In line with the recommendations made by the National Data Guardian in her ‘Review of Data Security, Consent and Opt-outs’, the national data opt-out was introduced for health and social care systems on 25 May 2018.
The system will offer patients and the public the opportunity to make an informed choice about whether they wish their confidential patient information to be used just for their individual care and treatment or also used for research and planning purposes.
Patients and the public who decide they do not want their confidential patient information used for planning and research purposes will be able to set their national data opt-out choice online.
Information on how your data is used
Introduction
The national data opt out applies to the disclosure of confidential patient information for purposes beyond individual care across the health and adult social care system in England.
The document provides operational guidance to understand the application of national data opt-out policy for practice purposes.
A patient is able to set an opt-out via a number of channels including online, digitally assisted and non-digital channels. Any patient with an NHS number is able to set a National Data opt-out.
The opt-out is stored in a central repository against their NHS number on the NHS Spine and is not set or visible at practice level. The National Data opt-out will also continue after the patients’ death. Health Care organisations are required to be compliant with the opt-out by March 2020 and declare their compliance on the Data Security and Protection (DSP) Toolkit.
The opt-out applies regardless of how the data is stored – electronically or paper based.
What are national data opt-outs
The national data opt out implements the opt-out process proposed by the National Data Guardian’s Review of Data Security, Consent and Opt-Outs. The review proposed the following:
“There should be a new consent/opt-out model to allow people to opt-out of their personal confidential data being used for purposes beyond their direct care”.
The NDG’s review carefully considered the scope of the model including its limitation to purposes beyond individual care only and for it to be an opt-out rather than consent model:
“3.2.2: The Review was persuaded that the best balance between meeting these expectations and providing a choice to those who have concerns is achieved by providing an opt-out model. The review concluded that people should be made aware of the use of their data and the benefits; an opt-out model allows data to be used whilst allowing those who have concerns to opt out”.
The review also acknowledged that: “Whilst patients have a right under the NHS Constitution to request that their personal confidential data is not used beyond their direct care, there is currently no easy way for them to do that”. The national data opt-out provides a single central mechanism which gives effect to this right.
Applying the national data opt-out
Health and care organisations are required to apply national data opt-outs in line with the NHS National Data Opt-Out Policy.
NHS Digital has developed a technical service which enables health and adult social care organisations to check if their patients have a national data opt-out in order to enable them to comply with the opt out.
This service can be used in two ways:
- Organisations can submit a list of NHS numbers that they need to disclose and the service looks these up against the central repository of national data opt-outs. It returns a “cleaned list” of those that do not have a national data opt-out i.e. it removes the NHS numbers for those with a national data opt-out. This is most suitable for one-off and infrequent disclosures of data.
- Organisations can submit the NHS numbers for all patients with whom they have a legitimate relationship and then store temporarily the list of patients who do not have an opt-out at the current time and whose data they may be able to disclose16. There are a number of policy rules around the storage and use of this “temporary cache” of data which are set out below. This is most suitable for large scale and frequent disclosures of data.
More information on accessing the service, guidance and the timetable for the implementation of the national data opt-out through to March 2020 is provided on the National Data Opt-out Programme webpages.
Patients can apply the national data opt-out either online, post or phone. For more information please visit www.nhs.uk/manage-your-choice.
Which data disclosures do national data opt-outs apply to?
As per the NHS England Digital website: National data opt-outs apply to a disclosure when an organisation, e.g. a research body, confirms they have approval from the Confidentiality Advisory Group (CAG) for the disclosure of confidential patient information held by another organisation responsible for the data (the data controller) such as an NHS Trust.
The CAG approval is also known as a section 251 approval and refers to section 251 of the National Health Service Act 2006 and its current Regulations, the Health Service (Control of Patient Information) Regulations 2002. The NHS Act 2006 and the Regulations enable the common law duty of confidentiality to be temporarily lifted so that confidential patient information can be disclosed without the data controller being in breach of the common law duty of confidentiality.
In practice, this means that the organisation responsible for the information (the data controller) can, if they wish, disclose the information to the data applicant, e.g. research body, without being in breach of the common law duty of confidentiality. To be clear it is only in these cases where opt-outs apply.
What data is affected
Broadly it is data that meets all of the following three conditions:
- Identifiable or likely identifiable (for example from other data likely to be in the possession of the data recipient)
- Given in circumstances where the individual is owed an obligation of confidence
- Conveys some information about the physical or mental health or condition of an individual, a diagnosis of their condition; and/or their care or treatment
Which data disclosures does the national data opt-out NOT apply to?
- Information being disclosed is anonymised in accordance with the Information Commissioner’s Office’s anonymisation code of practice,
- the individual has given their consent for their information to be used for a particular purpose, e.g. a specific research study,
- there is an overriding public interest in the disclosure, i.e. the public interest in disclosing the data overrides the public interest in maintaining confidentiality, also referred to as the ‘public interest test’, and
- there is a legal requirement that sets aside the common law duty of confidentiality or the information is required by a court order.
- The national data opt-out does not apply to data disclosures for risk stratification for case finding but does apply where support under Section 251 is relied upon to support the disclosure.
- For the purpose of the National Data Opt-Out, risk stratification has been split into two functions, Risk Stratification for case finding and Risk Stratification for planning.
In these scenarios above, section 251 approvals would not have been sought. Further information can be read at NHS Digital.
Further Information/References
Patients are encouraged to read and understand the information in the below links about their right to opt out. Further information is explained regarding compliance, analysis of data opt-outs and more.