Details of information used for specific purposes: Risk Stratification

Data Controller(s)

NHS Sheffield CCG


Information from health and social care records, using the NHS Number provided via the Secondary Uses Service (SUS) at NHS Digital, is looked at to identify groups of patients who would benefit from some additional help from their GP or care team. This is known as ‘Risk Stratification’. The aim is to prevent ill health and possible future hospital stays, rather than wait for you to become sick. You have the right to opt out of your information being shared by NHS Digital; please see the Your Right to Opt Out section below.

Type of information Used

Only de-identified information (NHS number removed) is accessible to the CCG.

Only GP Practices within the CCG have access to identifiable information (NHS Number) of their own patients in order to see who may benefit from additional help.

Legal basis

GDPR Article 6(1)(e) – processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller.

GDPR Article 9(2)(h) processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

A section 251 approval (CAG 7-04(a)/2013) from the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority, enables the pseudonymised information to be sent to the CCG via NHS Digital in order to help us plan the most appropriate health services for our population.

How we collect (the source) and use the information

Primary Care data extracted from individual GP practices and Secondary Care data (collected nationally via the Secondary Uses Service): Inpatient, Outpatient, Accident and Emergency, Out of Hours, Urgent Care, Community Nursing, Community Mental Health is passed to the Data Services for Commissioners Regional Office (DSCRO) so that the information can be linked. This information is passed to eMBED Health Consortium who provides the Risk Stratification tool to GP Practices on behalf of the CCG.

De-identified information is made available to the CCG to provide a picture of the health and needs of their local population, which enables:

priorities to be determined in the management and use of resources;

planning services; cover the range of potential questions, and issues they may need to consider, and

to support and evidence decisions.

Data Processors

Data Services for Commissioners Regional Office (DSCRO) hosted by North of England Commissioning Support (NECS)

North of England Commissioning Support (NECS)

eMBED Health Consortium

Your Rights

If you do not want the NHS to use information about you, collected by your GP then you can opt out by completing an opt-out form and returning it to your GP practice. There are different types or levels of opt-out available; Type 1 opt out is where you do not wish for your information to be shared outside of your GP Practice for any purpose other than your direct care and Type 2 opt out   is where you do not wish for your information to be shared by NHS Digital. From 25 May 2018 the type 2 opt-out has been replaced by the national data opt-out. Type 2 opt-outs that have been recorded previously have been automatically converted to national data opt-outs. Further information about the Type 2 opt out and the conversion to the national data opt-out is available from NHS Digital.

Details of the national patient opt out can be found here:

With regards to Risk Stratification under GDPR you have the right:

  • To be informed about the processing of your information (this notice)
  • Of access to the information held about you
  • To have the information corrected in the event that it is inaccurate
  • To restrict or stop processing
  • To object to it being processed or used
  • Not to be subject automated decision-taking or profiling
  • To be notified of data breaches

How long we will keep the information

Information is retained in accordance with the Records Management Code of Practice for Health and Social Care 2016. Datasets received via NHS Digital are retained for as long as the Data Sharing Agreement is in place

Who we will share the information with (recipients)

This information is not shared outside of the CCG


This is a printable version of Stratification.htm?pr=