Data can help answer important questions about health and care, but using it comes with a responsibility to protect the people behind the data. At iCARE, decisions about how data is accessed and used are supported by governance, legal, ethical and security controls. These controls help make sure data is used for legitimate purposes, by the right people, with appropriate safeguards in place. But what does that actually mean in practice?
1. Who makes decisions about your data?
There isn't one person or one committee responsible for everything. Different parts of the data lifecycle have different responsibilities and checks.
iCARE works within the governance arrangements of Imperial College London, Imperial College Healthcare NHS Trust and the wider North West London health and care system. Together, these arrangements provide oversight of how data is accessed, used, protected and shared.
Key players include:
2. Why was iCARE entrusted with this role?
iCARE was established in 2019 by Imperial College London and Imperial College Healthcare NHS Trust, bringing together two trusted organisations with expertise in research, healthcare and data.
During the COVID-19 pandemic, iCARE's infrastructure expanded rapidly to support the urgent need for timely health intelligence across North West London - helping organisations understand infection rates, hospital capacity, vaccination and the impact on local communities.
This experience demonstrated iCARE's ability to securely manage and analyse health and care data at regional scale, laying the foundations for its role today.
3. How is your data protected?
The Secure Data Environment
The Imperial Secure Data Environment (SDE) provides a protected place for approved researchers to work with health and care data.
Researchers don't simply receive a copy of the data to use on their own computers. Instead, they access the data within the secure environment, where access and activity can be controlled and monitored.
Only authorised researchers can access data, and safeguards are in place to check what information can leave the environment.
Governance isn't an afterthought. It's built into how the SDE works. Ben Glampson iCARE Associate Director
The Imperial Secure Data Environment (SDE) provides a protected place for approved researchers to work with health and care data. Researchers can access the data they need for an approved project, but the data remains within the secure environment rather than being downloaded onto personal computers or devices.
Access is restricted to authorised researchers, and safeguards are in place to monitor how data is used and check what can leave the environment.
The SDE is one part of a wider system of safeguards that helps protect data throughout its use.
5. Five layers of protection
Keeping data safe involves more than technology.
We use the Five Safes framework to apply safeguards throughout the process: from deciding who can access data and why, through to checking what can leave the secure environment.
The Five Safes framework was developed by the UK Office for National Statistics and is now widely used to support the safe and responsible use of sensitive data.
Why do organisations need to work together?
Your care doesn't happen in one place
You might receive care from your GP, a hospital, community services or other parts of the NHS.
People move between GPs, hospitals, community services and other parts of the NHS, so understanding your health care in full can sometimes require information from different organisations.
In North West London, there is a formal data-sharing agreements which sets out how information can be shared safely, why it can be used, and who is responsible for it.
North West London Data Sharing Agreement
6. Who decides whether researchers can use data?
The Data Access Committee
Researchers cannot simply request health and care data and start using it.
Requests to use data from the Imperial SDE go through a formal review process to make sure the proposed use is appropriate and the necessary safeguards are in place.
100 percent of requests are reviewed by members of the community, making sure that the people whose data is being used have a voice in how it is accessed - and that research serves the communities it draws from, not just the institutions conducting it.
What does this look like when someone wants to use the data?
Can I see what my data is being used for?
Your health and care data is personal and sensitive. We believe people should be able to understand how data is being used, who is using it and what the research aims to achieve.
We publish information about projects that have been approved to use data from the Imperial SDE.
/prod01/channel_3/media/images/landscape-3000X2000/250617_Presidents_Awards_Winners_2024_Celebrating_Engagement_Campaign_Young_Producers_EB_007.jpg)
Transparency
See how your data is being used, who is using it, and what the research aims to achieve.
See which projects have been approved to use data.
Contact us
For general enquiries email: imperial.dcs@nhs.net
For data access enquiries email: imperial.dataaccessrequest@nhs.net