This page describes how kidney patients’ data are used by the UK Kidney Association (UKKA).

For more detail, patients can also read the UK Kidney Association's privacy notice.

Introduction

This document explains why patient information is collected by the UK Kidney Association (UKKA) and how that information may be used by the UKKA. This is called a Fair Processing Notice or Privacy Notice. It describes how the UKKA collects, uses and processes the personal data and associated information of patients and how, in doing so, it complies with its legal obligations to those patients. The privacy and confidentiality of all patients is important and the UKKA is committed to safeguarding data privacy rights.

What is the UK Kidney Association?

The UK Kidney Association (UKKA) is a not-for-profit organisation registered with the Charity Commission. It functions as a membership organisation for healthcare professionals caring for people with kidney disease. Its primary goal is improving the quality of treatment and outcomes for patients diagnosed with kidney disease.

To achieve its goals, the UKKA collects and uses data on kidney patients from across the UK. It is the Data Controller for these data, and uses the data across both of its clinical registries:

The UK Renal Registry (UKRR): A national clinical registry which collects data on patients diagnosed with kidney disease. The UKRR uses the data it collects to audit the quality of patient care and outcomes at each of the 83 (70 adult, 13 paediatric) kidney centres in the UK. The data is also used to form a research database. Researchers based in academic or health institutions can apply to use the data in this database to carry out research that improves the care and outcomes of kidney patients.

The National Registry of Rare Kidney Diseases (RaDaR): A research database that recruits patients who have been diagnosed with a rare kidney disease to make it easier to identify groups of potential participants for research. Patients recruited to RaDaR will be offered the opportunity to participate in clinical trials and studies that may benefit them and improve the treatment and outcomes of their rare kidney disease.

Both operational arms are run out of the UKKA’s office in Bristol.

Where does the UKKA collect data from?

The UKKA collects most of the data it processes directly from the kidney centres and hospitals where patients are treated. However, the UKKA also receives data from other national sources such as NHS Digital and the Scottish Renal Registry.

Kidney Centres

Kidney centres in the UK are required by the NHS to send data to the UKKA on the number of patients they treat, the treatment those patients receive, and an overview of each patient’s health. This data is sent through several different methods, depending on the type of IT systems the hospitals use and the intended use of the data. All kidney centres are required to send data to the UKKA quarterly to be included in the UKRR’s audit. The majority of hospitals also send daily data which is used for audit and research projects in the UKRR RaDaR, and electronic patient records.

Public Health Scotland (Scotland only)

In Scotland, kidney centres send their data to the Scottish Renal Registry, part of Public Health Scotland, which conducts audits similar to the ones carried out by the UKRR. Once a year, after the Scottish Renal Registry has published its annual report, it sends data on Scottish patients to the UKKA to be included in the UKRR’s analyses and reports.

Acute Trust Laboratories (England only)

When a patient needs to have their blood tested, either in hospital or when visiting their GP, the test itself is carried out at a nearby specialist laboratory. When testing blood, laboratories in England are required to check for acute kidney injury (AKI – a drop in kidney function). As well as telling the hospital or GP so that the patient can be treated, the laboratories also have to report the result to the UKKA, which keeps track of the number of cases of AKI in England.

Informatics Services

As well as sending data to the UKKA, the kidney centres and hospitals in the UK are required to share data with other NHS or health organisations. These organisations use this data to assess how hospitals are performing in different ways and make sure that hospitals have the money and resources they need to provide good quality care for their patients. The organisations are known as “informatics services”.

Rather than collect the same data from hospitals twice, these informatics services allow organisations like the UKKA to apply to collect patient data through them. Receiving this additional data allows the UKKA to get a wider and more accurate understanding of how kidney centres provide care for their patients, as well as getting a better view of each kidney patient’s overall health.

The UKKA collects data from five informatics services:

What data does the UKKA collect?

Identifiers

When collecting data about patients, the UKKA collects three identifiers:

• Name
• Date of birth
• NHS number (CHI Number in Scotland or H&C Number in Northern Ireland)

The identifiers are used to make sure that the UKKA is collecting data on the correct patients. This is especially important as the UKKA collects data over several years, and on patients who move around the country or are treated at different hospitals.

The identifiers are also used to link the data held by the UKKA with data held by the informatics services that are described above. More information about these data links can be found in ‘Who does the UKKA share data with? And why?’

Demographic Information

The UKKA collects data describing the types of people who have kidney disease including ethnicity, socio-economic status (based on postcode) and sex. This data allows the UKKA to analyse if kidney disease is more or less common in certain groups and if there are any differences in how different groups of patients are treated.

Contact Information

Where patients agree to be contacted by the UKKA (e.g. as part of participating the Consent for Approach for Resarch and/or RaDaR), the UKKA will collect appropriate information, such as email address or physical address to make contact and provide information relating to the activities the patient is participating in.

Clinical Information

The UKKA collects data relating to each patient’s kidney health and the treatment they are receiving. This includes results of blood and biochemical tests, the medication the patient is taking, and the frequency, duration, and type of dialysis the patient is on.

As well as data directly relating to the patient’s kidney health, the UKKA also collects information on the patient’s wider health, including if the patient has any other health issues such as diabetes or heart disease.

Patient Reported Measures Information

During their treatment, patients are asked to complete questionnaires on subjects such as their symptoms, how they are feeling or what they think about the quality of care they are receiving. Collectively, the information collected from these questionnaires is known as Patient Reported Measures and is analysed by the UKKA to help hospitals identify areas where they might be able to improve.

What does the UKKA do with the data it collects?

UK Renal Registry (UKRR)

Audit

Each year, the UKRR creates reports that show how each kidney centre or hospital has performed in treating patients with kidney disease compared to the standards that have been set by the NHS. To produce these reports, patient data is processed through the following steps.

• Collection – Local hospital IT systems collect and store information on patients with kidney disease. From this data the hospital sends, via secure methods (e.g. encrypted email, secure file transfer systems), a pre-determined set of data on each patient to the UKKA who store it securely in the UKRR’s database.
• Validation – The UKRR runs the data through a series of specialist computer programs which check that the data is accurate. Where errors are found the UKRR will ask the hospital to correct them.
• Linkage – The cleaned data is linked with data from the informatics services described above. This involves sharing the NHS number of each patient with the informatics service and requesting that the service sends back data they currently hold for that patient.
• Analysis – Patient identifiers are removed from the data and sent to the UKRR’s statistics team for analysis. These analyses produce a series of tables and graphs showing how each renal centre/hospital has performed against the standards set by the NHS.
• Publication – The results of the analyses are put together into a report which explains what each table and graph means. Once complete, the report is published online.

The information published in the UKRR’s reports is also available via an online data portal where patients and clinical staff can more easily compare renal centres and access the information that is important to them.

Research

The data that are collected and validated for the UKRR’s audit are also included in a research database hosted by the UKKA. This database is used to support research into kidney disease. Researchers either employed by the UKKA or based in hospitals and universities across the UK can apply to have data from the database shared with them so that they can carry out their research. The data is only released for ethically approved projects and where the researcher can prove that they will use the data responsibly and securely, in line with data protection law. Examples of the sort of research that has used data supplied by the UKRR can be found on the UKKA website.

Consented for Approach for Research (C4AR)

The UKRR invites patients included in the UKRR to provide consent to be contacted about additional research projects that they may be eligible for. Patients who provide this consent will provide contact details to the UKRR to receive a regular newsletter about research into kidney disease and opportunities to be involved in research projects. Each of these additional projects will be consented separately.

Quality Improvement

The UKKA works with renal centres in the UK to identify areas where the quality of patient care can be improved and help implement projects that will achieve these improvements. The UKKA uses the data collected by the UKRR to measure how successful the improvement projects are.

Electronic patient records

The UKKA works with providers of electronic patient records systems to allow kidney patients to log in to an online platform and view their test results and other information relating to their condition.

The data displayed in the electronic patient records system is sent from the renal centres on a daily basis to the UKRR to support its audit work. These data are then uploaded to the electronic patient records system to which patients have signed up.

National Registry of Rare Kidney Disease (RaDaR)

Patients with rare kidney diseases may be asked to participate in RaDaR by a member of the clinical team at the hospital where they are being treated. Participation is entirely voluntary and refusing to participate has no effect on the quality of the treatment the patient receives. Once a patient is recruited to participate in RaDaR, a research nurse at their hospital will input information about the patient, their condition, their health and the treatment they are receiving onto RaDaR via a secure webserver.

Patients on RaDaR are grouped together based on their disease or condition. Each group is managed by a senior kidney doctor who looks for possible studies or clinical trials that the group would be eligible for. Where suitable trials are found, patients are informed either directly by RaDaR or through their hospital and asked if they would like to participate in the trial or study.

The data from RaDaR is also processed by the UKRR to support its audit work.

How long does the UKKA store data for?

UKRR

Kidney disease is lifelong, with patients requiring treatment for many years. Because of this, the UKRR stores the data it collects for long periods of time. Doing this allows the UKRR to more accurately track trends in the quality of kidney care and outcomes.

The data that the UKRR collects forms the official record of the quality of kidney care and outcomes in the UKRR. To maintain this record, the UKRR will retain patient information for the lifetime of the registry plus five (5) years.

Patients who provide their contact details to participate in the Consent for Approach for Research (C4AR) will be able to withdraw their consent at any time and their contact details will not be retained.

RaDaR

Patients participating in RaDaR consent to their data being stored for the lifetime of the registry.

Who does the UKKA share data with? And why?

To help the UKKA achieve its goals of improving the quality of care and outcomes for patients with kidney disease, there are instances where it shares patient data with other organisations.

What is the UKKA’s legal basis for processing data?

Personal identifiable data

To process personal identifiable data for the purposes defined in this privacy notice, the UKKA relies on the legal basis of legitimate interest (article 6(1)(f) of the General Data Protection Regulation (GDPR)). This means that the UKKA believes, and can evidence, that

the work it does involving personal data has justifiable benefits for patients, clinicians, and its members, without unfairly impacting on individuals’ privacy.
The UKKA’s justification for processing personal identifiable data differs slightly depending on the purpose it is being used for. For each purpose, the UKKA has evidenced its justification for processing data in a document called a ‘Legitimate Interest Assessment’.

Special category data

The UKKA collects special category data regarding individuals’ health, ethnicity, sex, and genetic make-up. The legal basis for the processing of these data items differs by purpose as seen below.

When processing data for the UKRR’s audit and quality improvement functions, as well as data for electronic patient records, the UKKA relies on the legal basis defined in Article 9(2)(h) of the GDPR which allows for special category data to be used for the provision and management of health management systems (Data Protection Act (2018) Schedule 1, Part 1 Section 2(2)(b).

When processing data for research, whether as part of the UKRR’s research database or part of RaDaR, the UKKA relies on the legal basis defined in article 9(2)(j) of the GDPR which allows for special category data to be used for the purposes of conducting statistical research.

Confidential patient information

The medical information that is created as part of your treatment (e.g. clinical tests, blood results etc.) is covered by the common law duty of confidentiality, meaning that it can only be shared with the UKKA if you have given your consent for it to be shared, or where the UKKA has received special permission from the government to collect it without your consent, known as secondary use approval.

Secondary use approval
The UKKA holds secondary use approvals to collect and process confidential patient data for the purposes of the UKRR’s audit, quality improvement and research work. These approvals are renewed every year.

Patients can opt-out of having their confidential data shared with the UKRR at any time. Details on how they can do this can be found in ‘How to opt-out of your data being sent to the UK Kidney Association’ below.

Consent
Patients included in the UKRR can provide consent to participate in the C4AR and provide their contact details to be informed about research opportunities.

When signing up to participate in RaDaR and/or an electronic patient record platform, patients provide their consent for their confidential information to be processed for these purposes.

Patients completing the Your Health Survey questionnaires also provide consent for their data to be processed to analyse the results of the survey and report the findings back to the patient’s renal centre.

Data Processors

The UKKA engages several organisations which provide services that allow the UKKA to carry out its work. Not all these organisations are data processors for patient information; however, the two listed below are data processors because they process patient data on behalf of the UKKA

Arrow Business Communications Ltd (ARO) – ARO provides secure data storage and IT infrastructure for the UKKA. The UKKA entrusts ARO with storing patient information, but ARO employees cannot see the information which the UKKA stores on their servers.

Patients Know Best (PKB) – The UKKA works with PKB to provide electronic health records for kidney patients across the UK. This involves the sharing of patient information between the two organisations, firstly to allow patients to see up to date information about the care they are receiving and secondly to allow the UKKA access to additional information which can be used to audit the quality of care being provided as part of the UKRR’s audit.

Each of these organisations processes data on behalf of the UKKA under the terms of a contract specifically stating the services they are to provide and limiting how they are allowed to process patient information. All of the UKKA’s data processors have proven that they have high levels of data security measures in place, having been assessed by independent bodies on a regular basis to ensure standards are maintained.

How does the UKKA protect the data it processes?

The UKKA works hard to ensure that it maintains high standards of information security, especially when working with patient information.

The UKKA is based in a secure office which requires a swipe card to access on a site that is monitored by CCTV and regular security patrols 24 hours a day.

The UKKA has implemented a number of policies setting out how it expects its staff to behave when working with patient data, including setting what data certain staff members can have access to, ensuring that all data is stored securely, whether on a computer or in a locked filing cabinet and how to securely send data when sharing it with the organisations listed in this privacy notice.

All UKKA staff are the subject of security checks when they are employed. They must complete data protection training annually and the data protection officer carries out random spot checks to ensure that information security standards are maintained.

Every year the UKKA completes an assessment set by the NHS to show that it is complying with its responsibilities under data protection law and protecting patient data to a high standard.

What are a patient’s rights as a data subject?

This section describes how patients can access, amend, erase and move their personal data, withdraw their consent and object to or raise concerns about the data the UKKA holds and processes.