Update 09.06.21: the NHS data grab has been postponed until 1 September. At this stage it is unclear whether patients will be informed and whether an opt-in will be required instead. The government has also not given any information about how personal data will be protected and under what circumstances our data will be shared with private companies. So, in the meantime, this is how to opt out.
Here is your ‘how to’ guide to opt out of the NHS data sharing plans. There has been a lot of media coverage of the government’s plans to sell off our private medical records. This has been tried before, but on that occasion the government informed people and made it easier to refuse consent. This time it’s being rushed through under cover of the pandemic, when GP surgeries are already overwhelmed.
How to opt out of data sharing
We each have to tell our GPs that we do not consent to our private data being transferred to a database and potentially sold to the highest bidder – our data, and our kids’ data. If we fail to do this, GPs will just hand over our records.
There are two kinds of data: GP data and non-GP data. And two different ways to opt-out. For GP data you have to print off and hand a form in to your GP surgery for every member of your household. For non-GP data it depends whether you have children under 13 – if you do, you have to print off another form and post it to NHS, but if you and any children are 13 or over, you can complete the opt out online.
GP data opt out
To stop GPs automatically transferring your private medical data out of their practice, you have to print out and complete a ‘Type 1 opt-out form’. Then take this to your GP surgery. You have to complete a separate one for each child or dependant.
Opting out of data sharing for non-GP data (hospital or clinic treatments – including sexual health clinics) is easier, if you have no children under 13. Just fill out a form online for each person over 13. Note that even this isn’t always simple, as some readers have experienced problems. In which case, follow the option for those with kids under 13!
If you have children under 13, you need to complete and post, a separate form, this time to NHS Digital. You can also email (firstname.lastname@example.org) or ring (0300 300 5678) them for help or to ask for the form to be mailed to you.
How to find your NHS number
While not essential, it is better to include your NHS number on all these forms. You can find this 10-digit number on any letter you receive from the NHS.
Or if you don’t have any letters to hand, you can get your NHS number via this NHS website. To do so, you will need to provide your name, date of birth and postcode. The NHS will send a text, email or letter with your NHS number to you – but remember, the NHS number isn’t essential, so if it doesn’t arrive, you can still opt out using the postcode you’re registered to your GP surgery with.
What are the concerns about sharing private medical information?
A basic principle of respecting people’s right to privacy is that their consent should be obtained if any of it is to be ‘shared’. And a data privacy impact assessment should be done – in this case, we’re not aware of any. Any processing of our data that breaches duties of confidentiality (as in the case of what you share with your doctor) cannot be considered ethical, fair, or lawful.
The government appears to be bouncing pressurised GPs into just sending off all our data. Using media diversion techniques and the pandemic as cover for NHS Digital ordering GPs to submit the records of every patient in their care to the new, permanent database.
Many GPs didn’t know about this. Neither the British Medical Association nor the Royal College of GPs has approved this.
The NHS Digital website provides re-assuring phrases about confidentiality and ‘pseudonymisation’ and ‘the NHS’ not selling our data. But it adds that it can unlock the pseudonymisation codes “in certain circumstances, and where there is a valid legal reason”. So our identities can be revealed and ‘medical’ information sold off to private providers.
If you’re not OK with this – opt out.