Diabetes Prevention Programme: Information Governance and Data Flows Framework

Objectives

The NHS Diabetes Prevention Programme (NHS DPP) is an evidence-based national model intended to reduce the risk of Type 2 diabetes among people with non-diabetic hyperglycaemia, including through links with the NHS Health Check where appropriate.[1][2]Its strategic focus combines identifying and referring eligible people to behavioural interventions with lawful, transparent, secure and confidential use of their personal information.[2][3][4]

• Identify people at high risk of Type 2 diabetes through NHS Health Checks, diabetes risk assessments, opportunistic clinical identification and general-practice registers of existing non-diabetic hyperglycaemia cases.[3][5][6]
• Refer eligible individuals to NHS DPP intervention providers and support their attendance following informed agreement to referral.[5][7]
• Develop business rules for case finding and registers of people at risk, including applicable exclusions.[5][6]
• Protect patient confidentiality and uphold data-protection rights by ensuring that processing is fair, lawful, transparent and secure.[2][8][4]
• Promote equality and diversity by reducing inequalities in healthcare access and outcomes, integrating services where this may reduce inequalities, and meeting Equality Act 2010 duties.[9]
• Support service management, payment, quality assurance and evaluation through the appropriate use of treatment, attendance and outcome information.[10][11][9]

The available material does not set quantified diabetes-prevention targets, a broader outcome framework, or specific clinical objectives beyond reducing the risk of Type 2 diabetes and delivering the Programme to eligible people.[2][6]

Implementation

The NHS DPP operates as a joint initiative involving NHS England, Public Health England and Diabetes UK through a National Programme Team, with NHS England as contracting authority and central funder of intervention costs.[2]Local commissioners call off provision from a national framework according to local needs and requirements, while general practices, NHS Health Check providers, intervention providers, commissioners, local authorities and other referring organisations perform defined identification, referral, delivery and information-governance functions.[2][3]

• Establish local pathways covering identification and invitation, referral from primary care and non-GP NHS Health Check providers, intervention data collection and storage, return of information to primary care, and information transfers to the commissioning authority.[2]
• Determine local referral processes through dialogue between referring organisations and providers, with providers arranging attendance and supplying further Programme and fair-processing information.[5]
• Identify eligibility within GP practice systems as direct care, or through a data processor acting solely on the GP practice’s instructions as data controller.[6]
• Send invitations directly from practices or through contracted processors, explaining the Programme, the provider arrangements, intended data uses, lawful basis, follow-up communications, and options to accept or decline referral.[6][7]
• Record patient agreement in the clinical record before the GP refers the individual to the intervention provider, and include the referral date and General Medical Practice Code in referral notifications.[7]
• Collect referral data including identifiers, clinical measures, disability, serious mental illness register status and communication-support needs, alongside socio-demographic information where provided.[10]
• Record attendance, initial-assessment attendance, completion or non-completion, whether at least 60% of the recommended programme dose was completed, intervention outcomes, weight, blood results and relevant measurement dates.[10][11]
• Return specified attendance, completion, weight and blood-result information to general practices to update records and inform future care decisions.[10][11]
• Submit contractually specified datasets to NHS Digital’s Data Services for Commissioners Regional Office under NHS England Directions, and provide relevant treatment information to commissioners for payment and quality assurance.[11][9]

Information governance is a core delivery mechanism. Participating organisations must establish a lawful basis for their data flows, assess confidentiality, fairness, lawfulness and transparency, and provide patients with clear privacy or fair-processing information before referral or other relevant processing.[2][5][4]Patients should be informed about information returned to their GP and may consent to contact by nationally appointed Programme evaluators; where this consent is absent, their contact details are excluded from the commissioning dataset.[10][11]

• Conduct Data Protection Impact Assessments for high-risk, novel, new or amended processing, covering processing purposes, necessity and proportionality, risks to individuals, and planned safeguards and security measures.[11][8]
• Assign data-controller responsibilities to relevant GP practices, providers and commissioners, and designate Data Protection Officers with expertise in data-protection law to monitor compliance.[4][12]
• Use binding written contracts for processors, specifying confidentiality, security, sub-processing, support for individual rights, breach management, audit arrangements, and data return or deletion.[3][13][12]
• Apply technical and organisational safeguards through business processes, operational procedures, staff training and awareness to prevent unauthorised processing, loss, destruction or damage.[4][13]
• Require providers under the NHS Standard Contract to complete and publish annual information-governance assessments and demonstrate compliance with the applicable NHS information-governance framework.[13]

Operational assurance includes updating GP records, commissioner quality assurance, documented audit materials and participant feedback where individuals agree to contact.[7][9]The material does not specify wider performance targets, reporting schedules, formal clinical outcome evaluation methods, or detailed accountability arrangements beyond contractual, audit, quality-assurance and data-protection mechanisms.[1][13][14]

Monitoring & Evaluation

Monitoring and accountability centre on programme data collection, audit, quality assurance and information-governance compliance. The material specifies operational data flows and selected delivery measures, but does not set out a comprehensive outcomes framework, quantified targets, routine surveillance system or overall reporting timetable.[1][2][3][5][6][7][10][11]

• Document information flows on a lawful basis, assess privacy risks through Data Protection Impact Assessments, and maintain local privacy and confidentiality assurance arrangements.[1][2][11][8][4]
• Record referral, socio-demographic and intervention information, including identifiers, clinical measures, disability, serious mental illness register status, communication-support needs and whether individuals decline to provide socio-demographic information.[10]
• Monitor attendance and programme delivery by recording initial-assessment attendance, non-completion, completion, and whether participants complete more or less than 60% of the recommended programme dose.[11]
• Capture intervention outcomes, including weight and the dates of weight and blood-result measurements, and return specified attendance, completion, weight and blood-result information to primary care for clinical-record updates and future care decisions.[10][11]
• Use business rules and practice-register queries to identify people with blood glucose readings within the non-diabetic hyperglycaemia parameters, create eligible-patient lists, and apply relevant exclusions.[5][6]
• Submit contractually specified datasets to NHS Digital’s Data Services for Commissioners Regional Office under Directions issued by NHS England.[11]
• Support commissioner payment and quality assurance by supplying treatment information, where patients have received the relevant information about this use.[5][7][9]
• Enable national evaluation by recording consent for contact by nationally appointed evaluators in the field mapped to DPP38, and exclude contact details from the commissioning dataset where consent has not been provided.[10][11]
• Enable service feedback collection by a support organisation where a participant has agreed to be contacted.[9]
• Use the NHS Diabetes Prevention Programme Audit Overview, Audit Section Descriptions and Audit Clinical Extraction Criteria as documented audit materials.[9]
• Require providers operating under the NHS Standard Contract to complete and publish an annual information-governance assessment and demonstrate satisfactory compliance with the applicable NHS Information Governance Toolkit or successor framework.[13]
• Monitor General Data Protection Regulation compliance through designated Data Protection Officers, while retaining organisational and professional accountability for compliance.[4][12]
• Provide fair-processing information on processing purposes and legal basis, data sharing, objection, access and correction rights, retention, and complaints to the Information Commissioner’s Office.[14][12]
• Apply written processor contracts, technical and organisational security measures, staff training, and confidentiality procedures as information-governance controls.[3][6][4][13]
• Recognise that the supplied material does not specify quantitative clinical outcome indicators, formal evaluation methods beyond the stated audit, feedback and national-research arrangements, diabetes surveillance measures, or a programme-wide reporting schedule.[3][7][8][13][14]

Costing & Financing

Financing information is limited. NHS England acts as the contracting authority and meets intervention costs centrally, while local provision is commissioned through call-off arrangements from a national framework according to local need and requirements.[2]No total budget, unit price, payment methodology, allocation, funding gap, resource-mobilisation target or economic assumption is specified.[2][5][7][10][11][8][4][13][14][9]

• Fund the NHS Diabetes Prevention Programme intervention centrally through NHS England as contracting authority.[2]
• Commission local intervention provision through national-framework call-off arrangements based on local requirements.[2]
• Use treatment information for commissioner payment and quality assurance, without specifying a financial value or payment mechanism.[5][7][9]
• Recognise that the source does not quantify funding for data collection, privacy assessments, audit, evaluation, information governance, workforce, technical safeguards or local referral processes.[2][10][8][13]