Help - Preparing & submitting applications - Confidentiality Advisory Group (CAG)
  • Using IRAS
  • Preparing & submitting applications
    • HRA and HCRW ApprovalHRA and HCRW Approval
    • NHS/HSC R&D PermissionsNHS/HSC R&D Permissions
    • Ethical review (REC)Ethical review (REC)
    • Confidentiality Advisory Group (CAG)Confidentiality Advisory Group (CAG)
    • MHRA MedicinesMHRA Medicines
    • Site specific informationSite specific information
    • MHRA DevicesMHRA Devices
    • Templates for supporting documentsTemplates for supporting documents
    • HR Good Practice Resource PackHR Good Practice Resource Pack
    • Radiation AssuranceRadiation Assurance
    • Radiation - defining research exposuresRadiation - defining research exposures
    • Radiation - MPE and CRE review proceduresRadiation - MPE and CRE review procedures
    • Pharmacy AssurancePharmacy Assurance
    • Public InvolvementPublic Involvement
    • Interventional ResearchInterventional Research
    • Combined review applicationsCombined review applications
  • Maintaining your approvals
  • End of research
  • FAQs
  • Documentation
  • Reference
Confidentiality Advisory Group (CAG)

Preparing and submitting applications to the Confidentiality Advisory Group (CAG)

This page provides the following information:

What is the Confidentiality Advisory Group (CAG) & do you need to apply to CAG

The Health Research Authority’s Confidentiality Advisory Group (CAG) provides independent expert advice to the HRA and the Secretary of State for Health on whether applications to access confidential patient or service user information without consent should or should not be approved.

CAG's remit extends to:
  • England and Wales; and
  • Activities that are managed as research and non-research

You should apply to CAG if you need to access:
  • Identifiable patient or service user information relating to people living in, or receiving care in, England and Wales without consent, prior to the disclosure of confidential information; or
  • Human Fertilisation and Embryology Authority (HFEA) Research Register Data.

Potential applicants should refer to the guidance provided to identify whether an application to CAG is advised, in particular the pre-application checklist. You should contact the the Confidentiality Advice Team (CAT) if you wish to discuss considerations prior to submitting an application. Please note the team also offers a pre-application assessment service.

Please note: Where an applicant intends to link to datasets, such as Hospital Episodes Statistics (HES) and cancer registry data, they will be expected to have contacted the data controllers for the dataset and discussed whether alternative methods which might limit the disclosure of confidential patient information without consent could be used. You will need to provide copies of this correspondence, and any other evidence to show that alternatives to access of confidential patient data without consent have been explored, as part of the supporting information for your application to CAG.

Using patient identifiable information from Scotland or Northern Ireland: This activity is not within the remit of CAG and you should seek additional guidance from, and make contact with, the relevant privacy committee:

Back to the top

Contacting the Confidentiality Advice Team (CAT)

If you need to contact the Confidentiality Advice Team you should:

Back to the top

How to apply to CAG

Research projects, Research Tissue Banks and Research Databases
All research applications should be prepared in IRAS.

***IMPORTANT: At project filter question 4 select the application for the Confidentiality Advisory Group (CAG) and then in the secondary question asking "Will you be seeking data from the Hospital Episodes Statistics (HES) or Secondary Uses Service (SUS)?" you should always select "no". ***

The CAG Form should be electronically authorised prior to creating a final version for submission. The final version for submission is created via the Submission Tab for the CAG Form and you should submit both PDF and XML versions of the CAG Form, plus any supporting documentation, directly to the Confidentiality Advice Team (CAT). The booking process must be followed in order to submit an application to the CAG.

Supporting document requirements are set out in the checklist associated with the CAG Form. Please note that all documents should be provided in black and white and labelled with a clear title, version number and date. Application forms should not include embedded documents.

The Confidentiality Advice Team (CAT) offers a service of pre-application assessment, upon request, prior to formal submission of an application. More information of this service is provided below.

Instructions for the booking and submission of the application are below.

Non-research activities
All non-research application should complete the Section 251 Form . The form may be signed electronically or a printed copy signed and scanned to PDF.

The Section 251 Form contains a list of expected supporting documentation. Please note that all supporting documents should be provided in black and white and labelled with a clear title, version number and date. Application forms should not include embedded documents.

The Confidentiality Advice Team (CAT) offer a service of pre-application assessment, upon request, prior to formal submission of an application. More information of this service is provided below.

Pre-application assessment
The pre-application assessment is an optional, pre-submission assessment of the content of your draft application by the Confidentiality Advice Team (CAT). The assessment aims to provide you with an indication as to any areas that may be queried further by the CAG, to advise where greater clarity may be required, to highlight key aspects specific to your application and to signpost to specific contacts to address points raised where necessary.

In order to take advantage of this service, the following criteria applies:
  • The request for pre-application assessment must be submitted no later than 10 days prior to the date the assessment is required. We cannot guarantee to provide an assessment if the output is required sooner than 10 working days from receipt. If a response is required earlier than 10 working days, a request will be accepted only at the discretion of the CAT team capacity to deliver to that timescale. Applicants are advised to plan accordingly and to make contact at an early stage.
  • A completed draft application is required. Advice cannot be provided against protocols or briefing papers alone as the questions in the form are necessary for a pre-application assessment to be undertaken. Patient leaflets and supporting information should also be provided so an assessment with the full context can be undertaken.

Additionally, for complex or novel applications, the CAT is happy to meet to discuss initial proposals as we have found it significantly aids submissions if consideration of CAG issues takes place at an early stage. If the view is that the application raises significant issues, complex or novel issues and a conversation would be helpful, please contact the Confidentiality Advice Team (CAT).

Booking and submitting to CAG
Applications to CAG must be booked for review prior to submission. You should only contact the Confidentiality Advice Team (CAT) to book once an application is ready for submission as the application must be submitted within 24 hours of booking.

  • If the application is not submitted within 24 hours the booking will be cancelled.
  • The team are unable to reserve spaces for future meetings to prevent delays to applicants who are ready to submit.

The process to book an application is:
  1. Review the precedent set criteria prior to booking to determine if any apply to your application.
  2. Check the meeting and cut off dates on the HRA website. The dates advertised specify the date that bookings must be received by to be considered for inclusion onto the scheduled meeting.
  3. Call the Confidentiality Advice Team (CAT) to book the application into the next available meeting.
  4. Email the fully completed application (for research applications please include PDF and XMLversions of the form) and all supporting documents to the Confidentiality Advice Team (CAT) within 24 hours of booking. If the application is not submitted within this time period it will automatically be removed from the meeting agenda.

If you have any questions in relation to the process please contact the Confidentiality Advice Team (CAT).

Back to the top

Tips for successful application:

There are a number of errors that are seen in applications to CAG. These usually delay the progress of an application and in some instances may lead to the application being rejected. Below are some tips to avoid some of the common application errors:
  1. Application Form
    • Make sure that you completed all questions in the form. The CAG provides recommendations based upon the written documentation so it is important you fully address the questions
    • For research applications you should submit both PDF and XML versions of the form in IRAS.
  2. Supporting documents
    • Make sure that you provide all necessary supporting documentation
    • For research applications the checklist tab associated with the CAG Form in IRAS provides a list of the documents that are normally expected to support the application. Use this as a guide to the documents you should include although those that are marked as mandatory are expected in all cases.
    • For non-research applications refer to the documents list in the form for a list of document that are normally expected to support the application
    • Make sure you enter the correct file title, version number and date.
  3. Authorisations
    • For research applications in IRAS, make sure you have electronic authorisations in place for all declarations in the form and that they are shown as valid. Do not add electronic authorisations until you are certain the application is complete. Any changes made to the will invalidate any authorisations that are already in place. If your form requires multiple authorisations be aware that if one of the authorisers changes the form before they authorise it then any authorisations that were already in place will be invalidated and will need to be sought again.
    • For non-research applications you may use an electronic signature.
  4. Submitting the application
    • You must book your application before you submit it by email. If you do not book the application, or you do not submit it within 24 hours of booking, the booking will be cancelled.
    • Ensure you or someone else familiar with the research is available to be contacted in the days after submission. This will enable quicker resolution of any queries about the application.

In addition to the tips above you may wish to check whether your application is likely to meet the relevant validation criteria by referring to the CAG Standard Operating Procedures. The SOPs are publicly available on the Health Research Authority website.

Back to the top

After you have submitted your application

All applications, except those reviewed via the Precedent Set process are considered at a full CAG meeting.

On receipt of the application, the first validation stage will determine whether there is sufficient information for the application to be presented to CAG. The validation criteria are set out in CAG Standard Operating Procedures, these include the following elements:
  • Application form is fully completed and authorised (or signed)
  • Relevant supporting documents have been submitted
  • Application is clear and comprehensive i.e. without the use of overly technical language or acronyms and all data flows have been adequately explained.
  • The application addresses the requirements of the legislative framework (please refer to the standard operating procedures for detailed information).

At this stage the Confidentiality Advice Team (CAT) may advise that further information is required prior to presenting the application to CAG. CAT may also advise on potential alternatives to the use of patient identifiable data without consent and, if necessary, applicants will need to speak to other parties potentially involved in the activity about the application. If further information is required before the application can be confirmed as valid, the applicant will be informed within one week of submitting their application.

It is the applicant’s responsibility to ensure that queries are responded to within the given timescales, normally one week, to enable the application to progress. In some instances applicants may be asked to revise their application form to ensure the information presented is clear.

Following validation the applicant will be advised by email whether their application is valid, whether it will be submitted for full CAG review or processed via precedent set review and be given details of the timescales involved.

CAG review of applications
If your application requires full CAG review then it will be considered at a monthly CAG meeting. In some circumstances, the CAT may advise you to attend the meeting. Where applications are reviewed at a CAG meeting applicants can expect to receive a decision with 60 days.

If your application is being reviewed via the Precedent Set process then it will be reviewed by a sub-committee. Where applications are reviewed via precedent set applicants can expect to receive a decision within 30 days. In some cases this review may refer the application to a full CAG review.

After CAG review
CAG will provide advice to the Health Research Authority (HRA) or Secretary of State (SofS) who in turn make a decision on the application. The Confidentiality Advice Team will inform you of the decision, in writing, within 10 working days of the review by CAG.

The possible HRA/SofS decisions are:
  • An application is approved
  • An application is conditionally approved
  • An application is provisionally approved pending further information from the applicant
  • A decision is deferred, further information is required from the applicant to determine if the requirements of the Regulations are met
  • A decision is deferred, further information is required from a third party to determine if the requirements of the Regulations are met
  • An application is not approved
  • Approval under the Regulations is not considered to be required.

Where your application is approved, this is for a period of 12 months, or as otherwise specified as part of the approval letter, and is conditional on your compliance with the CAG standard conditions of support .

If your application is not approved and you can address the reasons given for this that were set out in the outcome letter from CAG then you may resubmit your application. In this situation, you should follow the advice provided in the outcome letter and submit the application with a covering letter detailing the amendments made and how these address the issues raised. The normal booking and submission process should be followed when resubmitting the application for review.

Back to the top

Page last updated: 20 October 2020

IRAS Integrated Research Application System, version 6.2.1, 26/05/2022, IRAS Dataset version 3.5.
The Health Research Authority (HRA) acknowledges the Integrated Research Application System (IRAS) partners in developing IRAS content. © Health Research Authority 2022.
Copyright and other intellectual property rights in the content of the Integrated Research Application System (IRAS) belong to the HRA and all rights are reserved. Terms & Conditions, Privacy Policy. APP-N