Skip to main content

Coronavirus (COVID-19) treatments - transparency notice

Read the transparency notice for coronavirus (COVID-19) treatments.

Our purposes

NHS England have asked NHS Digital to provide a COVID-19 Medications Service (Medications Service), this has been set up to provide treatment for people who have tested positive for coronavirus (COVID-19).

There are different potential treatments, including an antibody treatment, known as Neutralizing Monoclonal Antibodies (nMAbs) which is given by an intravenous injection or an anti viral treatment which is a tablet, these aim to relieve symptoms of COVID-19 quicker and can stop people from getting seriously ill.

The Chief Medical Officer for England (CMO), along with senior clinicians at NHS England, has set out the clinical conditions (clinical criteria) to identify people who are more at risk at getting seriously ill with COVID-19 and who would be suitable for treatment.

NHS Digital is providing information about potentially eligible people to treatment providers so that people may be contacted and clinically assessed for the service if they test positive for COVID-19:

  • people with a positive polymerase chain reaction (PCR) test or a positive rapid lateral flow test (LFT) within the previous 3 calendar days
  • people who are 12 years minus 2 days or older
  • people will have one or more qualifying conditions

Further information about the clinical criteria.   

To deliver this service, NHS Digital is providing NHS providers with contact information of people who are potentially suitable for treatment. 

This information will be used in the following ways:

  • NHS England will write to all people who meet the clinical criteria to inform them that they may be suitable for Treatment and provide them with a pre-registered PCR test kit
  • Integrated Care System COVID-19 medication delivery units (ICS CMDUs), commissioned by your local Clinical Commissioning Group (CCG), will contact patients who meet the clinical criteria to arrange a clinical assessment if they test positive, this will determine if they are suitable for treatment
  • where a person has provided their (or their representatives) mobile or email contact information when booking their COVID-19 test and they test positive, they will be contacted by text/email to inform them they may be suitable for treatment
  • where is a person is in prison, youth offending institution or immigration centre, the centre will use the information to refer the person to the CMDU for assessment

This notice should be read alongside our Coronavirus (COVID-19) response transparency notice.

The controller of your personal data

Under the UK General Data Protection Regulation 2016 (GDPR), NHS Digital is the controller of your personal data where we are directed or requested to process personal data for COVID-19 purposes. 

We are also a joint controller with the person who has directed or requested us to do this work. In this case this is NHS England who are directing NHS Digital to carry out processing for COVID-19 purposes.

Where we share data, NHS Digital is the sole controller for the sharing of your personal data.

How we obtain your personal data

Identifying patients for inclusion into the COVID-19 Medications Service is being carried out by using data we already hold as the national safe haven for health and care data in England.

We are also collecting information from ICS CMDUs about the outcomes from their assessment; including whether the patient was contacted successfully and the outcomes of the assessment, including:

  • whether the patient declined treatment
  • whether the patient was suitable for treatment
  • if suitable, which treatment was identified as being most appropriate 

We are also collecting information from NHS England, about the treatment which was provided to patients, this is includes the patient’s NHS Number and the medication code for the treatment delivered.

Types of personal data we process

Data used to identify whether you would be suitable for the treatment, and outcomes from the treatment, includes:

  • NHS number
  • name
  • sex
  • address
  • postcode
  • date and time of positive polymerase chain reaction (PCR) test or positive rapid lateral flow test (LFT)
  • registered GP practice
  • date of birth
  • contact information provided by the patient or their representative/guardian at the point of booking their PCR or registering their LFT test
  • health related data (in the form of condition codes held in central NHS records), where the data matches the clinical conditions and ruleset established by the CMO
  • treatment planned the CMDU at the point of triage and treatment delivered by the CMDU

Who we share your personal data with

We are sharing relevant information with organisations who have responsibilities for delivering the Medications Service. 

To identify whether you would be suitable for the Medications Service, NHS Digital will share your data with the ICS CMDU responsible for your care. (ICS CMDU providers are either your CCG or a health service provider commissioned by your CCG, such as the local Trust, GP or community services).

NHS Digital will share your contact information with:

  • NHS England: they will write to you, or you as a child’s parent or carer,  to inform you that you or your child may be suitable for treatment if you, or they, are diagnosed with COVID-19 and to provide advice and guidance
  • Department of Health and Social Care: are responsible for the delivery of the national COVID-19 Testing programme for England,  they will send you a PCR test kit to use if you have COVID-19 symptoms
  • NHS Business Service Authority: are responsible for messaging people in England regarding their PCR test, results on behalf of DHSC. At the point of COVID-19 diagnosis, they will text or email you (using the information you or your carer provided when you booked your PCR test), or registered your LFT result) to inform you that you may be suitable for treatment and to provide advice and guidance
  • NHS England Health and Justice system: where a person may be suitable for treatment and where they are diagnosed with COVID-19.  If they are currently located within a prison, youth offending centre or an immigration centre, their information will be shared with NHS England Health and Justice in order to ensure that a person can be referred for assessment should they test positive for COVID-19

NHS Digital will share your contact information and clinical condition group with:

  • ICS CMDUs: if you test positive, they will contact you to arrange a call with a clinician to assess whether you would be suitable for the treatment. They will also arrange treatment where appropriate

NHS Digital will share your clinical condition group and ICS CMDU outcome decision with

  • NHS England: to link with other data sets to understand whether treatment is effective, support purchase of medication and to monitor health inequalities. The data provided by NHS Digital is pseudonymised to ensure that individual patients are not identifiable.

Further information is provided in NHS England Privacy Notice

We will only share identifiable information about people for the Medications Service where it is lawful for us to do so and under a terms of release letter which:

  • details the terms of release and the agreed purposes for which the data can be used
  • identifies other organisations who may be permitted to use or receive the data and for what agreed purposes for delivery of the Medications Service
  • sets out the lawful basis for sharing and using the data
  • obtains commitments from the recipient to the secure handling and management of the data, including its destruction once the agreed purposes have been met

We will also provide aggregate reporting to NHS England and to support management of the Ant-Viral programme, which we have fully anonymised so individuals cannot be identified from that data.

We will also use and share information from the Medications Service for planning, commissioning and research purposes, including clinical trials, relating to coronavirus. This will include sharing information with NHS organisations, government departments, other public authorities and research organisations. Data will be at record level or aggregate and will not identify individuals unless we have your consent.

We will also publish and share data which we have fully anonymised, so that no individuals can be identified from that data.

How long we keep your personal data for

We will retain your personal data for as long as is necessary for the purpose outlined above in accordance with the Records Management Code of Practice 2021 and NHS Digital’s Records Management Policy.

Other organisations with whom we share your personal data have obligations to keep it for no longer than is necessary for the purposes for which we have shared your personal data. Information about this will be provided in their transparency or privacy notices which are published on their websites.

Where we store the data

NHS Digital only stores and processes your personal data for this service within the United Kingdom.

Fully anonymous data, for example statistical data (which does not allow you to be identified), may be stored and processed outside of the UK.

Your rights over your personal data

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice.

You can read more about how NHS England processes your data for COVID-19 purposes here NHS England and NHS Improvement transparency notice

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.

Last edited: 19 May 2022 11:53 am