The Scottish Government requested that NHS Education for Scotland, a special NHS Board, develop a secure National Clinical Data Store to act as a single national data repository, where possible, in relation to seasonal influenza, pneumococcal, shingles and, more recently, COVID-19 vaccinations given to the Scottish population.
This was necessary for the following reasons:
- To manage the change of responsibility for providing vaccines from GP Practices to NHS Boards as detailed in the new general medical services contract
- To provide an overview of vaccinations provided to individuals at a local and national level, given that multiple IT systems exist across multiple sites in NHS Boards (note this overview will not identify individuals)
- To manage the way new COVID-19 vaccinations are administered to patients in that individuals may require 2 doses at a clinically recommended number of days or weeks apart with a need to know when each dose was administered
- To ensure that information about previous vaccinations are available to clinical staff at the point of administration to ensure patient safety
- To provide information to support clinical audit, public health planning, public accountability and generating intelligence about COVID-19
Lead organisations
- Scottish Government
- NHS Education for Scotland (NES)
- Public Health Scotland (PHS)
- NHS National Services Scotland (NSS)
- GP Practices (GPs)
- Territorial NHS Boards
What is being done, and why?
In the provision of any vaccination, the following processes need to happen:
- To identify the different groups of individuals who should be prioritised to receive the vaccination – e.g. in the case of COVID-19 vaccination, the elderly and care home and health and care workers will be prioritised initially.
- To communicate with patients and health and care staff to inform them about the vaccine and schedule an appointment
- To administer the vaccination at various locations in Scotland, while making sure there are sufficient doses available for all those scheduled to attend
- To record important clinical information, e.g. type of vaccine, vaccination batch number, the date given, the dose given, location in the body, informed consent for receiving the vaccination,
- To record important information about the person receiving the vaccination, e.g. NHS identifier, name of the patient, address of patient, patient date of birth, location of premises where the vaccine was given, patient’s NHS Board, patient’s GP Practice
NHS Education for Scotland has modified a clinical assessment tool for use as a vaccination management tool. This tool has undergone extensive clinical and security testing and assessment to ensure that it is both safe and secure. This will be made available to clinicians in the health and social care service and GP Practices who administer vaccinations to the population so that, where possible, it will be used in place of their current electronic systems and report back to the national clinical data store.
A scheduling system is being developed by NHS National Services Scotland to handle appointments and bookings for vaccination clinics which may take place at various locations in Scotland, including care homes.
Albasoft is a trusted partner and has been appointed as a processor by NES to work with GP Practices to ensure that GP Practice information systems are updated with information about their patients’ vaccination status, and this information is also used to update the national clinical data store.
What data are used, and who is the data controller?
NES and PHS are joint controllers of the data in the national clinical data store. NES will be responsible for the provision of the secure infrastructure and the provision of data to and from GP systems.
PHS will use the information held in the national clinical data store (NCDS) for public health, public accountability and management information purposes; and will also work collaboratively with NES to accurately identify the groups of people initially eligible for COVID-19 vaccination. In doing so, PHS provides the NHS identifier for each eligible health and social care staff and care home staff to allow for scheduling of vaccination appointments, thereby ensuring that the vaccine is offered to the right person. PHS does so in a specific processing capacity for NES.
Health boards are responsible for vaccinating the population in their territorial boundaries. GPs assist the health boards in this responsibility. GPs (and the relevant health board) are both controllers of their patient’s GP medical record, and they assist in the validation of the vaccine cohorts. GPs assist with the validation of cohorts, to ensure their patients are assigned to the right priority group for vaccination based on their understanding of the needs and risks of their patients.
NES works collaboratively with NHSSScotland health boards, including PHS, to agree on all the necessary data flows into and out of the NCDS. PHS publishes regular statistics for public accountability, provides management information to NHSScotland to help with planning and decision making, engages in activities in relation to evaluating the vaccination programme, monitoring the effectiveness and safety of the vaccine, as well as supporting research activities which have undergone scrutiny and authorised to proceed.
NES have an additional role in providing the Vaccination Management Tool to support frontline administration and recording of vaccinations.
NSS is a processor on behalf of PHS to develop tools for reporting on immunisation activity. NSS manages PHS’s cybersecurity and IT services under a shared services agreement.
NSS is a controller in respect of the capture and reporting of data on vaccine stock availability and vaccine delivery locations. NSS will be able to report on report on overall inventory levels across the supply chain and ad-hoc reporting for vaccine batch traceability. Additionally, NSS manages the case management service for COVID-19 test and protect and contact tracing on behalf of PHS and will become the controller of the COVID-19 data extracts that are used for linking to any positive COVID-19 case reported into the case management service for supporting vaccine safety minoring purposes.
Albasoft is a processor on behalf of NES appointed to provide the necessary connection to allow vaccination information to flow between GP systems and the NCDS (both directions).
GP Practices and their respective territorial NHS Board are joint controllers of the data within GP Practices.
The following data are used for the COVID-19 vaccination programme:
- Information about the person receiving the vaccine: NHS identifier (Community Health Index), name, address, date of birth, sex, ethnicity, GP Practice, Health Board, reason for decline, eligibility status
- Information about the clinic: vaccination centre/clinic details, vaccinator name and job title, date of clinic
- Information about key clinical details of the person receiving the vaccine: clinical adverse event, reason vaccine cannot be administered, pregnancy (if applicable), informed consent for vaccine given/not given
- Information about the vaccine: product name, batch number, dose, dose number, method of administration, body location of administration
The sharing of data between General Practices, territorial Health Boards, PHS, NSS and NES is in accordance with the 2018 General Medical Services (GMS) contract in Scotland and the Intra NHS Scotland Information Sharing Accord (2020).
Your rights
The information held in the national clinical data store forms part of the patient’s clinical record and is required by NHS Scotland to allow clinical audit and ensure safe treatment. There are no fundamental changes to your data protection rights.
We have explained more about how to exercise your rights in the main page of this COVID-19 Privacy Statement.
Should you wish to exercise your rights in relation to vaccination data held about you within the national clinical data store, please contact NES in the first instance.
Data retention
The data in the national clinical data store will be retained in accordance with the Scottish Government Records Management Health and Social Care Code of Practice (Scotland) 2020 and in line with those for GP records. This decision is based on the need to ensure that GPs and other clinicians have access to vaccination records over an extended period to ensure clinical safety.