We have detected that you are using Internet Explorer to visit this website. Internet Explorer is now being phased out by Microsoft. As a result, NHS Digital no longer supports any version of Internet Explorer for our web-based products, as it involves considerable extra effort and expense, which cannot be justified from public funds. Some features on this site will not work. You should use a modern browser such as Edge, Chrome, Firefox, or Safari. If you have difficulty installing or accessing a different browser, contact your IT support team.
IAPT data set: fair processing guidance
This guidance document is designed to support IAPT care providers that are implementing the Improving Access to Psychological Therapies (IAPT) Data Set for the first time or are implementing the changes defined in the version 2.0 release which goes live on 1 September 2020.
We have provided information and guidance to IAPT service providers around the IAPT Data Set, to support understanding of the purpose and processing of the data set and their responsibilities for transparency with patients.
This guidance also contains suggested fair processing information for inclusion within existing patient information material.
This is to comply with the requirements of the common law duty of confidentiality, the Data Protection Act 2018, the General Data Protection Regulation (GDPR), NHS Constitution and the Department of Health and Social Care’s Directions to NHS Digital, formerly known as the HSCIC, issued in 2015, 2017 and 2018 on upholding patients’ national data opt out preferences.
Lawful basis for processing
Under GDPR, our lawful basis for processing is Article 6 (1) (c), which relates to processing necessary to comply with a legal obligation to which we are subject. Our lawful basis for processing special category data is GDPR Article 9 (2) (h) and Schedule 1, Part 1 (2) (2) (f) of the Data Protection Act 2018.
Requirement for IAPT service providers
A Data Provision Notice (DPN) has been published prior to version 2.0 of the data set going live on 1 September 2020. This means that all providers of NHS-funded IAPT services are required under Section 259 (5) of the HSCA 2012 to provide the data set as specified by NHS Digital within the DPN.
Fairness and transparency
As the IAPT data is to be used for secondary care rather than direct patient care, patients using NHS-funded IAPT services must be made aware that their confidential data will be used for this beneficial, additional purpose i.e. to improve care.
Acting fairly and transparently ensures compliance with the common law duty of confidentiality, the NHS Constitution and legislation such as the Data Protection Act 2018 and the GDPR.
Ensuring fairness is the responsibility of the care provider from which the data will be collected (NHS Digital has provided some suggested wording later in this document).
Patients must also be informed of their right to set a national data opt-out preference to prevent their confidential patient information from being used for purposes beyond their own direct care and treatment (for research and planning purposes, for example). This complies with the Department of Health and Social Care’s Directions, issued to NHS Digital in 2015, 2016 and 2018 on the upholding of patients’ national data opt out preferences.
Data protection laws in the UK give people a number of rights concerning their personal data. Not all rights apply equally to all our processing activity as certain rights are not available depending on the lawful basis for the processing.
With respect to the IAPT Data Set, providers are legally required to submit full returns of IAPT v2.0 data, as the DPN that will be issued under section 259 (10) of the Health and Social Care Act
(HSCA) 2012 sets aside the common law duty of confidence in respect of this data. However, providers may themselves exclude records where they are subject to any other restriction on disclosure, such as by other laws.
Patients however, do have a right to set a national data opt-out preference to prevent their confidential patient information being used for research and planning. Where an opt-out is received from a patient (or their parent or guardian in the case of a child), NHS Digital will exclude the relevant records from any applicable onward dissemination of the data.
Patients using these services have the right to change their minds about a disclosure decision at any time before the disclosure is made and can do so afterwards to prevent further disclosures.
Further information on the national data opt out programme is available from our data opt out guidance for health and care staff.
Providers should maintain awareness of developments in legislation around opting out, as this may impact the required approach to opt-outs during the lifetime of this information standard.
For existing users - change from IAPT v1.5 guidance
The guidance under the ‘Patient choice’ heading above represents a change from the guidance issued for v1.5 of the data set. The IAPT v1.5 Implementation Guidance stated:
“providers are encouraged to seek consent from patients for their information to be used to support secondary uses wherever possible and in line with local policy.”
From 1 September 2020, services are no longer encouraged to seek consent from patients, as the issuing of a DPN means providers are legally required to submit full returns of IAPT data. However, providers may themselves exclude specific records where they are subject to any other restrictions on disclosure, such as by other laws.
Managing the transition between v1.5 and v2.0
Collection of Version 2.0 data commences 1 September 2020.
It is likely services will have ongoing referrals that span 1 September 2020.
Where services have previously sought patient consent, some of these referrals may have been refused consent and therefore have been excluded from v1.5 submissions.
For ongoing referrals where consent has previously been refused:
- services may choose to uphold the patient’s original consent preference throughout their referral for care. NHS Digital accept that these referrals may continue to be excluded in v2.0.
- services must not start to flow such referrals in v2.0, unless the patient has been informed.
For all new referrals received from 1 September 2020:
- services must follow the new position and the referral must be submitted to NHS Digital in line with the DPN.
Reason for change
This change in consent guidance aligns the IAPT Data Set with the national data opt out and with the consent guidance adopted across other NHS Digital data sets, including the Mental Health Services Data Set (MHSDS).
The amended guidance ensures that NHS Digital are able to fulfil the directions issued by NHS England to establish a complete collection of IAPT services data. This also ensures that the anonymised data published by NHS Digital provides a true reflection of the delivery of IAPT services in England, so that benefits from the data can be maximised.
Following the national data opt-out for patient consent preferences ensures that individuals are able to make and maintain an informed central choice about the use of their confidential patient information for research and planning.
Suggested wording for fair processing information
This suggested wording is intended to be incorporated into a service's existing information for patients. It does not need to be a separate leaflet.
IAPT service providers MAY choose to use this wording (or elements of) or may use locally agreed wording, providing that responsibilities for fairness and transparency are met.
"We share information about you (your personal data) for the Improving Access to Psychological Therapies (IAPT) Data Set, to help achieve better outcomes and experiences of care.
The data set collects information about demographics (such as postcode, date of birth, ethnic category), referral, treatment and outcomes details.
The data is securely sent to NHS Digital which is the central organisation that receives the same data from all NHS-funded IAPT services across England.
The data set is used to produce anonymised national reports that show summary numbers of, for instance, numbers of patients referred to different IAPT services across the country as well as average waiting times and outcomes.
The reports help the NHS to improve the care it provides to you and other patients. No information that could reveal your identity is used in these reports.
The data may be linked with other sources of data to support a wider range of information within these national reports, such as to investigate the relationship between IAPT services and other care services.
For more information about how NHS Digital uses IAPT data including their lawful basis for processing, how long they hold it for and your rights, please see our GDPR register.
To manage your choice about how your confidential patient information is used for research and planning, please visit the following website: https://www.nhs.uk/your-nhs-data-matters/. Alternatively, you can call 0300 303 5678.
More information about the IAPT Data Set can be found on the NHS Digtial IAPT web pages."