Is the NHS sharing your data? What you need to know

Here's what you need to know:

• Shared data helps the NHS. It has been used to find the first treatment for coronavirus and for vaccine research.
• The data that NHS Digital will hold and share is anonymous. It doesn't include your name, address or any identifiable numbers like your NHS Number.
• Collection of data from GP practices has been delayed until 1st of December. There is no deadline for opting out of sharing your data so if you want to stop your GP data from being shared with NHS Digital you will need to opt out before then.
• You can opt out of your GP data being shared with NHS Digital or of NHS Digital sharing your data with third parties at any time.
• NHS Digital will never sell your data. There are strict rules about how the NHS can use your data. It's only shared securely and safely for planning, commissioning and research purposes. Your data will never be sold to marketing or insurance companies.

What is changing?

NHS Digital will start collecting patient data from GP medical records in England about any living patient, including children, and any data about patients who died after the collection started. They have not set a specific date for when data collection with start. 

This is called the General Practice Data for Planning and Research data collection, and NHS Digital says it will be used to help the NHS improve health and care services by allowing it to plan better, prevent the spread of infectious diseases, help with research and monitor the long-term safety and effectiveness of care.

NHS Digital is the NHS provider for data and IT systems for the NHS in England.

What will be collected?

NHS Digital will collect information on diagnoses, symptoms, test results, medications, information about physical, mental and sexual health, a person’s sex, ethnicity, sexual orientation and which staff have treated them.

This will include most of the historic data from each patient’s record.

The data collection won’t include people’s names or where they live. Of course, that’s not the only information that can identify someone. Other details, like NHS numbers, postcodes and dates of birth, which can identify people, will go through a process called pseudonymisation, which means codes will be generated to replace these details. NHS Digital says this means that no one will be able to directly identify you in the data, without also having access to the key that links each patient to their code. 

NHS Digital says the keys to convert these codes back into data that could identify you, but won’t do that “unless in the circumstances of any specific request it is necessary for it to be provided in an identifiable form”. 

NHS Digital says they’ll only do that in certain cases when there is a valid legal reason, for example, if you consent to participate in a clinical trial, or where the data was needed by a health professional to provide you care.

NHS Digital WILL collect: 

• Data about diagnoses, symptoms, observations, test results, medications, allergies, immunisations, referrals, recalls, and appointments, including information about physical, mental and sexual health 

• Data on sex, ethnicity and sexual orientation 

• Data about staff who have treated patients 

NHS Digital will NOT collect: 

• Name and address (except for postcode, protected in a unique coded form) 

• Written notes, such as the details of conversations with doctors and nurses 

• Images, letters and documents   

• Coded data that is not needed due to its age - for example, medication, referral and appointment data that is over ten years old 

• Coded data that GPs are not permitted to share by law - for example, specific codes about IVF treatment, and specific information about gender re-assignment 

Is this data being sold?

This depends on your definition of selling data.

The NHS Digital website says: “We are not going to sell your data”. But there is a price list on the organisation’s website listing charges for its Data Access Request Service.
On this page, NHS Digital says “We do not charge for data but we do apply charges to cover the cost of processing and delivering our service.”

Any organisations that want to pay to access this data need to convince the NHS Digital Data Access Request Service that they have a legal basis to use the data and will do so safely, securely and appropriately. Requests are also subject to scrutiny by the Independent Group Advising on the Release of Data.

NHS Digital publishes information on what data it releases and to whom every month. Many recipients are organisations like the Office for National Statistics, local authorities, government departments like the Department of Health and Social Care and research organisations like universities and charities, but they can also include companies that get approved.

NHS Digital says: “Any data that NHS Digital collects will only be used for health and care purposes. It is never shared with marketing or insurance companies.”

What do I need to do?

If you're happy with your confidential patient information being used for research and planning you do not need to do anything.

You can stop your confidential patient information being used for research and planning by opting out either from it being shared with NHS Digital or by opting out from NHS Digital sharing your data. .

Stopping data being shared with NHS Digital

If you do not want your patient data shared with NHS Digital, you can return this form to your GP practice. This is called a Type 1 Opt-out with your GP practice. You do this at any time and you can change your mind at any time and withdraw a Type 1 Opt-out.

Stopping NHS Digital sharing your data further

You can opt out of NHS Digital sharing your data by:

Online: Find out how to make your choice

Phone: 0300 303 5678 – Monday to Friday, 9am to 5pm (excluding bank holidays)

By post or email fill in the opt-out form and email it to enquiries@nhsdigital.nhs.uk 

Alternatively, you can post the form to:
National Data Opt Out, 
Contact Centre
NHS Digital
HM Government
7 and 8 Wellington Place
Leeds