On this page
- Application Amendment Request
- NHSS HSC-PBPP Approved applications
- Examples of changes
- Amendment Request Application Form
- File naming
- Versioning of HSC-PBPP application forms
- Note – PAC, CHIAG or National Caldicott Guardian-approved Applications
- Note – Legal Basis
NHSS HSC-PBPP Approved applications –
The named applicant of the approved NHS Scotland Public Benefit and Privacy Panel for Health and Social Care (HSC-PBPP) application must be the person that submits any amendment request via your Public Health Scotland (PHS) electronic Data Research and Innovation Service (eDRIS) application coordinator or eDRIS. inbox- phs.edris@phs.scot.
An amendment request is for any change to the approved application see Examples of changes below.
The applicant and their organisation are responsible to keep the approved application up to date as specified in the HSC-PBPP approval letter provided.
How an amendment request is processed once it is received by HSC-PBPP from eDRIS. (eDRIS can approve certain low risk changes)
A new HSC-PBPP Application Amendment request is scrutinised by the HSC-PBPP manager or Tier 1 panel depending on complexity.
Should the requirements of approval be satisfied (see HSC-PBPP Guidance for Applicants V4), an approval letter will be provided and this is what you need to approach data controllers for access to their data.
Should the amendment request require justification, explanation, corrections or clarification, a Request for Clarification email is sent to your eDRIS research coordinator to send to, or discuss with, you. The scrutiny process is paused until the clarifications are received by HSC-PBPP from your eDRIS research coordinator.
This can add time to your amendment request scrutiny and any approval for access to data.
Please be aware, new HSC-PBPP Amendments Requests are prioritised over responses to request for clarifications.
It is in your interest to ensure the HSC-PBPP application form and HSC-PBPP Amendment Request form are fully completed, questions answered clearly and concisely and relevant support documents or evidence provided. The questions on the amendment request form are clear, with explanations about what is required, however it is not uncommon for applicants to not complete the HSC-PBPP Amendment Request form as required. Taking the time to answer the questions asked will negate the need a request for clarifications or explanation.
Examples of changes
Changes to personnel, project duration, data sources/data variables etc.
To reduce ‘data or scope creep’ of applications, the applicant must justify how the amendment remains within the scope of the original application. If HSC-PBPP consider the amendment request to be outwith the original scope, a new application may be requested. While this will depend on the content and context of the original application, changes beyond the original scope might include addition of new dataset(s), new objectives, different locations for storage or access to the data.
The Amendment Request form includes a checklist for applicants to complete which, when completed, has shown to reduce the number of questions that are returned to applicants.
Requests for clarification or answers to unclear explanations or unanswered questions can delay approval for access to data.
Amendment Request Application Form
The HSC-PBPP amendment request form v2.4 (only this version of the amendment request form will be accepted) should be completed to request changes to an approved HSC-PBPP application which has not exceeded the declared project duration. An updated version of the HSC-PBPP application form should also be submitted with changes highlighted within the body of the document.
All changes requested must be highlighted in yellow and deletions requested should be highlighted in yellow and struck through.
An example
Application V1 (Approved). Text in application shows- This study uses pseudonymised data only.
The applicant now wants to add identifiable data. This change has to be highlighted.
The new Application form submitted will be V2 and text will show – This study uses identifiable and pseudonymised data only. The change, new text, is highlighted.
The applicant now wants to remove the identifiable data from the study.
The new Application form submitted will be V3 and text will show – This study uses identifiable and pseudonymised data only. The change, removal of text, is highlighted and struck through.
FILE NAMING – Documents that do not follow the HSC-PBPP file naming or versioning guidance will not be accepted by HSC-PBPP.
Documents showing track changes will not be accepted.
File Naming of HSC-PBPP Amendment Request forms:-
Acceptable file name is
- Reference Number provided by PHS eDRIS followed by
- the applicant name followed by
- HSC PBPP Amendment Request followed by
- the version number. This will match the supporting application form.
e.g. 2122-9999 Name HSC PBPP Amendment Request Vx
No other information is required in the file name.
The applicant is free to provide documentation to organisations information security or project governance stakeholders with whatever naming convention and format they require for their purposes however documents submitted to HSC-PBPP must follow the guidance provided.
File naming of support documents
| Document no.e.g. SD1 | Document type / descriptione.g. protocol, DPIA | Filename (use short names)e.g. SD1 protocol YYYY-1234 Surname e.g. SD2 DPIA YYYY-1234 Surname |
DO NOT provide support documents with long file names, for example
“ABC-2018-DSA-02 – External Data Sharing Agreement between Applicant Organisation and University of X – First Name Last Name – Study Title – signed”
“SD2 DSA YYYY-1234 Surname” is acceptable.
You may have file naming conventions for your project however you must follow the HSC-PBPP- guidance for document submission.
The HSC-PBPP have to share application and support documents with remote panel members and large file names cannot be opened or cause difficulties between systems.
File Naming of HSC-PBPP application forms:-
Acceptable file name is
- Reference Number provided by PHS eDRIS followed by
- the applicant name followed by
- HSC PBPP Application followed by
- the version number.
e.g. 2122-9999 Name HSC PBPP Application Vx
No other information is required in the file name.
The applicant is free to provide documentation to organisations information security or project governance stakeholders with whatever naming convention and format they require for their purposes however documents submitted to HSC-PBPP must follow the guidance provided.
Versioning of HSC-PBPP application forms.
A new application or amendment to an approved application is a whole number.
An updated version e.g. providing clarifications requested adds a decimal until approval.
e.g.
- New application is V1. Accepted and approved as V1.
- New application is V1. Clarifications required. Updated application is V1.1. Accepted and approved as V1.1.
- New application is V1. Clarifications required. Updated application is V1.1. Further clarification required. Updated application is V1.2. Accepted and approved as V1.2.
- First amendment request is supported by application V2. Accepted and approved as V2.
- First amendment request is supported by application V2. Clarifications required. Updated application is V2.1. Accepted and approved as V2.1.
- First amendment request is supported by application V2. Clarifications required. Updated application is V2.1. Further clarification required. Updated application is V2.2. Accepted and approved as V2.2.
Note – PAC, CHIAG or National Caldicott Guardian-approved Applications-
After 31st December 2020, you must submit and new application to HSC-PBPP.
Contact the eDRIS Team at Public Health Scotland (phs.edris@phs.scot).
The eDRIS Team will assist you with completion of the
- correct amendment request form version and
- application forms and
- provide further guidance.
Note – Legal Basis
Due to the changes in data protection legislation from May 2018 with the implementation of the GDPR, HSC-PBPP require that all amendments update the lawful bases for processing data with the relevant GDPR legal basis articles. It is the responsibility of applicants to ensure that their application conform to current legislation. An updated Data Protection Impact Assessment (DPIA), should one be in place, will be requested, as this is a ‘live’ document that should record any changes to the approved application.
Full details of how we use your information, and how we maintain your right to privacy, can be found on the Public Health Scotland Privacy and Cookies page.
.