• Deadline for compliance with National Data Opt Out policy approaching
  • Scheme introduced to give patients more control over their data
  • Fewer than 10,000 people opt out after 18 months

Patient data could be shared unlawfully from April as the NHS is likely to miss a key privacy target, HSJ has learned.

Several senior sources close to the process told HSJ they believed the NHS will miss the 31 March deadline to be compliant with the National Data Opt Out.

The opt out, which was introduced in May 2018, gives patients the power to stop their health provider from using their confidential data for research or planning purposes. It was introduced following the recommendations of Dame Fiona Caldicott in her 2016 review of data security, consent and opt outs.

Under the rule, all health and care organisations and GP practices in England must comply with the policy by the end of March.

However, achieving compliance requires a number of actions by the provider, such as identifying its relevant data, updating information policies and procedures, making changes to software, and subsequently applying the opt out across its organisation.

Failure to do so means patients’ data could be shared against their wishes. One senior NHS source told HSJ they believed it would take more than six months beyond March for the NHS to become completely compliant. GP practices are believed to be a particular concern. 

NHSX and NHSE said they did not envisage making an extension to the deadline, meaning non-compliant providers risk breaching data protection legislation and could be subject to subsequent enforcement from the Information Commissioner. 

In 2017, the IC ruled the Royal Free London Foundation Trust breached the Data Protection Act after sharing patient data with Deep Mind, which is now part of Google Health.

NHS Digital will publish a list of organisations that have confirmed compliance with the opt out later this year, after providers have submitted a mandatory “data security and protection toolkit”. 

Dame Fiona told HSJ: ”Having a system-wide consent model in place is essential – it allows us to maintain trust by respecting people’s decisions about how their personal confidential data will be used beyond their own care.

”Implementing the opt-out is no small task, and I commend those organisations which have already done so. I urge those not yet compliant with the data opt-out policy to take appropriate measures to remedy this as soon as possible.”

‘Low’ uptake

Meanwhile, the number of patients choosing to opt out remains low. As of December, the latest figures available, the number of patients opting out had reached 9,645.

On average, 507 people opt out every month.

However, in December — the same month it emerged Amazon could access content from the NHS Choices website through a deal with the Department of Health and Social Care — more than 1,300 patients chose to opt out.

Natalie Banner, from health information group Understanding Patient Data, told HSJ the number of patients opting out was “quite low” and said it could be an indication people are not aware of the opt out.

“Higher usage of the service appears to have occurred either in months accompanied by a significant communications push, such as the months following the launch of the opt out, or in months accompanied by several media stories about the use of NHS data,” she said.

However, she added further research would be needed to ascertain a correlation between media reports about NHS data and opt out rates.

The NHS Digital data also showed nearly 3,700 patients have reversed their decision to opt out.

Dr Banner said this number suggested the case for potential benefits of data use and assurance about safeguards was “reaching some individuals”, but she added the numbers were too small to draw meaningful conclusions from.

Under previous arrangements, patients could opt out by telling their GP, but they must now do so online, over the telephone, or in writing if on behalf of someone else.

Phil Booth, from privacy rights campaign group MedConfidential, told HSJ the new system had caused a “barrier to access” the opt out.

“The number of people making a consent choice dropped dramatically when the GP route disappeared, because patients used to be able to make a choice when registering for a GP,” he said.

NHSX and NHS England were approached for comment.