**Introduction**

All Health and Social Care organisations (HSC) must ensure that when sharing
HSC data for nondirect care (secondary purposes), assurances are provided by
the requesting organisations that they comply with the Data Protection Act
(1998) and that staff are aware of the relevant DPA Policies and Procedures in
place.

Researchers undertaking studies and who require access to patient identifiable
information and / or anonymous HSC data should follow the research protocol
(Research Governance Framework for Health and Social Care in Northern
Ireland).

Please be aware that it may be more appropriate to make use of the Honest
Broker Service (HBS) rather than completing a Data Access Agreement. The HBS
will enable the provision of anonymised, aggregated and in some cases
pseudonymised health and social care data to the DHSSPS, HSC organisations and
in the case of anonymised data for ethically approved Health and Social care
related research.

Arrangement for access to personal data may already be covered by a contract
(eg a contract for supplier support on an information system) therefore
organisations need to be clear that any proposed data sharing is either
covered adequately by that contract or make sure that a Data Access Agreement
is completed.

The following Data Access Agreement must be completed by any organisation
wishing to access

HSC Trust data. It must be considered for approval and signed by the supplier
organisation’s Personal Data Guardian.

In the event of a breach of this agreement which results in a financial
penalty, claim or proceedings, the parties agree to co-operate to identify and
apportion responsibility for the breach and the defaulting party will accept
responsibility for any such claim.

Please refer to Appendix 2, ‘Principles Governing Information Sharing’ for
guidance.

The form is divided into Sections (A-I) as detailed below:  
  
<table>  
<tr>  
<th>

**Section A** :

</th>  
<th>

Details of Requesting Organisation

</th> </tr>  
<tr>  
<td>

**Section B:**

</td>  
<td>

Commissioning Organisation

</td> </tr>  
<tr>  
<td>

**Section C:**

</td>  
<td>

Details of data items requested

</td> </tr>  
<tr>  
<td>

**Section D:**

</td>  
<td>

Consent issues

</td> </tr>  
<tr>  
<td>

**Section E:**

</td>  
<td>

Data Protection

</td> </tr>  
<tr>  
<td>

**Section F:**

</td>  
<td>

Measures to prevent disclosure of Personal Identifiable Information

</td> </tr> </table>

**Section G:** Data Retention

**Section H:** Declaration: Requesting Organisation

**Section I:** Declaration: Owner Organisation

**Appendix 1:** Data Destruction Notification and checklist

**Appendix 2:** Principles Governing Information Sharing

Please ensure that this form is returned to: _____________________________

_____________________________

_____________________________

_____________________________

Internal Reference: _______________________

Internal Contact:

Name ___________________________________

IAO_____________________________________

Service Group (if relevant):__________________  
  
<table>  
<tr>  
<th>

Title of Agreement

</th>  
<th>

</th> </tr>  
<tr>  
<td>

Date of Request

</td>  
<td>

</td> </tr> </table>

Please state if this is an update of a previous agreement or a new request for
personal identifiable information

Date Access Begins: _______________________

Date Access Ends: ________________________

Review date if on-going agreement:_____________

An update of an earlier extract New application  
  
<table>  
<tr>  
<th>

**(A) Details of Requesting Organisation**

</th> </tr>  
<tr>  
<td>

Name of Requesting Organisation: Please note that the Data Access Agreement
will be immediately returned unless the requesting organisation has signed
section H.

</td> </tr>  
<tr>  
<td>

Name of Authorised Officer

Requesting Access to Trust Data (please print)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Position/Status

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Address

Postcode

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Sector of the requesting organisation e.g. Voluntary, Public, Private etc.

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Telephone Number

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Email Address

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Name and Telephone Number of

Requesting Organisation or Personal

Data Guardian

</td>  
<td>

</td> </tr> </table>

If you require the data to carry out work on behalf of another organisation,
please complete section (B) below. If not, please go straight to section (C).  
  
<table>  
<tr>  
<th>

**(B) Commissioning Organisation**

</th> </tr>  
<tr>  
<td>

Name of Commissioning Organisation

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Contact Name

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Title

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Contact Number

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Email Address

</td>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

**(C) Details of ‘Data Items’ Required:**

</th>  
<th>

**Rationale for data Items**

</th> </tr>  
<tr>  
<td>

Please provide a list and description of the data to which the request
applies, eg include all identifier attributes, (eg Name, Address, Postcode,
Date of Birth, Gender, HSC

Number, Diagnosis Code, Religion etc)

</td>  
<td>

Please indicate the reasons for requiring each of these data items

</td> </tr>  
<tr>  
<td>

1 _________________________________

2___________________________________

3 ___________________________________

4___________________________________

5___________________________________

6___________________________________

7___________________________________

8___________________________________

</td>  
<td>

1__________________________________

2 __________________________________

3___________________________________

4 ___________________________________

5___________________________________

6 ___________________________________

7___________________________________

8 ___________________________________

</td> </tr>  
<tr>  
<td>

Please state in as much detail as possible, the purpose for which the data are
required by the organisation named in section (A) including any record linking
or matching to other data sources.

Please continue on a separate sheet if necessary or attach any relevant
documentation.

</td> </tr>  
<tr>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

**Processing of Data**

</th> </tr>  
<tr>  
<td>

Please indicate how you propose to process the data once received (e.g. to
extract and anonymise Service User information; for auditing and monitoring of
Service User care and treatment.

</td>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

System(s) from which Data is to be extracted (If Known) Please include sites
or Geographical locations (If Known)

</th> </tr>  
<tr>  
<td>

For example PAS, RVH

</td> </tr>  
<tr>  
<td>

Is the Data to be Viewed only (V); or Viewed and Updated (U); or Transferred
and Viewed (T)?

</td>  
<td>

Please specify: _______

</td> </tr>  
<tr>  
<td>

Will Data contain Client Identifiable Details?

</td>  
<td>

**(Please Tick)**

Yes No

</td> </tr>  
<tr>  
<td>

If you have answered “No” to the question above have you considered whether
the data could be released via the Honest Broker Service?

</td>  
<td>

**Yes**

</td>  
<td>

</td>  
<td>

No

</td>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Frequency of transfers

</td>  
<td>

Once Only

Other (Please specify)

</td>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

</td> </tr>  
<tr>  
<td>

**(D) Consent Issues**

</td> </tr>  
<tr>  
<td>

Do you have the individuals’ consent?

</td>  
<td>

Yes No

</td> </tr>  
<tr>  
<td>

If yes please provide a copy of the consent form i.e Explicit consent should
be obtained for the processing of sensitive personal data.

</td>  
<td>

</td> </tr>  
<tr>  
<td>

If no, why is it not practical to obtain consent?

</td>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

**(E) Data Protection (of Requesting Organisation)**

</th> </tr>  
<tr>  
<td>

Do you have a confidentiality / privacy policy which complies with the Data
Protection Act 1998?

</td>  
<td>

Yes

</td>  
<td>

No

</td> </tr>  
<tr>  
<td>

Are confidentiality clauses included within contracts of all staff with access
to the person identifiable information?

</td>  
<td>

Yes

</td>  
<td>

No

</td> </tr>  
<tr>  
<td>

Are all staff trained and aware of their

responsibilities under the Data Protection Act 1998 and adhere to the eight
Data Protection Act Principles?

</td>  
<td>

Yes

</td>  
<td>

No

</td> </tr>  
<tr>  
<td>

Provide details /copy of your ICT security policy for your organisation

</td>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Provide confirmation that your organisation has Data Protection notification
for purposes of analysis.

Please provide your ICO notification/registration number

</td>  
<td>

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Have you conducted a Privacy Impact Assessment?

If yes please include a copy with this form.

</td>  
<td>

Yes

</td>  
<td>

No

</td> </tr> </table>  
<table>  
<tr>  
<th>

**(F) Measures to Prevent Disclosure of Person Identifiable Information (of
Requesting Organisation)**

</th> </tr>  
<tr>  
<td>

Will this data be accessed or transferred by you to another organisation?

</td>  
<td>

Yes No

(If Yes, please give details including in what country it will be stored)

</td> </tr>  
<tr>  
<td>

If Yes, has your Data Controller/Data Processor granted permission for onward
disclosure?

</td>  
<td>

</td> </tr>  
<tr>  
<td>

How will you secure the information provided being transferred?

</td>  
<td>

</td> </tr>  
<tr>  
<td>

If Applicable how will you secure information provided being transferred by
you to another organisation

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Describe the physical security arrangements for the location where person
identifiable data is to be:

  * processed; and 

  

  * stored _(if different to above)._

  

</td>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

**System Information**

</th> </tr>  
<tr>  
<td>

Provide details of access and/or firewall controls implemented on the system,
and measures to encrypt which are in place.

</td>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

**(G) Data Retention (of requesting Organisation)**

</th> </tr>  
<tr>  
<td>

Please state the date by which you will be finished using the data.

</td>  
<td>

</td> </tr>  
<tr>  
<td>

If the retention period which you require the data is greater than one year,
please indicate the reasons.

(The maximum data retention period is 2 years, after this time a review of
this agreement is required)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Describe the method of data destruction you will employ when you have
completed your work using person identifiable data

</td>  
<td>

</td> </tr> </table>

**Please ensure that the Data Destruction Notification (Appendix 1) is
completed within the specified retention period and returned to the contact
person on the front of the form.**  
  
<table>  
<tr>  
<th>

**(H) Declaration: Requesting Organisation**

</th> </tr>  
<tr>  
<td>

**Data Protection Undertaking on Behalf of the Organisation Wishing to Access
the Data**

My organisation requires access to the data specified and will conform to the
Data Protection Act 1998 and the guidelines issued by the DHSSPS Executive in
January 2009 in _“The Code of Practice on Protecting the Confidentiality of
Service User Information”._

I confirm that the information requested, and any information extracted from
it,

</td> </tr> </table>  
<table>  
<tr>  
<th>

  * Is relevant to and not excessive for the stated purpose 

  

  * Will be used only for the stated purpose 

  

  * Will be stored securely 

  

  * Will be held no longer than is necessary for the stated purpose 

  

  * Will be disposed of fully and in such a way that it is not possible to reconstitute it. 

  

  * That all measures will be taken to ensure personal identifiable data will not be disclosed to third parties. 

  

  * The Health and Social Care organisation will be informed of the data being deleted / destroyed. 

  

I _(name: printed)_ ______________________________, as the Authorised Officer
of _(Organisation)_ _________________________________, declare that I have
read and understand my obligations and adhere to the conditions contained in
this Data Access Agreement.

**______________________________________________________ Signed:**

**(Personal Data Guardian)**

**Signed: (IAO/SIRO)**

**Date:**

______________________________________________________

</th> </tr>  
<tr>  
<td>

**(I) Declaration – Owner Organisation**

</td> </tr>  
<tr>  
<td>

**DATA ACCESS AGREEMENT I CONFIRM THAT:**

  1. Southern Health and Social Care Trust consents to the disclosure of the data specified, to the organisation identified in Section A of this form. 

  

  

The disclosure of the data conforms to the guidelines issued by the DHSSPS NI
Code of Practice on Protecting Confidentiality of Service User Information,
2012.

  2. The data covered by this agreement are: **(*delete as appropriate)**

  

  

 Either data which are exempt from the Data Protection Act 1998, or

</td> </tr>  
<tr>  
<td>

 Are notified under the Data Protection Act 1998 and their disclosure
conforms to the current notification under The Act.

**Signed:** _____________________________________________________

**(Personal Data Guardian) OR (Senior Information Risk Owner SIRO)**

**Date:** _____________________________________________________

</td> </tr> </table>

**Please note that this organisation has the right to inspect the premises and
processes of the requesting organisation to ensure that they meet the
requirements set out in the agreement.**

**Any loss, theft or corruption of the shared data by the requesting
organisation must be immediately reported to the Personal Data Guardian of the
owning organisation. Please also note that any serious breaches, data loss,
theft or corruption should also be reported to the ICO by the Data
Controller.**

**Appendix 1**

**Data Destruction Notification and checklist**

Authorised users of the person identifiable data have, under the terms and
conditions of the Data Access Agreement, a requirement to destroy the data on
or before the retention date stated in Section (H).

This form should be completed on destruction of the data and returned to the
Personal Data Guardian.

This form should be completed on destruction of the data, and returned to:-

**ENTER ADDRESS**  
  
<table>  
<tr>  
<th>

**Data Destruction Notification**

</th> </tr>  
<tr>  
<td>

Name of Organisation

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Name of Authorised Officer (please print)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Position/Status

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Address

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Telephone Number

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Mobile Number (Optional)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Fax Number

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Email Address

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Title of Agreement

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Date Declaration Signed

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Date Data Received

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Date Data Destroyed

</td>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

Signature

</th>  
<th>

</th> </tr>  
<tr>  
<td>

Date

</td>  
<td>

</td> </tr> </table>

**Health and Social Care Checklist**  
  
<table>  
<tr>  
<th>

**Termination of Data Access Agreement - Trust Checklist**

</th> </tr>  
<tr>  
<td>

Name of Internal Trust Contact

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Position/Status

</td>  
<td>

</td> </tr>  
<tr>  
<td>

IAO

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Telephone Number

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Mobile Number (Optional)

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Email Address

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Title of Agreement

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Can you confirm Data flow has stopped

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Have you advised IT to stop facilitating transfer

</td>  
<td>

</td> </tr>  
<tr>  
<td>

Have you received confirmation from receiving organisation that all
information has been destroyed or returned

</td>  
<td>

</td> </tr> </table>  
<table>  
<tr>  
<th>

Signature

</th>  
<th>

</th> </tr>  
<tr>  
<td>

Date

</td>  
<td>

</td> </tr> </table>

**Once the Destruction Notification Form and the Organisation Checklist has
been completed please return both to the contact person detailed on the
agreement.**

Horizon 2020

This project has received funding from the _European Union’s Horizon 2020
research and innovation programme_ under grant agreement No 687228

##  Appendix 2 - Principles Governing Information Sharing  1  
  
<table>  
<tr>  
<th>

**Code of Practice 8 Good Practice**

**Principles 2  **

</th>  
<th>

**DPA Principles**

</th>  
<th>

**Caldicott Principles 3  **

</th> </tr>  
<tr>  
<td>

  1. All organisations seeking to use confidential service user information should provide information to service users describing the information they want to use, why they need it and the choices the users may have. 

  

  2. Where an organisation has a direct relationship with a service user then it should be aiming to implement procedures for obtaining the express consent of the service user. 

  

  3. Where consent is being sought this should be by health and social care staff who have a direct relationship with the individual service user. 

  

  4. ‘Third Party’ organisations seeking information other than for direct care should be seeking anonymised or pseudonymised data. 

  

  5. Any proposed use must be of clear general good or of benefit to service users. 

  

  6. Organisations should not collect secondary data on service users who opt out by specifically refusing consent. 

  

  7. Service users and/or service user organisations should be involved in the development of any project involving the use of confidential information and the associated policies. 

  

  8. To assist the process of pseudonymisation, the Health and Care Number should be used wherever possible. 

  

  

</td>  
<td>

  1. Data should be processed fairly and lawfully. 

  

  2. Data should be processed for limited, specified and lawful purposes and not further processed in any manner incompatible with those purposes. 

  

  3. Processing should be adequate, relevant and not excessive. 

  

  4. Data must be accurate and kept up to date. 

  

  5. Data must not be kept longer than necessary. 

  

  6. Data must be processed in line with the data subject’s rights (including confidentiality rights and rights under article 8 of the Human Rights Act). 

  

  7. Data must be kept secure and protected against unauthorised access. 

  

  8. Data should not be transferred to other countries without adequate protection. 

  

  

</td>  
<td>

  1. Justify the purpose(s) for using confidential information. 

  

  2. Only use it when 

  

  

absolutely necessary.

  3. Use the minimum 

  

  

that is required.

  4. Access should be on 

  

  

a strict

need-toknow basis.

  5. Everyone must understand his or her responsibiliti es. 

  

  6. Understand and comply with the law. 

  

  

</td> </tr> </table>

  1. These principles must be followed by health and social care organisations when considering use and disclosure of service user information. 

  

  2. Code of Practice, paragraph 3.17. 

  

  3. PDG Principles are adopted from the Caldicott Principles established in England and Wales.