5. When does a national data opt-out apply?

National data opt-outs apply to the use of confidential patient information approved under:

• regulation 2 (medical purposes related to the diagnosis or treatment of neoplasia) or
• regulation 5 (general medical purposes)

of the Health Service (Control of Patient Information) Regulations 2002.

National data opt-outs apply in cases where the approval is subject to the Confidentiality Advisory Group (CAG) ‘standard condition’ that 'the wishes of patients who have witheld or withdrawn their consent are respected'  (e.g. their opt-out)  (Further information is available in Definitions or on CAG webpages.) In exceptional circumstances, and on a case-by-case basis only, CAG may advise the decision-maker that the national data opt-out should not apply to a specific data flow supported under S.251. It is the responsibility of the data controller to satisfy themselves that such an exemption from the standard condition has been given e.g. by requesting sight of the S.251 approval letter or published minutes which should clearly indicate that opt-outs do not apply before they disclose any data.

CAG consider a large number of section 251 applications each year, the CAG Registers give details of its approvals under S.251 (regulation 2 and 5) which cover both non-research and research applications.  Specific exemptions to this are set out in Section 7 - Policy considerations for specific organisations or purposes. Where these are still subject to the standard CAG condition, there will need to be an alternative opt out procedure. (These alternative opt-out mechanisms are set out in section 7 for completeness.)

CAG may, as part of their consideration of an application, also recommend that a local or study-specific opt-out is applied in addition to the national data opt-out.  This allows an individual to opt out from the CAG-approved study only without having to register a national data opt-out that would prevent all uses of their data for planning or research. This is particularly important during the transition period from May 2018 through to March 2020 when the functionality for other organisations across health and care to uphold the opt-out is still being rolled out.  However, CAG reserve the right to recommend an additional opt-out in some specific circumstances after the full introduction of the national data opt-out, for example where an application is for a research study which draws data from a wider geography (for example England and Wales) or where the confidential patient information is particularly sensitive. 

For avoidance of doubt where the approval for access to the data relies upon Section 251 support (ie approval under the NHS (Control of Patient Information Regulations) 2002 (regulation 2 or 5)) support then all data disclosed under this approval will be deemed to be confidential patient information even where the specific disclosure does not contain any health or care information.

National data opt-outs apply to data disclosures using Section 251 support regardless of the data format. The national data opt-out applies to structured electronic data (for example csv, XML), unstructured electronic data (for example PDFs, scans or images) and paper records. It can also apply to data that is disclosed via other means such as people viewing confidential patient information on computer screens.

In some circumstances an individual’s record may contain confidential patient information about another person (such as a mother and baby in the same record).

The national data opt-opt applies to the entire record irrespective of whether an opt-out is identified for the individual who is the subject of the record (i.e. whom the record primarily relates to) or for a third party whose confidential patient information is contained within the record. 

However, it is recognised that the national data opt-out can only be applied in these circumstances where the NHS number is present for the third party.  If the record only includes name or another identifier then it is not possible to apply the national data opt-out.