Shielded Patient List: transparency notice

NHS Digital processes personal data to produce a Shielded Patient List (SPL) of patients in England who were previously identified as clinically extremely vulnerable in relation to coronavirus (also referred to as COVID-19). 

The shielding programme in England has now ended, which means that those who were previously identified as clinically extremely vulnerable are no longer being asked to shield. As part of the programme closure, the list of people identified as at high risk at the end of the shielding programme will continue to be held and managed by NHS Digital to support enquiries from those involved in the provision of direct care to patients, previously identified as clinically extremely vulnerable and will be used to plan health and social care services and to carry out medical research.

Patients on the SPL will receive a letter and email (if an email address has been previously registered with their GP) informing them that shielding has ended and advising them of support that is available to them should they continue to need it.

NHS Digital is conducting a managed closure of the SPL and this Transparency Notice will be updated as appropriate to reflect any further changes in processing personal data as a result of the closure of the SPL.

If you have previously been identified as clinically extremely vulnerable, you can find more guidance about what to do now on NHS.UK and in the guidance from Public Health England.

As someone who was identified as clinically extremely vulnerable you may be prioritised for COVID-19 vaccination, and/or a booster vaccination. You can read more about how patients are prioritised for vaccination and NHS Digital’s role.

NHS Digital also processed personal data of patients who use the NHS.UK Get Vitamin D Supplements Service. The application service has now closed, however data processing will continue in order to process data to complete the vitamin delivery activities. 

NHS Digital is the controller of the personal data in the List under the General Data Protection Regulation 2016 (GDPR) jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse data for purposes relating to COVID-19 under the COVID-19 Public Health Directions 2020 (COVID-19 Directions).

A Data Protection Impact Assess (DPIA) has been undertaken and completed for the SPL and is subject to ongoing review as and when the service is revised.

The Shielded Patient List (SPL) contains the name, address, email address (where registered with GP), date of birth, phone numbers, and NHS number of those patients who were identified as clinically extremely vulnerable to coronavirus.

The SPL also includes an explanation of why you were included in the list, which may have been due to a pre-existing medical condition and/or wider risk indicator (please see below for further details).

It also contains the name of a patient's GP practice and the GP practice telephone number, as well as a patient’s contact preferences from their GP record. Where a person required written communications to be in Braille or large print, NHS Digital will ensure these requirements were applied for national shielding communications from the NHS and the Department of Health and Social Care.

As part of the programme closure, the list of people identified as at high risk at the end of the shielding programme will continue to be held and managed by NHS Digital to support enquiries from those involved in the provision of direct care to patients previously identified as clinically extremely vulnerable.  

NHS Digital created the SPL based on data we already hold as the national safe haven for health and care data in England.  Further information on how we collect data can be found on our website.

We collect additional data from GP practices in England and from Public Health England about patients previously determined to be clinically extremely vulnerable, or whose risk status has changed.

We collect information from the Health and Justice Information System (HJIS) to identify patients in detained and secure estates who may have been clinically extremely vulnerable if they contracted COVID-19. Information about patients who are on the SPL was then provided back to healthcare clinicians by NHS Digital through identifying those patient records with a flag on the HJIS clinical system.

The Chief Medical Officer (CMO) for England also determined that patients with health conditions not listed above may still have been at risk of extreme vulnerability to coronavirus if they had a combination of other factors associated with becoming seriously unwell from coronavirus. The CMO has made this determination based on the results of a clinical research project undertaken by the University of Oxford.

Researchers from across the UK, led by the University of Oxford, produced a risk prediction model called QCovid® as part of this project. This combines a number of factors such as age, sex registered at birth, ethnicity, height and weight (to calculate BMI) and specific health conditions and treatments to estimate the risk of catching and becoming seriously unwell with coronavirus.

NHS Digital developed a COVID-19 Population Risk Assessment which used QCovid® and patient data held in existing NHS Digital datasets, to identify those patients with relevant factors or health issues to assess their risk. NHS Digital generated a risk assessment result for each of these patients and those with a result above an agreed threshold set by the CMO were added to the SPL. A cautious approach was taken, so there is a chance that a patient’s risk is lower than the risk assessment estimated. 

Information about patients who were added to the SPL in this way was provided to their GP and where appropriate hospital specialist. GPs and hospital specialists were able to add or remove a patient from the Shielded Patient List at any time and, while the SPL was still active, were able to review whether patients on the List are clinically extremely vulnerable on an ongoing basis, according to their clinical judgement or when a patient requests this.

Read more about the COVID-19 Population Risk Assessment.

For more information on how your personal information is used as part of the COVID-19 Population Risk Assessment see the COVID-19 Population Risk Assessment Transparency Notice.

The shielding programme in England has now ended, which means that those who were previously identified as clinically extremely vulnerable are no longer being asked to shield. However, the list is currently still being held and maintained by NHS Digital to support enquiries from those involved in the provision of direct care to patients previously identified as clinically extremely vulnerable.

NHS Digital previously updated the SPL to ensure it continued to include all patients deemed to be clinically extremely vulnerable to coronavirus (COVID-19).

This work included considering changes to patient status following a new diagnosis, or change in circumstance, or where a patient is identified as extremely vulnerable by their GP or hospital doctor or through the COVID-19 Population Risk Assessment.

Following the end of the national shielding programme, the SPL has been closed and is no longer updated with new patients identified as at high risk from COVID-19. The SPL is also no longer updated to reflect changes to the risk status of patients on the list by GPs or hospital trusts. 

As such, the list reflects those people who were identified as clinically extremely vulnerable at the point at which the list was closed. This final version of the list will be held and managed by NHS Digital to support enquiries from those involved in the provision of direct care to patients previously identified as clinically extremely vulnerable.

This management includes maintenance to:

• ensure demographic information about those people included in the list remains accurate
• remove those people from the list who have died
• remove those people from the list who are no longer registered with a GP for NHS care in England, where they have moved out of the country and this has been recorded as an “exit” on their health record
• to identify those people who have re-registered with a GP for NHS care in England and who were previously included on the list

NHS Digital is conducting a managed closure of the SPL and this Transparency Notice will be updated as appropriate to reflect any further changes in processing personal data as a result of the closure of the SPL.

NHS Digital ceased sharing updates to the SPL with organisations after September 2021.  

We previously shared relevant information from the Shielded Patient List with organisations who have responsibilities for providing care and support to the patients on the List. This includes:

• GP practices about their own patients on the List
• NHS hospitals about their own patients on the List
• healthcare staff in prescribed places of detention (for example prisons) about their own patients on the List
• Other NHS organisations, Government departments and local authorities. This included the Cabinet Office who were responsible for providing the Extremely Vulnerable Persons Service. More information about how the Cabinet Office used personal data for that Service, who it shared information with and how long it will keep the information following the closure of the Service is explained in its privacy notice.  

Following a consultation with recipients of the SPL in October and November 2021 and the emergence of a new variant of COVID-19, NHS Digital and the Department of Health and Social Care have agreed that there are ongoing needs for recipients to process the Disclosed Data they currently hold.  

This is for the purposes of:

• providing ongoing direct care and support to those people who were previously clinically extremely vulnerable and were on the Shielded Patient List where recipient’s feel this is necessary
• the forthcoming independent statutory Public Inquiry into the UK response to the Covid-19 pandemic (Public Inquiry). Many NHS and social care organisations are ensuring (where feasible) that documents and evidence relating to the pandemic are preserved in case they are required by the Public Inquiry. This may include the SPL data they hold

We also used and share information from the Shielded Patient List for planning, commissioning and research purposes, including clinical trials, relating to coronavirus. This included sharing information with NHS organisations, government departments, other public authorities and research organisations.

We will only share identifiable information about those patients on the Shielded Patient List where it is lawful for us to do so and under a terms of release letter which:

• details the terms of release and the agreed purposes for which the data can be used
• identifies other organisations who may be permitted to use or receive the data and for what agreed purposes
• sets out the lawful basis for sharing and using the data
• obtains commitments from the recipient to the secure handling and management of the data, including its destruction once the agreed purposes have been met

We will also publish and share data from the List which we have anonymised, so that no individuals can be identified from that data.

This will enable NHS and other organisations to use this anonymous data for statistical analysis and for planning, commissioning and research purposes as part of the response to coronavirus.

To keep patients informed of their risk of complications from COVID-19, as well as to provide relevant advice, guidance and support as and when necessary, information was also shared with national processing partners for the purposes of issuing letters and emails to patients.

Read more details here about the organisations with whom we have shared information from the Shielded Patient List.

Data will be processed until the expiry of the COVID-19 Directions which are in place until 31March 2022 (unless extended). Data shall be retained for 8 years from the expiry of those Directions in accordance with the Records Management Code of Practice 2021 and NHS Digital’s Records Management Policy.

Other organisations with whom we share your personal data have obligations to keep it for no longer than is necessary for the purposes for which we have shared your personal data. Information about this will be provided in their transparency or privacy notices which are published on their websites.

For information about how long the Cabinet Office will retain any data we share with them for the purposes of providing the Extremely Vulnerable Patient Service, please see their privacy notice.

The information we use to contact clinically extremely vulnerable patients is drawn from existing information held by the NHS in your patient record.

Where this information was identified as incorrect during or as a consequence of providing relevant information to you as a clinically extremely vulnerable patient, the following steps were taken:

• where your NHS registered residential address was identified as incorrect when a letter was sent to you (undeliverable / returned / not known at this address), a flag will have been set on your patient record to indicate you no longer appeared to live at the address registered with the NHS
• if no response was received from you or your GP practice has been unable to contact you, you may be removed from the practice patient list
• other data quality issues raised by the health and care system have been managed with the support of the National Back Office

It is important that you ensure your GP has current and accurate information about you including your name, residential address and telephone contact details as well as, where appropriate, your personal email address. Email address is increasingly used by the NHS and health services as a means of communicating with patients.

NHS Digital only stores and processes your personal data for this service within the United Kingdom.

Fully anonymous data, for example statistical data (which does not allow you to be identified), may be stored and processed outside of the UK.

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.