Skip to main content
Creating a new NHS England: Health Education England, NHS Digital and NHS England have merged. More about the merger.

Shielded Patient List: transparency notice

Version 8: 30 June 2022. We processed users' personal data in order to provide the shielded patient list for people at high clinical risk from coronavirus. This notice outlines what data was collected, how it was processed, and what we do with it now that the shielded patient list is closed.

Our purposes

NHS Digital processed your personal data to produce a Shielded Patient List (SPL). This is a list of patients in England who were previously identified as clinically extremely vulnerable to coronavirus (also known as COVID-19). The shielding programme in England has now ended, which means that those who were previously identified as clinically extremely vulnerable are no longer being asked to shield.

Between September 2021 and June 2022 NHS Digital has been conducting a managed closure of the SPL.  This Transparency Notice describes how your personal data will be processed upon closure of the SPL.

NHS Digital is the controller of the personal data in the SPL under the General Data Protection Regulation 2016 (UK GDPR) jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse data for purposes relating to COVID-19. This is under the COVID-19 Public Health Directions 2020 (COVID-19 Directions).

COVID-19 Public Inquiry

In March 2022 the government announced that there will be a COVID-19 public inquiry. The COVID-19 Inquiry Terms of Reference includes shielding within its scope. This places a legal obligation on NHS Digital not to delete or amend records for the duration of the inquiry. Your personal data will be held in identifiable form in archive for as long as it is considered necessary to meet the needs of the public inquiry. For example, NHS Digital may need to access your personal data in the SPL to respond to queries from the public inquiry.


Types of personal data we processed

The SPL contains the name, address, email address (where registered with GP), date of birth, phone numbers, and NHS number of those patients who were identified as clinically extremely vulnerable to coronavirus.

It also includes an explanation of why you were included in the list, which may have been due to a pre-existing medical condition and/or wider risk indicator (please see below for further details).

It also contains the name and telephone number of your GP practice, as well as your contact preferences from your GP record.


How we obtained your personal data

NHS Digital created the SPL based on data we already hold as the national safe haven for health and care data in England. See further information on how we collect data can be found on our website.

We collected additional data from GP practices in England and from Public Health England about patients previously determined to be clinically extremely vulnerable, or whose risk status has changed.

We collected information from the Health and Justice Information System (HJIS) to identify patients in detained and secure estates who may have been clinically extremely vulnerable if they contracted COVID-19. Information about patients who were identified as vulnerable was then provided back to healthcare clinicians by flagging patient records on the HJIS clinical system.

NHS Digital no longer collects data for SPL purposes as the SPL programme is now closed.


How the SPL was created

The Chief Medical Officer for England asked NHS Digital to create the SPL as part of our legal functions to collect and analyse data under the COVID-19 Directions.

Patients were included in the SPL if they had pre-existing medical conditions which were considered an indicator of extreme vulnerability to coronavirus.

Patients were also included in the SPL if they had pre-existing conditions which, when taken together with other relevant risk factors (such as the patient’s age, sex, ethnic group, body mass index (BMI) and postcode), were also considered to provide indicators of extreme vulnerability to coronavirus. We used a risk assessment model, known as the COVID-19 Population Risk Assessment (see below), to help identify patients in this category.


Medical conditions which were an indicator of extreme vulnerability

For the SPL, the Chief Medical Officers for the UK agreed the following underlying conditions were indicators of extreme vulnerability to coronavirus:

  • solid organ transplant recipients
  • people with severe respiratory conditions including all cystic fibrosis, severe asthma and severe chronic obstructive pulmonary (COPD)
  • people with rare diseases and inborn errors of metabolism that significantly increase the risk of infections (such as Severe combined immunodeficiency (SCID), homozygous sickle cell)
  • people on immunosuppression therapies sufficient to significantly increase risk of infection
  • people who have problems with their spleen, for example have had a splenectomy
  • adults with Down’s syndrome
  • adults on dialysis with kidney impairment (Stage 5 Chronic Kidney Disease)
  • women who are pregnant with significant heart disease, congenital or acquired
  • people with cancer who are undergoing active chemotherapy
  • people with lung cancer who are undergoing radical radiotherapy
  • people with cancers of the blood or bone marrow such as leukaemia, lymphoma or myeloma who are at any stage of treatment
  • people having immunotherapy or other continuing antibody treatments for cancer
  • people having other targeted cancer treatments which can affect the immune system, such as protein kinase inhibitors or PARP inhibitors
  • people who have had bone marrow or stem cell transplants in the last 6 months, or who are still taking immunosuppression drugs

Other indicators of extreme vulnerability

The Chief Medical Officer (CMO) for England also determined that patients with health conditions not listed above may still have been at risk of extreme vulnerability to coronavirus if they had a combination of other factors associated with becoming seriously unwell from coronavirus. The CMO made this determination based on the results of a clinical research project undertaken by the University of Oxford.

Information about patients who were added to the SPL in this way was provided to their GP and where appropriate, their hospital specialist. GPs and hospital specialists were able to add or remove a patient from the SPL at any time. They were also able to review whether patients on the List were clinically extremely vulnerable on an ongoing basis, according to their clinical judgement or when a patient requested this.

Read more about the COVID-19 Population Risk Assessment.

For more information on how your personal data is used as part of the COVID-19 Population Risk Assessment see the COVID-19 Population Risk Assessment Transparency Notice.


How the SPL has been maintained

NHS Digital previously updated the SPL when there were changes to patient status following a new diagnosis, or change in circumstance, or where a patient was identified as extremely vulnerable by their GP or hospital doctor or through the COVID-19 Population Risk Assessment.

Following the end of the national shielding programme, the SPL has been closed and is no longer updated with new patients identified as at high risk from COVID-19.

As such, the list reflects those people who were identified as clinically extremely vulnerable at the point at which the list was closed. This final version of the list will be held by NHS Digital in archive.


Managing my entry on the SPL

The UK Health Security Agency advises that previously clinically extremely vulnerable people should now, as a minimum, follow the same guidance as everyone else. For more information read the guidance on protecting people who are clinically extremely vulnerable. For general advice on coronavirus please visit the NHS website.

While the list was active, patients could request to be removed from the SPL by asking their GP. They added a low or moderate flag (note) to the patients record to be removed from the SPL. The SPL is now being held as a static list which cannot be updated, and patients can no longer request to be removed. This is because NHS Digital has a legal obligation to hold the information in this way as it may be required for the duration COVID-19 Public Inquiry.


Who we shared your personal data with

NHS Digital ceased sharing updates to the SPL with organisations after September 2021.

We previously shared relevant information from the SPL with organisations who have responsibilities for providing care and support to the patients on the List. This included:

  • GP practices about their own patients on the List
  • NHS hospitals about their own patients on the List
  • healthcare staff in prescribed places of detention (for example prisons) about their own patients on the list
  • other NHS organisations, government departments and local authorities for the purposes of the national and local response - this included the Cabinet Office who were responsible for providing the Extremely Vulnerable Persons Service which closed in September 2021

We also used and shared information for planning, commissioning and research purposes, including clinical trials, relating to coronavirus. This included sharing information with NHS organisations, government departments, other public authorities and research organisations.

We only shared identifiable information about those patients on the SPL where it was lawful for us to do so and under a terms of release letter which:

  • detailed the terms of release and the agreed purposes for which the data could be used
  • identified other organisations who may be permitted to use or receive the data and for what agreed purposes
  • set out the lawful basis for sharing and use of the data
  • obtained commitment from the recipient to the secure handling and management of the data, including its destruction once the agreed purposes had been met

In May and June 2022 NHS Digital informed recipient organisations that the SPL was closing. Where necessary, organisations were reminded of their responsibility as Controllers to destroy the data they held by 30 June 2022 or request to hold the data for other purposes. We envisage that there may be two reasons why an organisation might need to extend their Terms of Release:

  1. Need for continued COVID-19 purposes – in such cases organisations have been asked to provide an alternative legal basis both under the UK GDPR and to address the common law duty of confidentiality and meet all current standards to continue to process the data.
  2. Need for Public Inquiry – this option will require an organisation to have an alternative legal basis and meet all current standards to continue to process the data. 

Where an organisation is providing direct care to a person and the information has been entered on to the person’s local health or care record, it would not be expected their health or care record would require deletion of the fact that they were previously on the SPL. In such cases a further Terms of Release will not be required.

We have also published and shared data from the List which we have anonymised, so that no individuals can be identified from that data. This enables the NHS and other organisations to use this anonymous data for statistical analysis and for planning, commissioning and research purposes as part of the response, or evaluation of the response, to coronavirus. Anonymous data may also be shared to respond to queries in relation to the COVID-19 Public Inquiry.

Read more details here about the organisations with whom we have shared information from the Shielded Patient List.


How long we keep your personal data for

In March 2022 the Government announced that there will be a COVID-19 Public Inquiry and the associated COVID-19 Inquiry Terms of Reference includes shielding within its scope.  Your personal data will be held in identifiable form in archive for as long as it is considered necessary to meet the needs of the Public Inquiry. For example, NHS Digital may need to access your personal data in the SPL to respond to queries from the Public Inquiry.

Further to this, your personal data in the SPL will be held for 8 years from the expiry of the Covid-19 Public Health Directions and in accordance with the Records Management Code of Practice 2021 and NHS Digital’s Records Management Policy.

Other organisations with whom we shared SPL data have obligations to keep it for no longer than is necessary for the purposes under which we agreed to share it. Information about this will be provided in their transparency or privacy notices which are published on their websites.

For information about how long the Cabinet Office will retain any data we share with them for the purposes of providing the Extremely Vulnerable Patient Service, please see their privacy notice.


Where we store the data

NHS Digital only stores and processes your personal data for this service within the United Kingdom.

Fully anonymous data, for example statistical data (which does not allow you to be identified), may be stored and processed outside of the UK.


Your rights over your personal data

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice.

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.

Last edited: 30 June 2022 12:49 pm