How opt-outs work

Understand the system for recording people's choices on the use of their identifiable data.

The NHS Constitution states 'You have the right to request that your confidential information is not used beyond your own care and treatment and to have your objections considered'. Anyone can request this by asking their GP practice to register a either a type 1 or a type 2 opt-out. See Opting out of sharing your confidential patient information.

Type 1 opt-outs

Type 1 opt-outs prevent us from collecting information from your GP records for anything other than your own care. We only record the numbers of type 1 opt-outs at each GP practice for monitoring purposes. No other information is collected.

Type 2 opt-outs

NHS Digital collects information on type 2 opt-outs to create a record of people who have opted out. Before we give data to another organisation for planning or research, we check this record. We use it to find any data on people that have opted out, and to remove it. The contract we set up with each organisation every time we agree to share data states that they must not try to identify individuals who have chosen to opt out of sharing their information. (There are certain specific circumstances where opt-outs don't apply.)

Individuals are only identified using the NHS number. If you have chosen to opt out and you are given a new NHS number, you should check your opt-out is still recorded.

See the direction from the Secretary of State for Health and Social Care to apply type 2 opt-outs from 29 April 2016. It wasn't possible for us to honour type 2 opt-outs made before this date. This means that information may have been shared without respecting these opt-outs between January 2014 and April 2016.

See more information on the DARS process, which makes sure health and care data is only shared legally and responsibly.

See our registers of approved data releases, which record every time we agreed to share data with other organisations to improve health and care.

Collecting type 2 opt-out data

When you register a type 2 opt-out you are only identified using your NHS Number. We collect information about type 2 opt-outs from GP practices in England every month. We only collect the:

  • code that tells us the opt-out or withdrawal of opt-out
  • date the code was added to the record
  • NHS Number associated with the code
  • GP practice's unique code

Read the Patient Objections Management - Privacy Impact Assessment to see how the information in this data collection is kept safe and kept to a minimum.

How long it takes to apply type 2 opt-outs

We only collect opt-out data once a month. It can take up to 21 days after we collect the information for your decision to be put in place.

Where type 2 opt-outs apply

Type two opt-outs only apply to health information that could identify you, and that is being used for reasons beyond your own care.

Health information that could identify you

Type 2 opt-outs only apply to health information that could identify you as an individual. The NHS Act 2006, Section 251, paragraphs 10 and 11 calls this 'personal confidential information'. Personal confidential information is defined as information that both identifies you and includes some information about your physical or mental health condition, care or treatment.

This means that we can use information from your medical records as long as it doesn't identify you. Most of the time we use:

See more information on anonymised data.

Information sharing for reasons beyond your individual care

Type 2 opt-outs only apply to sharing information for reasons beyond your individual care, such as planning and research. This means that even if you opt out, you will still be included in national screening programmes and other programmes to improve your own health and care. The individual care you get will not be affected by your decision to opt out.

Where type 2 opt-outs don't apply

There are some specific circumstances where your identifiable health information might still be used for reasons beyond your own health and care, even if you have opted out.

Consent

You may have given consent for your information to be shared for a specific purpose, for example where you have agreed to participate in a medical research study or clinical trial. This will not be affected by your decision to register a type 2 opt-out. If you have previously given consent to the use of your information for a specific purpose, and you now don't want it to be used in this way, you should contact the organisation that you gave consent to.

Legal requirements

We may have a legal requirement to share your information, for example due to a court order.

Public interest

Information may still be shared if there's an overriding public interest in sharing your information. Certain government departments may request information and each request is considered on a case by case basis. Our National Back Office looks at these kinds of requests.

The Secretary of State for Health and Social Care has decided that there are some special circumstances where information is so important that type 2 opt-outs should not be applied. These are where information is needed:

Technical reasons

There are some circumstances where it isn't possible for us to apply type 2 opt-outs. These are:

  • where the personal confidential information held by us does not contain an NHS Number - this means that we can't match it to your opt-out choice
  • in the Cancer Waiting Times system - the complexity of individual patient treatment plans means the existing system can't process opt-outs, although a new system expected in 2018 will be able to do this.