Skip Ribbon Commands
Skip to main content

GDPR Compliance

:

GDPR: alex.simpson@evidera.com

Email address

alex.simpson@evidera.com

What is the title of your Research Study?

Retrospective study of treatment patterns and overall survival in patients with advanced melanoma, advanced renal cell carcinoma and metastatic squamous cell carcinoma of the head and neck in the United Kingdom.

What is the IRAS Number for the study?

257073

What is the description of the data?

NONPCD - Non Identifiable - only relevant for anonymous surveys - Consent forms are identifiable

Is it bulk data?

Yes - bulk data is defined as more than 50 instances

What is / are the name/s of the data capture tools?

​ChemoCare

What is/are the 'type' of data capture tools?

Off the Shelf 'online' data capture

Please provide a description of the data capture tools

​ChemoCare provides a chemotherapy prescribing and patient management system to over 80% of the UK’s National Health Service (NHS) cancer centres and has been in use in the NHS for over 15 years. The ChemoCare dataset can be linked to other systems including HES, through use of national patient identifiers (e.g., NHS number in England and Wales, CHI number in Scotland). De-identified data from ChemoCare provided by CIS-oncology will include demographics variables (e.g., age, sex, body mass index [BMI]), disease characteristics (e.g., cancer type, diagnosis date, stage), real-world usual care systemic treatment patterns (e.g., therapy type, cycle dates, dose) and survival status (e.g., date of death).

Is the data already collected for clinical purposes?

Yes

Is relevant access authorised?

Yes

How does the data flow?

Data sent External only - external to UHL sites

Does the data leave the originating department?

Yes - Please give details in the 'Specific Address of Destination for Data' section

What is the Specific Address of Originating Data?

HOPE Annexe

Level 2 Sandringham Building

Leicester Royal Infirmary

LE1 5WW

What is the Specific Address of Destination for Data?

Cyrus One data centre, 2223 NE Creek Pkwy, Durham, NC 27713, United States

What is the Legal Cover for Flow of Data?

Legal Request

How is Data Sent?

Data viewed via systems

If 'other' answered above, please give details

 

Is information provided via other teams?

Yes

Are you collecting Childrens Personal Confidential Data?

No

Have the roles for data collection personnel been defined?

NA

Have the roles for CRF completion personnel been defined?

Yes

How are access controls managed?

​​Access to ChemoCare system is limited to those with authorised access with a login username and password

Have 'data' personnel been added to the Delegation Log?

Yes

How will staff be trained on the systems and how will ongoing training be provided?

​No training will be required from site staff as data is extracted directly from the ChemoCare platform by CIS Oncology. Staff that enter data into ChemoCare will have already been trained on its use

Has access to electronic CRF been arranged?

NA

Has the frequency of collection and upload to CRF been agreed?

NA

Will any mobile equipment be used for this study?

No

Has the Point of Contact for Data Queries been confirmed?

Yes

Does a Confidentiality Agreement exist?

Yes

Is 3rd Party access allowed?

No

Does a Data Sharing Agreement Exist?

Yes - within existing contract

Are there defined access controls?

Yes

Does Data Collection Tool(s) Remote Access exist?

Yes

Other HCP Social Care access - name protocol

​HCP's can access ChemoCare at their site in the usual way

Please describe the Registration / Deregistration process

Confidentiality:

Ethical concerns relating to personal data are addressed by ensuring security of personal data acquired for the study

and by following good clinical practice and the requirements of the European Union data protection law (General Data

Protection Regulation [GDPR]) and data protection regulations of the countries to which study data may be transferred

to for analysis. Data will be provided by CIS-Oncology to contract research organisation (Evidera, a part of PPD) in a

pseudonymised format containing no patient identifiable information. For the purposes of protecting a patient's identity,

a unique code will be assigned to identify each patient. CIS-Oncology will keep the key to match the unique study

codes with the NHS patient identifiers and Evidera and Bristol-Myers Squibb will not have access to this.



Informed consent:

All data collected will be retrospective and will be pseudonymised to ensure that no patient identifiable data will be

extracted and transferred from ChemoCare. It is therefore not anticipated that informed consent is required for this

study. In line with GDPR, centres that take part in the study have information pages on their hospital websites,

describing how patient data may be used for research.



Repeated access to data (waved data collection approach):

Data from each wave will be used in the final analysis. The rationale for this approach is because at the time of the

first data extract (wave 1), some treatments for the indications of interest may have only been on the market for a short

period of time and therefore repeated data extraction would facilitate the evaluation of longer term outcomes (e.g.,

treatment patterns and overall survival). While new patients will be included with each follow-up wave (waves 2-7),

patient identification and data collection will remain fully retrospective at each follow-up extraction. At each follow-up

wave, the data extracted will span from the time of the first wave (i.e., the study eligibility period start date) up until the

current wave extraction date. Data collected from each subsequent follow-up wave will replace data extracts from

previous waves, to ensure that the most up-to-date information is available at each timepoint. The same confidentiality measures will apply to the first wave and any follow-up waves. With this approach, no linking between data extraction

waves is needed.

The ChemoCare prescription platform owner (CIS-Oncology) will be provided with a list of the variables and timepoints

of interest and they will de-identify all data before sending this to Evidera. Therefore, Evidera will not have access to

any patient identifiable data at any stage in this study.

Who will the data be shared with?

The data will be analysed by researchers/analysts from Evidera (a part of the PPD contract research organisation)

geographically located in the United Kingdom (UK) or United States (US).

In what Media is Data Set Stored?

Electronic

Data stored electronically - where?

System outside of UHL / UOL

Who is the Information Asset Owner?

Adrian Nicholson

Who is the Information Asset Administrator?

Adrian Nicholson

Name of Data Controller/s & Organisation

Chirs Short, CIS Oncology

Are there business continuity plans in place?

The primary data centers are built to specifications to ensure physical security, are hardened to prevent intrusion, and are supported by back-up power sources. PPD's production data center is compliant with HIPAA, FISMA (High), FedRAMP, ISO 27001 and PCI DSS standards.

Have the Data capture tools been recorded on UHL Asset Register?

No

How long will the data set be stored?

5 years

How will information be disposed of?

Software will be used to securely delete from all systems

What Date will the data be destroyed?

30/06/2024

Attachments

Created at 26/06/2019 12:44 by  
Last modified at 26/06/2019 12:44 by