What’s happening with your NHS data?

We’ve been asked by readers about a forthcoming change in the way the NHS in England shares patient data, the various opt-outs available to the public and whether the data is really being sold.

What is changing?

From September 2021, NHS Digital will start collecting patient data from GP medical records in England about any living patient, including children, and any data about patients who died after the collection started. 

This is called the General Practice Data for Planning and Research data collection, and NHS Digital says it will be used to help the NHS improve health and care services by allowing it to plan better, prevent the spread of infectious diseases, help with research and monitor the long-term safety and effectiveness of care.

NHS Digital is the NHS provider for data and IT systems for the NHS in England.

What will be collected?

NHS Digital will collect information on diagnoses, symptoms, test results, medications, information about physical, mental and sexual health, a person’s sex, ethnicity, sexual orientation and which staff have treated them.

This will include most of the historic data from each patient’s record.

The data collection won’t include people’s names or where they live. Of course, that’s not the only information that can identify someone. Other details, like NHS numbers, postcodes and dates of birth, which can identify people, will go through a process called pseudonymisation, which means codes will be generated to replace these details. NHS Digital says this means that no one will be able to directly identify you in the data, without also having access to the key that links each patient to their code. However, NHS Digital does make a distinction between pseudonymisation and complete anonymisation, and so although the data will be de-personalised it will not be completely anonymous (you can read more about the distinction here).

NHS Digital maintains the keys to convert these codes back into data that could identify you, but won’t do that “unless in the circumstances of any specific request it is necessary for it to be provided in an identifiable form”. 

NHS Digital says they’ll only do that in certain cases when there is a valid legal reason, for example, if you consent to participate in a clinical trial, or where the data was needed by a health professional to provide you care.

Opting out

There are two ways of “opting out”, if you don’t want your data to be shared in the ways described. 

Type 1 opt-out

This prevents your data being shared outside your GP practice for anything other than individual care for patients. 

People have asked us about this opt-out recently, because there is an upcoming deadline if you want to use it to stop your GP data being shared with NHS Digital.

To use this opt-out so that your GP data isn’t shared, you need to print, fill in and return this document to your GP practice. The campaigning group MedConfidential has more information on how to do so if you don’t have access to a printer.

The deadline to get this form to your GP was previously 23 June, to allow time for GPs to process that before the implementation date 1 July. But on 8 June, Health Secretary Jo Churchill told the House of Commons the implementation date had changed.

She said: “Patient data is of course owned by the patient and we are absolutely determined to take people with us on this journey. 

“We have therefore decided we will proceed with the important programme but we will take some extra time, as we have conversed with stakeholders over the past couple of days. The implementation day will now be on the 1st of September and we will use this time to talk to patients, doctors, health charities and others to strengthen the plan, build a trusted research environment and ensure that data is accessed securely.”

It’s not clear when exactly you have to return the opt out form to your GP to make sure it gets processed before the new implementation day on 1 September. Full Fact asked NHS Digital if there was a deadline for this but it wasn’t able to specify. The previous deadline, of 23 June, was a week before implementation day.

You can also use a type 1 opt-out at any time after this date, and no further GP data will be shared, but any data shared up to that point will still be held by NHS Digital.

National Data Opt-out

This opt-out stops NHS Digital from sharing any confidential identifiable information (not just GP data) for reasons other than your individual care. Essentially, this stops your data being shared with other organisations, except in the cases where it’s a legal requirement or there’s a public interest argument, for example in managing coronavirus. 

There is no deadline for this type of opt-out. 

The national data opt-out used to be called a type 2 opt-out, and people who previously secured a type 2 opt-out should have had that converted to a national opt-out. As of 1 May 2021, there were just under 1.7 million national data opt-outs.

To use the national opt-out or check your status, you can go to this NHS website. To read about opting-out by phone, for your child (if they are under 13), or for someone else, you can visit this page.

Is this data being sold?

This depends on your definition of selling data.

The NHS Digital website says: “We are not going to sell your data”. But there is a price list on the organisation’s website listing charges for its Data Access Request Service.

On this page, NHS Digital says “We do not charge for data but we do apply charges to cover the cost of processing and delivering our service.”

Any organisations that want to pay to access this data need to convince the NHS Digital Data Access Request Service that they have a legal basis to use the data and will do so safely, securely and appropriately. Requests are also subject to scrutiny by the Independent Group Advising on the Release of Data.

NHS Digital publishes information on what data it releases and to whom every month. Many recipients are organisations like the Office for National Statistics, local authorities, government departments like the Department of Health and Social Care and research organisations like universities and charities, but they can also include companies that get approved.

NHS Digital says: “Any data that NHS Digital collects will only be used for health and care purposes. It is never shared with marketing or insurance companies.”