What will the NHS do with my patient data?

NHS Digital is rolling out a new system to collect patient data held by GP practices across England. This process is called the General Practice Data for Planning and Research (GPDPR) data collection. 

In a letter to GPs dated 19 July 2021, the Parliamentary Under Secretary of State for Health and Social Care, Jo Churchill, set out a new process for the data collection.

There is no longer a specific start date for the collection of data (previously this had been 1 September 2021) and data will only start being collected once certain criteria are met - which includes patients being made more aware of the scheme.

Read the letter sent to GP practices 

Why does NHS Digital collect general practice data? 

The NHS uses patient data daily, including data from General Practice. This data is used in many ways, from deciding where to provide new clinics and GP practices to informing guidance and government responses, including managing and monitoring the Covid-19 pandemic.  

NHS Digital is engaging with doctors, patients, data and governance experts to design a new approach to collect data from general practice that: 

• Help patients understand how data from General Practice is used to run and improve health and care services in England.

• Sets a high and consistent standard for access to data, ensuring data is used in a lawful way that improves health and social care for everyone. 

• Makes research and planning easier as the NHS will see more clearly what is happening to people across different services. For example, if you visit the GP repeatedly with symptoms and are diagnosed with a condition, the NHS can build a better picture of early warning signals of specific problems.

• Reduces the burden on GP practices so that practices will not have to review and assess every request for access to GP data. This will be done on their behalf by NHS Digital, supported by independent experts and GP representatives.

Find out more about NHS Digital

What will my data be used for? 

To improve health and care services, NHS Digital has said that your data will be used to: 

• Monitor the long-term safety and effectiveness of care. 

• Plan how to deliver better health and care services. 

• Prevent the spread of infectious diseases. 

• Identify new treatments and medicines through health research.

Some of the areas the NHS will be looking closely at include: 

• Researching the long-term impact of coronavirus on the population. 

• Healthcare inequalities. 

• Developing treatments for serious illnesses .

Will my data be anonymous? 

The data shared won't include your name or your address. Any other data that could directly identify you (such as NHS Number, date of birth, full postcode) will be replaced with unique codes produced by de-identification software before the data is shared with NHS Digital. This process is called pseudonymisation.  

However, NHS Digital notes that pseudonymised data is not the same as anonymised data. Your data will be replaced with alternative identifiers that cannot be attributed to you without the use of additional information. In comparison, anonymised data is entirely unrecognisable. 

Learn more about anonymised and pseudonymised data  

NHS Digital WILL collect: 

• Data about diagnoses, symptoms, observations, test results, medications, allergies, immunisations, referrals, recalls, and appointments, including information about physical, mental and sexual health.

• Data on sex, ethnicity and sexual orientation.

• Data about staff who have treated patients. 

NHS Digital will NOT collect: 

• Name and address (except for postcode, protected in a unique coded form).

• Written notes, such as the details of conversations with doctors and nurses.

• Images, letters and documents.

• Coded data that is not needed due to its age - for example, medication, referral and appointment data that is over 10 years old. 

• Coded data that GPs are not permitted to share by law - for example, specific codes about IVF treatment, and specific information about gender re-assignment. 

What guarantee is there that my data won't be sold or passed on more widely in the future? 

NHS Digital has stated that "any data that NHS Digital collects will only be used for health and care purposes. It is never and will never be shared with marketing or insurance companies." This applies to any/all data that's shared. 

"We are not going to sell your data...We do not charge for data, but we do apply charges to cover the cost of processing and delivering our service." 

Any organisation that wants access to the data will be checked by the NHS Digital Data Access Request Service (DARS) and the Independent Group Advising on the Release of Data (IGARD). They will assess whether any organisations applying for the data should legally have access to it and will handle it safely and appropriately.  

It is also public knowledge which specific organisations have access to the data. NHS Digital releases a statement about this monthly known as the Data Uses Register. These organisations include the Office for National Statistics, local authorities, government departments and research organisations like universities and charities. It also could include pharmaceutical and tech companies, but these would be checked by NHS Digital Data Access Request Service and the Independent Group Advising on the Release of Data. 

What's the difference between Type 1 opt-out and National data opt-out? 

If you would like to opt-out of your data being shared you have two options:  

Type 1 opt-out:  

This stops your data from being shared outside your GP practice for anything other than your own care. If you’d like to opt-out this must be done through your GP practice, but you can download the form yourself from NHS Digital.  

Opt out of data sharing

National data opt-out 

This stops your data from being shared by NHS Digital with other organisations, except when there’s a legal requirement to do so, such as managing the Coronavirus outbreak.  

National data opt-out service