Data protection information for patients in Scotland who might be invited to take part in ORION-4
WHO IS ELIGIBLE TO TAKE PART IN ORION-4 AND HOW ARE THEY IDENTIFIED?
People are potentially able to take part in ORION-4 if they have had a heart attack, stroke or an operation or procedure to unblock or bypass one of the arteries to their legs or to repair their aorta, and they are at least 55 years old. In Scotland, these patients are identified by the electronic Data Research and Innovation Service (eDRIS) team, which is part of Public Health Scotland. eDRIS may also liaise with NHS Scotland Health Boards to allow the exclusion of patients who have opted out of contact for research at the Health Board. eDRIS holds information from the records that health providers in Scotland keep about the care and treatment they give and are able to run an electronic search to find patients who have had one of these conditions or procedures. Details, including name, sex, date of birth, address, CHI number and registered general practice, for these patients are securely transferred to the Health Informatics Centre, University of Dundee, a designated Safe Haven for NHS data in Scotland, so that invitations to take part in the study can be sent.
HOW IS PERSONAL DATA ABOUT POTENTIALLY ELIGIBLE PATIENTS PROCESSED?
Personal data about potentially eligible patients are used to mail a letter inviting them to attend a study visit at their local ORION-4 clinic. Invitation letters will be printed and mailed by the Health Informatics Centre (HIC), University of Dundee. The ORION-4 team at the University of Oxford does not have access to this information, and will only become aware that patients are interested in joining the trial if they complete the reply slip included on the invitation letter and return it by FREEPOST to the ORION-4 research team in Oxford.
People who decide to take part in the study are asked to provide written consent at their first study visit. For details about how information about study participants is collected and processed see the Data protection information for ORION-4 participants section of this website. Information about people who decide not to take part (or do not reply) is kept securely by HIC until 2024 at the latest to ensure those people are not invited again and to produce reports about the study (for example how many people were invited). After that, information about potentially eligible patients who did not take part in the study is deleted. ORION-4 is coordinated by the Clinical Trial Service Unit at the University of Oxford and is co-sponsored by the University of Oxford and Novartis Pharmaceutical Corporation. Information about patients who are to be invited to take part in ORION-4 may be shared with the NHS Health Board in which it was originally recorded, but will not be shared with any other organization. No information identifying any individuals will be transferred to Novartis Pharmaceutical Corporation.
The Health Boards in NHS Scotland are “data controllers” for information used to send invitations to potentially eligible individuals in Scotland, which means the data are handled by HIC on behalf of the Health Boards to allow invitations to be generated and posted. Information about potentially eligible patients is stored securely using encryption and password protection and access is limited to only those members of staff who need to use the information. HIC is using information about people who are potentially eligible to take part in ORION-4 for research purposes to generate invitations and it will only process “personal data” (information about someone where that individual could be identified) in order to undertake research carried out in the public interest. This is known under data protection law as the “legal basis” for processing personal data.
The Public Benefit and Privacy Panel for Health and Social Care (PBPP) has approved, and provided support for, details about potentially eligible patients in Scotland to be shared with HIC and used to generate invitations to join the ORION-4 trial.
After a patient in Scotland has shown interest in the trial by returning a reply slip to the research team in Oxford, the University of Oxford will then act as the “data controller” for information collected from that point onwards, including information collected during the trial after a participant has given consent. This means that the University of Oxford is responsible for looking after this information and for ensuring it is used properly.
RIGHTS AND COMPLAINTS
If you would like to find out whether the ORION-4 team holds information about you then contact us via our website, by e-mail at orion4@ndph.ox.ac.uk, or telephone 0800 585323. If you do not wish to receive an invitation to take part in ORION-4 or do not want the ORION-4 team to hold information about you then please contact us.
You have the right to access any personal information that is held about you by the ORION-4 team, the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict processing or object to processing or to receive an electronic copy of the personal information we hold about you. If you would like to discuss this further please contact the ORION-4 team using the details above or alternatively you can contact the Data Protection Officer, data.protection@admin.ox.ac.uk.
If you are not happy with the way your data has been handled by the ORION-4 team you have the right to lodge a complaint with the Information Commissioner’s Office (0303 123 1113 or www.ico.org.uk).