Here is your ‘how to’ guide to opt out of the NHS data sharing plans – otherwise known as the NHS data grab. There has been a lot of media coverage of the government’s plans to sell off our private medical records. Under the original plans, we only had until 23 June to opt out. This deadline has now been extended to 1 September, but many other questions remain unanswered.
It is unclear whether patients will be informed and whether an opt-in will be required instead. The government has also not given any information about how personal data will be protected and under what circumstances our data will be shared with private companies. So, in the meantime, this is how to opt out (don’t leave it until too late).
How to opt out of data sharing (data grab)
We each now have until sometime before 1 September to tell our GPs that we do not consent to our private data being transferred to a database and potentially sold to the highest bidder – our data, and our kids’ data. If we fail to do this, GPs will just hand over our records and although you can choose to opt out later, this will only relate to new information and the original data will still have been shared.
There are two kinds of data: GP data and non-GP data. And two different ways to opt-out. For GP data you have to send a form to your GP surgery for every member of your household. For non-GP data it depends whether you have children under 13 – if you do, you have to print off another form and post it to NHS, but if you and any children are 13 or over, you can complete the opt out online.
GP data opt out
To stop GPs automatically transferring your private medical data out of their practice, you have to complete a ‘Type 1 opt-out form’ and send it to your GP surgery. You have to complete a separate one for each child or dependant. You can post this form, email it to the surgery, or take it in by hand.
Non-GP data
Opting out of data sharing for non-GP data (hospital or clinic treatments – including sexual health clinics) is easier, if you have no children under 13. Just fill out a form online for each person over 13. Note that even this isn’t always simple, as some readers have experienced problems. In which case, follow the option for those with kids under 13!
If you have children under 13, you need to complete and post, a separate form, this time to NHS Digital. You can also email (enquiries@nhsdigital.nhs.uk) or ring (0300 300 5678) them for help or to ask for the form to be mailed to you.
How to find your NHS number
While not essential, it is better to include your NHS number on all these forms. You can find this 10-digit number on any letter you receive from the NHS.
Or if you don’t have any letters to hand, you can get your NHS number via this NHS website. To do so, you will need to provide your name, date of birth and postcode. The NHS will send a text, email or letter with your NHS number to you – but remember, the NHS number isn’t essential, so if it doesn’t arrive, you can still opt out using the postcode you’re registered to your GP surgery with.
What are the concerns about sharing private medical information?
A basic principle of respecting people’s right to privacy is that their consent should be obtained if any of it is to be ‘shared’. And a data privacy impact assessment should be done – in this case, we’re not aware of any. Any processing of our data that breaches duties of confidentiality (as in the case of what you share with your doctor) cannot be considered ethical, fair, or lawful.
The government appears to be bouncing pressurised GPs into just sending off all our data. Using media diversion techniques and the pandemic as cover for NHS Digital ordering GPs to submit the records of every patient in their care to the new, permanent database.
Many GPs didn’t know about this. Neither the British Medical Association nor the Royal College of GPs has approved this.
The NHS Digital website provides re-assuring phrases about confidentiality and ‘pseudonymisation’ and ‘the NHS’ not selling our data. But it adds that it can unlock the pseudonymisation codes “in certain circumstances, and where there is a valid legal reason”. So our identities can be revealed and ‘medical’ information sold off to private providers.
If you’re not OK with this data grab – opt out. And remember, the deadline is approaching.
