FAQs about the transition of the IBD registry into NHS England as the National IBD Registry

The IBD Registry is moving at the end of 2025 onto the new NHS Outcomes and Registries Platform (ORP) as the first disease registry to join the platform. The ORP is the new patient-centred and clinically-led national platform for registries, run by NHS England (NHSE) but working closely with all UK home nations.  The ORP objective is to better support direct care, clinical practice, research and innovation through collecting, linking and analysing specialist registries data more effectively.  The new name for the IBD Registry at NHS England will be the National IBD Registry (NIBDR)

The Outcomes and Registries Programme (ORP) is a patient centred, clinically led registries programme whose purpose is to improve patient safety and outcomes by collecting, linking and analysing data more effectively. The data will be used to support direct care, clinical practice, innovation and research. The programme is a core Department of Health and Social Care / NHS England programme, and that includes four nations involvement (England, Northern Ireland, Scotland, Wales).

.

The IBD Registry governance includes guidelines on who these can be transferred to, to ensure that any future use of the IBD registry data is appropriate.  NHS England is an organisation with similar goals and objectives to that of the IBD Registry, with appropriate technical and organisational capabilities to handle and look after the data. 

.

The purpose of the IBD registry will continue as before: to bring together health data from people with inflammatory bowel disease (IBD) across the UK to help improve treatment and care and support research.  This purpose is supported and enhanced by the move onto the Outcomes and Registries Platform, for example, through bringing together data at greater scale and through secure linkage to other datasets. With the responsible, ethical use of higher quality data, and the availability of shared knowledge and resources within the NHSE ORP, data from the IBD Registry can be used more effectively to inform clinical practice, patient outcomes and health policy.

Yes.  IBDR is set up for all ages, so both adults and children will be covered in quality of care improvement and other non-research studies. However, the research consent (as an ethically approved research database) is currently only active for adults, although there are plans to extend this to cover children as well

Yes.  The ORP has been developed by NHS England but is available for use by all four home nations (England, Northern Ireland, Scotland and Wales). There are differences in governance between the health bodies of the home nations, but this will change as NHS England becomes part of the DHSC (Department of Health and Social Care) in due course. Governance routes and compliance will be reviewed as part of that change.

In the initial period of uncertainty in 2024 there was an agreed wish by everyone to safeguard the data and other assets of the registry while a new home was being found.  To ensure these assets were protected, the Royal College of Physicians (RCP) offered to act as a Data Steward to provide a safe haven if needed.  In the event, discussions started quickly with NHSE ORP and the move of the assets for safekeeping to the RCP was then not needed. All assets have remained with the IBD Registry during this time

There will be a specialist Steering Group for IBD, which will have both patients and clinicians on it. Each registry has its own specialist steering group, with all the ORP registries coming together in a group to promote knowledge sharing and best practice.  The IBD specialist Steering Group will be a part of the combined registries board, which is run by NHS England.

The IBD registry will have a focused IBD Patient Advisory Group {link}.  People with IBD will be invited to apply to join this, by newsletters and other media, by ourselves or via any of our IBD UK partners that represent patients.  The Chair of this group will join the IBD Steering Group to represent patients, alongside patient organisation representatives invited from such as Crohn’s & Colitis UK, CICRA and Guts UK

.

The activities of our Patient Advisory Group (PAG) were originally sustained until March 2024, to support our goal of embedding patient voice in the processes during this period.  As part of the transfer to NHS England, a new Patient Advisory Group is expected to be formed, with a dedicated representative from that group on the IBD Steering Group. 

NHS England will become the legal Data Controller for the IBD datasets, and future data collection, as part of the registries datasets on ORP.

The transfer date will be on 30th December 2025.  At this point in time the data and other supporting information will be transferred from the IBD Registry Ltd (the hosting company for the IBD registry) to NHS England.  At this date NHS England becomes the legal Data Controller.  We are currently in a transition preparation period, before the transfer takes place, where we get everything ready, let everyone know what is planned, and listen to their feedback.

The main source of information during the transition period (i.e. until December 2025) will be the IBD Registry website.  Once the transfer takes place in December 2025, we will keep general information available on the IBD Registry website for continuity, but the key information about data will then be available on the NHSE website, on the specific National IBD Registry webpage {link}. The IBD Registry website will be updated at this point to include information about the transfer including where to find information now on NHSE.

The National IBD Registry will be hosted for an interim period by a specialist data and technical organisation within NHSE called NHSE Arden & GEM. There are a number of registries currently in discussion, and because the IBD Registry had its own tools and data systems, very similar to what NHSE Arden & GEM are used to running, the most sensible transition option was for these to be effectively moved to NHSE Arden & GEM for an interim period.  This will allow the IBD Registry to continue running in much the same way, with the least disruption. There will be a consolidation pathway in late 2026-2027 bringing this and any other registries together. 

The biggest dataset that IBD Registry collects is medical data on the care that patients receive from their hospital teams (called ‘secondary care’ data).  Data from GPs (i.e. your local doctor) is not currently collected.  People with IBD can also provide other data about themselves and their health directly to the IBD Registry, which goes with the hospital data to create a more complete picture of peoples’ health problems, treatments given, and resulting outcomes. This combination of data is very useful to researchers looking for ways to improve health of patients with IBD.

NHS England is a public body with specific legal powers and duties to collect and process personal data. Under UK GDPR (the UK General Data Protection Regulations) NHS England’s legal basis for collecting personal data from hospitals is as a‘public task’      (GDPR 6.1(e)). This hospital data is special category health data, for which the additional legal basis is GDPR 9.2(j), in the public interest.  To allow the clinical teams to legally send the data from their hospitals, patients can provide their consent (this is consent for your confidential data, not GDPR).  As it is difficult to contact all patients, the hospitals have been given permission by the Government’s Confidentiality Advisory Group (CAG) for the data to be shared with NHS England, for non-research purposes. You can see this permission on the HRA’s CAG registers webpage, under reference 25/CAG/0112. This means that the data collected represents the patient population most accurately, which is essential for understanding (for example) variations in care across the UK, or the picture of IBD across the UK.  

Your data rights are fully protected and will continue to be upheld by NHS England as the new data controller. There is, however, an important legal change you should be aware of.  As a private, non-profit company, the IBD Registry processed your personal data under the lawful basis of “Legitimate Interests”. As a public authority, NHS England’s correct lawful basis for operating the registry is “Public Task”.

You continue to have the right to:

• Be Informed: About how your data is used.
• Access: Request a copy of the data held about you.
• Rectification: Correct any inaccurate information.
• Erasure: Request the deletion of your data from the registry.

You also retain your Right to Object to the processing of your data. However, because the legal basis has changed to ‘Public Task’, this right will no longer be absolute. This means that while you can object, NHS England may be required to continue processing your data if it can demonstrate compelling legal grounds to do so for public health and research purposes.

For those who consented for their data to be used in research, NHS England will remain legally bound to uphold all the original promises made to you about how your confidential data will be used.

You can exercise any of these rights by contacting the NHS England Data Protection Officer}. If you have any concerns, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Where a patient has provided consent for the IBD Registry to collect data, there are also 2 additional options available: for consent for research in IBD, and to be contacted to be involved in future research in IBD.  This is called ‘research consent’, and is very valuable to IBD researchers in IBD as it makes the process of research easier by having a group of people who are already ready for their data to be used, or to take part.  

As part of the transition process, we will be trying to contact everyone who has given us consent for research, so that they are informed of the change and can decide whether or not they want to continue to provide their consent.  We are aware that some people’s contact details may have changed, and so we are also covering this on public channels to reach as widely as possible.  

ou can read our IBD registry consent form here, and the Patient Information Leaflet that goes with it here.  These will be transferred across to NHS England following a proper legal process, which will include being careful to keep the promises that were made to patients, while still updating the form to reflect different operational processes.  A further application must then be made to the Health Research Authority (HRA) following transition for transfer of the ethical permission as a consented research database.  

We hold health data related to IBD, contact details, and also consent details. We also hold administrative personal data, such as staff records that must be retained by law. 

Patients who joined the IBD Registry were known as participants, and had options to control whether their data was used for research or not, whether they were contacted for research or not, and could even withdraw completely if they wanted to, at any time.  The IBD registry participants online application is being transferred to NHS England, and the expectation is that this will be restarted, so that patients have these options again.

You can opt-out of the collection of data for the IBD registry using this form here.  This opt-out is just for your IBD data as part of the National IBD Registry.  If you want to opt-out of all patient data sharing across the NHS, you can find out more about doing this here. You can also find out more here on how NHS England looks after your data.  This applies for England and Wales, in alignment to the current data collection.

If you want to know what information (if any) is held by IBD Registry Ltd, you can submit a data access request by using this form here. When the transition period ends and the data is transferred to NHS England, you will be able to submit a subject access request directly to NHS England.  The IBD Registry team and NHS England are working closely together to ensure that any requests ‘in progress’ will be transferred for completion following data protection rules.

To check for hospital data, you will need to provide your NHS Number and date of birth.  This is because we don’t hold any other directly identifying information in our records.  You can usually find your NHS Number on a hospital letter or by using the NHS number online service. For non-medical records, such as mailing lists, you will usually have to provide your name or email address. You may be asked for additional information to prove your identity. 

Requests are usually processed within 30 days, from the date that your proof of identity was received. If we need longer, we will write back to you within 30 days giving reasons, and we may also request an extension of a further 60 days. 

The IBD Registry medical data is currently ‘frozen’ offline, and so any searches for data in this database will probably take longer than 30 days.  Each request is reviewed on a case by case basis, and if this means that your request will take longer than 30 days, then we will write to you to let you know this.

Yes.  Given the time for postal delivery over the Xmas and New Year period that the transition is taking place, we would recommend that you write directly to NHS England.

No. The data collected in the IBD registry is what is called a ‘secondary use’. The primary use is for your direct care and is unrelated to the collection of registry data.

All data that is collected and shared is protected by strict rules around privacy, confidentiality and security

No.  Arden & GEM are appointed by NHS England to process the data on their behalf. They are a Data Processor, and must follow NHS England’s instructions, because NHS England are responsible for the data (the Data Controller).  In common with all Data Controllers, NHS England must have a contract in place with its Data Processors which sets out clearly what they can and cannot do.  If NHS England change the processing company in the future, the new company will also be a Data Processor, and must do as instructed by NHS England.

Yes.  Both NHS England and NHS Arden & GEM are accredited in data security and protection, and have long experience in both.  As well as being NHS Data Security Protection Toolkit Compliant and maintaining ongoing accreditation in Cyber Essentials Plus, Arden & GEM are also accredited by a number of organisations and have won a number of awards. 

NHS England are responsible for the data (the Data Controller) and while they would be expected to appoint suppliers to do the data processing on their behalf, the suppliers are Data Processors and can only act under the instructions of NHS England. 

These will transfer for the most part to NHS England. There has been a lot of work over the past year to ensure that the transfer will be compliant with legal and data protection obligations, as well as patient and other data subject expectations

The IBD Registry also holds a set of anonymised study datasets (these are specific subsets of the main dataset that were used in research and other studies). Best practice in research and studies is that the same analysis can be done again (reproduced) if needed, to show that the study findings were robust.  For this, a copy of each study dataset will be securely returned to the academic lead or clinical centre for the study, in line with best practice and to provide reproducibility for the study if required.

Health data, including IBD data, can provide new knowledge that can improve health outcomes for people with IBD.  Data in the IBD registry can be used only when there is a clear benefit for patients. This might be in improving treatments for people with IBD, or helping to research new treatments; better use of hospital and clinical resources; understanding of variations in care patients receive between different hospitals; identifying patient safety issues in care or treatment use.

Access for purposes with a clear patient benefit can be requested by research bodies and organisations, including for example, university researchers, hospital researchers, medical royal colleges and pharmaceutical companies researching new treatments.

Patient data will never be sold or shared with insurance or marketing companies.

For research, patients are asked directly for their consent to allow their health data to be used for research purposes for IBD.  The IBD Registry was approved as an ethically-approved research database, and as part of this, patients were asked to give their consent directly. We are currently in the process of discussing transition of this to NHSE with the Health Research Authority (HRA), and we will re-open consent when this is ready. If you would like to be involved in research for IBD and be kept informed of when this is ready, please let us know.  Our goal in this is for the consent and patient information to remain effectively unchanged, apart from legal and contact details to reflect the transfer.

For information during transition, our revised consent form and our patient information leaflet are available to read. If you want a paper copy of these, they can be downloaded from our website. If you don’t have access to the internet, you will be able to telephone the National IBD Registry team to ask for a paper consent form and information leaflet. 

How do I consent, change my consent options, or withdraw completely?

The consent form has additional options for permission to use your data in ethically-approved research, and permission to contact you for involvement in future research projects.  You can change your options at any time or withdraw completely if you want. 

The IQICC (KPIs) Tool was designed by the IBD Registry, based on REDCap software. It has been taken down for the transition period but can be re-installed in the future if this is required.  The IQICC KPIs Tool was free for clinical teams to use, thanks to the licence granted by the REDCap Consortium to the IBD Registry as a not-for-profit organisation.  The templates have been kept safe for future use if this should be an option

The Cerner IBD Registry module has been developed independently (but based on the IBD Registry dataset definition) by IBD clinicians together with Cerner; and allows a Trust using the Cerner eHR system to download a module designed for IBD. It is live for use, and for details please contact: [email protected].

The IBD Registry WebTool (software provided by CIMS and paid for by the IBD Registry Ltd) was decommissioned at the end of March 2024. 

However there is the option for a new future IBD WebTool, if the IBD Clincal Steering Group recommend this as an option.  Part of the rationale for the Outcomes and Registries Programme is to support registries both in sustainability and in data security, and this includes the provision of technical registry elements such as webtools and platforms.  Please note that the preferred approach is to collect clinical data wherever possible without data entry into webtools or similar,  and so this woukd be balanced carefully. The decision will come from the IBD clinical community, led by the IBD Clincial Steering Group. 

To maximise the legacy of the Registry’s work and your contributions to improving the care and treatments that people with IBD receive, we are in discussions with suitable organisations about a future long term and active home for the data.

The IBD Registry has collected a valuable set of data assets for the purpose of improving the care and treatments that people with IBD receive, supporting research, and increasing the information available about IBD.  If an appropriate home can be found, in the interests of patients and clinical teams, this will be an excellent outcome. 

.There was an initial period of uncertainty in early 2024, and in this time, there was a wish from all to ensure that the data and other assets remained safe and secure.  Secure data movements take careful planning and a respected interim safe haven was thought the best option to allow the time needed to find the best fits for the data and tools, to maximise the legacy of the Registry’s work. The Royal College of Physicians (RCP) offered to act as interim stewards for the safeguarding of the data and other assets.  In the event, this was not required, and all data and assets have remained with the IBD Registry.  We are grateful to the RCP for both this kind offer and their continued support

If your enquiry is about your personal data, please contact us at [email protected]

If your enquiry is more general, please contact us on [email protected]