Close
In order to access personal data you need permission. Find out what permissions you need.
In some cases you will need to start by asking the participant themselves (consent). However, approaching NHS patients or, say, school pupils to ask for their permission is usually regulated under further permissions guidelines like the Health Research Authority or the Department for Education. Havig ethical approval for a study is not sufficient to start collecting data, generally.
Use of personal data in research requires ethical approval. Find out whether you need ethical approval and which type here. If you imagine a hospital where there is just a small research department, the ethical approval may not be connected at all to the overall information governance regime at the hospital.
When accessing data collected by another organisation, most organisations will have an approval procedure to follow. Public Health England use the Office for Data Release and NHS Digital use their own Data Access Request Service (DARS). Depending on how you wish to access these data, the provider will determine a process which meets their own requirements as a Data Controller.
You might be asked for assurances around confidentiality in the form of a security questionnaire or simply through dialogue. UCL has policies and procedures for maintaining confidentiality which researchers can quote in order to provide the necessary assurances. Note that this means you will have to work in line with the assurances that you provide at this stage. IT for SLMS operates an IG Toolkit which researchers will be able to use if a data provider asks for this level of assurance and the project has provided the appropriate level of assurance. It requires that your project is registered with SLMS Information Governance services. Click here to begin this process (requires a UCL login).
Moreover, third parties will control data coming to UCL with a contract. If you are asked by a third party to sign a contract then you need to be sure you can comply with the terms after getting suitable advice first, after which you should seek a contracts officer from UCL's Research Contracts department.
Some NHS bodies do not provide guidance on their web pages about gaining approvals but their procedures are internally managed. As a rule of thumb, you should seek guidance from the Information Governance Lead of an NHS Trust before trying to gain access to patients or their data for research.