GP Data for Planning and Research: Letter from Parliamentary Under Secretary of State for Health and Social Care to general practices in England - 19 July 2021

Patient data from general practice has significantly contributed to the improvement of health and care services and treatments for many years. Patients rightly trust their GP to safeguard their data, a role that we know that all general practitioners take very seriously. This is why I am writing to share more information with you about how we are working to improve how this data is collected.

NHS Digital is making improvements to how data is collected from general practice, with a new framework for data extraction called the General Practice Data for Planning and Research (GPDPR) collection.

You will have seen the announcement to pause the collection of this data, to provide more time to engage with GPs, patients, health charities and others, and to strengthen the plan.

We are working in collaboration with a range of partners including the Royal College of General Practitioners (RCGP) and the British Medical Association (BMA). I want to reassure you that we have heard your concerns loud and clear and will continue to listen.

I am writing now to provide an update on the four key areas of work to strengthen the plan. We hope this will foster your trust in the system and provide a strong basis for you and your patients to participate in the scheme with confidence.

Most importantly, I can confirm today that, while we are continuing to work on the infrastructure, and communication for the project, we are not setting a specific start date for the collection of data. Instead, we commit to start uploading data only when we have the following in place:

• the ability to delete data if patients choose to opt-out of sharing their GP data with NHS Digital, even if this is after their data has been uploaded
• the backlog of opt-outs has been fully cleared
• a Trusted Research Environment has been developed and implemented in NHS Digital
• patients have been made more aware of the scheme through a campaign of engagement and communication

In this letter each of these adjustments are set out, all of which are critical to the success and impact of the programme, including through better understanding of the huge benefits the programme will have to the NHS and to our ability to provide the best and safest possible care for patients. 

We want to make the position around opt-out much simpler. While 1 September has been seen by some as a cut-off date for opt-out, after which data extraction would begin, I want to reassure you that this will not be the case and data extraction will not commence until we have met the tests.

We are introducing three changes to the opt-out system which mean that patients will be able to change their opt-out status at any time:

• Patients do not need to register a Type 1 opt-out by 1 September to ensure their GP data will not be uploaded
• NHS Digital will create the technical means to allow GP data that has previously been uploaded to the system via the GPDPR collection to be deleted when someone registers a Type 1 opt-out
• The plan to retire Type 1 opt-outs will be deferred for at least 12 months while we get the new arrangements up and running, and will not be implemented without consultation with the RCGP, the BMA and the National Data Guardian

Together, these changes mean that patients can have confidence that they will have the ability to opt-in or opt-out of the system, and that the dataset will always reflect their current preference. And we will ensure it is easy for them to exercise the choice to optout.

We have heard from many GPs and practices that there is concern about the administrative burden that Type 1 opt-outs have placed on you and your teams. We are in the process of working with colleagues across general practice to develop a way of simplifying and centralising the opt-out process in order to remove this burden on practices. This is still in development, but we will share further information with you in the coming weeks.

In the meantime, given the changes we have agreed to the opt-outs there is now no urgency to process Type 1 opt-outs specifically for GPDPR in order to get people opted out before September. We will keep you updated on timelines for when we expect the programme to go live.

We will also ensure that the NHS Digital Data Protection Impact Assessment (DPIA) reflecting these changes to the programme is published well before data collection commences. A template DPIA for practice use will also be made available in good time to allow practices to complete it.

The Government has committed that access to GP data will only be via a Trusted Research Environment (TRE) and never copied or shipped outside the NHS secure environment, except where individuals have consented to their data being accessed e.g. written consent for a research study. This is intended to give both GPs and patients a very high degree of confidence that their data will be safe and their privacy protected.

The TRE will be built in line with best practice developed in projects, such as OpenSAFELY and the Office for National Statistics’ Secure Research Service.

We are also committed to adopting a transparent approach, including publishing who has run what query and used which bit of data. We are developing a TRE which will meet our specific needs and act as 'best in class'.

We commit to only begin the data collection once the TRE is in place. Further, we will ensure that the BMA, RCGP and the National Data Guardian have oversight of the proposed arrangements and are satisfied with them before data upload begins.

I can also confirm that the previously published Data Provision Notice for this collection has been withdrawn.

Once the data is collected, it will only be used for the purposes of improving health and care. Patient data is not for sale and will never be for sale.

There has been a great deal of concern regarding the lack of awareness amongst the healthcare system and patients. We recognise that we need to strengthen engagement, including opportunities for non-digital engagement and communication.

Since the programme has been paused, we have been developing an engagement and communications campaign, with the goal of ensuring that the healthcare system and patients are aware and understand what is planned, and can make informed choices. The public rightly look to and trust general practice - through a centrally driven communication campaign, with clear messages, we will seek to ensure that the introduction of this collection does not impose an additional burden on practices.

We are developing a communications strategy delivered through four phases.

• Listening - where we listen to stakeholders and gather views on how best to communicate with the profession, patients and the public and give them the opportunity to inform the development of the programme in areas such as opt-outs, trusted research environments and other significant areas
• Consultation - a series of events where we can explain the programme, listen and capture feedback and co-design the information campaign
• Demonstration - show how feedback is being used to develop the programme and shape communications to the healthcare system and the public
• Delivery - of an information campaign to inform the healthcare system and the public about changes to how their GP data is used, that utilises the first three phases to ensure the campaign is accessible, has wide reach and is effective

Data saves lives. The vaccine rollout for COVID-19 could not have been achieved without patient data. The discovery that the steroid Dexamethasone could save the lives of one third of the most vulnerable patients with COVID-19 – those on ventilators - could not have been made without patient data from GP practices in England. That insight has gone on to save a million lives around the globe. That is why this programme is so important.

The programme and I will be providing further information as the programme progresses. In the meantime, if you have any questions, you can contact the programme at [email protected].

The NHS Digital web pages also provide further information at https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research#additional-information-for-gp-practices.

Thank you for your continued support. 

JO CHURCHILL
Parliamentary under Secretary of State for Primary Care and Health Promotion

NHS Digital is making improvements to how data is collected from general practice, this new framework for data extraction is called the General Practice Data for Planning and Research data collection (GPDPR). The goal of this new system is to:

• reduce burden on GP practices in managing access to patient data and maintain compliance with relevant data protection legislation
• improve protections through the consistent and rigorous review of all applications for access to patient data
• make it easier for patients to understand how their health and care data is being used, including increasing use of Trusted Secure Environments that avoids data flowing outside the NHS

This new NHS Digital service will collect data from GP practices in England and will analyse, publish statistical data and provide safe, secure, lawful and appropriate access to GP data for health and social care purposes. This will include planning, commissioning, policy development, public health purposes (including COVID-19) and research.

NHS Digital is engaging with the British Medical Association (BMA), Royal College of General Practitioners (RCGP) and the National Data Guardian (NDG) to ensure relevant safeguards are in place for patients and GP practices. 

All data will be pseudonymised and encrypted by your GP system suppliers on your behalf before it is transferred to NHS Digital. Access to GP data will only be via a Trusted Research Environment (TRE) and never copied or shipped outside the NHS secure environment, except where individuals have consented to their data being accessed, e.g. written consent for a research study.

As with the COVID-19 collection, access to the data will be through the NHS Digital Data Access Request Service (DARS) and will be subject to a robust approvals process, which includes oversight by the Independent Group Advising on Release of Data (IGARD) and a Professional Advisory Group, which is made up of representatives from the BMA and RCGP.

Once fully established, this new collection will help to reduce the number of patient data flows for planning and research purposes currently managed by each GP practice. GPs and patients will be able to clearly see how patient data is being used to run and improve health and care services from the information provided by NHS Digital. 

We are committed to ensuring continuity of data flows to support accurate and timely payments to General Practice. The existing General Practice Extraction Service (GPES) will continue to operate for GP payment purposes until the new arrangements are agreed, tested and then approved for managed transition to the GPDPR service in consultation with GP professional representatives.