I’m a programme manager, working with highly complex technology systems. In my world, data is often talked about in technical terms as data sets, codes or numbers, but I’m acutely aware that behind each piece of information is a person – a sister, a mother, a friend or a brother, with their own life story, experiences, views and beliefs.

Whatever their circumstances, people place their trust in me and my colleagues to handle their data appropriately and in line with their wishes; it’s a responsibility we take incredibly seriously. They rightly expect us to ensure that:

• data security measures and strict controls are in place
• we can clearly show how data is used
• there are meaningful choices for people to make about how their data is used
• there is clear information to support people to make an informed choice

Last year, the GPDPR programme, which sought to improve the way in which patient data from GPs was accessed and used to run and improve NHS health and care services and for research purposes, quickly ground to a halt when the public raised concerns about transparency, data security and future use.

This highlighted a lack of understanding about how identifiable patient data is currently used for purposes other than their individual care. The combined effect of these concerns was that people chose to opt out of their data being shared beyond their GP (Type 1 Opt-out) or other heath and care organisations (National Data Opt-out).

Type 1 Opt-outs are currently registered via a paper form given to your GP practice, so this placed a significant and unsustainable burden on GP surgeries to update people’s preferences. This led to a backlog, and left people wondering if their choice had been recorded.

The increased number of people opting out also created gaps in the data we use to improve care and inform the planning of services so that they are delivered in the places that people need them – ensuring that NHS services are fair and equitable.

Every gap in information limits our ability to understand current need, predict future use and reduces our capability to deliver services in the best way possible. This, for me, is why building trust in data use and choice must go hand in hand so that people can make informed decisions.  

As part of the revised approach to the GPDPR programme, I was tasked with leading a workstream to improve people’s experience and reduce the burden placed on general practices in relation to Type 1 Opt-outs. I knew we needed to engage both the GP profession and the public.

Our work revealed that the opt-out landscape is complicated and confusing to navigate. Earlier this year, public research was done as part of the GPDPR listening phase. It showed that despite strong awareness of the ability to opt-out, understanding of the different types of opt-out is low.

More positively, almost 75% of people surveyed believed that their patient data should help the NHS to improve services and care, however, there was a significant drop-in support for the use of patient data by organisations beyond the NHS.

We also conducted a survey with GP staff which found that a third of practice staff don’t know what a Type 1 Opt-out is.

So, amongst all this confusion, how can we improve the experience for people while also reducing the burden on GP practices? Clear, high-quality information, ease and choice has been central to our thinking.

A further consideration, ahead of exploring potential solutions, was the commitment to review and simplify the ways people can opt out of sharing their data, as set out in the national Data saves lives strategy.

The insight from our research supported our discovery phase as we worked through and rationalised our ideas, and an online service emerged as the preferred solution.

The service would provide the means for people to check and apply their own Type 1 Opt-out status online, whist also reducing burden on GPs by creating an additional way for people to apply their choice.

Our principal design accommodated 2 options that could be used for online opt-out service to allow for potential policy changes around opt-outs:

Route A

Provide people with the option to check their status and a binary choice to opt-in or opt-out of their identifiable data leaving their GP surgery for purposes other than their individual care.

Route B

Allow people to check their status, including more granular options to choose how their data is used. For example, use by the NHS for planning and commissioning services but not shared or accessed by other organisations for purposes such as research.

We needed to test our thinking, so we developed a prototype service to undertake user testing. Overall, user testing participants welcomed the digital service and the control it gave them to check and update their opt-out status. Participants also told us they saw the value in sharing their data to receive the care they needed and to improve NHS services.

The user testing findings also echoed some of the findings from the public survey I talked about above: specifically, there is confusion and low levels of understanding about data in general, which participants told us prevented them from making an informed choice when using the prototype service.

Participants also wanted more control than a binary opt-in or opt-out choice – there was a desire to apply discretion about the use of their data, for example, by the NHS or organisations outside of the NHS. Some participants confused accepting cookies on the NHS website as sharing their data, whist others presumed that by using the NHS App their data was shared by default.

The language and terminology surrounding opt-outs, and even the term ‘data’ added to the confusion. 

It became overwhelmingly clear that a comprehensive public conversation is required on opt-outs, and clear and accessible information needs to be available to the public and professionals before we introduce an additional service.

As such, we’ve reached a natural point in our service design work to pause and allow for the work around the data strategy to take place, which avoids putting time and resources into a service which is a best fit now, rather than one designed around the needs of the public. There is no wasted effort though – our planning, design and user testing is sound and ready to be mobilised quickly following the review.

Once rekindled and brought to fruition, the digital service would see us meet one of the commitments we made back in summer 2021 - to give people the ability to opt-in or out, and that whenever data for planning and research is collected, the dataset will always reflect people’s current preference. For now, all the ways people can currently opt-out remain available.

Whatever the outcome of any opt-out review, one thing is clear; public and patient engagement is key and there must be a genuine commitment to acting on the public’s feedback and empowering them to choose how their data is used. This must be accompanied by an increase in effort to explain how data is already used, the safeguards that are in place to protect the confidentiality of patient data, and greater visibility is needed about how this has improved NHS services and helped society as a whole.