Secure Data Environments

Whilst there are increasing opportunities for data-driven innovation and technology to support the management of healthcare services and the delivery of health-related research, public outcries in the recent years have demonstrated how certain members of the public are not comfortable with the idea that their personal health data, which was originally shared with doctors in confidence, being used and/or shared with third parties for purposes beyond the provision of direct care. A recent example of this was NHS’ large scale project entitled ‘GP Data for Planning and Research’ (GPDPR), which faced such resistance when originally proposed that it had to be suspended for further consideration.

Striking a balance between leveraging the power of health data for the mentioned purposes, preserving patient confidentiality and ensuring the security of data is therefore fundamental for healthcare organisations to effectively discharge their statutory obligations whilst maintaining public trust and confidence in the health services. And the use of Secure Data Environments (SDEs) is currently regarded as the gold standard for achieving that balance.

“Secure data environments are data storage and access platforms, which uphold the highest standards of privacy and security of NHS health and social care data when used for research and analysis. They allow approved users to access and analyse data without the data leaving the environment.”[1]

Where effectively implemented, SDEs present numerous advantages to the current practice of routine sharing of data for purposes beyond the provision of care, including the following:

• protects the data under robust technical and organisational controls;
• allows access to the environment only to users who obtain prior approval;
• restricts access to only the data strictly necessary for the approved project;
• controls the form in which the data is presented to approved users;
• limits what approved users can do with the data in the environment;
• prevent approved users from extracting data from the environment;

For these reasons, the implementation of SDEs has received strong support from industry experts and is now recommended by the government in its policy paper. The Department of Health and Social Care, in its policy paper “Data saves lives: reshaping health and social care with data”[2], highlights the central role that SDEs will play in allowing analysis to take place within a secure online platform while also building public’s trust that their health and care data are kept safe. To this end, the paper states that the SDEs will be the default route for NHS and adult social care organisations to gain access to de-identified data for research and analysis without engaging in any data distribution.

The policy paper echoes the recommendations of Professor Ben Goldacre made in his independent report, ‘Better Broader, Safer: Using Health Data for Research and Analysis’ (also known as the ‘Goldacre Review’).[3] According to Professor Goldacre, SDEs also present an opportunity to modernise data analysis by removing the IT constraints arising from having multiple platforms which may not always support the use of modern data analysis tools.

[1] Department of Health and Social Care’s (DHSC) policy paper “Secure data environment for NHS health and social care data – policy guidelines”, updated 23 December 2022.

[2] ‘Policy Paper: Data saves lives: reshaping health and social care with data’ (GOV.UK, 15 June 2022) accessed 10/07/2023.

[3] ‘Better, Broader, Safer: Using Health Data for Research and Analysis (Secretary of State for Health and Social Care, April 2022)  accessed 10/07/2023.