Privacy Impact Statement

What study is this?

The UK HIV Drug Resistance Database (UKHDRD).

The UKHDRD study is organised by a study team at University College London, Institute for Global Health. The study is funded by a grant from the Medical Research Council. The data controller is University College London.

 

What is the study about?

The UKHDRD study investigates changes in the prevalence of HIV-1 drug resistance over time and epidemic dynamics of HIV-1 in the UK. The study makes use of data that are routinely collected in a number of virology laboratories across the UK, for people with HIV tested for HIV drug resistance since 1996.

 

What information does the study collect?

Routinely collected information including HIV nucleotide sequences and antiretroviral treatment history.

 

What personal data does the study collect?

We do not collect identifiable personal data such as name, address or postcode. We do collect a minimum number of data items that are needed to run the study (clinic identification number, date of birth, gender, and an encoded version of a patient’s surname [Soundex]), and these are stored securely within the study database. They are used to query information with laboratories and to link records to other clinical research databases.

All these stored data items are removed or anonymised for the final datasets used for research analyses; clinic identifier is replaced by a study specific identifier number (and replaced by a randomly generated identification number before release to collaborators), date of birth is reduced to year only; gender is coded and Soundex is removed. Geographical information regarding the centre requesting the resistance test is aggregated to 15 regions of the UK.

Linked personal data items, such as ethnicity and date of death, are coded and aggregated and reduced to month/year of death respectively.

These measures, combined with robust safeguards to limit access, ensure that it is highly unlikely that our data could be used to identify any individual.

 

What is the purpose and legal basis for processing the information?

The purpose and legal basis of collecting and processing information in the UKHDRD study is for scientific research into drug resistance and the epidemic dynamics of HIV-1 in the UK.

 

How do we collect this information and what do we do with it?

Each year, participating virology laboratories send the data required for the study to the study team. Data are sent in an electronic format and by secure transfer methods.

The data from each laboratory are checked, cleaned and merged. Each year an anonymised dataset is produced to use for research analyses.

Proposals for research analyses come from the UKHDRD study group and from collaborations with other HIV observational cohort studies and projects. The results are presented at conferences and are written up for peer-reviewed publications and other study outputs.

 

How is the information kept secure and where is it stored?

Data are sent to the study team by secure, encrypted, transfer methods. The data sent and the database itself are stored on separate servers at the MRC CTU at UCL, University College London.

The submitted data, and the study database can only be accessed by a few named individuals.

Datasets used for analyses are anonymised.

By removing clinic identifiers and anonymising the dataset before it is used for analyses, researchers do not have information that could identify a patient.

Staff must undergo annual information governance training.

 

Who is the Data Controller?

University College London

 

Is the information shared or linked with other studies or datasets?

Yes, some information is linked and shared with a number of other UK HIV studies. Linking records enables the anonymised data to be used for research analyses on a broader range of topics.

We link and share information with other UK HIV studies that are also managed within UCL: the UK Collaborative HIV Cohort Study (CHIC), to understand better the epidemiology and clinical aspects of HIV drug resistance; The Collaborative HIV Paediatric Study (CHIPS) which studies HIV in children and adolescents living with HIV in the UK to understand drug resistance in individuals exposed to treatment since childhood.

We also link and share information with records at Public Health England for the purpose of surveillance of transmitted drug resistance in the UK.

 

Is there any automated decision making or profiling, and why is this done?

No.

 

How long are the data kept for?

Data submitted from participating laboratories are kept for 2 years. Data archiving is done in line with MRC guidance. The anonymised datasets used for research analyses are kept indefinitely and are archived and managed accordingly.

 

What we will not do with the information collected.

The anonymised datasets are not currently made publicly available. Instead, data or subsets of the data are made available to collaborators working in academic or research organisations. First though, collaborators must submit a research proposal to the group and this must be accepted by the study’s steering committee. Only data items necessary for the research analysis being conducted are provided.

 

What to do if you do not want your data to be included in this study, or if you want to see your data that we hold.

Data for an individual can be removed from the database and from any research analysis datasets.

If an individual attending for care at a UK HIV clinic wants to see their study record data, please speak to your HIV doctor in the first instance.

 

What to do if you have a concern or complaint about the study.

If you have a concern about how the UKHDRD study handles your information, contact the Information Commissioner’s Office (ICO) www.ico.org.uk/concerns or the ICO telephone helpline 0303 123 1113.