The COPI mechanism was used as the simplest and quickest way to communicate the changes to GP Connect and Summary Care Record Additional Information during a time of national crisis.
However, the legal basis under which GP Connect and Summary Care Record Additional Information operated pre-pandemic was not affected by COPI and remains in place.
The legal basis for both GP Connect and Summary Care Record Additional Information is Article 6(1)(e) and Article 9(2)(h) of the UK GDPR (General Data Protection Regulation). For Common Law Duty of Confidentiality, implied consent with opt out is used.
The law on information sharing has not changed since the response to the crisis. Legal basis is driven by parliamentary law, and NHS policy is driven by NHS England, the Department of Health and Social Care, and national stakeholders.
To support the continuation of each service, the following work is underway
NHS Digital is working with national stakeholders to ensure that data sharing for direct care via GP Connect continues on a national basis after COPI ends. Local Data Sharing Agreements were in place for GP Connect before the pandemic. These were not legally needed but were identified by the Information Commissioner’s Office as good practice. A National Data Sharing Agreement is being prepared to follow the precedent.
Summary Care Record Additional Information
The temporary policy change made during the pandemic to patients’ Summary Care Record Additional Information has been extended by NHS England, whilst a permanent policy change is considered