The National Data Guardian review & Government response Published November 2017 (Review February 2018)

Overview Better use of information and data has the potential to transform health and care for everyone. People want to know that their privacy and rights are safeguarded, understand how and when information about them is shared, and, be able to make an informed choice about whether to share their data or not. It was in this context that the Secretary of State for Health commissioned a review on data security and data sharing in the health and social care system by Dame Fiona Caldicott, the National Data Guardian for Health and Care (NDG). This independent review of data security, consent and opt-outs was published July 2016, followed by a public consultation that ran until September 2016. Government response published on 12 July 2017. The work takes place in the context of the drive to develop a digitised health and care system that offers patients more control and choice over the care they receive, improves their experience, provides them with better outcomes and delivers a more efficient health and care system.

NDG Review and Government’s response National Data Guardian Review – Key Points & Recommendations You are protected by the law Information is essential for high quality care Information is essential for other beneficial purposes You have the right to opt out of your personal confidential information being used for these other purposes beyond your direct care: Providing local services and running the NHS and social care Supporting research and improving treatment and care This opt-out will be respected by all organisations that use health and care information Explicit consent will continue The opt-out will not apply to anonymised information Arrangements will continue to cover exceptional circumstances The Government response to the National Data Guardian Review supports the recommendations

“A patient should be able to state their preference once (online or in person), confident in the knowledge that this will be applied across the health and social care system” National Data Guardian, July 2016 A key message from the review is that the patient must have a simple option available to set or change their opt-out preference that can then be accessed and applied when appropriate by all health and social care organisations that intend to share the patients identifiable data for purposes beyond the individual’s care and treatment.

What was said - during the review and consultation I need a simple explanation and clear choices Professionals want clarity about their responsibilities I don’t understand what you do with my data Majority of purposes beyond direct care do not require personal confidential data Expectation that information shared for direct care Case for data sharing needs to be made to public The review conducted a series of evidence sessions and interviews with key organisations and stakeholders, including patient representative groups, GPs and other clinicians, commissioners and providers of health and social care services, researchers and the Information Commissioner’s Office. Once published the review went out to consultation between 6 July 2016 to 7 September 2016. In order to promote participation, approximately 500 professional and public stakeholders were directly engaged and signposted to the consultation exercise that followed the publishing of the review. There were 638 responses to the consultation and these came from a broad range of organisations and individuals, including: Members of the Public, Clinical Commissioning Groups, General Practice Local Authorities, Arm’s Length Bodies, Public Health Organisations, Social Care Provider, Commissioning Support Units, Government Departments, Special Interest Groups, Professional Organisations/Associations, Hospital Trusts/Foundation Trusts and Research Bodies. In addition to the consultation, three events were held in London, Southampton and Leeds to engage with a wide range of people and explore the NDG review’s findings in more depth. At each event, there was a session for professionals and a session for members of the public. The events were attended by a total of 178 people comprising 111 professionals and 67 members of the public.

Implement communications strategy Implementation Timetable (Oct 2017 – Mar 2020) Area Opt-out awareness raising Opt-out service testing Setting opt outs Applying opt-outs New Data Protection Legislation (GDPR) Overall data communications strategy Oct – Dec 2017 Jan – Mar 2018 Apr – Jun 2018 Jul 2018 – Mar 2019 Apr 2019 – Mar 2020 Awareness raising Build opt-out service Test opt-out service 03/18 Opt-outs can start being set from this date 03/18 Opt-outs upheld by NHS Digital Upholding of opt-outs phased in for all other health and care organisations 05/18 New data protection legislation comes into effect Develop strategy Implement communications strategy The national data opt-out service will be tested with the public and professionals from September 2017. The health and care service including GP Practices will be readied for public launch from October 2017. Changes will be communicated about existing Type 2 preferences from January 2018 . Note this does not mean writing to those patients in January 2018. Nationally, members of the public will be able to start setting national data opt-outs from March 2018. The Department of Health will work with NHS England and NHS Digital to support all health and social care organisations to uphold the national data opt-out by March 2020. A separate piece of work has been commissioned to develop a strategy for data sharing communications. The national data opt-out will be referenced within the communications on data sharing rather than communications being focused on the national data opt-out alone.

More information National Data Guardian review https://www.gov.uk/government/publications/review-of-data-security-consent-and-opt-outs Government response Your Data, Better Security, Better Choice, Better Care National Data Opt-out Programme web pages & to join our mailing list https://digital.nhs.uk/national-data-opt-out Understanding Patient Data - Wellcome Trust https://understandingpatientdata.org.uk To be kept informed of further developments about the national data opt-out including news of any events taking place and any new or updated materials being made available please subscribe to our mailing list via the contact form on our web pages.