NHS data collection - what you need to know
Updated 21 July 2021:
The Government has indefinitely halted this GP data sharing scheme, with a minister admitting mistakes had been made in the way the project has been run.
In a letter to GPs, the Government said it was dropping the previous target date (1 September) to launch significantly increased patient data collections by NHS Digital from GPs, and that the project would only go live once four conditions have been met.
These four conditions are:
- The ability to delete data already collected prior to a person choosing to opt out;
- The backlog of existing opt outs being fully cleared;
- The development of a “trusted research environment” — a repository into which the data will be collected and accessed only by NHSD-approved users without further extracting the data; and
- Greater patient awareness of the scheme.
This is a significant shift in policy. It comes as a result of campaigners — both inside and outside the NHS — raising concerns about privacy and a lack of communication with patients.
In her letter to GPs, health minister Jo Churchill said the government has “heard [their] concerns loud and clear” and will “continue to listen”.
Read about how Healthwatch England is involved in the NHS patient data project.
This information explains what the NHS GP data sharing scheme was due to look like. The Government has announced that these plans are now on hold.
Data sharing with NHS Digital will start on 1 September 2021.
We’ve put together some relevant information about what will be shared, why, and how you can opt out if you want to.
Why NHS Digital collects general practice data
NHS Digital has responsibility for standardising, collecting, analysing, publishing and sharing data and information from across the health and social care system, including general practice.
NHS Digital collected patient data from general practices using a service called the General Practice Extraction Service (GPES), which has operated for over 10 years.
NHS Digital has engaged with doctors, patients, data and governance experts to design a new approach to collect data from general practice that:
- reduces burden on GP practices
- explains clearly how data is used
- supports processes that manage and enable lawful access to patient data to improve health and social care
What data will be shared
This data will be shared from 1 September 2021. Data may be shared from your GP medical records about:
- any living patient registered at a GP practice in England when the collection started - this includes children and adults
- any patient who died after 1 September 2021, and was previously registered at a GP practice in England when the data collection started
- NHS Digital will not collect patients’ names or addresses. Any other data that could directly identify patients (such as NHS Number, date of birth, full postcode) is replaced with unique codes which are produced by de-identification software before the data is shared with NHS Digital.
NHS Digital will collect:
- data about diagnoses, symptoms, observations, test results, medications, allergies, immunisations, referrals, recalls and appointments, including information about physical, mental and sexual health
- data on sex, ethnicity and sexual orientation
- data about staff who have treated patients
NHS Digital will not collect:
- name and address (except for postcode, protected in a unique coded form)
- written notes (free text), such as the details of conversations with doctors and nurses
- images, letters and documents
- coded data that is not needed due to its age - for example medication, referral and appointment data that is over 10 years old
- coded data that GPs are not permitted to share by law - for example certain codes about IVF treatment, and certain information about gender re-assignment
Opting out of data sharing
If you don’t want your identifiable patient data to be shared for purposes except for your own care, you can opt-out by registering a Type 1 Opt-out or a National Data Opt-out, or both. These opt-outs are different and they are explained in more detail below. Your individual care will not be affected if you opt-out using either option.
GP data only - or 'Type 1 Opt-out'
NHS Digital will not collect data from GP practices about patients who have registered a Type 1 Opt-out with their practice.
Downloads
Complete the GP data 'Type 1 opt out' form
Non GP data sharing
If you want to stop your non-GP data, such as hospital or clinic treatments, being used for purposes other than your direct care (e.g. for “research and planning“), this is what you need to do.
- If it’s just for yourself, use NHS Digital’s online National Data Opt-out process – this process only works for individuals aged 13 and over.
- If you have children under 13, complete this form and e-mail or post it back to NHS Digital – this form works for both you and your children.
- If you have an adult dependent for whom you have legal responsibility, complete this form and send it back to NHS Digital on their behalf.
There is no deadline for non-GP 'National Data Opt-out'.
The National Data Opt-out will not stop your GP data being extracted by the new GP data collection.
Who the NHS share patient data with
The NHS states that:
"All data which is shared by NHS Digital is subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the relevant health and social care purpose will be shared."
All requests to access patient data from this collection, other than anonymous aggregate statistical data, will be assessed by NHS Digital’s Data Access Request Service, to make sure that organisations have a legal basis to use the data and that it will be used safely, securely and appropriately.
These requests for access to patient data will also be subject to independent scrutiny and oversight by the Independent Group Advising on the Release of Data (IGARD). Organisations approved to use this data will be required to enter into a data sharing agreement with NHS Digital regulating the use of the data.
There are a number of organisations who are likely to need access to different elements of patient data from the General Practice Data for Planning and Research collection. These include but may not be limited to:
- the Department of Health and Social Care and its executive agencies, including Public Health England and other government departments
- NHS England and NHS Improvement
- primary care networks (PCNs), clinical commissioning groups (CCGs) and integrated care organisations (ICOs)
- local authorities
- research organisations, including universities, charities, clinical research organisations that run clinical trials and pharmaceutical companies
If the request is approved, the data will either be made available within a secure data access environment within NHS Digital infrastructure, or where the needs of the recipient cannot be met this way, as a direct dissemination of data. We plan to reduce the amount of data being processed outside central, secure data environments and increase the data we make available to be accessed via our secure data access environment. For more information read about improved data access in improving our data processing services.
Data will always be shared in the uniquely coded form (de-personalised data in the diagram above) unless in the circumstances of any specific request it is necessary for it to be provided in an identifiable form (personally identifiable data in the diagram above). For example, when express patient consent has been given to a researcher to link patient data from the General Practice for Planning and Research collection to data the researcher has already obtained from the patient.
It is therefore possible for NHS Digital to convert the unique codes back to data that could directly identify you in certain circumstances, and where there is a valid legal reason which permits this without breaching the common law duty of confidentiality. This would include:
- where the data was needed by a health professional for your own care and treatment
- where you have expressly consented to this, for example to participate in a clinical trial
- where there is a legal obligation, for example where the COPI Notices apply - see Our legal basis for collecting, analysing and sharing patient data above for more information on this
- where approval has been provided by the Health Research Authority or the Secretary of State with support from the Confidentiality Advisory Group (CAG) under Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002 (COPI) - this is sometimes known as a ‘section 251 approval’
This would mean that the data was personally identifiable in the diagram above. Re-identification of the data would only take place following approval of the specific request through the Data Access Request Service, and subject to independent assurance by IGARD and consultation with the Professional Advisory Group, which is made up of representatives from the BMA and the RCGP.
If you have registered a National Data Opt-out, this would be applied in accordance with the National Data Opt-out policy before any identifiable patient data (personally identifiable data in the diagram above) about you was shared.
