Skip to main content

Shielded Patient List: transparency notice

Version 4: February 2021. We process users' personal data in order to provide the shielded patient list for people at high clinical risk from coronavirus. This notice outlines what data is collected, how it is processed, and what we do with it.

Our purposes

NHS Digital processes personal data to produce a Shielded Patient List (SPL) of patients in England who have been identified as clinically extremely vulnerable in relation to coronavirus (also referred to as COVID-19). A patient who is listed on the SPL is at a high risk of complications from coronavirus.

When a patient is added to the SPL, they will be sent a letter and an email (if an email address has been previously registered with their GP). This will explain that they are included on the SPL as someone who is clinically extremely vulnerable to coronavirus (COVID-19). The letter offers advice and guidance on reducing risk of infection from COVID-19 as well as shielding advice for those who live, work or travel to areas where shielding advice is in place.  

The letter (or email) includes details about the clinically extremely vulnerable person service being provided by the Government and invites patients to contact this service to register for help.

If you are included on the SPL as someone who is clinically extremely vulnerable to coronavirus, you may be prioritised for COVID-19 vaccination. You can read more about how patients are prioritised for vaccination and NHS Digital’s role.

NHS Digital will also process personal data of patients who use the NHS.UK Get Vitamin D Supplements Service, which can be used by clinically extremely vulnerable patients to request free vitamin D supplements.

NHS Digital is the controller of the personal data in the List under the General Data Protection Regulation 2016 (GDPR) jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse data for purposes relating to COVID-19 under the COVID-19 Public Health Directions 2020 (COVID-19 Directions).

A Data Protection Impact Assess (DPIA) has been undertaken and completed for the SPL and is subject to ongoing review as and when the service is revised.


Types of personal data we process

The Shielded Patient List (SPL) contains the name, address, email address (where registered with GP), date of birth, phone numbers, and NHS number of those patients who have been identified as clinically extremely vulnerable to coronavirus.

The SPL will also include an explanation of why you have been included in the list, which may be due to a pre-existing medical condition and/or wider risk indicator (please see below for further details).

It also contains the name of a patient's GP practice and the GP practice telephone number.


How we obtain your personal data

NHS Digital have created the SPL based on data we already hold as the national safe haven for health and care data in England.  Further information on how we collect data can be found on our website.

We collect additional data from GP practices in England and from Public Health England about patients determined to be clinically extremely vulnerable, or whose risk status has changed.

We collect information from the Health and Justice Information System (HJIS) to identify patients in detained and secure estates who may be clinically extremely vulnerable if they contract COVID-19. Information about patients who are on the SPL will then be provided back to healthcare clinicians by NHS Digital through identifying those patient records with a flag on the HJIS clinical system.


How the SPL is created

The Chief Medical Officer for England has asked NHS Digital to create the SPL as part of our legal functions to collect and analyse data under the COVID-19 Directions.

  • Patients are included in the SPL if they have pre-existing medical conditions which are considered an indicator of extreme vulnerability to coronavirus.
  • Patients are also included in the SPL if they have pre-existing conditions which, when taken together with other relevant risk factors (such as the patient’s age, sex, ethnic group, body mass index (BMI) and postcode), are also considered to provide indicators of extreme vulnerability to coronavirus. We use a risk assessment model, known as the COVID-19 Population Risk Assessment (see below), to help identify patients in this category.

Medical conditions which are an indicator of extreme vulnerability

The Chief Medical Officers for the UK have agreed the following underlying conditions as an indicator of extreme vulnerability to coronavirus:

  • solid organ transplant recipients
  • people with severe respiratory conditions including all cystic fibrosis, severe asthma and severe chronic obstructive pulmonary (COPD)
  • people with rare diseases and inborn errors of metabolism that significantly increase the risk of infections (such as Severe combined immunodeficiency (SCID), homozygous sickle cell)
  • people on immunosuppression therapies sufficient to significantly increase risk of infection
  • people who have problems with their spleen, for example have had a splenectomy
  • adults with Down’s syndrome
  • adults on dialysis with kidney impairment (Stage 5 Chronic Kidney Disease)
  • women who are pregnant with significant heart disease, congenital or acquired
  • people with cancer who are undergoing active chemotherapy
  • people with lung cancer who are undergoing radical radiotherapy
  • people with cancers of the blood or bone marrow such as leukaemia, lymphoma or myeloma who are at any stage of treatment
  • people having immunotherapy or other continuing antibody treatments for cancer
  • people having other targeted cancer treatments which can affect the immune system, such as protein kinase inhibitors or PARP inhibitors
  • people who have had bone marrow or stem cell transplants in the last 6 months, or who are still taking immunosuppression drugs

We identify and include patients with these conditions in the SPL based on health and care data held within our data sets. Where applicable, we supplement this data with further information provided by Public Health England, the patient’s GP or hospital specialist.

You can read more about how we do this in the detailed methodology.


Other indicators of extreme vulnerability

The Chief Medical Officer (CMO) for England has also determined that patients with health conditions not listed above may still be at risk of extreme vulnerability to coronavirus if they have a combination of other factors associated with becoming seriously unwell from coronavirus. The CMO has made this determination based on the results of a clinical research project undertaken by the University of Oxford.

Researchers from across the UK, led by the University of Oxford, produced a risk prediction model called QCovid® as part of this project. This combines a number of factors such as age, sex registered at birth, ethnicity, height and weight (to calculate BMI) and specific health conditions and treatments to estimate the risk of catching and becoming seriously unwell with coronavirus.

NHS Digital has developed a COVID-19 Population Risk Assessment which uses QCovid® and patient data held in existing NHS Digital datasets, to identify those patients with relevant factors or health issues to assess their risk. NHS Digital generates a risk assessment result for each of these patients and those with a result above an agreed threshold set by the CMO are added to the SPL. A cautious approach has been taken, so there is a chance that a patient’s risk is lower than the risk assessment estimated. 

Information about patients who are added to the SPL in this way is provided to their GP and where appropriate hospital specialist. GPs and hospital specialists can add or remove a patient from the Shielded Patient List at any time and will continue to review whether patients on the List are clinically extremely vulnerable on an ongoing basis, according to their clinical judgement or when a patient requests this.

Read more about the COVID-19 Population Risk Assessment.

For more information on how your personal information is used as part of the COVID-19 Population Risk Assessment see the COVID-19 Population Risk Assessment Transparency Notice.


Maintaining the SPL

The SPL is updated on an ongoing basis to ensure it continues to include all patients deemed to be clinically extremely vulnerable to coronavirus (COVID-19).

This work includes considering changes to patient status following a new diagnosis, or change in circumstance, or where a patient is identified as extremely vulnerable by their GP or hospital doctor or through the COVID-19 Population Risk Assessment.

The SPL will also be updated from time to time to reflect any new criteria set by the Chief Medical Officers in the UK.

The SPL will also be routinely updated to remove people:

  • who have died
  • where a GP or hospital doctor has determined they are not clinically extremely vulnerable
  • where a GP or hospital doctor has responded to a request from a patient to be removed from the list

Managing my entry on the SPL

If you think you should be added to the SPL you should speak to your GP. They will be able to discuss your circumstances with you and, if appropriate, add you to the SPL.

You can also request to be removed from the SPL by asking your GP. They will add a low or moderate flag (note) to your record and you will be removed from the SPL within a short period of time (up to two weeks).

For more information about shielding read the Guidance published by Public Health England on Shielding. For general advice on coronavirus please visit the NHS website.

For more information on what to do if you think you should be subject to shielding measures, or if you have received a letter from the NHS telling you to take shielding measures and you don’t think you need to do this, please speak to your GP or hospital specialist. Our Shielded Patient List pages for adults and children also provides some useful information.

Read more details here about the timings for information flows between systems  which explains the process for updating the SPL and the timings for this.


Who we share your personal data with

We are sharing relevant information from the Shielded Patient List with organisations who have responsibilities for providing care and support to the patients on the List. This includes:

  • GP practices about their own patients on the List
  • NHS hospitals about their own patients on the List
  • healthcare staff in prescribed places of detention (for example prisons) about their own patients on the List
  • Other NHS organisations, Government departments and local authorities. This includes the Cabinet Office who are responsible for providing the Extremely Vulnerable Persons Service. More information about how the Cabinet Office uses personal data for that Service, who it shares information with and how long it will keep the information is explained in its privacy notice.  

We will also use and share information from the shielded patient list for planning, commissioning and research purposes, including clinical trials, relating to coronavirus.

This will include sharing information with NHS organisations, government departments, other public authorities and research organisations.

We will only share identifiable information about those patients on the shielded patient list where it is lawful for us to do so and under a terms of release letter which:

  • details the terms of release and the agreed purposes for which the data can be used
  • identifies other organisations who may be permitted to use or receive the data and for what agreed purposes
  • sets out the lawful basis for sharing and using the data
  • obtains commitments from the recipient to the secure handling and management of the data, including its destruction once the agreed purposes have been met

We will also publish and share data from the List which we have anonymised, so that no individuals can be identified from that data.

This will enable NHS and other organisations to use this anonymous data for statistical analysis and for planning, commissioning and research purposes as part of the response to coronavirus.

To keep patients informed of their risk of complications from COVID-19, as well as to provide relevant advice, guidance and support as and when necessary, information is also shared with national processing partners for the purposes of issuing letters and emails to patients.

Read more details here about the organisations with whom we have shared information from the Shielded Patient List.


How long we keep your personal data for

Data will be processed until the expiry of the COVID-19 Directions which are in place until 31March 2022 (unless extended).  Data shall be retained for 8 years from the expiry of those Directions in accordance with the Records Management Code of Practice for Health and Social Care 2016 and NHS Digital’s Records Management Policy.

Other organisations with whom we share your personal data have obligations to keep it for no longer than is necessary for the purposes for which we have shared your personal data. Information about this will be provided in their transparency or privacy notices which are published on their websites.

For information about how long the Cabinet Office will retain any data we share with them for the purposes of providing the Extremely Vulnerable Patient Service, please see their privacy notice.


How we manage data quality

The information we use to contact clinically extremely vulnerable patients is drawn from existing information held by the NHS in your patient record.

Where this information is identified as incorrect during or as a consequence of providing relevant information to you as a clinically extremely vulnerable patient, the following steps may be taken:

  • where your NHS registered residential address is identified as incorrect when a letter is sent to you (undeliverable / returned / not known at this address), a flag is set on your patient record to indicate you no longer appear to live at the address registered with the NHS
  • if no response is received from you or your GP practice is unable to contact you, you will be removed from the practice patient list
  • other data quality issues raised by the health and care system are managed with the support of the National Back Office

It is important that you ensure your GP has current and accurate information about you including your name, residential address and telephone contact details as well as, where appropriate, your personal email address. 


Where we store the data

NHS Digital only stores and processes your personal data for this service within the United Kingdom.

Fully anonymous data, for example statistical data (which does not allow you to be identified), may be stored and processed outside of the UK.


Your rights over your personal data

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.

Last edited: 26 May 2021 12:12 pm