Mortality after hip fracture - Privacy Notice

We are committed to protecting the privacy and security of your personal information. This notice describes how we collect and use your personal data in this study, in accordance with the General Data Protection Regulation (GDPR) and associated data protection legislation.

Data controller

The University of Oxford is the “data controller" for the information that you provide to us for the purposes of the study. This means that we decide how to use it and are responsible for looking after it in accordance with the GDPR.

Data Protection Officer

If you wish to raise any queries or concerns about this privacy policy please contact the Information Compliance Team by email or by post at University of Oxford, University Offices, Wellington Square, Oxford, OX1 2JD. The University's full Privacy Policy can be found on the University website.

Purpose of the data processing

This project is a service evaluation into patient outcomes following hip fracture. Hip fracture is a serious and common injury and research has shown mortality rates as high as 30% at 12-months following hip fracture. In 2024 there were more than 65,000 hip fractures across England, and although there has been much research into the rates of mortality after hip fracture, there is a lack of systematic, up-to-date large-scale analysis of the causes of mortality after hip fracture. We aim to evaluate the causes of mortality after hip fracture across England. The benefit we aim to achieve is better patient care and improved understanding of where and in whom the biggest gains lie in reducing mortality after hip fracture.

Lawful basis for the data processing

The lawful bases for processing of your data under GDPR are:

Article 6(1)(e) (processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller)

Article 9(h) (processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;)

The study has support under section 251 of the NHS Act 2006 to enable the common law duty of confidentiality to be temporary lifted so that confidential patient information can be transferred to NHS England without any party being in breach of the common law duty of confidentiality.

Categories of data used in the study

Personal data will be processed during the conduct of this study. We will also process special category data including details about individuals’ health and mortality information. These special category data are essential to the conduct of the study. For the purposes of the study, only pseudonymised data will be processed by the University of Oxford.

Source of the data

This project will use data from the National Hip Fracture Database (NHFD) linked with hospital records. The NHFD is part of the Fragility Fracture and Falls Audit Programme (FFFAP). This audit programme is administered by the Royal College of Physicians on behalf of the Healthcare Quality Improvement Programme (HQIP). HQIP is the data controller and Crown Informatics is the data processor.

Hospital Episode Statistics (HES) is a database containing information about admitted patient care in NHS hospitals in England. The Civil Register (Deaths) is a register of dates and causes of deaths of individuals in England. NHS England is the data controller for both these datasets.

Data flow

Crown Informatics will send NHS Number, date of birth, full postcode, and a pseudonymised NHFD ID variable to NHS England. NHS England will extract the HES and mortality data linked to the cohort.

NHS England will share the HES and mortality data with the University of Oxford as pseudonymised data. The linked extract will also contain the NHFD ID supplied by Crown Informatics.

Crown Informatics will separately send pseudonymised NHFD data containing NHFD-collected clinical variables to the University of Oxford, where the NHFD ID will be used to combine the NHFD data and the linked HES and mortality data.

Access to your data

Access to your personal data within the University will be provided to those staff who need to view it as part of their work. Data will not be shared with any third party.

Access to your personal data within the University will be provided to those staff who need to view it as part of their work. Data will not be shared with any third party.

Where will we store and process your data

We store the data we have received electronically. The data is stored on secure servers and/or in our premises within the UK.

Retaining your data

We will only retain your data for as long as we need it to fulfil our purposes, including any relating to legal, accounting, or reporting requirements. We plan to process the data until June 2027 – this will give sufficient time to conduct the study and then retain the data for six months whilst we publish the findings. At that stage the data will be securely destroyed so that it cannot be used for any other purpose.

Your rights

The University website provides information on your rights to access and modify your personal data.

You have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ICO). A complaint to the ICO can be made by visiting their website or by calling their helpline: 0303 123 1113