Skip to main content

TPP type 2 issue: information for patients

Further information about an error that meant some patients who had registered a type 2 opt-out did not have their wishes respected. Includes information about type 2 and national data opt outs, which patients have been affected, how to request that your confidential patient information is not used beyond your own individual care, and answers to frequently asked questions.

Some patients who registered a type 2 opt-out, to ask NHS Digital not to share any of their personal confidential information, have not had those wishes respected. This was due to a coding error in a third-party computer system which some GPs use.

The error happened because of a coding error in the TPP system, which meant that NHS Digital didn’t receive the requests to apply the opt-out. We apologise unreservedly for this issue and TPP have also apologised for the error.

Those affected are people who registered an opt-out with GPs using a system called SystmOne, run by a company called TPP, between 1 April 2015 and 1 April 2018.

As soon as we realised that there was an error we stopped sharing data where type 2 opt-outs should apply, until we were confident that they were all being honoured. We have reported the issue to the Information Commissioner and have informed GP representatives, GPs and the National Data Guardian.

This issue has not affected people’s care or treatment in any way, but we have worked as quickly as possible to put things right and all opt-outs are now being honoured.

If you have been affected we will write to you before the end of July 2018 to explain the situation and to apologise to you personally. If you do not receive a letter then you have not been affected. You can read the text of the letter here

More information

How will I know if I am affected?

We will write to all affected patients by the end of July 2018 to make them aware of the issue. If you do not receive a letter by this date you have not been affected and have no cause for concern.

What does this mean?

If you are affected by this issue it means that your objection to sharing your information for research and planning purposes hasn’t been honoured, because NHS Digital were never given the information about your preferences from the GP system where they were recorded (SystmOne, run by TPP).

We have strong controls around data sharing and only share information where there is a legal basis to do so and when there are strict controls in place about how the data should be used, how it is stored safely, who can access it and when and how it must be securely destroyed.

If you have been affected please be reassured that we have now fixed the problem and that your care and treatment has never been affected.

We apologise unreservedly if you have been affected and the system supplier who made the coding error has also apologised.

What is a type 2 opt-out?

A type 2 opt-out is an opt-out which can be logged in a GP system, asking that NHS Digital does not share an individual’s personal confidential data for purposes beyond their own care.

On 25 May 2018 the health and care system introduced a national data opt-out and existing and future type 2 opt-outs (which can be set up until 1 October 2018) will automatically be changed into a national data opt-out. This can be set by an individual themselves, directly with NHS Digital, either online, by telephone or using a paper form.

What is a national data opt-out?

The health and care system introduced a new national data opt-out service on 25 May 2018. This will provide a secure and accessible way for the public to opt out of their confidential patient information being used for reasons other than their individual care and treatment. 

This new service means that data sharing preferences can be recorded by you, directly with NHS Digital, rather than being recorded by a GP on a third-party system and then collected by NHS Digital. Using the new system an error like this would not be able to occur.

The new service is operational but is currently in public beta, meaning that feedback and changes can be incorporated until October 2018. Type 2 opt-outs set by patients, via their GPs, over this transitional period will be automatically converted to national data opt-outs on a monthly basis.

Find out more about how your data is used and request that your confidential patient information is not used beyond your own individual care.

Are type 2 opt-outs being replaced by the national data opt-out?

Yes. The NHS launched a national data opt-out on 25 May 2018. This opt-out prevents NHS Digital from sharing information for research and planning, and can be set by you either online, on the phone or using a paper form.

Type 2 opt-outs can still be set in your GP during a planned transition period until 1 October 2018, but will be automatically changed into the new opt-out. We are writing to patients with type 2 opt-out to tell them about this change.

I have received a letter saying that I have a national data opt-out now. Has this been affected?

No. If you have received a personal letter about a national data opt-out then this means that you previously had a type 2 opt-out which had been correctly applied to your record, so you have not been affected by this issue. Please be reassured that your preferences have been honoured throughout.

I have a type 2 opt-out but I have not received a letter. Does this mean I am affected?

No. Letters are being sent out in a phased way during June and July 2018, so you may be in a later batch. However, if you are affected we will write to you by the end of July 2018 to explain further and to apologise.

If my information has been incorrectly shared who has received it?

We produce a register which shows when we have shared data, who it has been shared with, the legal basis for releasing the information and the type of information shared

Will you get my data back that shouldn’t have been shared?

We are now correctly applying all opt-outs and will be contacting organisations with whom we have shared data that may have been affected.

We will be asking those organisations to destroy any data which has not had the opt-outs applied as soon as practically possible, and we will look to resupply data with the opt-outs applied where required.

In some exceptional circumstances that may not be possible (for example where the data has been used for a research project and has been included in a publication, or where the data has subsequently been combined with other data sources), but we will look carefully at this on a case by case basis.

How many people are affected?

Around 150,000 people have been affected.

Patients are affected if they registered a type 2 opt-out in a GP practice using SystmOne, after 31 March 2015.

If you have been affected we will write to you by the of July 2018 to explain further and to apologise.

Why didn’t you notice that you weren’t getting any newly raised objections from TPP earlier?

The number of objections submitted to NHS Digital has increased at a steady rate since April 2015, with an average of around one new objection per practice per month.

Objections from TPP practices also increased, although at a slower rate (around one new objection per practice every two months). Although we haven’t historically analysed opt-outs by supplier rather than by practice, the steady increase for TPP would not have immediately indicated a problem with their data.

The reason that opt-outs continued to rise in TPP practices is because some opt-outs have always been recorded in the past, rather than on the day they were set. Those opt-outs have continued to come through from TPP practices because they were technically set before the cut-off date of 1 April 2015, which TPP coded into their system.

Following this issue, we will be investigating trends by system supplier to add another layer of scrutiny to the analysis, and we will develop thresholds for variations in these trends that triggers further investigation.

How did you analyse opt-out rates?

We looked at the number of type 2 opt-outs in many ways, examining them by area, by practice and nationally. One of the ways we quality assured the results was to publish them and make that publication very open and transparent. We publish information about type 2 opt-outs on our website, broken down to practice level and recording;

  1. Number of type two opt outs
  2. Number of registered patients at the practice
  3. Rate of type 2 opt outs calculated using 1 and 2

We have had discussions with GP representatives, PHE, academics even individual GP practices about this regular publication. At no stage has anyone raised concerns about opt-out rates as a result of these publications, which suggests that the issue was not easy to spot, even by those setting the opt-outs.

We have however revised our practices as a result and from now on we will analyse data at supplier level as well as at practice and national level.

Last edited: 10 April 2019 1:32 pm