NATCAN Information Governance and Privacy Policy

What is the aim of the National Cancer Audit Collaborating Centre (NATCAN)?

The aim of the National Cancer Audit Collaborating Centre (NATCAN) is to assess the process of care and its outcomes in patients diagnosed with cancer and to determine where hospitals are doing well, and areas in which the quality of care can be improved. By producing information for all NHS providers, it allows cancer services to compare themselves with others in England and Wales, and share examples of good practice.

On the 1^st October 2022, the Clinical Effectiveness Unit at the Royal College of Surgeons of England (RCSEng) was commissioned to develop the new centre including new audits in breast cancer (primary and metastatic), ovarian, pancreatic, non-Hodgkin lymphoma or kidney cancer.

The following established audits moved into NATCAN under a contract variation in 2023:

• The Gastro-Intestinal Cancer Audit Programme (comprising the National Bowel Cancer Audit [NBOCA] and the National Oesophago-Gastric Cancer Audit [NOGCA]) on the 01.06.23
• The National Prostate Cancer Audit (NPCA) on 01.07.23
• The National Lung Cancer Audit (NLCA) on 01.10.23
• NATCAN will strive to raise standards across the clinical teams in order to improve treatment and outcomes for patients with cancer.

Where is patient-level data collected from?

NATCAN’s Prospective Audits do not ‘collect’ clinical data directly from patients. NATCAN utilises the nationally mandated flows of data from cancer patients to The National Cancer Registration and Analysis Service (NCRAS) and the Wales Cancer Network, Public Health Wales.

NATCAN receives clinical information for every patient diagnosed with bowel, breast cancer (primary and metastatic), lung, ovarian, oesophago-gastric, pancreatic, prostate, non-Hodgkin lymphoma and kidney cancer since 1^st January 2015 in England and Wales. Data from Trust/Health Board data submissions are linked to selected data items from national datasets to provide information on the diagnosis, management and treatment of all patients newly diagnosed with these cancers including staging, mode of admission, comorbidities, surgical procedure or intervention details, radiotherapy and chemotherapy details, readmissions and complications.

All patient identifiable information including name, address, date of birth, address, postcode and NHS number is removed (de-identified) by NCRAS in England and WCN in Wales before they are securely transferred to the NATCAN team. NATCAN presents analyses of these data in annual State of the Nation and quarterly reports to provide information regarding the type and extent of cancer and the quality of cancer services and treatment in England and Wales.

Data controller

NATCAN is commissioned by the Healthcare Quality Improvement Partnership on behalf of NHS England and the Welsh Government. HQIP and NHSE are joint data controllers for the linked de-identified dataset that is supplied to NATCAN for analysis.

Legal basis for processing patient-level data

NATCAN has approval for processing data under articles 6 (1) (e) and 9 (2) (i) of the General Data Protection Regulation (GDPR) as the data are needed to carry out a task in the public interest to ensure high standards of quality and safety of healthcare.

Patient confidentiality and level of data collected

The patient-level information received and managed by NATCAN and the appropriate project team is treated as confidential. When analysing the data to produce the information on patient care and outcomes, NATCAN use de-identified data so individual patients are not identifiable. 

NATCAN is also careful when publishing information to include graphs or tables that do not allow individuals to be identified. To ensure this, the Audit follows guidelines on publishing statistics issued by the Office for National Statistics. – Review of the Dissemination of Health Statistics: Confidentiality Guidance (PDF).

Management of patient-level data by NATCAN’s audit teams

The Audit project teams are based in the National Cancer Audit Collaborating Centre in the Clinical Effectiveness Unit, RCSEng. The RCSEng has strict security measures in place to safeguard the use and storage of de-identified patient-level information, which is handled in accordance with the GDPR. All de-identified data extracts are stored on a password-protected encrypted server at the RCSEng with restricted access to named analysts in the audit teams.

How long do we hold patient-level data for?

NATCAN holds patient-level data for the length of our Data Sharing Agreement (DSA) with NHS England. Our current Data Sharing Agreement expires on 30.09.25? After this time, the DSA will either be renewed or the data we hold will be securely deleted and we will no longer have access.

Who do we share data with?

NATCAN only shares patient-level data following a strict governance procedure to ensure compliance with the GDPR. Researchers may apply to the NATCAN Data Controller (HQIP) if they want to use the patient data for a research study. These requests undergo a stringent approval process as outlined here.

What if I do not want my patient-level information used by the Audit?

The National Cancer Registration and Analysis Service (NCRAS) in England and the Wales Cancer Network are allowed to collect data on patients diagnosed with cancer. Information on how to opt out of data collection is provided here.

Provider team contact information held by NATCAN

NATCAN holds contact information (name, email address and hospital name) for key members of each extended provider team (Clinical Lead, MDT coordinator, audit department and cancer services designated contacts). This information enables NATCAN to distribute newsletters with important updates about the audit and to administer the prospective audit outlier process.

Our legal basis for collecting and processing contact information is legitimate interest, which is handled in accordance with the GDPR and will not be used for any other purpose without consent. If you believe that any contact information we are holding on you is incorrect or incomplete, please contact us as soon as possible. We will promptly correct any information found to be incorrect.

Website Privacy Policy

We are committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website; you can be assured that personal data will not be stored.

We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

How to contact us

Please contact us if you have any questions about our privacy policy or information we hold about you [email protected].

Changes to our Privacy Policy

We keep our privacy policy under regular review and we will publish updates on our website.