NDOO Policy
1. How can patients opt out and what does it mean?
Patients have the right to opt out of having their personal confidential data used for purposes other than their individual direct health care. This means that before the practice can share, disclose, or allow access to personal identifiable data by other organisations for purposes other than to provide them with individual direct health care (such as planning or research), patients should be offered the right to object via an opt-out.
There are exemptions to opting out and cases where sharing patients’ personal confidential data outside of their direct care is allowed. For more details, see below in section 4.
Type 1 Opt-Out
Patients may opt out of having their personal confidential data extracted or shared by the GP practice for purposes other than their individual direct care.
It is the responsibility of the GP practice to record Type 1 Opt-Outs on the patient’s record. Type 1 Opt-Outs only apply to GP data.
Patients can request that a Type 1 Opt-Out is applied to their medical record using the codes provided. This means that before the GP practice wish to share patients’ details for anything other than the patient’s individual direct care, they have to exclude those patients from their search criteria.
It also means that when NHS England extract patient data from GP practices in order to inform planning or research those patients will be excluded from the extraction. It does not apply to the data NHS England collects from other health providers.
The National Data Opt-Out – NDOO
The National Data Opt-Out replaced the Type 2 Opt-Out Programme in May 2018. All patients who do not wish to have their personal confidential data used for planning or research will be excluded from these uses. Patients with an NDOO applied will still have their data extracted from the GP practice, but it will not be used for planning or research purposes.
As the Type 2 Opt-Out has been superseded, practices should ensure that they have removed any details of how patients can request them from their website or surgery communication. They should instead signpost patients to the NHS App, the ‘Your Data Matters’ site or telephone number 0300 303 5678 where they can register a National Data Opt-Out.
The list of patients who have registered an NDDO is held by NHS England. Practices do not hold these details.
NHS England collect personal confidential data from GP practices and secondary care providers to instruct planning and research. All data collected is pseudonymised before sharing with ICBs or other organisations
There are exemptions to patients opting out of having their personal confidential data used for planning, research or other secondary uses as follows:
It does not apply
· where information is being used or shared for an individual patient's care;
· to information that is anonymised in line with the Information Commissioner’s Office (ICO) Code of Practice (CoP) on Anonymisation or is aggregate or count type data
· when there is a legal requirement to disclose information that sets aside the common law duty of confidentiality, for example Section 251, but you will still need to determine how the common law duty of confidentiality is being met. Likewise, it does not apply for information required by law or a court order;
· to mandatory data collections with Confidentiality Advisory Group (CAG) approval;
· if a patient has agreed to a specific use of data. I.e., patients who have registered a national data opt-out can still agree to take part in a specific research project or clinical trial by giving their explicit consent;
· if disclosure is being used to protect public health, for example to:
o diagnose communicable diseases
o control or prevent their spread
o deliver and monitor vaccination programmes
o manage risks of infection from food or water supplies or the environment
· where there is an overriding public interest such as reporting of patients’ fitness to drive
· to the National Cancer Patient Experience Survey (CPES) and CQC NHS Patient Survey Programme;
· to local audits;
· to data used to support payment and invoice validation;
· There are a small number of exceptional circumstances where clinicians, Caldicott Guardians and managers can decide to share information based on public interest, but these are made on a case-by-case basis and carefully consider the circumstances involved.
· Specific exemptions have been made for disclosure of data for:
o Public Health England National Disease Registers
o Assuring Transformation, i.e. It does not apply to confidential patient information about people with learning disabilities and/or autism who are in hospital for their mental health or due to challenging behaviour which is disclosed under the following approval: Assuring Transformation: Enhanced Quality Assurance Process Data flow (CAG 8-02 (a-c)/2014). These flows continue to operate a separate opt-out mechanism and details of how to opt-out of the Assuring Transformation data collection can be found on the NHS England webpages. This exemption is time limited until the end of the “Building the Right Support Programme”.
o National patient experience surveys
· There are specific rules in the application of national data opt-outs to data flows into and out of NHS England as these recognise NHS England’s role as the national safe haven and the specific powers it has under the Health and Social Care Act 2012. Further information about these can be found in the Policy Guidance Document.