1. National data opt-out - Preparing for implementation
Published February 2018 (Review April 2018)

2. Implemented in two stages
Stage 1 - Readying for setting opt-outs
Previously undertaken general awareness work with health and care organisations
Engagement focus now is on preparing health and care organisations to be ready for the introduction of the national data opt-out and being able to handle queries from patients
Stage 2 – Upholding
Providing information on how and when to uphold the national data opt-out
The requirement for organisations to uphold the national data opt-out will be phased in through to 2020, starting with NHS Digital in May 2018
Stage 1 is about raising awareness of the national data opt-out and how opt-out preferences can be set and changed.
The National Data Opt-out Programme are engaging as widely as possible with some circa organisations across the health and care system.
Engagement from January 2018 will be to ready the health and care service to enable conversations between patients and health and care professional about national data opt-outs, data sharing and the ways in which patients can set and change their opt-out preferences along with signposting to where more resources and materials will be available.

3. Materials to support the national data opt-out
Information materials will be made available with the expectation they can be adapted and tailored to suit local needs and be available through local channels as well as being hosted and available through national websites
The national data opt-out will be communicated as part of communicating about data use and sharing in the health and care system to provide greater transparency and understanding
A wider benefits of data sharing campaign strategy is being developed and delivery will take place outside of the National Data Opt-out Programme
Will concentrate on developing content that can be used in a range of materials and this will be focused on the national data opt-out
3 layers of content will be made available:
Level 1 simple easy read information – these will be made available to all organisations in the form of posters and handouts.
Level 2 more detailed explanations and answers to more complex questions for those that want fuller understanding – these materials will be hosted and available from a national website but could be taken and made available through local channels as well
Level 3 technical guidance and answers to very specific questions – these materials will be hosted and available from a national website
These products and materials will communicate the opt-out and help raise awareness across the health and care system and help patients and the workforce to understand:
How an opt-out can be recorded
When an opt-out will be applied
How an opt-out can be applied
The intent is to provide information on data sharing and benefits rather than promote the national data opt-out though ensuring it is clearly referenced through these materials and for those that want to know more they are able to easily identify and access where more information is held
The National Data Opt-out Programme are also looking at what can be done in parallel to support messaging and approaches to communicating on General Data Protection Regulations
We expect communication materials to point out to other key supporting resources such as “Understanding Patient Data” which has case studies on data sharing and information on “Supporting Conversations” with patients and is supported by the Wellcome Trust
The Royal College of General Practitioners are also being commissioned to develop supporting implementation materials

4. Organisation readiness - Stage 1
The national data opt-out will be launched to the public in May 2018
At this time and possibly earlier, patients/service users may start to ask questions about the national data opt-out and the uses of their data e.g. why do you share my data? what is the national data opt-out?, do I need to do anything?, have I already got an opt-out recorded?, what do I need to do to record a national data opt-out?
Organisations need to be prepared for handling these enquiries from patients/service users about the national data opt-out and considering how such questions will be managed within their organisation
The following slide sets out the checklist of the implementation tasks for stage 1 that need to be considered and developed

5. Organisation preparation checklist
Responsible person identified to ready organisation for implementing national data opt-out awareness
Communications provided to all members of staff that need to be made aware of the national data opt-out
Privacy Notice materials on website have been assessed and updated
Other existing materials e.g. posters, registration forms have been checked for accuracy and updated to reflect the national data opt-out
Approach agreed on how, where and when to publicise information about data use and the national data opt-out perhaps aligned to transparency work for compliance with new data protection legislation (GDPR)
Handling plan for dealing with patient/service user enquiries has been agreed and communicated to staff
Checklist in more detail:
Responsible person identified to ready organisation for implementing national data opt-out awareness
(Someone that makes sure that the tasks on this checklist have all been considered, people are assigned to make any necessary changes and that the tasks have been completed)
Communications provided to members of staff that should be made aware of the national data opt-out
(Determine which members of staff need to be made aware of the national data opt-out e.g. are there members of staff that do not have contact with patients that require either minimal or no information about the national data opt-out?)
Privacy Notice materials on website have been assessed and updated
(Privacy / Fair Processing Notices need to comply with new data protection legislation)
Other existing materials e.g. posters, registration forms have been checked for accuracy and updated to reflect the national data opt-out
(Do any current patient materials talk about care.data for instance? If so these need updating to guide patients on the information available about data uses beyond their individual care and the national data opt-out which allows them to opt out of these uses)
Approach agreed on how, where and when to publicise information about data use and the national data opt-out, perhaps aligned to transparency work for compliance with new data protection legislation (GDPR)
(What will you do with new posters and handouts being provided that talk about wider data use by the NHS? Is there anything extra that you want to consider to help meet the duty of transparency about the wider use of data beyond individual care?)
Handling plan for dealing with patient/service user enquiries has been agreed and communicated to staff
(Look at current procedures for handling enquiries about the use of patient data and patients that ask to opt out or object to the use of their data, what if anything needs to change?)

6. Establish a handling plan for stage 1
Establish a plan for handling patient/service user enquiries that sets out:
How clinicians and those staff that need to know will be made aware of the national data opt-out and the handling plan
Who is expected to handle enquiries about the national data opt-out
The level of complexity that they are expected to be able to handle e.g. will they be expected to have a basic understanding in line with the level 1 information
If there is a nominated expert e.g. Caldicott Guardian, Data Protection Officer or Information Governance lead that complex enquiries can be passed on to
When they might be expected to signpost the patients/service users to materials that are available nationally

7. Implementation - Stage 2
The requirement for organisations to uphold the national data opt-out will be phased in through to 2020
The programme will work with organisations to help establish the organisation phases
The programme are looking at technical options to enable organisations to apply national data opt-outs to data disseminations as and when required
The following slide sets out some early preparation tasks to ready for stage 2 implementation
NHS Digital will be the first organisation ready to support the national data opt-out from May 2018
Phasing will most likely be based on organisation types as this will provide a coherent way to explain to patients when their national data opt-out will be applied
We are looking for organisations to help test the technical solutions for applying the opt-outs – if you are interested in taking part to help shape these solutions please let us know -

8. Initial preparation for stage 2
Review existing data processing and data disseminations to identify whether it looks likely that some data disseminations will need to have the national data opt-out applied
Mapping the legal bases for the range of data uses is a recommended preliminary step prior to introduction of the new data protection legislation (GDPR) being introduced in May 2018, so this will provide a good start.
If unsure due to uncertainty on the policy and awaiting more detailed guidance then register to join the mailing list to keep in touch as and when guidance and information materials are published
If it seems likely they need to be applied then ensure you keep in touch with timescales for other organisations to apply national data opt-outs by:
contacting the national data opt-out programme to identify your interest
registering to join the programme’s mailing list
considering volunteering to help with identifying and/or testing the technical solutions required to apply national data opt-outs
Remember to check that any data processing and disseminations are adequately described in Privacy Notice materials in accordance with Stage 1 preparation activities
See ‘More information’ slide for details of how to contact the programme and to join the mailing list

9. More information
National Data Opt-out Programme web pages & to join our mailing list
Understanding Patient Data - Wellcome Trust
National data opt-out enquiries mailbox
Information Governance Alliance (IGA) information on GDPR: