This policy is intended to identify how Manor Court Surgery will meet its contractual responsibilities in accordance with the NHS Digital National Data Op[t out and your data matters programme, and To comply with national data opt-out policy, you need to put procedures in place to review uses or disclosures of confidential patient information against the operational policy guidance.
The mandatory implementation deadline for the National Data Opt-Out (NDOO) is 31 July 2022.
Application of the NDOO is aligned with the authorisation for using a patient’s data in accordance with the common law duty of confidentiality. It does not apply where:
- The individual has consented (including where the consent is implied for the purposes of direct care)
- There is an overriding public interest. More on this can be found in the NDOO operational policy guidance–
- There is a mandatory legal requirement to use the information (e.g., where data is required by NHS Digital under section 259 of the Health and Social Care Act 2012).
- Data is processed under regulation 3 of the Health Service (Control of Patient Information) Regulations 2002 for purposes of communicable diseases and other threats to public health
- Data has been anonymised in line with the Information Commissioner’s Office (ICO) Code of Practice) on Anonymisation or is aggregate or count type data.
In practice this means that, broadly, the NDOO applies to data processed under regulation 5 of the Health Service (Control of Patient Information) Regulations 2002 (also known as section 251 approval) unless there is a specific exemption in place.
The Health Research Authority publishes a register of programmes which are processing data under regulation 5, which can be found here.
NHS Digital will publish a list of all those programmes relying on section 251 approval for processing which are exempt from application of the NDOO shortly.
Information for organisations on applying the NDOO can be found on the NHS Digital website here.
Type 1 opt-out: medical records held at GP practice
Some patients will have a type 1 opt-out registered with their GP practice, which indicates they do not want their confidential patient information leaving the practice for research and planning purposes. These existing type 1 opt-outs will continue to be respected until the Department of Health and Social Care conducts a consultation with the National Data Guardian on their removal.
Type 2 opt-out (National Data Opt-out): information held by NHS Digital
Previously patients could tell the practice if they did not want us, NHS Digital, to share confidential patient information that we collect from across the health and care service for purposes other than individual care. This was called a type 2 opt-out. The national data opt-out has replaced type 2 opt-outs. GP practices must no longer use the type 2 opt-out codes to record a patient’s opt-out choice as they are no longer collected or processed.
The type 2 opt-out was replaced by the national data opt-out. Type 2 opt-outs recorded on or before 11 October 2018 have been automatically converted to national data opt-outs.
Patients who previously had a type 2 opt-out
Where a patient had a type 2 opt-out registered on or before 11 October 2018, this was automatically converted to a national data opt-out and if they were aged 13 or over they were sent a personal letter explaining the change and a handout with more information about the national data opt-out.
Patients can be reassured that their choices will continue to be respected. If they want to change their choice, they can use the national data opt-out service to do this.
Guidance to prevent use of type 2 opt-out codes and identify if they have been used in error
Follow the guidance for the clinical system you use in your GP practice.
TPP SystmOne: guidance on invalid type 2 codes
EMIS Web: guidance on invalid type 2 codes
Vision: guidance on invalid type 2 codes
Microtest: guidance on invalid type 2 codes
Instructions for staff:
If a patient wants a Type 1 opt-out, provide them with ‘Patient Health Records – Refusal to consent’ form, Appendix 1, to complete. Then pass to PM for implementation.
If a patient wants a Type 2 opt-out, direct them to nhs.uk/your-nhs-data-matters as they must now do this directly with NHS Digital.
Further Info for staff: Information Sharing
The NHSD has a statutory role to collect and process health and social care information which is set out in the Health and Social Care Act 2012.
The NHSD’s fair processing materials, available on their website, explain and provide further information on:
- what NHSD collects – the types of information the NHSD collects and what it’s used for
- personal information choices – people’s rights regarding care information
- information requests from organisations – how organisations can ask NHSD to collect or provide access to care information
- assurance bodies and processes – how the information requests NHSD receive are carefully looked at
- examples of benefits that have been realised through the provision of such information including case studies involving breast cancer and diabetes that are available at: http://www.hscic.gov.uk/benefitscasestudies/extracts
The NHSD is absolutely committed to keeping all of the data it handles safe and secure and applies the same principle to any data that is released outside of the organisation.
Information is only ever shared with organisations that have gone through a strict application process, who can demonstrate they have a legitimate reason to access the data to use it for the benefit of health and care purposes, as per the new protections introduced as part of the Care Act 2014, and who have signed a legally binding agreement. So for example commercial companies cannot receive information for insurance or marketing purposes.
As part of the application process the Data Access Advisory Group, an independent group, hosted by the NHSD, considers all applications for data that are identifiable or de-identified for limited access.
Summary Information to give to patients:
You can choose whether your confidential patient information is used for research and planning. To find out more visit nhs.uk/your-nhs-data-matters. Or read leaflet available on reception ‘Your Data Matters to the NHS’
You do not need to do anything if you are happy about how your confidential patient information is used. You can change your choice at any time.
Resources are available for practice staff to share with patients if they have any questions. When patients ask about opting out:
- refer them to the website nhs.uk/your-nhs-data-matters
- it’s helpful to make sure they know their NHS number
- ensure they have an up-to-date email address or mobile phone number in their GP practice record, as this will be used to verify their identity when they use the service
Practices should check:
- existing posters, leaflet racks and screen display messages for materials that talk about data sharing and remove any which are no longer appropriate – for example, are there still copies of ‘Better information means better care’ leaflets or posters available that were used at the time of the care.data public campaign? (Care.data was formally closed in 2016, with no data extractions having taken place)
- the practice website (if you have one) for patient information about data sharing and opt-outs to check it is still relevant or whether anything will need to be updated to reflect the materials and information about the national data opt-out
- any patient registration forms that include information on different data uses and opt-outs available
- if there are any existing opt-out request forms in place and whether they are still accurate – for instance, do they offer the patient the ability to record an opt-out to prevent the sharing of data for purposes beyond individual care by NHS Digital (also referred to as a ‘type 2’ opt-out)
Detailed information for patients:
Sharing your records: your personal information
Information about you is used in a number of ways by the NHS and social care services to support your personal care and to improve health and social care services for everyone.
The NHS Digital (NHSD) is the national NHS organisation with a legal responsibility to collect data as people make use of NHS and social care services. The data is used both at a local level and nationally to help with planning, managing your care, supporting research into new treatments, identifying trends and issues and so forth, and is used to try to make services better for all.
You can, however, choose not to have information about you shared or used for any purpose beyond providing your own treatment or care.
Your right to opt out
You can choose not to have anything that could identify you shared beyond your GP practice (Type 1 objection). You can also choose for the NHSD not to share information it collects from all health providers any further (previously known as Type 2 objection, now National Data Opt-out).
If you have previously told your GP practice that you don’t want the NHSD to share your personal confidential information for purposes other than your own care and treatment, your opt-out will have been implemented by the NHSD from July 31 2022. It will remain in place unless you change it.
You can find more information about how the HSCIC handles your information and choices and how it manages your opt-out on the HSCIC website www.hscic.gov.uk/yourinfo
Appendix 1
Manor Court SurgerySurgery
Patient Health Records – Refusal to Consent – Type 1 Objection
Type 1 Objection: I am writing to give notice that I refuse consent for my identifiable information and the identifiable information of those for whom I am responsible (delete as appropriate) to be transferred from your practice systems for any purpose other than our individual medical care.
Please take whatever steps necessary to ensure my confidential personal information is not uploaded and record my dissent by whatever means possible.
This includes adding the ‘Dissent from secondary use of GP patient identifiable data’ code (Read v2: 9NU0 or SNOMED 827241000000103) to my record.
I am aware of the implications of this request, understand that it will not affect the care we receive and will notify you should I change my mind.
Type 2 Objection (National Data Opt-out): I understand that if I do not want NHS Digital to share confidential patient information that they collect from across the health and care service for purposes other than for my individual care, I must visit nhs.uk/your-nhs-data-matters or call 0300 303 5678 to action my wishes.
Signature: ………………………………………………………………… Date: ………………
Full Name: ………………………………………..………………………………
Address: ……………………………………………………………………………
……………………………………………………………………………..
……………………………………………………………………………..
Postcode: …………………………………………………………………………
Date of Birth: …………………………………………………………………….
NHS Number (if known): …………………………………………………….