1. National Data Opt-out Programme
London wide LMCs’ Annual Conference, 2 May 2018
Trevor Anders

2. Overview – NDG Review
Better use of information and data has the potential to transform health and care for everyone.
People want to know that their privacy and rights are safeguarded, understand how and when information about them is shared, and, be able to make an informed choice about whether to share their data or not.
It was in this context that the Secretary of State for Health commissioned a review on data security and data sharing in the health and social care system by Dame Fiona Caldicott, the National Data Guardian for Health and Care (NDG).
This independent “Review of data security, consent and opt-outs” was published July 2016, followed by a public consultation that ran until September 2016.
Government response published on 12 July 2017.
The work takes place in the context of the drive to develop a digitised health and care system that offers patients more control and choice over the care they receive, improves their experience, provides them with better outcomes and delivers a more efficient health and care system.
Optional

3. Applying the national data opt-out
Applies to data shared
for planning and research purposes
Data shared for an individual’s care & treatment
Legal requirement / public interest / consent
Data is anonymised
Is 1 option that covers: Research – finding ways to improve treatments and identify causes of and cures for illnesses
Planning – to improve and enable the efficient and safe provision of health and care services
E.g. where data is shared between the health and care professionals in a hospital and in a GP practice
E.g. There is a mandatory legal requirement such as a court order, to protect the greater interests of the general public or there is explicit consent
The data shared is determined to be compliant with the ICO Anonymisation: managing data protection risk code of practice
This identifies you personally
This identifies you personally
This identifies you personally
This does not identify you personally
There is just one choice and the opt-out is for both data used for research and for planning purposes
The national data opt-out applies only where personally identifiable data are being shared for purposes beyond an individual’s care and treatment and is intended to be used in research studies or to help in managing the efficient and safe running of the health and care system
Regardless of the national data opt-out personal identifiable data cannot be used for insurance or marketing purposes without the explicit consent of the patient
The national data opt-out is for purposes beyond an individuals care and treatment not their individual care aka direct care
The national data opt-out will not apply where:
1. There is a mandatory legal requirement such as:
CQC has statutory powers to require information for their inspection purposes
Reporting of notifiable diseases
Reporting of gunshot wounds
NHS Digital require a health and care organisation to provide data under s259 of HSCA 2012
Type 2 opt-out transition – Patients who had previously registered a ‘Type 2’ opt-out will be migrated to a national data opt-out.

4. When it applies The national data opt-out will apply when:
Confidential Patient Information is used for purposes beyond an individual’s care and treatment
the legal bases to use the data is based on approvals made under:
regulation 2 (medical purposes related to the diagnosis or treatment of neoplasia i.e. cancer); or
regulation 5 (general medical purposes including medical research)
of the Control of Patient Information Regulations 2002 under the NHS Act 2006 s251
The Confidentiality Advisory Group which provides independent expert advice on applications for data use under s251 can in some cases agree that opt-outs do not apply but have indicated that this would only be in exceptional circumstances
Confidential Patient Information is defined in section 251 (11) of the National Health Service Act 2006.
Broadly it is information that meets the following 3 requirements:
a: identifiable or likely identifiable e.g. from other data likely to be in the possession of the data recipient;
b: given in circumstances where the individual is owed an obligation of confidence; and
c: conveys some information about the physical or mental health or condition of an individual, a diagnosis of their condition; and/or their care or treatment.
CPI cannot be defined by a specific data item (e.g. name or postcode) alone, as it needs to be considered more broadly to take account the nature of the information and the circumstances of the disclosure. Section 251 has been updated to ensure that the definitions used expressly include local authority social care (ie care provided for, or arranged by, a local authority).
NATIONAL HEALTH SERVICE, ENGLAND AND WALES - The Health Service (Control of Patient Information) Regulations 2002
Reg 2 - Medical purposes related to the diagnosis or treatment of neoplasia
(1) Subject to paragraphs (2) to (3) and regulation 7, confidential patient information relating to patients referred for the diagnosis or treatment of neoplasia may be processed for medical purposes approved by the Secretary of State.
(2) For the purposes of this regulation, “processing” includes (in addition to the use, disclosure or obtaining of information) any operations, or set of operations, which are undertaken in order to establish or maintain databases for the purposes set out in paragraph (1 )
(3) The processing of confidential patient information for the purposes specified in paragraph (1) may be undertaken by bodies or persons who (either individually or as members of a class) are (a)approved by the Secretary of State, and (b)authorized by the person who lawfully holds the information.
Reg 5 - General
Subject to regulation 7, confidential patient information may be processed for medical purposes in the circumstances set out in the Schedule to these Regulations provided that the processing has been approved— (a) in the case of medical research, by both the Secretary of State and a research ethics committee, and (b) in any other case, by the Secretary of State.
Reg 7 - Restrictions and exclusions
Where a person is in possession of confidential patient information under these Regulations, he shall not process that information more than is necessary to achieve the purposes for which he is permitted to process that information under these Regulations 4

5. Some key facts
Who can opt-out – anyone registered on PDS (i.e. with data in English system)
Formal proxies can set opt-out on behalf of others
Type 1 opt-outs will remain available
Existing type 2 opt-outs will be migrated
But people resident in Wales, Scotland etc who have received care in NHS in England can set an opt-out - May need to justify PDS angle and age of 13
Formal proxies include those with Parental responsibility and Legal power of attorney (both health and wellbeing and financial)
Channels briefly cover digital, digital-assist and non-digital. Other channels being developed for certain groups such as prisoners 5

6. Position with GDPR

7. Fit with General Data Protection Regulations
The national data opt-out will sit alongside the new General Data Protection Regulations /Data Protection Legislation and is not replaced or changed by it
Areas of overlap relate mainly to:
Understanding of consent
The GDPR ‘right to object’
Potential changes to ICO Code of Practice on Anonymisation
Privacy Notices
Privacy Notices/Fair Processing - We will provide some guidance for opt-out

8. Setting Opt-outs

9. National data opt-out setting service
The service to set a national data opt-out will be available online providing a secure way for patients to express their preference(s) about sharing their data for reasons other than their individual care and treatment
Only those aged 13 and over can use the online system
Patients will be able to access the opt-out online, e.g. using a smartphone, tablet or personal computer from 25 May 2018
Patients who cannot or do not want to opt-out using an online service will be able to call a national telephone service
Patients will have access to information to make an informed choice about whether or not to share their data for reasons other than their individual care
A patient will be able to set their national data opt-out preference at any time and change their opt-out preference at any time.
As part of the process of setting a national data opt-out through the online service or via a contact centre the patient will be given more information on the reasons for and benefits of data sharing to enable them to make an informed decision.

10. How it will work Store once for all
National bodies
Make simple to uphold
Empower patients
Local providers
Store once for all
NHS Digital will uphold all opt-outs from 25 May 2018
All other health & care organisations will be expected to uphold the opt-out by 2020

11. Communications

12. The health and care system layer
How will a person find out about their choice?  
www
I am informed through the national public communications layer
I see the link on web sites of national bodies and health and care organisations
I see a poster and materials in health and care settings 
nhs.uk
I speak to a health and care professional
I visit the NHS web site
National data opt-out service  
I hear through targeted approach of specialist groups, networks and voluntary organisations
I see when I access NHS wifi
I receive a letter as a type 2 patient
We will evaluate and refine communications on an on-going basis

13. The health and care system layer
Workforce facing products
Workforce group
Approach we are taking
Dedicated NHS Digital national data opt-out web page
Factsheets: Data use and patient choice; when it applies; what it applies to; how it is applied; setting; how this fits with DPA
Monthly newsletters
Q&As
Health and social care professionals
GP Practices
Patient Data Choices Project is a collaboration with the RCGP to develop: an e-learning package; a toolkit; videos and regional and national events. It is led by a clinical champion.
Nurses
Tailored resources for nurses including a prompt card and pocket guide badged by the RCN
Regular bulletins to national and professional bodies
Organisational readiness checklists
Policy guide
Health and social care specialists inc. IG
Registered providers and public bodies
Chief Executive letters
Data Security & Protection Toolkit

14. Being ready for 25 May 18

15. What do I need to do for the 25 May 2018?
Make sure your organisation is aware of the national data opt-out
Use the communication materials we’ll provide and check existing materials to remove out of date information e.g. references to type 2, care.data
Be prepared to receive questions from patients about the national data opt-out. i.e. know where to signpost them to
Standard text to add alongside privacy notices will be provided explaining the wider uses and the national data opt-out, pointing to the NHS.UK landing page
Understand type 2 migration
Checklists available on our website.

16. Events Webinars to follow
RCGP & NHS Digital ‘Patient Data Choices’
National Event – Friends House, London, 24th May 2018
National Data Opt-out Programme - May events
10th May: London, Euston Road, NW1
Webinars to follow

17. More information
National Data Opt-out Programme web pages & to join our mailing list
National data opt-out enquiries mailbox
Understanding Patient Data - Wellcome Trust
Information Governance Alliance (IGA) information on GDPR: