Data will be ‘pseudonymised’ – but NHS Digital will still hold the keys to identifying you (Image: Getty Images)
Get US and UK politics insight with our free daily email briefing straight to your inbox
Invalid EmailSomething went wrong, please try again later.Sign upWhen you subscribe we will use the information you provide to send you these newsletters. Your information will be used in accordance with ourPrivacy Notice.Thank you for subscribingWe have more newslettersShow meSee ourprivacy notice
The Government has agreed to push back the launch of an NHS data-sharing scheme amid growing concerns from privacy campaigners.
The scheme will collect information on people's treatments, referrals and appointments over the past 10 years, alongside other data from medical records held on GPs' systems.
But data rights campaigners are concerned about the programme – which will see data shared with third parties including businesses.
Patients can opt out of the scheme – but the government has been criticised for failing to advertise the opt-out widely to patients.
Here’s everything you need to know about the NHS data sharing programme – and whether you should be concerned about it.
What data will be collected and shared?
Your GP will send data from your patient records to NHS Digital, who will hold it in their national database.
According to NHS Digital, the data can include:
- your sex, ethnicity and sexual orientation
- test results
- information about your physical, mental and sexual health
Ministers cave under pressure and delay NHS patient data grab plan
Labour demands delay to 'deeply concerning' plan to share GP patient data
Why do they want it?
The NHS says the data will allow them to be better at planning how services are delivered. It also says it will allow more research into improving treatments and patient care.
It also says that “in exceptional circumstances” it could be used to provide you with “individual care”.
Who will it be shared with?
As well as the people you might expect – the Department for Health and Social Care (DHSC), NHS England, other hospital groups and local authorities – the data could be shared with third party organisations.
These can include “research organisations, including universities, charities, clinical research organisations that run clinical trials and pharmaceutical companies.”
Any requests to access the data will be assessed by NHS Digital’s Data Access Request Service to ensure organisations have a “legal basis to use the data” and that it will be “stored safely and securely.”
Requests for access to patient data will be subject to oversight by the Independent Group Advising on the Release of Data (IGARD).
NHS Digital says the data will only be used for “health and care purposes” and will “never be shared with marketing or insurance companies.”
Can I be identified from the data?
Yes. But the NHS says they won’t unless they really have to.
Before it’s transferred to NHS Digital, any data that could identify you – like your NHS number, GP local patient number, “full postcode” and date of birth – is replaced with unique codes.
Rather than being anonymous, think of it as a pseudonym. Instead of being known by your name, your records are attached to a random number.
That allows researchers to know your data all came from the same person, and know roughly where that person lives, but they wouldn’t be able to pick you out individually.
NHS Digital say that in “certain circumstances” they – and only they – would be able to reverse the process and identify you from the records. But they say they would only do this if they had a “valid legal reason”.
An example given for this would be if “you consent to your identifiable data being shared with a research project or clinical trial in which you are participating, as they need to know the data is about you.”
Court orders Michael Gove's office to hand over documents on secretive 'blacklist' unit
Why are people concerned?
First of all, because of the sheer volume of data that is being extracted – far more than in any previous data access programme.
Secondly, as with all centralised collection of personal data, it increases the risk of it being stolen. The Government says all the data will be stored securely – but no system is totally secure.
Finally, many people and groups, including the Royal College of GPs, are concerned that the Government has failed to adequately advertise the plans – and their ability to opt out of them – to patients.
Prof Martin Marshall, the chair of the Royal College of General Practitioners (RCGP) said: “The job of informing the public must not be left to busy GPs, especially at a time of extreme workload pressures and focus on the Covid-19 vaccination programme, so we have written to NHS Digital urging them to undertake greater communications with the public about this new collection and their options for opting out.”
Information Commissioner Elizabeth Denham said there was still “considerable confusion regarding the scope and nature" of the programme.
She said: “The appropriate use of health data is an important part of health and care research and planning in England, and better sharing of health data could offer substantial benefits.
"However, it is clear that there remains considerable confusion regarding the scope and nature of the [programme], among both healthcare practitioners and the general public. This includes how data protection rights can be exercised in practice.
"It is sensible for NHS Digital to take more time to engage with its stakeholders, and consider the feedback it is receiving about its plans."
When does it start?
The programme will start from September 1 – a delay from the previous start date of July 1.
Announcing the delay earlier, Health minister Jo Churchill insisted that the data programme will still go ahead this year.
The coming weeks will see the plan "strengthened" and work undertaken to "ensure that data is accessed securely", she said.
Covid-19 advice to 'minimise travel' extended to all of Greater Manchester and Lancashire
How can I opt out?
Originally, patients only had until June 23 to opt out of the scheme and prevent their data being shared.
But that’s now been scrapped – and patients can ask for their data not to be shared at any time up to September 1.
You can opt out after that date, but it doesn’t work retrospectively – any data already shared with NHS Digital will stay shared, and will be accessible to third parties.
Patients can tell their GP not to share their data with NHS Digital by filling in a “Type 1 opt-out form” – which you can get here – and handing it in at their local practice.
Also, patients can tell NHS Digital not to share any of the identifiable data they hold about them with anyone else for purposes other than their own care by registering a National Data Opt-Out here.