by Dr Rosie Shire, DAUK GPC
The Department of Health and Social Care is rolling out a new way to collect patient’s data from their GP records. This is called General Practice Data for Planning and Research or GPDPR data collection. It replaces the current system of data extraction, known as General Practice Extraction Service (GPES), which is mainly used for calculating payments to GP practices. It requires each extract to be manually added to the system.
The proposed new system will run in real time and not require practices to add each search. The roll out date for GPDPR is 1st September 2021; this has been delayed from 1st July 2021 due to concerns raised by groups, including DAUK, about the process. More information here https://www.dauk.org/news/2021/06/04/dauks-dr-rosie-shire-on-nhs-data-government-faces-legal-challenge-over-nhs-data-sharing-plan/
When the GPDPR data collection goes live (1st September), the GP records of all patients in England will be uploaded to a central NHS digital database. GPs are expected to inform all their patients about this data collection. If patients want to prevent their record being uploaded, they MUST opt out before 1stSeptember 2021. After this date, they can opt out from any future data being collected about them, but they will not be able to remove any data that is already uploaded to NHS digital.
If you would like to read the full statement from NHS Digital, you can do here https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/data-provision-notices-dpns/general-practice-data-for-planning-and-research (please note, it appears that this document has not been fully updated with the new GPDPR roll out date of 1st September)
How do patients opt out?
To opt out patients need to complete a Type 1 opt out form. Medconfidential website gives clear instructions about how to opt out and the form to complete. They also give a number to call to be sent a form in the post, for those without access to a printer. https://medconfidential.org/how-to-opt-out/
When do patients need to opt out by?
NHS Digital has now said that GP practices must set their own deadlines for when patients can opt out by. https://www.pulsetoday.co.uk/news/technology/nhs-digital-gave-gpdpr-opt-out-deadline-in-error-says-gps-must-set-own-dates/
The opt out codes must be on patient’s records by 1st September 2021.
Can patients opt out online?
NO! To opt out of GP record sharing, the patient needs to complete a type-1 opt out form, and give it to their GP Practice. This form is available online, on the above website. It needs to be completed either on a computer or by hand, and emailed or posted to the GP Practice.
What about the NHS app?
The NHS app does not allow patients to opt out of GPDPR. It does allow patients to opt out of National Data collection, which is different to GPDPR.
What do GP practices need to do?
Practices need to inform their patients about GPDPR and how to opt out. Some practices have sent text messages to patients with the details about GPDPR, and how to opt out. NHS digital has suggested a statement which practices can display on their websites and in newsletters to inform their patients. The key point is that patients understand what their data will be used for, and who will have access to their data if they don’t opt out before 1st September 2021 (or sooner if deadline set to be earlier by the GP practice)
The NHS digtal statement can be found at https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/gp-privacy-notice
DAUK feels this statement does not clearly explain to patients what GPDPR is, and enable them to fully consent to their data being shared- or to opt out.
A clearer explanation about GPDPR and the implications of this can be found at https://www.foxglove.org.uk/news/the-nhs-data-grab-we-do-the-governments-job-and-explain-it-for-you
The opening paragraph indicates plainly what GPDPR actually is:
“The government wants to collect the confidential health records of every GP patient in England and put them into one huge new data pool. It says “third parties” will be able to access this pool, including commercial companies, but won’t say who or how.”
When the practice receive the opt out forms, they need to add the form the patient’s records, and add the code below.
| Code type | Code |
| Opt-out – Dissent code | 9Nu0 (827241000000103 |Dissent from secondary use of general practitioner patient identifiable data (finding)|) |
| Opt-in – Dissent withdrawal code | 9Nu1 (827261000000102 |Dissent withdrawn for secondary use of general practitioner patient identifiable data (finding)|)] |
Can GPs opt out all our patients en-mass?
While the Secretary of State’s Direction remains valid, you cannot do this. However, if the legal case of DAUK and others successfully challenges the Direction, this may change. We will keep you posted.
GPs are too busy to add all these forms and codes to patient records; what happens if we don’t do this?
Being over stretched isn’t a valid reason for failure to act in accordance with patients’ wishes. Under the UK GDPR you could be referred to the ICO and face a fine if you do not opt out patients who have given you their form.
Do Practices get funding this?
No. This directive has come from the Secretary of State, but there is no funding available to cover. GP Practices are expected to pay themselves for the time staff will spend processing forms and ensuring the opt-out code is added to patient records. This is one of DAUK’s concerns.
