s data security standards.
- A contract with a Processor must be in place that contains relevant security and data protection clauses. The contract instructs the Processor as to their obligations.
- Processer staff, GP Practice staff, and staff within the ICB are trained in data protection and information governance. Their contracts of employment and relevant organisational policies provide further safeguards against data misuse.
- Auditable Role Based Access Controls (RBAC) are in place for staff processing data.
- Only the minimum necessary patient identifiable data is obtained and processed.
- Data is processed in a secure data environment.
- The risk scores will be non-identifiable. This data will remain non-identifiable for commissioning and planning purposes, and only revealed in identifiable form to your GP Practice staff.
- Identifiable data is destroyed in accordance with the NHS Records Management Code of Practice.
Q – How is it ensured that the data used for risk stratification is accurate?
A – Healthcare Providers have organisational processes in place to verify the accuracy of your data and to ensure that it is kept up to date. For example, your GP Practice may check with you that your contact details are still up to date when you visit your Surgery.
The data that is ingested into the risk stratification tool has therefore already been verified as accurate and up to date at source.
Q – Do you need my consent when using my data for risk stratification purposes?
A – When information is given in circumstances where it is expected that a duty of confidentiality applies, that information cannot normally be disclosed without the consent of the patient.
However, there are some circumstances that make disclosure of confidential information lawful without patient consent. One of those circumstances is when Section 251 of the National Health Act 2006 is relied on to set aside the requirement under the Common Law Duty of Confidentiality (CLDC) to seek patient consent, subject to an application to the Confidentiality Advisory Group (CAG) and approval of the Secretary of State.
For our risk stratification purposes, Section 251 approval is relied on to provide a legal means of processing confidential patient information without patient consent.
We recognise that some patients may feel this is a loss of their autonomy. This is why we consider it important that we are transparent about the use of data, and increase public awareness of risk stratification.
Although we believe that the net impact of risk stratification on privacy is marginal and the benefits great, should you not wish for your confidential personal data to be used for risk stratification purposes then you can opt out. More information on opting out can be found higher up on this page.
Opting out will not affect the care you receive, but it could affect the pro-active provision of your care. You can change your mind about your choice(s) at any time.