National Data Opt-out Programme

1. National Data Opt-out Programme London wide LMCs’ Annual Conference, 2 May 2018 Trevor Anders

2. Overview – NDG Review • Better use of information and data has the potential to transform health and care for everyone. • People want to know that their privacy and rights are safeguarded, understand how and when information about them is shared, and, be able to make an informed choice about whether to share their data or not. • It was in this context that the Secretary of State for Health commissioned a review on data security and data sharing in the health and social care system by Dame Fiona Caldicott, the National Data Guardian for Health and Care (NDG). • This independent “Review of data security, consent and opt-outs” was published July 2016, followed by a public consultation that ran until September 2016. • Government response published on 12 July 2017. • The work takes place in the context of the drive to develop a digitised health and care system that offers patients more control and choice over the care they receive, improves their experience, provides them with better outcomes and delivers a more efficient health and care system.

3. Applying the national data opt-out Applies to data shared for planning and research purposes Data is anonymised Data shared for an individual’s care & treatment Legal requirement / public interest / consent E.g. where data is shared between the health and care professionals in a hospital and in a GP practice Is 1 option that covers: Research – finding ways to improve treatments and identify causes of and cures for illnesses Planning – to improve and enable the efficient and safe provision of health and care services The data shared is determined to be compliant with the ICO Anonymisation: managing data protection risk code of practice E.g. There is a mandatory legal requirement such as a court order, to protect the greater interests of the general public or there is explicit consent Thisidentifies you personally This identifies you personally This identifies you personally This does not identify you personally

4. When it applies The national data opt-out will apply when: • Confidential Patient Information is used for purposes beyond an individual’s care and treatment • the legal bases to use the data is based on approvals made under: • regulation 2 (medical purposes related to the diagnosis or treatment of neoplasia i.e. cancer); or • regulation 5 (general medical purposes including medical research) of the Control of Patient Information Regulations 2002 under the NHS Act 2006 s251 • The Confidentiality Advisory Group which provides independent expert advice on applications for data use under s251 can in some cases agree that opt-outs do not apply but have indicated that this would only be in exceptional circumstances 4

5. Some key facts • Who can opt-out – anyone registered on PDS (i.e. with data in English system) • Formal proxies can set opt-out on behalf of others • Type 1 opt-outs will remain available • Existing type 2 opt-outs will be migrated 5

6. Position with GDPR

7. Fit with General Data Protection Regulations • The national data opt-out will sit alongside the new General Data Protection Regulations /Data Protection Legislation and is not replaced or changed by it • Areas of overlap relate mainly to: • Understanding of consent • The GDPR ‘right to object’ • Potential changes to ICO Code of Practice on Anonymisation • Privacy Notices

8. Setting Opt-outs

9. National data opt-out setting service • The service to set a national data opt-out will be available online providing a secure way for patients to express their preference(s) about sharing their data for reasons other than their individual care and treatment • Only those aged 13 and over can use the online system • Patients will be able to access the opt-out online, e.g. using a smartphone, tablet or personal computer from 25 May 2018 • Patients who cannot or do not want to opt-out using an online service will be able to call a national telephone service • Patients will have access to information to make an informed choice about whether or not to share their data for reasons other than their individual care

10. How it will work National bodies Make simple to uphold Empower patients Local providers Store once for all NHS Digital will uphold all opt-outs from 25 May 2018 All other health & care organisations will be expected to uphold the opt-out by 2020

11. Communications

12. The health and care system layer How will a person find out about their choice?  www  I am informed through the national public communications layer I see the link on web sites of national bodies and health and care organisations I see a poster and materials in health and care settings  nhs.uk I speak to a health and care professional I visit the NHS web site National data opt-out service   I hear through targeted approach of specialist groups, networks and voluntary organisations I see when I access NHS wifi I receive a letter as a type 2 patient We will evaluate and refine communications on an on-going basis

13. The health and care system layer Workforce facing products • Dedicated NHS Digital national data opt-out web page • Factsheets: Data use and patient choice; when it applies; what it applies to; how it is applied; setting; how this fits with DPA • Monthly newsletters • Q&As • Workforce group • Approach we are taking Health and social care professionals GP Practices • Patient Data Choices Project is a collaboration with the RCGP to develop: an e-learning package; a toolkit; videos and regional and national events. It is led by a clinical champion. Nurses • Tailored resources for nurses including a prompt card and pocket guide badged by the RCN • Regular bulletins to national and professional bodies • Organisational readiness checklists • Policy guide Health and social care specialists inc. IG Registered providers and public bodies • Chief Executive letters • Data Security & Protection Toolkit

14. Being ready for 25 May 18

15. What do I need to do for the 25 May 2018? • Make sure your organisation is aware of the national data opt-out • Use the communication materials we’ll provide and check existing materials to remove out of date information e.g. references to type 2, care.data • Be prepared to receive questions from patients about the national data opt-out. i.e. know where to signpost them to • Standard text to add alongside privacy notices will be provided explaining the wider uses and the national data opt-out, pointing to the NHS.UK landing page • Understand type 2 migration

16. Events RCGP & NHS Digital ‘Patient Data Choices’ • National Event – Friends House, London, 24th May 2018 http://www.rcgp.org.uk/clinical-and-research/our-programmes/innovation/patient-choices.aspx National Data Opt-out Programme - May events • 10th May: London, Euston Road, NW1 • Webinars to follow http://web.ict.hscic.gov.uk/hscicgovuk-amnje/pages/0d160110f42ce811812270106faab5f1.html

17. More information National Data Opt-out Programme web pages & to join our mailing list https://digital.nhs.uk/national-data-opt-out National data opt-out enquiries mailbox newoptoutenquiries@nhs.net Understanding Patient Data - Wellcome Trust https://understandingpatientdata.org.uk Information Governance Alliance (IGA) information on GDPR: https://digital.nhs.uk/information-governance-alliance/General-Data-Protection-Regulation-guidance