IBD Registry Closure FAQs

Following the announcement of the IBD Registry’s planned closure, please click on the frequently asked questions (FAQs) below to see the responses.

FAQs about closure

What will happen to the data, tools, and other assets?

The future ownership of the data, tools, and other assets is under careful consideration, ensuring compliance with legal and data protection obligations. We understand especially patients want to understand possible pathways for the data, and this will be clearly communicated to the key patient stakeholders to maintain the high standards of data transparency that the IBD Registry has always upheld.

What will become of all the data the Registry is holding?

We are working carefully on safe transfer of the datasets . The IBD Registry holds a number of different datasets, and there are strict guidelines on who these can potentially be transferred to. It has to be an organisation with similar goals and objectives to that of the IBD Registry, with appropriate technical and organisational capabilities to handle and look after the data.

The IBD Registry also holds a set of anonymised study datasets (these are specific subsets of the main dataset that were used in research and other studies). Best practice in research and studies is that the same analysis can be done again (reproduced) if needed, to show that the study findings were robust.  For this, it is envisaged that each study dataset will be securely returned to the academic lead or clinical centre for the study, in line with best practice and to provide reproducibility for the study if required.

How and who will make the decisions on where the data will go?

The final decisions on the data will be considered by the IBD Registry Board of Directors, who will make a recommendation to the governing Member organisations of the IBD Registry for final approval.

Discussions are underway with a selected group of appropriate organisations, to a ensure a safe, secure and trusted home for the data, so that any decisions are well-informed.

We will be guided closely by our Data Protection Officer to ensure compliance with all legal requirements in our decision-making, including GDPR. We will also seek guidance and approval as required from key regulatory bodies, such as the Confidentiality Advisory Group and Health Research Authority.

How are people with IBD being represented in this decision making?

Communications with stakeholders, especially people with IBD, will take place during the upcoming closing period.  We will also be consulting closely with our Patient Advisory Group, and guided closely by our Caldicott Guardian who represents the patient within the clinical community.

What is the official closing date of the IBD Registry?

The official closing date will be 31 March 2024.

Who do I contact if I have a question after the IBD Registry has closed?

The data, tools and other assets are being transferred to a safe haven organisation, whilst discussions are underway with partners on a permanent home for the data. The IBD Registry website will remain available, with updates posted there. Any contact points required will also be listed there as well.

What is happening with the IBD Registry’s projects, data, tools and know-how?

The IBD Registry has collaborated with over 170 hospital teams and over 60,000 patients across the UK to create 5 primary datasets for quality of care improvement and research. These have contributed to published papers and presentations at national and international meetings, as well as producing national reports and reports for individual IBD teams.  There are more details on our story here.

Current outstanding projects are being completed in the coming months to March 2024, so that we expect to close with all contracts and obligations fulfilled.

We are working with key partners to establish the best possible way to transfer and integrate the data, tools and know-how, so that the ongoing benefit to people with IBD can continue.

What will happen to the IBD Registry’s Quality Accounts program?

The IBD Registry has been the representing organisation for IBD on the annual NHS England Quality Accounts programme since 2018.  This is based around the collection of patient-level clinical data and as we have not currently identified another organisation that can take the IBD Registry’s place, we will write to HQIP and NHS England to withdraw from April 2024.

We have now just completed the current data collection year (2023) for the Quality Accounts year 2023-24; and are preparing for participating hospitals and IBD teams their annual Quality Accounts report.  We anticipate delivering this by early March 2024 at the latest, to allow time for any queries back.

FAQs for clinical teams

What will happen to the IBD Registry’s WebTool and IQICC (KPIs) Tool?

The current plans are that both will be decommissioned by the end of March 2024. We are contacting all WebTool users to make arrangements for transferring their data to their IBD team. For the KPIs Tool, we have been exploring whether this could be continued by another organisation, but this is looking unlikely. It is possible for a Trust with an existing REDCap installation and technical capability to set up a local version of this if wished. If this is of interest to you, please contact [email protected].

What will happen to the IBD Registry’s Cerner IBD module?

The Cerner IBD Registry module has been developed independently (but based on the IBD Registry dataset definition) by IBD clinicians together with Cerner; and allows a Trust using the Cerner eHR system to download a module designed for IBD. It is live for use, and for details please contact: [email protected].

What will happen to the Patient Advisory Group?

The current activities of our Patient Advisory Group (PAG) are being sustained until March 2024, to support our goal of embedding patient voice in the processes during this period. However, following this period, the PAG will be disbanded. We extend our sincere gratitude to all our members for their dedication and hard work throughout this journey.

What should we do if a patient asks us about wanting to remove their data from the IBD Registry before it closes?  

For patients that have consented, they will be contacted directly using the email address that they gave us with information and options. For those patients that gave us a mobile phone number, we will use that for contact, and for those who gave a home address as preference we will use post.

What if a patient asks us about withdrawing their consent?

Anyone who has consented to the IBD Registry can withdraw their consent in the usual way, up until early March 2024.

FAQs about the data

Will any processing of my personal data occur between now and the planned closure date of 31 March 2024?

Communication: We will use your contact information to contact you to keep you informed and updated about the closure process. 

Data storage: We may anonymise your data and/or process your data into a format that is more secure for storage and transfer. 

Completion of Projects: We are in the process of finalising the remaining quality improvement and research projects. 

I want to know more about the IBD Registry’s data protection and data privacy policies.

You can find out more on our privacy policy page. 

UPDATE 14 FEB 24 - What will happen to my personal data after the planned closure of the IBD Registry on 31 March 2024?

To maximise the legacy of the Registry’s work and your contributions to improving the care and treatments that people with IBD receive, we are in discussions with suitable organisations about a future long-term home for our data (see below for an update).

We want to keep everyone who has engaged with us up to date with plans.  A number of studies and contacts have been anonymous, which means we don’t hold any contact information, and so we will publicise in newsletters and other public means.

For participants who have consented to join the IBD Registry, we will be sending out individual emails (or other preferred contact method) to keep you updated with plans for your personal data held in our records.

UPDATE 14 FEBRUARY 2024:

Our data assets, including personal data, will be securely transferred to the Royal College of Physicians (RCP) who will act as interim stewards for the safeguarding of the data and other assets.  The RCP will take over responsibility for the safeguarding of the data and become the new Data Controller.

NEW 14 FEB 24 - What is the Royal College of Physicians (RCP)?

The Royal College of Physicians exists to improve the practice of medicine, and is one of our founding member organisations. They have an extensive history of clinical audit and health database management, as well as excellent Data Security Standards and Cyber Essentials Certification. The original IBD Audit (the predecessor of the current IBD Registry) was held and managed by the RCP.  They are registered with the ICO, and their privacy policy can be found here.

What personal data do you hold?

We hold health data related to IBD, contact details, and also consent details. We also hold administrative personal data, such as staff records that must be retained by law. 

NEW 14 FEB 24 - Why is the RCP acting as the interim data steward?

The IBD Registry has collected a valuable set of data assets for the purpose of improving the care and treatments that people with IBD receive, supporting research, and increasing the information available about IBD.  There are discussions underway already with appropriate organisations about a future long term and active home for the data. Secure data movements take careful planning and a respected interim safe haven (the RCP) was thought the best option to allow the time needed to find the best fits for the data and tools, to maximise the legacy of the Registry’s work. As interim data stewards, the RCP is holding the dataset on a closed and inactive basis, with no data processing taking place.

NEW 14 FEB 24 - Will my personal data be used for further processing after the planned closure?

No. The RCP are acting strictly as interim stewards for safeguarding the data, which will be held on an inactive basis as a closed dataset. As such, there is no ongoing or regular processing of personal data planned at the RCP.

What measures are in place to protect my personal data during the closure?

We will maintain our strict data security measures including encryption to protect all personal data until it is securely transferred or deleted.

We perform data protection risk assessments for all data processing, which includes the closure of the Registry. This process includes considering where we can use privacy-enhancing technologies at any point in the process, to better protect the confidentiality of personal records.

UPDATE 14 FEB 24 - What are my rights under GDPR and UK law concerning my personal data held in the IBD Registry?

You have all the usual rights under GDPR. The key right related to the proposed transfer is your right to object and to request that your data be withdrawn before this takes place.  Please see below for details of how to do this.  To learn more about your data rights please visit our privacy policy page. More information can be found on the Information Commissioner’s website

 

UPDATE 14 FEB 24 - How can I get a copy of my personal data held by the IBD Registry?

You can make a request for a copy of your data in any form. The best way to request this is to use our Data Subject Rights Portal, an online form that includes useful information to explain the process and request a copy of your data or deletion of your data.

The data will be returned to you electronically using a secure download link. Further instructions and guidance will be sent to you after you submit a request.

UPDATE 14 FEB 24 – DEADLINE EXTENDED TO 27 FEB 2024

The deadline for requests is 27 February 2024 to allow time for us to process your request.

UPDATE 29 FEB 24:

Our Data Subject Rights Portal is offline. The deadline for making requests to access or to delete your personal data was 27 February 2024. As we prepare our IT systems and databases for closure, it may not be feasible to process data requests. Requests will be still considered on a case-by-case basis, depending on the complexity and number of requests received. To make a request, please email [email protected]

UPDATE 29 FEB 24 - How can I request deletion / withdrawal of my personal data held in the IBD Registry?

You can make a data deletion request in any form. The best way to request this is to use our Data Subject Rights Portal, an online form that includes useful information to help you understand and request a copy of your data or deletion of your data.

UPDATE 14 FEB 24 – DEADLINE EXTENDED TO 27 FEB 2024

The deadline for requests is 27 February 2024 to allow time for us to process your request.

UPDATE 29 FEB 24:

Our Data Subject Rights Portal is offline. The deadline for making requests to access or to delete your personal data was 27 February 2024. As we prepare our IT systems and databases for closure, it may not be feasible to process data requests. Requests will be still considered on a case-by-case basis, depending on the complexity and number of requests received. To make a request, please email [email protected]

UPDATE 29 FEB 24 - I wish to object to the transfer of my personal data to the RCP

If you are not happy that your personal data will be transferred to the RCP, we can delete your data before the transfer.  You will need to make a data deletion request using our Data Subject Rights Portal. You can also request a copy of your data using this portal.

The deadline for requests is 27 February 2024 to allow time for us to process your request.

UPDATE 29 FEB 24:

Our Data Subject Rights Portal is offline. The deadline for making requests to access or to delete your personal data was 27 February 2024. As we prepare our IT systems and databases for closure, it may not be feasible to process data requests. Requests will be still considered on a case-by-case basis, depending on the complexity and number of requests received. To make a request, please email [email protected]

Can I make requests by post?

Yes, please contact us at 1 St Andrews Place, Regent’s Park, London or call us on our office number  (see bottom of the webpage) for further information. The deadline for postal requests is 5 March 2024.

What information is required to make a request for a copy of my data or to delete my data?

You will need to provide your NHS number and date of birth so that we can match your personal data in our records. (if you are in Scotland or Northern Ireland your NHS Number is called a CHI number or HSC number).

You will also need to provide a valid email address (or if email is not possible, phone or postal address) so that we can contact you.

Your NHS number may be found on the top of any correspondence from your GP (doctor) or your hospital. It is also available on the NHS App, if you have this.  Alternatively, if you have forgotten your NHS number, you can use the NHS’s NHS Number finder service.

We will need to keep a record of this minimum set of your personal information to document and process your data requests.

NEW 14 FEB 24 - What is the deadline for requesting a copy of my personal data or deletion of my personal data?

The deadline for requests is 27 February 2024 to allow time for us to process your request.

NEW 14 FEB 24 - What happens if I miss this deadline?

You may still submit data related requests to the IBD Registry after the deadline of 27 February 2024. We will still consider each request on a case-by-case basis depending on the volume of requests and the complexity of your request. We may be able to fulfil basic requests, for example, “delete me from your mailing list”.

Our Data Subject Rights Portal will be unavailable from 28 February 2024. Before 31 March 2024, please email us at [email protected].

Once the data has transferred to the RCP (from 1 April 2024), any further enquiries regarding the data should be directed to them. You can contact the RCP data protection team from 1 April 2024 at [email protected].

I have further questions or concerns about my personal data not covered in these FAQs.

Before the planned closure on 31 March 2024, please contact us at [email protected]