National data sharing GP Connect and Summary Care Record Additional Information

In response to the COVID-19 pandemic, the health and social care system took action to manage and mitigate the spread and impact of the virus.

As a part of the response, a Control of Patient Information Notice (COPI Notice) was issued. Under this, it was agreed with national stakeholders that GP Connect should be enabled across all GP practices to share patient data nationally for direct care purposes. There was also a change to policy to enable Summary Care Record Additional Information to be made available by default, unless the patient had previously told the NHS that they did not want their information to be shared. 

The changes made have shown benefits, improved patient safety and been positively received by patients and healthcare professionals. There has also been a continued increase of usage of both services over the last 2 years.

The COPI mechanism was used as the simplest and quickest way to communicate the changes to GP Connect and Summary Care Record Additional Information during a time of national crisis.

However, the legal basis under which GP Connect and Summary Care Record Additional Information operated pre-pandemic was not affected by COPI and remains in place.

The legal basis for both GP Connect and Summary Care Record Additional Information is Article 6(1)(e) and Article 9(2)(h) of the UK GDPR (General Data Protection Regulation). For Common Law Duty of Confidentiality, implied consent with opt out is used.

The law on information sharing has not changed since the response to the crisis. Legal basis is driven by parliamentary law, and NHS policy is driven by NHS England, the Department of Health and Social Care, and national stakeholders.

To support the continuation of each service, the following work is underway

GP Connect

NHS Digital has worked with national stakeholders to ensure that data sharing for direct care via GP Connect continues on a national basis after COPI ends. Local Data Sharing Agreements were in place for GP Connect before the pandemic. These were not legally needed but were identified by the Information Commissioner’s Office as good practice. A National Data Sharing Agreement has been prepared to follow the precedent.

Summary Care Record Additional Information

The temporary policy change made during the pandemic to patients’ Summary Care Record Additional Information has been extended by NHS England, whilst a permanent policy change is considered

Patients can be reassured that if they have previously opted-out of sharing their data via GP Connect, having a Summary Care Record, or declined to provide consent to share their Additional Information, their preference will continue to be respected and applied as part of any policy change. Patients can also continue to express a Summary Care Record consent preference and they can change their mind at any time.

The use of both services is for direct patient care, which the National Data Guardian defines as

Care teams may also contain members of staff, who are not registered with a regulatory authority, but who may need access to a proportion of someone’s personal data to provide care safely.

The health and care service can be assured and confident that they have the legal basis to continue to provide and use these vital services for direct care purposes beyond 30 June 2022, when the COPI Notice expires.

Health and care services will need to update their privacy notices to ensure they no longer make reference to the COPI Notice. Guidance on this is available for GP Connect and SCR Additional Information.

We will keep stakeholders updated on the changes and further communications and engagement that will take place.

Contact [email protected] if you have any questions relating to this.