For now, you must use NHS Digital’s online / paper process for you and your children separately to cover some of your health data, and a paper form for your whole family to protect your GP data.

Yes, this is a mess…

---

A National Data Opt-out launched on 25 May 2018. As a result, you now have to take several steps to make consent decisions for yourself, and extra steps for your children or other dependents.

It was announced that, from October 2018, you should be able to easily view how data about you has been used, so you can verify the effects of your consent choices. We await delivery of this promise. [March 2021: we’re still waiting]

People who had already opted out of the use of their data for purposes beyond their direct care were written to personally during the summer of 2018 – but there was no commitment to directly inform those who had not already expressed their choice. In other words, unless you happened to see a poster or hear a radio ad, you and a very large number of other NHS patients were likely kept in the dark.

Until you can see how data about you is actually used, and details of those uses, the Government expects you to base your decision solely upon the various statements and assertions that are made about them. We provide links below to evidence of ways in which some of these statements and ‘guidance’ are breached in practice.

In the absence of evidence that reassures you, medConfidential’s advice is (as it always has been) to follow the precautionary principle – opting out now is safer, as you can change your mind at any time. Once your data has been copied or released, however, it cannot be recovered.

As new information or actions you can take become available, we inform people via our mailing list:

 

 

---

Re-use of your records beyond your direct medical care:
Choices available to you

None of these choices will affect your medical care, or the data that is available for your care.

GP data: As your ‘front door’ to the NHS, your GP holds the lifetime history of your GP care – your prescriptions, your ailments, your tests and referrals, and the context for them all. You have the choice whether information from your GP record is copied outside of your GP practice for purposes other than your direct medical care. (This choice was created in 2010, and is between you and your GP only.)  Your GP treats you; other parts of the NHS tend to treat ‘a condition’.

Other data: The National Data Opt-out is intended to cover your data leaving all other care providers, and NHS Digital, for purposes beyond your direct care. This choice will, in time, cover all hospitals, etc. and can (at present) only be set via NHS Digital – the option to do so via your GP having been withdrawn in 2018. The National Data Opt-out does also cover your data leaving bodies such as Public Health England, which ran the database of every patient who has ever had cancer, as well as other databases.

Opting out: While in 2014 you could opt out of secondary (non-care) uses of your NHS data with a single form, now you must use at least two different processes – three, if you have children.

If you want to stop your GP data leaving your GP practice for purposes other than your direct care, you can do so by filling in and giving this form to your GP:

Your GP data: fill in and give this form to your GP [PDF] – allows you to include details of your children and dependents.

If you want to stop your non-GP data (e.g. hospital or clinic treatments) being used for purposes other than your direct care, e.g. “research and planning“, you must use NHS Digital’s online process:

Other NHS data: use NHS Digital’s online process – if you have have any children under 13, NHS Digital’s online process excludes* them.

*If you do have have children under 13, or other dependents, see this page about the process that excludes them.

If you don’t have access to a working printer, e-mail printer@medConfidential.org with your postal address and we will post you one, for free, no questions asked. If you don’t have e-mail, you can text your address to 07980 210 746.

If you can afford to make a small donation to support us in offering this service to others, we have a donation page.

We will, of course, only use your details to send you the forms and will delete them as soon as we have done that. (medConfidential is registered with the ICO to process personal data in this way.)

---

Re-use of your records beyond your direct medical care:
Choices not available to you

Exercising the opt-out choices linked above will protect you from some risks – certainly more risks than if you do not express those choices. Both opt-outs do precisely what the Department of Health claims they do, but they do not protect you as they could.

These choices do not, for example, currently:

• • Prevent the sale of your hospital history to companies;
  • Prevent the use of prescribing data by pharmaceutical marketers to influence your doctors;
  • Prevent public bodies doing work with the data they have for commercial companies, such as tobacco companies;
  • Prevent mistakes by those who have copies of your medical information from the above, cf. Partridge Review recommendations.
  • Prevent the non-clinical body NHS England insisting that you opt out all over again if it decides to create a new project…

As of 2021, some NHS bodies’ actions are still not compliant with the 2018 Data Protection Act, which implemented the General Data Protection Regulation (GDPR) into UK law. And several of the important safeguards promised in 2014 are still entirely missing:

• • The commercial re-use loophole remains open;
  • No ‘single-strike’ penalties are in place;
  • No significant contractual sanctions have been applied, despite serious breaches;
  • No Regulations have been laid to guide the Confidentiality Advisory Group;
  • NHS Digital is still releasing huge volumes of linked, individual-level patient histories rather than using safe settings;
  • The sole independent advisory group on collecting GP data – GPES IAG, the group that first raised concerns about care.data – was abolished without a full replacement.

The best way to have confidence in how your wishes will be respected, and in how your data will be used next month, is to see how your data was used last month. This, for all the reasons we list above, remains impossible.