Public Services

Caution urged over NHS Digital national data opt-out pledge

Neil Merrett Published 13 July 2017

With the government proposing a new national opt-out for sharing patient information beyond direct care purposes, doctors question whether this may undermine existing objections


Despite welcoming Whitehall commitments to step up NHS cyber security initiatives and training, medical professionals remain cautious over the government's pledge to overhaul how patients can give consent for sharing their data beyond the purposes of direct care.

Individuals and representative bodies working in UK healthcare have warned that commitments to introduce a revised 'national opt-out' from sharing information are yet to be finalised. As such, the changes could still undermine existing guarantees that no information can be shared by their GP with NHS Digital or other organisations seeking to pool together patient information when not supporting an individual's treatment.

The government's new proposals to overhaul information management and security have been set out this week in response to National Data Guardian Dame Fiona Caldicott's review of data sharing, consent and opt-outs, as well as the Care Quality Commission's (CQC) findings on system resilience.

The decision last year to scrap NHS Digital's flagship programme followed from a review by Caldicott of how patient information was shared and protected across UK healthcare to prevent similar outcomes in future programmes. This in turn led to a consultation being established to look at future directions for patient data sharing programmes and how individuals should be informed about them.

Responding to this consultation process, Whitehall has agreed to a national opt-out that aims to streamline the multiple existing options for patient data sharing under a new model that is intended to be more understandable and simple for patients.

However, the exact details of this opt-out are yet to undergo a testing and consultation process to define its implementation and how the public can be informed of their rights.

The two opt-out model

During the delayed and later abandoned roll-out of, patients were given two choices with how their personal information could be restricted.

These included an option to prevent any data from their GP being shared for purposes other than direct care - known as a type-1 objection. Alternatively they could opt out of having this GP data, which is then shared with NHS Digital, from being shared with regulated third parties, under what is called a type-2 objection.

Authorities had previously come under criticism in 2015 from the UK data regulator for continuing to share information of some 700,000 patients that had registered type-2 objections, with NHS Digital later claiming to have put in place a new system to manage these patient requests.

The government said this week that it now intends to give people a choice to opt-out of having any of their data shared beyond direct care that will be applied across the entire health and care system - although the devil will be in the detail for stakeholders and campaign groups.

"In moving to the national opt-out, we will honour existing type 1 opt-outs until 2020 and consult with the National Data Guardian before confirming their removal," said the findings.

The government response document also committed by December 2018 to put in place a digital service to detail who may have accessed an individual's summary care record. By March 2020, online functions will also be provided to monitor how confidential data that is collected by NHS Digital is being used for purposes not classed as direct care.

At the same time a tool will be put in place by NHS Digital to de-identify information collected from GP practices by September 2019. The work will also be complemented by a National Information Board (NIB) focus on building up public trust in sharing information for health and social care.

Care provider view

On a broad level, the British Medical Association (BMA) welcomed the government's findings on cyber security and system resilience, as well as its work in considering "more suitable" data security standards.

BMA medical ethics committee chair Dr John Chisholm noted that while there were "many potential benefits" in sharing patient data to aid medical research and clinical care, concerns were still in place among care professionals about ensuring oversight of how NHS Digital manages such large amounts of personal information.

"Doctors have serious concerns about the removal of patients' right to opt-out of having their details sent from their GP surgery to NHS Digital without first putting in place the necessary protections and guarantees about how this information will be used," said the BMA.

"The current arrangement between NHS Digital and the Home Office, in which the Home Office can request confidential patient information for immigration purposes, is undermining patient trust in how their confidential information is used."

"Constructive discussions" were said to be ongoing with the government around the BMA's concerns.

At an individual level, Dr Neil Bhatia, GP and Caldicott Guardian for the Oaklands Practice in Yateley, Hampshire, said he remained "very cautious" on the commitments outlined in the government's responses to the CQC and Caldicott.

Echoing the sentiments of the BMA, Dr Bhatia said that the commitment to cyber security, particularly in organisational training was encouraging, yet questions needed to be answered on who may be taking responsibility for actively auditing and checking commitments made by health organisations - if at all.

With cyber security standards and commitments viewed as being largely self-declaratory, he said there was a lack of clarity on detail on who may be in charge of policing and determining good and bad practice among care organisations. While the remit to review and inspect care standards is the responsibility of the CQC, Dr Bhatia said the key factor would be to ensure the organisation, or any eventual oversight body, had the required technical expertise to understand good and bad practice in use.

Looking specifically at the issue of data sharing and opt-outs, Dr Bhatia predicted that a number of difficulties remained for NHS Digital in ensuring public support and confidence in sharing information in order to prevent similar criticisms and challenges that undermined

He noted that while type-1 opt-outs were guaranteed to be in place for the next three years, a lack of clarity on whether a similar arrangement to prevent GPs having to provide an individual's personal information to NHS Digital would be introduced risked undermining efforts to ensure public consent on a broad level.

"The whole point of the type 1 opt-out was to prevent the extraction of personal confidential information (PCD) to organisations, including NHS Digital, for purposes other than direct care (secondary purposes)," he said.

" was a prime example of such a scheme, and the type 1 opt-out would have prohibited that. Now, the DoH have proposed scrapping the type 1 opt-out altogether, so - in theory - (or son of could now go ahead, from 2020, without all those pesky opt-outs."

Although the government's response suggested that a single national opt-out would prevent use of PCD for secondary purposes, this did not apply to de-identified information, which may still be able to be used by other parties to identify individuals, Dr Bhatia argued.

He noted that a failure to remove any such doubts going forward could have negative impacts on the willingness of patients to provide confidential information or seek treatment from the NHS.

Dr Bhatia added that it still remained difficult to know how the national opt-out may develop, with implementation still a few years away and many hurdles facing the government in finalising plans on data sharing.

"Cautiously positive"

Pressure group MedConfidential said that with more details to emerge over the data sharing proposals and no work having commenced by NHS England on their implementation, it was "cautiously positive" in the first instance.

The organisation's coordinator Phil Booth said he welcomed a clear commitment to try and let patients better understand how their medical records may be used for direct care and other areas such as research.

"Some of the details remain to be worked out, but there is a clear commitment from the Secretary of State. The focus on digital tools shows the benefit to the whole NHS of the work towards NHS.UK. It is now up to NHS Digital and NHS England to deliver," he said.


Post a comment

Comments may be moderated for spam, obscenities or defamation.

We have updated our privacy policy. In the latest update it explains what cookies are and how we use them on our site. To learn more about cookies and their benefits, please view our privacy policy. Please be aware that parts of this site will not function correctly if you disable cookies. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy unless you have disabled them.