Adjournment debate: Use of patient data

There has been widespread press coverage about the General Practice Data for Planning and Research (GPDPR) programme, reflecting concerns about the sharing of patient data outside the NHS, and the perceived lack of public engagement. The Full Fact article ‘What’s happening with your NHS data?’ (updated 8 June 2021) provides a summary. The programme has now been postponed from 1 July 2021 to 1 September 2021 and information on the delay can be found in the BBC News article ‘New NHS patient data store delayed by two months’ (8 June 2021).

NHS Digital have published a webpage ‘General Practice Data for Planning and Research (GPDPR)’ (updated 9 June 2021) which provides information about the rationale for the plans, the nature of the data to be collected, how this will be shared, and how to opt out. NHS Digital has also published a webpage ‘Collecting GP data – advice for the public.

The British Medical Association (BMA) and the Royal College of General Practitioners (RCGP) had issued a joint letter to NHS Digital on 27 May 2021, which outlined their concerns about a lack of communication with the public about the GPDPR programme. The letter recommended NHS Digital “take immediate action to run a public information campaign, possibly including the use of national help desks and local champions who GPs can signpost patients to in order to ensure the public is properly informed of this new collection and their options in terms of opting out”.

A coalition of organisations and David Davis MP had also called for a pause, as set out on the Doctors’ Association UK website on 4 June 2021.

Following the announcement of a delay to the programme on 8 June 2021, the BMA published a press release ‘BMA says Ministers listened to Association’s call to delay roll-out of the patient data sharing programme and it was the right thing to do’. The RCGP and the Information Commissioner’s Office also published statements welcoming the delay (RCGP: ‘Pause in GP data sharing scheme must be used to ‘properly communicate’ with patients and clinicians’; Information Commissioner’s Office: ‘Elizabeth Denham welcomes a delay to the launch of the GPDPR’, 8 June 2021).

The GPDPR programme has been the subject of a number of Parliamentary Questions. Health Minister Nadine Dorries, provided the following response to a question regarding data sharing with third parties on 9 June 2021:

Any organisation or individual can request data from NHS Digital and their request will be assessed through the Data Access Request Service to ensure that there is an appropriate legal basis for us to share data. The collected General Practice Data for Planning and Research data will be pseudonymised before it leaves general practitioner practices and made available for research and planning according to the same criteria as all other reference sets held at NHS Digital. Data is only shared with organisations who have a legal basis and meet strict criteria to use it for local, regional, and national planning, policy development, commissioning, public health and research purposes.

All applications for access to this data must have a health or care benefit and cannot be for solely commercial purposes. NHS Digital will not approve requests for data where the purpose is for marketing purposes, including promoting or selling products or services, market research or advertising.

[PQ8636, Medical Records: Data Protection, 9 June 2021]

Health Minister Jo Churchill announced the delay to the GPDPR programme in the Commons Chamber on 8 June 2021:

[…] Data saves lives —it is as simple as that. We have seen that in the pandemic, and it is one of the lessons of the vaccine roll-out. The GP data programme will strengthen the system and save lives. Patient data is, of course, owned by the patient. We are absolutely determined to take people with us on this journey. We have therefore decided that we will proceed with the important programme, but we will take some extra time, as we have conversed with stakeholders over the past couple of days. The implementation date will now be 1 September. We will use this time to talk to patients, doctors, health charities and others to strengthen the plan, build a trusted research environment and ensure that data is accessed securely. This agenda is so important, because we all know that data saves lives.

The NHS Digital webpage ‘Collecting GP data – advice for the public’ provides the following information on how data is shared:

NHS Digital does not sell data. It does however charge those who want to access its data for the costs of making the data available to them. This is because we are not funded centrally to do this. Charges only cover the cost of running the service and means that those organisations who need access to the data bear the costs of this, rather than NHS Digital. We do not make profits from the service. The data will only be used for health and care planning and research purposes by organisations who have a legal basis and legitimate need to use the data. We publish the details of the data we share on our data release register so we can be held to account. We do not allow data to be used solely for commercial purposes.

The NHS have also published a series of webpages ‘Choose if data from your health records is shared for research and planning’ which provide an overview of data sharing in the NHS.

NHS Digital have published a ‘General Practice Data for Planning and Research Transparency Notice’ (updated 9 June 2021) which includes a section outlining the legal basis for collecting, analysing and sharing patient data.

The Library briefing on Patient health records: Access, sharing and confidentiality provides further background on data sharing in the NHS which may be of interest.

There are two ways for a patient to opt out of sharing their information:

• Type 1 opt-out: Prevents information being shared outside a GP practice for purposes other than direct care.

• National data-opt out: This replaced the ‘type 2 opt-out’ from 25 May 2018 which prevented information being shared outside NHS Digital for purposes beyond the individual’s direct care. NHS Digital provide the following summary of the ‘National Data Opt-out’:

This applies to identifiable patient data about your health (personally identifiable data in the diagram above), which is called confidential patient information. If you don’t want your confidential patient information to be shared by NHS Digital for purposes except your own care - either GP data, or other data we hold, such as hospital data - you can register a National Data Opt-out.

If you have registered a National Data Opt-out, NHS Digital won’t share any confidential patient information about you with other organisations unless there is an exemption to this, such as where there is a legal requirement or where it is in the public interest to do so, such as helping to manage contagious diseases like coronavirus. You can find out more about exemptions on the NHS website.

From 1 October 2021, the National Data Opt-out will also apply to any confidential patient information shared by your GP practice with other organisations for purposes except your individual care. It won't apply to this data being shared by GP practices with NHS Digital, as it is a legal requirement for GP practices to share this data with NHS Digital and the National Data Opt-out does not apply where there is a legal requirement to share data. You can find out more about and register a National Data Opt-out or change your choice on nhs.uk/your-nhs-data-matters or by calling 0300 3035678.

As set out above, the National Data Opt-out does not currently apply to data being shared by GP practices and it is necessary to complete a Type 1 Opt-out to prevent information being shared outside a GP practice for purposes other than direct care.