Shielded Patient List: transparency notice

NHS Digital processed your personal data to produce a Shielded Patient List (SPL). This is a list of patients in England who were previously identified as clinically extremely vulnerable to coronavirus (also known as COVID-19). The shielding programme in England has now ended, which means that those who were previously identified as clinically extremely vulnerable are no longer being asked to shield.

Between September 2021 and June 2022 NHS Digital has been conducting a managed closure of the SPL.  This Transparency Notice describes how your personal data will be processed upon closure of the SPL.

NHS Digital is the controller of the personal data in the SPL under the General Data Protection Regulation 2016 (UK GDPR) jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse data for purposes relating to COVID-19. This is under the COVID-19 Public Health Directions 2020 (COVID-19 Directions).

COVID-19 Public Inquiry

In March 2022 the government announced that there will be a COVID-19 public inquiry. The COVID-19 Inquiry Terms of Reference includes shielding within its scope. This places a legal obligation on NHS Digital not to delete or amend records for the duration of the inquiry. Your personal data will be held in identifiable form in archive for as long as it is considered necessary to meet the needs of the public inquiry. For example, NHS Digital may need to access your personal data in the SPL to respond to queries from the public inquiry.

The SPL contains the name, address, email address (where registered with GP), date of birth, phone numbers, and NHS number of those patients who were identified as clinically extremely vulnerable to coronavirus.

It also includes an explanation of why you were included in the list, which may have been due to a pre-existing medical condition and/or wider risk indicator (please see below for further details).

It also contains the name and telephone number of your GP practice, as well as your contact preferences from your GP record.

NHS Digital created the SPL based on data we already hold as the national safe haven for health and care data in England. See further information on how we collect data can be found on our website.

We collected additional data from GP practices in England and from Public Health England about patients previously determined to be clinically extremely vulnerable, or whose risk status has changed.

We collected information from the Health and Justice Information System (HJIS) to identify patients in detained and secure estates who may have been clinically extremely vulnerable if they contracted COVID-19. Information about patients who were identified as vulnerable was then provided back to healthcare clinicians by flagging patient records on the HJIS clinical system.

NHS Digital no longer collects data for SPL purposes as the SPL programme is now closed.

The Chief Medical Officer for England asked NHS Digital to create the SPL as part of our legal functions to collect and analyse data under the COVID-19 Directions.

Patients were included in the SPL if they had pre-existing medical conditions which were considered an indicator of extreme vulnerability to coronavirus.

Patients were also included in the SPL if they had pre-existing conditions which, when taken together with other relevant risk factors (such as the patient’s age, sex, ethnic group, body mass index (BMI) and postcode), were also considered to provide indicators of extreme vulnerability to coronavirus. We used a risk assessment model, known as the COVID-19 Population Risk Assessment (see below), to help identify patients in this category.

The Chief Medical Officer (CMO) for England also determined that patients with health conditions not listed above may still have been at risk of extreme vulnerability to coronavirus if they had a combination of other factors associated with becoming seriously unwell from coronavirus. The CMO made this determination based on the results of a clinical research project undertaken by the University of Oxford.

Information about patients who were added to the SPL in this way was provided to their GP and where appropriate, their hospital specialist. GPs and hospital specialists were able to add or remove a patient from the SPL at any time. They were also able to review whether patients on the List were clinically extremely vulnerable on an ongoing basis, according to their clinical judgement or when a patient requested this.

Read more about the COVID-19 Population Risk Assessment.

For more information on how your personal data is used as part of the COVID-19 Population Risk Assessment see the COVID-19 Population Risk Assessment Transparency Notice.

NHS Digital previously updated the SPL when there were changes to patient status following a new diagnosis, or change in circumstance, or where a patient was identified as extremely vulnerable by their GP or hospital doctor or through the COVID-19 Population Risk Assessment.

Following the end of the national shielding programme, the SPL has been closed and is no longer updated with new patients identified as at high risk from COVID-19.

As such, the list reflects those people who were identified as clinically extremely vulnerable at the point at which the list was closed. This final version of the list will be held by NHS Digital in archive.

The UK Health Security Agency advises that previously clinically extremely vulnerable people should now, as a minimum, follow the same guidance as everyone else. For more information read the guidance on protecting people who are clinically extremely vulnerable. For general advice on coronavirus please visit the NHS website.

While the list was active, patients could request to be removed from the SPL by asking their GP. They added a low or moderate flag (note) to the patients record to be removed from the SPL. The SPL is now being held as a static list which cannot be updated, and patients can no longer request to be removed. This is because NHS Digital has a legal obligation to hold the information in this way as it may be required for the duration COVID-19 Public Inquiry.

NHS Digital ceased sharing updates to the SPL with organisations after September 2021.

We previously shared relevant information from the SPL with organisations who have responsibilities for providing care and support to the patients on the List. This included:

• GP practices about their own patients on the List
• NHS hospitals about their own patients on the List
• healthcare staff in prescribed places of detention (for example prisons) about their own patients on the list
• other NHS organisations, government departments and local authorities for the purposes of the national and local response - this included the Cabinet Office who were responsible for providing the Extremely Vulnerable Persons Service which closed in September 2021

We also used and shared information for planning, commissioning and research purposes, including clinical trials, relating to coronavirus. This included sharing information with NHS organisations, government departments, other public authorities and research organisations.

We only shared identifiable information about those patients on the SPL where it was lawful for us to do so and under a terms of release letter which:

• detailed the terms of release and the agreed purposes for which the data could be used
• identified other organisations who may be permitted to use or receive the data and for what agreed purposes
• set out the lawful basis for sharing and use of the data
• obtained commitment from the recipient to the secure handling and management of the data, including its destruction once the agreed purposes had been met

In May and June 2022 NHS Digital informed recipient organisations that the SPL was closing. Where necessary, organisations were reminded of their responsibility as Controllers to destroy the data they held by 30 June 2022 or request to hold the data for other purposes. We envisage that there may be two reasons why an organisation might need to extend their Terms of Release:

1. Need for continued COVID-19 purposes – in such cases organisations have been asked to provide an alternative legal basis both under the UK GDPR and to address the common law duty of confidentiality and meet all current standards to continue to process the data.
2. Need for Public Inquiry – this option will require an organisation to have an alternative legal basis and meet all current standards to continue to process the data. 

Where an organisation is providing direct care to a person and the information has been entered on to the person’s local health or care record, it would not be expected their health or care record would require deletion of the fact that they were previously on the SPL. In such cases a further Terms of Release will not be required.

We have also published and shared data from the List which we have anonymised, so that no individuals can be identified from that data. This enables the NHS and other organisations to use this anonymous data for statistical analysis and for planning, commissioning and research purposes as part of the response, or evaluation of the response, to coronavirus. Anonymous data may also be shared to respond to queries in relation to the COVID-19 Public Inquiry.

Read more details here about the organisations with whom we have shared information from the Shielded Patient List.

In March 2022 the Government announced that there will be a COVID-19 Public Inquiry and the associated COVID-19 Inquiry Terms of Reference includes shielding within its scope.  Your personal data will be held in identifiable form in archive for as long as it is considered necessary to meet the needs of the Public Inquiry. For example, NHS Digital may need to access your personal data in the SPL to respond to queries from the Public Inquiry.

Further to this, your personal data in the SPL will be held for 8 years from the expiry of the Covid-19 Public Health Directions and in accordance with the Records Management Code of Practice 2021 and NHS Digital’s Records Management Policy.

Other organisations with whom we shared SPL data have obligations to keep it for no longer than is necessary for the purposes under which we agreed to share it. Information about this will be provided in their transparency or privacy notices which are published on their websites.

For information about how long the Cabinet Office will retain any data we share with them for the purposes of providing the Extremely Vulnerable Patient Service, please see their privacy notice.

NHS Digital only stores and processes your personal data for this service within the United Kingdom.

Fully anonymous data, for example statistical data (which does not allow you to be identified), may be stored and processed outside of the UK.

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice.

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.