This is a statutory duty under the Public Health (control of disease) Act 1984 and the Health Protection (notification) Regulations 2010. Since October 2010, the Health Protection (notification) Regulations have required diagnostic laboratories to notify UKHSA of the identification of specified causative agents in a human sample (live or deceased patients), within 7 days. A ‘causative agent’ is defined as one of those listed in the regulations, but also evidence of an infection that has been caused by such an agent or clinical presentations listed under the Health Protection Regulations 2010 (e.g., acute meningitis) which may, or may not, be associated with a positive laboratory sample. If notification relates to a clinical presentation, rather than positive sample, the information is shared direct between the clinical teams and UKHSA without input from the laboratory.
UKHSA is an executive agency, sponsored by the Department of Health and Social Care (DHSC). It fulfils the Secretary of State’s statutory duties to protect health and address health inequalities and executes the Secretary of State’s power to promote the health and wellbeing of the nation. UKHSA’s annual remit letter from the Parliamentary Under Secretary of State for Prevention, Public Health and Primary Care sets out its responsibility to protect the public’s health from infectious diseases and other public health hazards.
UKHSA has approval from the Secretary of State to process confidential information associated with notifiable causative agents and notifiable infectious diseases without patient consent under Regulation 3 of the Health Service (Control of Patient Information) Regulations 2002.
UKHSA undertake surveillance of notifiable infectious diseases to obtain important information that is used to protect public health. This can range from intervening with a single case requiring prompt national/international intervention, to informing policy development, to developing exposure reducing measures.
What data is shared, how and what mechanisms are employed to ensure confidentiality?
The following ‘core surveillance data’ is submitted to the UKHSA:
- Source lab
- Reference lab (if applicable)
- Reporting Lab (usually the source lab, but in some cases a reference lab)
- Patient ID info: Patient surname and initial or soundex code and initial, Hospital number, NHS number
- Date of Birth
- Sex
- Organism full name and any typing results (or the description of the associated illness)
- Date of Onset
- Specimen type(s)
- Specimen date(s)
- Identification method(s) – the method(s) used to identify the organism
- Postcode
- Ethnicity
Additionally for certain defined notifiable organisms:
- name and address of the diagnostic laboratory
- patient’s home address
- patient’s current residence (if not home address)
- name, address and organisation of the person who solicited the test which identified the causative agent.
- Indicate if a patient is a Care Home resident
- Indicate if patient is a Health Care Worker
- any antimicrobial susceptibility test result and resistance mechanism(s) identified
Data generated by the laboratory information management system (LIMS) is uploaded via secure file transfer protocol (sFTP) to the UKHSA ‘second generation surveillance system (SGSS)’ and is made available to users out with the organisation, subject to robust access control mechanisms.
We receive an email notification which indicates the successor failure of the upload. In the event of failure, the file concerned is sent directly to an SGSS administrator at UKHSA via secure email (sent from and to nhs.net accounts or another DCB1596 accredited email service, such as gov.uk (used by UKHSA).
All data sent to UKHSA is encrypted and the data is processed by UKHSA in strict accordance with the requirements of the Data Protection Act 2018 and the Caldicott Guidelines.