National Data Opt-out Programme London wide LMCs’ Annual Conference, 2 May 2018 Trevor Anders

Overview – NDG Review Better use of information and data has the potential to transform health and care for everyone. People want to know that their privacy and rights are safeguarded, understand how and when information about them is shared, and, be able to make an informed choice about whether to share their data or not. It was in this context that the Secretary of State for Health commissioned a review on data security and data sharing in the health and social care system by Dame Fiona Caldicott, the National Data Guardian for Health and Care (NDG). This independent “Review of data security, consent and opt-outs” was published July 2016, followed by a public consultation that ran until September 2016. Government response published on 12 July 2017. The work takes place in the context of the drive to develop a digitised health and care system that offers patients more control and choice over the care they receive, improves their experience, provides them with better outcomes and delivers a more efficient health and care system. Optional

Applying the national data opt-out Applies to data shared for planning and research purposes Data shared for an individual’s care & treatment Legal requirement / public interest / consent Data is anonymised Is 1 option that covers: Research – finding ways to improve treatments and identify causes of and cures for illnesses Planning – to improve and enable the efficient and safe provision of health and care services E.g. where data is shared between the health and care professionals in a hospital and in a GP practice E.g. There is a mandatory legal requirement such as a court order, to protect the greater interests of the general public or there is explicit consent The data shared is determined to be compliant with the ICO Anonymisation: managing data protection risk code of practice This identifies you personally This identifies you personally This identifies you personally This does not identify you personally There is just one choice and the opt-out is for both data used for research and for planning purposes The national data opt-out applies only where personally identifiable data are being shared for purposes beyond an individual’s care and treatment and is intended to be used in research studies or to help in managing the efficient and safe running of the health and care system Regardless of the national data opt-out personal identifiable data cannot be used for insurance or marketing purposes without the explicit consent of the patient The national data opt-out is for purposes beyond an individuals care and treatment not their individual care aka direct care The national data opt-out will not apply where: 1. There is a mandatory legal requirement such as: CQC has statutory powers to require information for their inspection purposes Reporting of notifiable diseases Reporting of gunshot wounds NHS Digital require a health and care organisation to provide data under s259 of HSCA 2012 Type 2 opt-out transition – Patients who had previously registered a ‘Type 2’ opt-out will be migrated to a national data opt-out.

When it applies The national data opt-out will apply when: Confidential Patient Information is used for purposes beyond an individual’s care and treatment the legal bases to use the data is based on approvals made under: regulation 2 (medical purposes related to the diagnosis or treatment of neoplasia i.e. cancer); or regulation 5 (general medical purposes including medical research) of the Control of Patient Information Regulations 2002 under the NHS Act 2006 s251 The Confidentiality Advisory Group which provides independent expert advice on applications for data use under s251 can in some cases agree that opt-outs do not apply but have indicated that this would only be in exceptional circumstances Confidential Patient Information is defined in section 251 (11) of the National Health Service Act 2006. Broadly it is information that meets the following 3 requirements: a: identifiable or likely identifiable e.g. from other data likely to be in the possession of the data recipient; b: given in circumstances where the individual is owed an obligation of confidence; and c: conveys some information about the physical or mental health or condition of an individual, a diagnosis of their condition; and/or their care or treatment.   CPI cannot be defined by a specific data item (e.g. name or postcode) alone, as it needs to be considered more broadly to take account the nature of the information and the circumstances of the disclosure. Section 251 has been updated to ensure that the definitions used expressly include local authority social care (ie care provided for, or arranged by, a local authority). NATIONAL HEALTH SERVICE, ENGLAND AND WALES - The Health Service (Control of Patient Information) Regulations 2002 Reg 2 - Medical purposes related to the diagnosis or treatment of neoplasia (1) Subject to paragraphs (2) to (3) and regulation 7, confidential patient information relating to patients referred for the diagnosis or treatment of neoplasia may be processed for medical purposes approved by the Secretary of State. (2) For the purposes of this regulation, “processing” includes (in addition to the use, disclosure or obtaining of information) any operations, or set of operations, which are undertaken in order to establish or maintain databases for the purposes set out in paragraph (1 ) (3) The processing of confidential patient information for the purposes specified in paragraph (1) may be undertaken by bodies or persons who (either individually or as members of a class) are (a)approved by the Secretary of State, and (b)authorized by the person who lawfully holds the information. Reg 5 - General Subject to regulation 7, confidential patient information may be processed for medical purposes in the circumstances set out in the Schedule to these Regulations provided that the processing has been approved— (a) in the case of medical research, by both the Secretary of State and a research ethics committee, and (b) in any other case, by the Secretary of State. Reg 7 - Restrictions and exclusions Where a person is in possession of confidential patient information under these Regulations, he shall not process that information more than is necessary to achieve the purposes for which he is permitted to process that information under these Regulations 4

Some key facts Who can opt-out – anyone registered on PDS (i.e. with data in English system) Formal proxies can set opt-out on behalf of others Type 1 opt-outs will remain available Existing type 2 opt-outs will be migrated But people resident in Wales, Scotland etc who have received care in NHS in England can set an opt-out - May need to justify PDS angle and age of 13 Formal proxies include those with Parental responsibility and Legal power of attorney (both health and wellbeing and financial) Channels briefly cover digital, digital-assist and non-digital. Other channels being developed for certain groups such as prisoners 5

Position with GDPR

Fit with General Data Protection Regulations The national data opt-out will sit alongside the new General Data Protection Regulations /Data Protection Legislation and is not replaced or changed by it Areas of overlap relate mainly to: Understanding of consent The GDPR ‘right to object’ Potential changes to ICO Code of Practice on Anonymisation Privacy Notices Privacy Notices/Fair Processing - We will provide some guidance for opt-out

Setting Opt-outs

National data opt-out setting service The service to set a national data opt-out will be available online providing a secure way for patients to express their preference(s) about sharing their data for reasons other than their individual care and treatment Only those aged 13 and over can use the online system Patients will be able to access the opt-out online, e.g. using a smartphone, tablet or personal computer from 25 May 2018 Patients who cannot or do not want to opt-out using an online service will be able to call a national telephone service Patients will have access to information to make an informed choice about whether or not to share their data for reasons other than their individual care A patient will be able to set their national data opt-out preference at any time and change their opt-out preference at any time. As part of the process of setting a national data opt-out through the online service or via a contact centre the patient will be given more information on the reasons for and benefits of data sharing to enable them to make an informed decision.

How it will work Store once for all National bodies Make simple to uphold Empower patients Local providers Store once for all NHS Digital will uphold all opt-outs from 25 May 2018 All other health & care organisations will be expected to uphold the opt-out by 2020

Communications

The health and care system layer How will a person find out about their choice?   www I am informed through the national public communications layer I see the link on web sites of national bodies and health and care organisations I see a poster and materials in health and care settings  nhs.uk I speak to a health and care professional I visit the NHS web site National data opt-out service   I hear through targeted approach of specialist groups, networks and voluntary organisations I see when I access NHS wifi I receive a letter as a type 2 patient We will evaluate and refine communications on an on-going basis

The health and care system layer Workforce facing products Workforce group Approach we are taking Dedicated NHS Digital national data opt-out web page Factsheets: Data use and patient choice; when it applies; what it applies to; how it is applied; setting; how this fits with DPA Monthly newsletters Q&As Health and social care professionals GP Practices Patient Data Choices Project is a collaboration with the RCGP to develop: an e-learning package; a toolkit; videos and regional and national events. It is led by a clinical champion. Nurses Tailored resources for nurses including a prompt card and pocket guide badged by the RCN Regular bulletins to national and professional bodies Organisational readiness checklists Policy guide Health and social care specialists inc. IG Registered providers and public bodies Chief Executive letters Data Security & Protection Toolkit

Being ready for 25 May 18

What do I need to do for the 25 May 2018? Make sure your organisation is aware of the national data opt-out Use the communication materials we’ll provide and check existing materials to remove out of date information e.g. references to type 2, care.data Be prepared to receive questions from patients about the national data opt-out. i.e. know where to signpost them to Standard text to add alongside privacy notices will be provided explaining the wider uses and the national data opt-out, pointing to the NHS.UK landing page Understand type 2 migration Checklists available on our website.

Events Webinars to follow RCGP & NHS Digital ‘Patient Data Choices’ National Event – Friends House, London, 24th May 2018 http://www.rcgp.org.uk/clinical-and-research/our-programmes/innovation/patient-choices.aspx National Data Opt-out Programme - May events 10th May: London, Euston Road, NW1 Webinars to follow http://web.ict.hscic.gov.uk/hscicgovuk-amnje/pages/0d160110f42ce811812270106faab5f1.html

More information National Data Opt-out Programme web pages & to join our mailing list https://digital.nhs.uk/national-data-opt-out National data opt-out enquiries mailbox newoptoutenquiries@nhs.net Understanding Patient Data - Wellcome Trust https://understandingpatientdata.org.uk Information Governance Alliance (IGA) information on GDPR: https://digital.nhs.uk/information-governance-alliance/General-Data-Protection-Regulation-guidance