The General Practice Data for Planning and Research (GPDPR) is a scheme whereby GP surgeries in England will automatically upload and share the medical records of every patient in England to an NHS Digital platform, unless the person has opted out.
Why is it happening?
NHS Digital says that this new service will help to support the planning and commissioning of health and care services. This includes:
- The development of health and care policy
- Public health monitoring and interventions
- Enabling many different areas of research, from analysing the long-term impact of Covid, identifying and addressing healthcare inequalities, and developing treatments or cures for serious illnesses.
The data that NHS Digital collects will only be used for health and care purposes – it won’t be shared with marketing or insurance companies. It’s worth noting that medical data can already be used to further scientific research without this scheme. People can still choose to contribute to medical research for specific projects, and the UK’s data protection laws already enable access to data when needed for research and scientific purposes.
For more information on our research projects please click link below: https://www.sussexpartnership.nhs.uk/mental-health-research
When is it happening?
The original opt-out date was 23 June 2021, but a campaign supported by medical professionals and MPs got this delayed, and the scheme is now being held off further so that public awareness can be increased and privacy safeguards worked on.
NHS Digital have now confirmed all organisations must be compliant by 30 September 2021.
What data is actually being collected?
Your medical record includes details of your physical, mental and sexual health, as well as wide-ranging data, including appointments, symptoms, observations, referrals, diagnoses, test results, medications, allergies and immunisations. It also includes your sex, ethnicity and sexual orientation.
All of the above data would be shared under the GPDPR scheme.
All this data is pseudonymised. This means any data that could directly identify you, for example your NHS number, GP patient number, full postcode and date of birth, is all replaced with unique codes, which are produced by de-identification software before the data is shared with NHS Digital. This means no one will be able to identify you from the data. Only individuals who provide explicit consent to reidentifying the data to be used for a valid legal purpose such (such as participating in a clinical trial).
What data won't be collected?
NHS Digital won’t collect patients’ names or addresses. Other identifying data is encoded (see more on that below). It also won’t collect written notes, such as the details of conversations with doctors and nurses, images, letters or documents, or data that is more than 10 years old.
Some data isn’t legally allowed to be shared by GPs, and this won’t be collected. This includes certain information about IVF treatment or gender-reassignment surgery.
Who will be able to access this data?
NHS Digital lists the organisations who may get access to the data, which are ‘included but not limited to’:
- The Department of Health and Social Care, and its executive agencies, including Public Health England and other government departments NHS England and NHS Improvement
- Primary care networks (local networks between GPs and community, mental health, social care, pharmacy, hospital and voluntary services), clinical commissioning groups (which are groups of GP surgeries by area) and integrated care organisations (groups of health and care providers in an area)
- Local authorities
- Research organisations, including universities, charities, clinical research organisations that run clinical trials and pharmaceutical companies
What is the National Data Opt Out (NDOO)?
This is the main way to opt out of sharing your data under the new GPDPR scheme. It’s done through an online form which can be found here, where you complete a few basic details (name, date of birth and NHS number) and are then sent a security code via text or email. It’s then just a matter of selecting yes or no to the data-sharing scheme.
How does SPFT support individuals with NDOO?
The Trust stores whether a patient has chosen to opt out on their care record in Carenotes. This can updated either through a manual update (a member of staff amending it) or through our automated process. This process checks the Summary Care Record of all our patients each night and updates their Carenotes record accordingly.