COPI notice transition applications

Contents

What does this mean for me
I need Regulation 5 support - what do I do?
How to begin the process
Precedent Set Category: COPI Notice transition
Exclusion Criteria

What does this mean for me?

If you are relying on the General COPI notice and need to process confidential patient information for COVID-19 purposes after 30 June 2022 you should use the remaining time to ensure you have an alternative lawful basis. If you don't you will need to cease processing of confidential patient information after 30 June 2022.

Alternative lawful bases could be:

• obtaining patient consent,
• Regulation 3 support
• applying to the CAG to transition to Regulation 5 support

If you do none of these you will need to delete all identifiable information.

The following areas are outside the remit of the CAG’s legal and regulatory framework.. You should not submit an application to the CAG if you:

• are carrying out activities related to COVID-19 that primarily or solely supports the provision of direct care – these activities are excluded from the scope of the COPI notice
• are processing confidential patient information by members of the direct care team/those with legitimate access with no onwards identifiable disclosure
• are processing confidential patient information under the NHS Digital COPI Notice, NHS England and Improvement COPI Notice or the Biobank COPI Notice
• rely on another legal basis, for example where Directions are in place, or Regulation 3 support will be the appropriate legal basis.

I need Regulation 5 support – what do I do?

If you have identified that transitioning to Regulation 5 support should be the permanent legal basis for your activity you should make an application to CAG no later than eight weeks ahead of the expiry of the COPI notice. Any applications submitted after this date may not be processed in time to have a permanent common law legal basis under Regulation 5 support when the General COPI notice expires.

Applying to CAG early will provide legal reassurance that your activity can continue without breaching the common law duty of confidentiality (and data protection legislation) and without impacting on ongoing activities.

How to begin the process

• check that the activity is:
  • currently relying on the General COPI Notice for processing of confidential patient information for COVID-19 purposes
  • continuing to process confidential patient information for COVID-19 purposes after expiry of the General COPI notice on 30 June 2022
  • unable to use an alternative permanent legal basis such as Regulation 3 support, consent or deleting all identifiable patient information
• contact the Confidentiality Advice team at cag@hra.nhs.uk so we are aware of the application and are able to support you
• read and follow the guidance in the COPI notice Precedent Set Category carefully and prepare your application documents. Research applications should be prepared on the Integrated Research Application System (IRAS). Non -research applications should be prepared on the section 251 form
• after initial contact we will begin working with you to arrange a meeting booking and advise on the timeframe for submitting the application documents.

Precedent Set Category: COPI Notice transition

The COPI notice transition precedent set category has been developed by CAG to support those relevant activities that need to transition from the general COPI Notice to a more long-term legal basis. This legal basis is known as Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002 (‘Regulation 5 support’).

To be processed under this category, the activity purpose must primarily or solely relate to COVID-19 and patient data would have been processed under the general COPI Notice prior to applying to the CAG.

You should ensure all of the following are addressed in your application, or in place;

• Favourable Research Ethics Committee (REC) opinion. If there have been significant changes to your research and you have not yet submitted these to REC, you should submit these now using the amendment tool
• For research applications – a fully completed and signed CAG section in IRAS. You should use the IRAS form from your original application to REC and update Question 4 on the project filter page to enable the CAG form, ensuring that the information in the original IRAS form is still relevant. You will not need to re-submit this form to the REC. A PDF of the completed CAG section will be required for your application
• For non-research applications – a fully completed and signed Section 251 form
• For all applications, clear descriptions of where the breach in confidentiality is, the scope of support requested and how long support is needed
• A cover letter outlining what activities in relation to processing confidential patient information without consent have been completed under the COPI notice so far and what activities are yet to be completed, along with a predicted timescale for completion
• A clear data flow diagram showing the flows of identifiable information and controllership at each stage
• Security assurances for all organisations processing identifiable data. Read further information on security assurances.
• Patient objection - it is understood that certain activities taking place under the general COPI Notice do not currently need to respect patient objections due to the nature of the activity. .
• Patient notification – reasonable steps should be taken to inform the relevant cohort of the unconsented activity. You should provide a description of the communications plan, including timeframes, which should be proportionate to the activity and ability of the cohort to receive this information. Privacy notices required under data protection legislation are not considered sufficient in isolation but can form part of the plan
• Patient and Public Involvement (PPI) – this should be relevant to the unconsented activities set out in the application to CAG. If no relevant PPI has been undertaken, you should provide a description of the PPI you plan to undertake and the timeframe for completion.

Exclusion Criteria

Applications meeting any of the following criteria will not be processed under the Precedent set category: COPI Notice transition. These will automatically be referred to a full CAG meeting:

• Applications involving access to free text
• Seeking access to, or linkage with, the Human Fertilisation and Embryology Authority research register, genetic information or non-health data
• The transfer of confidential patient information outside of the European Economic Area (EEA), or to organisations who intend to use the information for commercial purposes
• Some applications may raise specific complex issues that may be referred to a full CAG meeting. You will be informed if this is the case and supported through this process by the Confidentiality Advice Team