How will I know if I am affected?
We will write to all affected patients by the end of July 2018 to make them aware of the issue. If you do not receive a letter by this date you have not been affected and have no cause for concern.
What does this mean?
If you are affected by this issue it means that your objection to sharing your information for research and planning purposes hasn’t been honoured, because NHS Digital were never given the information about your preferences from the GP system where they were recorded (SystmOne, run by TPP).
We have strong controls around data sharing and only share information where there is a legal basis to do so and when there are strict controls in place about how the data should be used, how it is stored safely, who can access it and when and how it must be securely destroyed.
If you have been affected please be reassured that we have now fixed the problem and that your care and treatment has never been affected.
We apologise unreservedly if you have been affected and the system supplier who made the coding error has also apologised.
What is a type 2 opt-out?
A type 2 opt-out is an opt-out which can be logged in a GP system, asking that NHS Digital does not share an individual’s personal confidential data for purposes beyond their own care.
On 25 May 2018 the health and care system introduced a national data opt-out and existing and future type 2 opt-outs (which can be set up until 1 October 2018) will automatically be changed into a national data opt-out. This can be set by an individual themselves, directly with NHS Digital, either online, by telephone or using a paper form.
What is a national data opt-out?
The health and care system introduced a new national data opt-out service on 25 May 2018. This will provide a secure and accessible way for the public to opt out of their confidential patient information being used for reasons other than their individual care and treatment.
This new service means that data sharing preferences can be recorded by you, directly with NHS Digital, rather than being recorded by a GP on a third-party system and then collected by NHS Digital. Using the new system an error like this would not be able to occur.
The new service is operational but is currently in public beta, meaning that feedback and changes can be incorporated until October 2018. Type 2 opt-outs set by patients, via their GPs, over this transitional period will be automatically converted to national data opt-outs on a monthly basis.
Find out more about how your data is used and request that your confidential patient information is not used beyond your own individual care.
Are type 2 opt-outs being replaced by the national data opt-out?
Yes. The NHS launched a national data opt-out on 25 May 2018. This opt-out prevents NHS Digital from sharing information for research and planning, and can be set by you either online, on the phone or using a paper form.
Type 2 opt-outs can still be set in your GP during a planned transition period until 1 October 2018, but will be automatically changed into the new opt-out. We are writing to patients with type 2 opt-out to tell them about this change.
I have received a letter saying that I have a national data opt-out now. Has this been affected?
No. If you have received a personal letter about a national data opt-out then this means that you previously had a type 2 opt-out which had been correctly applied to your record, so you have not been affected by this issue. Please be reassured that your preferences have been honoured throughout.
I have a type 2 opt-out but I have not received a letter. Does this mean I am affected?
No. Letters are being sent out in a phased way during June and July 2018, so you may be in a later batch. However, if you are affected we will write to you by the end of July 2018 to explain further and to apologise.
If my information has been incorrectly shared who has received it?
We produce a register which shows when we have shared data, who it has been shared with, the legal basis for releasing the information and the type of information shared.
Will you get my data back that shouldn’t have been shared?
We are now correctly applying all opt-outs and will be contacting organisations with whom we have shared data that may have been affected.
We will be asking those organisations to destroy any data which has not had the opt-outs applied as soon as practically possible, and we will look to resupply data with the opt-outs applied where required.
In some exceptional circumstances that may not be possible (for example where the data has been used for a research project and has been included in a publication, or where the data has subsequently been combined with other data sources), but we will look carefully at this on a case by case basis.
How many people are affected?
Around 150,000 people have been affected.
Patients are affected if they registered a type 2 opt-out in a GP practice using SystmOne, after 31 March 2015.
If you have been affected we will write to you by the of July 2018 to explain further and to apologise.
Why didn’t you notice that you weren’t getting any newly raised objections from TPP earlier?
The number of objections submitted to NHS Digital has increased at a steady rate since April 2015, with an average of around one new objection per practice per month.
Objections from TPP practices also increased, although at a slower rate (around one new objection per practice every two months). Although we haven’t historically analysed opt-outs by supplier rather than by practice, the steady increase for TPP would not have immediately indicated a problem with their data.
The reason that opt-outs continued to rise in TPP practices is because some opt-outs have always been recorded in the past, rather than on the day they were set. Those opt-outs have continued to come through from TPP practices because they were technically set before the cut-off date of 1 April 2015, which TPP coded into their system.
Following this issue, we will be investigating trends by system supplier to add another layer of scrutiny to the analysis, and we will develop thresholds for variations in these trends that triggers further investigation.
How did you analyse opt-out rates?
We looked at the number of type 2 opt-outs in many ways, examining them by area, by practice and nationally. One of the ways we quality assured the results was to publish them and make that publication very open and transparent. We publish information about type 2 opt-outs on our website, broken down to practice level and recording;
- Number of type two opt outs
- Number of registered patients at the practice
- Rate of type 2 opt outs calculated using 1 and 2
We have had discussions with GP representatives, PHE, academics even individual GP practices about this regular publication. At no stage has anyone raised concerns about opt-out rates as a result of these publications, which suggests that the issue was not easy to spot, even by those setting the opt-outs.
We have however revised our practices as a result and from now on we will analyse data at supplier level as well as at practice and national level.