NHS Digital processed your personal data to produce a Shielded Patient List (SPL). This is a list of patients in England who were previously identified as clinically extremely vulnerable to coronavirus (also known as COVID-19). The shielding programme in England has now ended, which means that those who were previously identified as clinically extremely vulnerable are no longer being asked to shield.
Between September 2021 and June 2022 NHS Digital has been conducting a managed closure of the SPL. This Transparency Notice describes how your personal data will be processed upon closure of the SPL.
NHS Digital is the controller of the personal data in the SPL under the General Data Protection Regulation 2016 (UK GDPR) jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse data for purposes relating to COVID-19. This is under the COVID-19 Public Health Directions 2020 (COVID-19 Directions).
COVID-19 Public Inquiry
In March 2022 the government announced that there will be a COVID-19 public inquiry. The COVID-19 Inquiry Terms of Reference includes shielding within its scope. This places a legal obligation on NHS Digital not to delete or amend records for the duration of the inquiry. Your personal data will be held in identifiable form in archive for as long as it is considered necessary to meet the needs of the public inquiry. For example, NHS Digital may need to access your personal data in the SPL to respond to queries from the public inquiry.
Types of personal data we processed
The SPL contains the name, address, email address (where registered with GP), date of birth, phone numbers, and NHS number of those patients who were identified as clinically extremely vulnerable to coronavirus.
It also includes an explanation of why you were included in the list, which may have been due to a pre-existing medical condition and/or wider risk indicator (please see below for further details).
It also contains the name and telephone number of your GP practice, as well as your contact preferences from your GP record.
How we obtained your personal data
NHS Digital created the SPL based on data we already hold as the national safe haven for health and care data in England. See further information on how we collect data can be found on our website.
We collected additional data from GP practices in England and from Public Health England about patients previously determined to be clinically extremely vulnerable, or whose risk status has changed.
We collected information from the Health and Justice Information System (HJIS) to identify patients in detained and secure estates who may have been clinically extremely vulnerable if they contracted COVID-19. Information about patients who were identified as vulnerable was then provided back to healthcare clinicians by flagging patient records on the HJIS clinical system.
NHS Digital no longer collects data for SPL purposes as the SPL programme is now closed.
How the SPL was created
The Chief Medical Officer for England asked NHS Digital to create the SPL as part of our legal functions to collect and analyse data under the COVID-19 Directions.
Patients were included in the SPL if they had pre-existing medical conditions which were considered an indicator of extreme vulnerability to coronavirus.
Patients were also included in the SPL if they had pre-existing conditions which, when taken together with other relevant risk factors (such as the patient’s age, sex, ethnic group, body mass index (BMI) and postcode), were also considered to provide indicators of extreme vulnerability to coronavirus. We used a risk assessment model, known as the COVID-19 Population Risk Assessment (see below), to help identify patients in this category.
Other indicators of extreme vulnerability
The Chief Medical Officer (CMO) for England also determined that patients with health conditions not listed above may still have been at risk of extreme vulnerability to coronavirus if they had a combination of other factors associated with becoming seriously unwell from coronavirus. The CMO made this determination based on the results of a clinical research project undertaken by the University of Oxford.
Information about patients who were added to the SPL in this way was provided to their GP and where appropriate, their hospital specialist. GPs and hospital specialists were able to add or remove a patient from the SPL at any time. They were also able to review whether patients on the List were clinically extremely vulnerable on an ongoing basis, according to their clinical judgement or when a patient requested this.
Read more about the COVID-19 Population Risk Assessment.
For more information on how your personal data is used as part of the COVID-19 Population Risk Assessment see the COVID-19 Population Risk Assessment Transparency Notice.
How the SPL has been maintained
NHS Digital previously updated the SPL when there were changes to patient status following a new diagnosis, or change in circumstance, or where a patient was identified as extremely vulnerable by their GP or hospital doctor or through the COVID-19 Population Risk Assessment.
Following the end of the national shielding programme, the SPL has been closed and is no longer updated with new patients identified as at high risk from COVID-19.
As such, the list reflects those people who were identified as clinically extremely vulnerable at the point at which the list was closed. This final version of the list will be held by NHS Digital in archive.
Managing my entry on the SPL
The UK Health Security Agency advises that previously clinically extremely vulnerable people should now, as a minimum, follow the same guidance as everyone else. For more information read the guidance on protecting people who are clinically extremely vulnerable. For general advice on coronavirus please visit the NHS website.
While the list was active, patients could request to be removed from the SPL by asking their GP. They added a low or moderate flag (note) to the patients record to be removed from the SPL. The SPL is now being held as a static list which cannot be updated, and patients can no longer request to be removed. This is because NHS Digital has a legal obligation to hold the information in this way as it may be required for the duration COVID-19 Public Inquiry.
How long we keep your personal data for
In March 2022 the Government announced that there will be a COVID-19 Public Inquiry and the associated COVID-19 Inquiry Terms of Reference includes shielding within its scope. Your personal data will be held in identifiable form in archive for as long as it is considered necessary to meet the needs of the Public Inquiry. For example, NHS Digital may need to access your personal data in the SPL to respond to queries from the Public Inquiry.
Further to this, your personal data in the SPL will be held for 8 years from the expiry of the Covid-19 Public Health Directions and in accordance with the Records Management Code of Practice 2021 and NHS Digital’s Records Management Policy.
Other organisations with whom we shared SPL data have obligations to keep it for no longer than is necessary for the purposes under which we agreed to share it. Information about this will be provided in their transparency or privacy notices which are published on their websites.
For information about how long the Cabinet Office will retain any data we share with them for the purposes of providing the Extremely Vulnerable Patient Service, please see their privacy notice.
Last edited: 30 June 2022 12:49 pm