NHS Data Sharing


This non-commercial website was written by Dr Neil Bhatia, a GP and Caldicott Guardian / Information Governance lead in Hampshire.

Tweet


This site tells you about NHS Data sharing (in England) - the very many ways by which information from your electronic GP record is, or can be, made available to others.

This site also tells you how to control your GP record, so that you decide what happens to your personal confidential information. Once you know what can happen, or is already happening, to your personal information, then you can make an informed choice as to whether to allow such data sharing to happen or continue - in other words, whether to opt-out or not.

It tells you about Type 1 ("9Nu0") and Type 2 ("9Nu4") opt-outs (or objections) - electronic flags added to your GP record, at your request, that prohibit the use of your personal confidential information in various ways. It tells you what they do, and what they do not do; where they work, and where they seem to have no effect (when they should).

It tells you how you can limit the ways that the Health and Social Care Information Centre (HSCIC) can disseminate and sell information that it holds about you, obtained from your GP/hospital/social care/mental health and other such records, to third parties within and outside of the NHS (including commercial organisations).

And it tells you what little we know about the Single National GP Dataset, the mammoth data extraction due to replace the now decommissioned care.data project, and a key component of the new "Data Services Platform" planned by NHS Digital and the Department of Health.

It helps you find information about the NHS Databases, where information from your GP record is extracted and sent elsewhere:

This site tells you about other ways, completely unrelated to the NHS Databases, by which your electronic GP record is, or can be, made available to health professionals providing you with direct medical care:

And this site mentions:


The care.data project has now been shut down by the Department of Health, though it will be back in one way or another.

If you wish to opt-out of secondary uses (see below), then do so now.

You can opt back in to secondary uses at any time in the future.

Following the publication of the Caldicott 3 data sharing proposals, it may well be that the Department of Health will withdraw the right of citizens to prevent the extraction and uploading of their personal confidential information to the HSCIC (NHS Digital).

After a certain date, it may be that you will no longer be able to request such an opt-out from your GP surgery.

If you want to find out about what had been planned with care.data, do visit www.caredata.website

It is very likely that care.data will be replaced by the Single National GP Dataset, a similar (but much bigger) extraction of personal confidential information from GP records to the HSCIC. It really is the "son of care.data", and you can find out about it in this document, in this document, and in this FOI response (to this FOI request) .



For many of the NHS Databases, where your information is extracted and uploaded from your GP record:

For nearly all of the clinical data repositories, the only way to prevent medical information about you from hospitals and other non-GP sources from being disseminated in this way is to opt-out at your GP surgery.

And all but a couple of the clinical data repositories, processing uploading information for secondary purposes, respect any objection that you might have made to information from your GP record being extracted and uploaded for such secondary uses. The overwhelming majority of them blatantly ignore any such Type 1 objection or opt-out.

However, the opt-out form on this website will ensure that no such processing takes place, should that be your wish.


You can opt-out, of any or all of the NHS databases, at any time - it is never "too late" to opt-out.

And you can opt back in, to any or all of the NHS Databases, at any time - should you wish.


When you opt-out your GP surgery will add a special electronic flag (known as a read code) to your GP record, which will block any extraction and uploading of your personal confidential information to the relevant databases.

If information about you has already been uploaded, then opting out will ensure that no further information is uploaded, and that any already uploaded information is either "blanked" or made unavailable.

You can opt out of each database individually (amend the opt-out form below accordingly).

Or you can opt out of all of these databases at once, by downloading this single form (as .doc or .pdf), and either:

Though please note - the above form will not opt you out of the Google/Royal Free/Moorfields data extractions. You will need to opt out directly to those hospitals to achieve that (see later).


Almost without exception within the NHS, you need to actively object if you do not want your personal confidential information shared or disseminated in these ways.

Choosing not to have your data extracted in any, or all, of these ways will have no direct impact on any NHS or private organisation's ability to care for you.



In many areas multiple NHS datasharing schemes are running all the same time, sharing differing information from your GP record with differing organisations and uploading to different data controllers.

For example, in North East Hampshire and Farnham, the Summary Care Record, The Hampshire Health Record, risk stratification ("the ACG Tool"), the National Diabetes Audit, eMed3 extractions to the DWP, and EMIS Web data streaming are all running, all at the same time.

The different NHS databases and data sharing schemes can be very confusing. Your GP surgery should make it clear:

Your GP surgery can help you understand the differences between the various schemes running in your area.

And this chart might help too.



How do I find out what I have already opted out of, or am opted out of?

You can find out what you have already opted out of by simply asking your GP surgery.

Alternatively, you can just opt out of the schemes that you wish to - right now (by using the form linked to above).

It doesn't matter if you opt out of any - or all - of them more than once.




When it come to how your GP-held medical information is used:


Primary uses are uses of data for the main purpose for which they were originally collected directly from the individuals concerned.

For your GP record, this means making that information available, to healthcare professionals that you are seeing, for your direct medical care.

You can download a simple factsheet about data sharing between healthcare professionals here.

Click to to drop down/close more information about primary uses of your GP record

You have the right to opt-out of allowing your medical record to be shared, or be directly accessible, for primary purposes - for your direct medical care - beyond your GP surgery, if you so wish.

This may limit the opportunity for certain health professionals (other than those within your GP surgery) to directly access aspects of your electronic GP record in a particular way.

However, it in no way limits all of the other and many ways that your medical information can be made available to those who require it.

That information can, is, and always will be made available to those who require it by your GP, whether directly, by phone, fax, text, letter, email, e-referral or e-prescription.

That information can be made available by you - the patient - directly, by temporarily giving the health professional secure online access to your medical record, or by many of the other ways in which you can share information with health professionals outside of the surgery.

An example of preventing a primary use of your GP record would be opting out of the Summary Care Record.

You can opt back in to primary uses of your GP record at any time in the future.

You can opt back in and allow all the primary use schemes to extract and upload, or stream your data, or you can opt back into each scheme individually, as you prefer.


Secondary uses are uses of existing data for purposes other than those for which they were originally obtained.

For your GP record, this means making that information available, to anyone (not just within the NHS), for purposes other than providing your direct medical care.

Examples of secondary uses include, research, audit, healthcare planning, "population health management", commercial and even political uses.

You can download a simple factsheet about the Type 1 secondary uses opt-out here.

You can download a simple factsheet about the Type 2 secondary uses opt-out here.


If you want to express a Type 1 and/or a Type 2 objection, then do so now.

The Government is currently consulting on consent and opt-outs, and it is highly likely that the right to express a Type 1 opt-#out (at least, as it applies to the extraction and uploading of information from your medical record to the HSCIC) will be withdrawn from a certain date.

If you haven't opted out by that date then you may not be able to do so anymore.


Click to to drop down/close more information about secondary uses of your GP record

You have the right to opt-out of allowing your medical information to be used for secondary purposes - in ways unrelated to your direct medical care - if you so wish.

You can register a Type 1 objection ("9Nu0") with your GP surgery, which will act on your GP-held medical records, and/or you can register a Type 2 objection ("9Nu4") with your GP surgery, which will act on information that the HSCIC holds about you (whether derived from your GP record or hospital information).

You can find out more about these opt-outs on the HSCIC website.

Not allowing secondary uses of your GP record - which should prohibit risk stratification, the national audits and GPES extractions - will in no way affect the medical care that you receive, anywhere in the NHS or privately.

Opting out of secondary uses will hopefully opt you out of the forthcoming Single National GP Dataset, the successor to care.data.

Opting out of secondary uses of your GP record will not prevent medical researchers accessing your information - they just have to ask for your explicit permission first.

An example of prohibiting a secondary use of your GP record would be opting out of one or more of the national audits.

You can opt back in to secondary uses of your GP record at any time in the future.

You can opt back in and allow all the secondary use schemes to extract, upload and process your data, or you can opt back into each scheme individually, as you prefer.


Back to index



The Summary Care Record

Detailed information about the Summary Care Record can be found at www.summarycarerecord.info

The site tells you about

The Summary Care Record is an example of a database that processes your data for primary medical uses only, that is for the provision of direct medical care by healthcare professionals.

Information uploaded from your GP record will be available to healthcare professionals across England, i.e. nationally.

Click to to drop down/close more information about The Summary Care Record

The Summary Care Record will ultimately hold personal confidential medical information from all 53 milliion people in England (unless individuals have opted out).

Your GP surgery will not be the data controller for your uploaded information - the HSCIC will be.

Your GP surgery will be extracting and uploading data to the Summary Care Record.

Because every GP surgery in England is compelled to extract and upload information to the Summary Care Record - they have no choice.

But you do.

You do not have to have a Summary Care Record created about you if you do not want one.

You have the right to opt-out of The Summary Care Record (at any time) and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for primary purposes.

Opting out will ensure that either no personal confidential information about you is extracted and uploaded, or, as is more likely, that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.


Back to index



The Hampshire Health Record

Detailed information about the Hampshire Health Record (HHR) can be found at www.hampshirehealthrecord.info

The site tells you who is uploading your information to the HHR, and who is not.

The Hampshire Health Record will only apply to you your GP surgery is a Hampshire or Surrey (Farnham) based practice

Click to to drop down/close more information about The Hampshire Health Record

The Hampshire Health Record is an example of a database that processes your data for both primary and secondary uses.

The Hampshire Health Record is a clinical data repository (or data warehouse) - where information from your GP record is combined with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, will be available to healthcare professionals across Hampshire and parts of Surrey, i.e. regionally.

You can find out if your GP surgery is uploading information to the HHR via this map.

The Hampshire Health Record currently holds the personal confidential medical information of approximately 2,780,000 people.

Your GP surgery will not be the data controller for your uploaded information - NHS South, Central and West Commissioning Support Unit (NHSSCW CSU) will be.

Information about you, from your Hampshire Health Record, will also be disseminated for secondary purposes in anonymised and pseudonymised formats, although some contributing organisations (such as Hampshire Hospitals NHS FT) do not allow the information that they upload to be processed for secondary purposes by the HHR database.


A Type 1 objection (9Nu0) to secondary uses ought to prevent data from your GP record from being extracted and uploaded, from your GP record, to this database - but it doesn't.

"Patients can object to information about them leaving a general practice in identifiable form for purposes other than direct care, then confidential information about them will not be shared. This is referred to throughout this documentation as a type 1 objection."

HSCIC, Patient Objections Management



You do not have to have a Hampshire Health Record created about you if you do not want one.

You have the right to opt-out of The Hampshire Health Record entirely (at any time) and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for both primary and secondary purposes.

Alternatively, you can opt-out of secondary processing of your uploaded information. This will not stop your personal confidential information from being extracted and uploaded to the HHR (and used for primary purposes), but will prevent any secondary processing of your uploaded information by the HHR (and also stop extraction and uploading of your information to other schemes such as the National Audits, risk stratification, and sick note data extractions to the DWP.

The data controller for the HHR, NHSSCWCSU, has confirmed that the presence of the secondary uses objection code, 9Nu0, in the GP record will prohibit secondary uses of any personal confidential data uploaded to the HHR.

You cannot control how your data is used for secondary purposes by the HHR, for example to whom that data is given or for what reason, only prevent its use for such purposes entirely.

Hospitals associated with the HHR, such as Southampton, Portsmouth, Winchester and Basingstoke, all upload personal confidential data extracted from your hospital records into the HHR, where it is combined with your GP record.

Other NHS trusts, such as Solent NHS Trust and Southern Health NHS Trust, also upload personal confidential data extracted from records that they hold about you into the HHR, where it is combined with your GP record.

Southern Health NHS Foundation Trust is the only organisation that has the capability, and will allow you, to prohibit extraction and uploading of your information from its database to the HHR.

As regards all the other organisations uploading to the HHR, you cannot prohibit the processing of your hospital or non-GP records in this way. There is no point in approaching those other trusts to request that your personal confidential information is not exported to the HHR.

Those trusts do not have policies or procedures in place to register and action any such objection.

All you can do is to opt-out of the HHR entirely at your GP surgery. This will not stop your data being extracted and exported from your hospital or non-GP records, but will ensure that they are deleted upon arrival at the HHR database.

Opting out of the HHR entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.

Opting out of the HHR entirely will also ensure that no personal confidential information about you from your hospital or other such records are stored in the HHR.


Back to index



Connected Care (The Berkshire Health record)

Detailed information about Connected Care (CC) can be found:

Connected Care will only apply to you if your GP surgery is in Berkshire (East or West)

It has yet to go live, but will do soon.

Click to to drop down/close more information about Connected Care

Connected Care is an example of a database that processes your data for primary medical uses, that is for the provision of direct medical care by healthcare professionals..

Information about you, from your Connected Care shared record, may also be disseminated for secondary purposes in anonymised and pseudonymised formats.

Connected Care is a clinical data repository (or data warehouse) - where information from your GP record is combined with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, will be available to (up to 12,000) healthcare professionals across Berkshire, i.e. regionally.

Connected Care currently holds the personal confidential medical information of approximately 855,000 people.

Connected Care will only apply to you if your GP surgery is one of the 102 surgeries in:

Your GP surgery will not be the data controller for your uploaded information - NHS South, Central and West Commissioning Support Unit (NHSSCW CSU) will be.

You do not have to have a Connected Care record created about you if you do not want one.

You have the right to opt-out of Connected Care (at any time) and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for both primary and (possibly) secondary purposes.

The Royal Berkshire NHS Foundation Trust, Frimley Health NHS Foundation Trust, Berkshire Healthcare NHS Foundation Trust, Slough Borough Council, Reading Borough Council, West Berkshire Council, Bracknell Forest Borough Council, Royal Borough of Windsor & Maidenhead Council, and Wokingham Borough Council all upload, or plan to upload, personal confidential data extracted from your records, as held on their databases, into Connected Care, where it is combined with your GP record.

You cannot prohibit the processing of your hospital, SCAS, or local authority records in this way. There is no point in approaching those organisations to request that your personal confidential information is not exported to the Connected Care database.

Those organisations do not have policies or procedures in place to register and action any such objection.

All you can do is to opt-out of Connected Care entirely at your GP surgery. This will not stop your data being extracted and exported from your hospital, or other non-GP, record, but will ensure that it is deleted upon arrival at the Connected Care database.

Opting out of Connected Care entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.

Opting out of Connected Care entirely will also ensure that no personal confidential information about you from your hospital or other such records are stored in the Connected Care database.



Although Connected Care processes uploaded personal confidential data for both primary (and possibly secondary) purposes, it is uncertain as to how it respects any objection that you might have expressed to your GP surgery to the processing of your GP record for secondary purposes (the addition of the 9Nu0 read code flag).

Opting out of secondary uses of your GP record (such as risk stratification and the national audits) will not prevent your GP data from being extracted and uploaded to Connected Care.

Opting out of secondary uses of your GP record (such as risk stratification and the national audits) may not prevent your uploaded GP data from being processed for any secondary purposes, such as commissioning, healthcare planning, audit, commercial and political purposes, if indeed such processing takes place.


A Type 1 objection (9Nu0) to secondary uses ought to prevent data from your GP record from being extracted and uploaded, from your GP record, to this database - but it doesn't.

"Patients can object to information about them leaving a general practice in identifiable form for purposes other than direct care, then confidential information about them will not be shared. This is referred to throughout this documentation as a type 1 objection."

HSCIC, Patient Objections Management



If you wish to prevent your GP data from being extracted, uploaded and processed by Connected Care, for any potential secondary purposes, then you may need to opt-out of Connected Care entirely.


Back to index



The Manchester Care Record

Some information about The Manchester Care Record (MCR) can be found:

The Manchester Care Record will only apply to you if your GP surgery is in Manchester.

Click to to drop down/close more information about The Manchester care Record

The Manchester Care Record is an example of a database that processes your data for both primary and secondary uses.

The Manchester Care Record is a clinical data repository (or data warehouse) - where information from your GP record is combined with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, will be available to healthcare professionals across Manchester, i.e. regionally.

The Manchester Care Record currently holds the personal confidential medical information of approximately 595,000 people.

The Manchester Care Record will only apply to you if your GP surgery is one of the 90 surgeries in:

Your GP surgery will only be the data controller for your uploaded GP information - The Manchester CCGs host the database (and so are data processors).

All other organisations contributing to the shared record retain data controller reponsibility for the information that they upload.

Information about you, from your Manchester Care Record, will also be disseminated for secondary purposes in anonymised and pseudonymised formats.

You do not have to have a Manchester Care Record created about you if you do not want one.

You have the right to opt-out of The Manchester Care Record (at any time) and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for both primary and secondary purposes.

At present, University Hospitals of North Midlands NHS Trust (UHNM) does not extract and upload personal confidential information to the Manchester Care Record.

Central Manchester University Hospitals NHS Foundation Trust, University Hospital of South Manchester Foundation Trust, Pennine Acute Hospitals NHS Trust, Manchester County Council, and Manchester Mental Health and Social Care Trust all upload, may upload, or plan to upload, personal confidential data extracted from your records, as held on their databases, into The Manchester Care Record, where it is combined with your GP record.

You cannot prohibit the processing of your hospital or local authority records in this way. There is no point in approaching those organisations to request that your personal confidential information is not exported to the Connected Care database.

Those organisations do not have policies or procedures in place to register and action any such objection.

You can opt-out of The Manchester Care Record entirely at your GP surgery. This may not stop your data being extracted and exported from your hospital or social care records, or other non-GP records, but will ensure that it is deleted upon arrival at The Manchester Care Record database.

Opting out of The Manchester Care Record entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.

Opting out of The Manchester Care Record entirely will also ensure that no personal confidential information about you from your social care or other such records are stored in The Manchester Care Record database.




The Manchester Care Record processes uploaded personal confidential data for both primary and secondary purposes, and it is one of the few NHS Databases that respects an objection that you might have expressed to your GP surgery to the processing of your GP record for secondary purposes (the addition of the 9Nu0 read code flag).

Accordingly, opting out of secondary uses of your GP record (such as risk stratification and the national audits) will prevent your GP data from being extracted, uploaded, and processed, for both primary and secondary purposes, by the Manchester Care Record.


Back to index



The Stockport Health and Care Record

Detailed information about the Stockport Health and Care Record (SHCR) can be found:

The Stockport Health and Care Record will only apply to you if your GP surgery is part of Stockport CCG.

Click to to drop down/close more information about The Stockport Health and Care Record

The Stockport Health and Care Record is an example of a database that processes your data for both primary and secondary uses.

The Stockport Health and Care Record is a clinical data repository (or data warehouse) - where information from your GP record is combined with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, will be available to healthcare professionals across Stockport, i.e. regionally.

The Stockport Health and Care Record currently holds the personal confidential medical information of approximately 363,000 people.

Your GP surgery will not be the data controller for your uploaded information - NHS Stockport CCG will be.

Information about you, from your Stockport Health and Care Record, will also be disseminated for secondary purposes in anonymised and pseudonymised formats.

At present, Stockport NHS Foundation Trust does not upload hospital records to the Stockport Health and Care Record.

Stockport Metropolitan Borough Council is not currently extracting and uploading information to the Stockport Health and Care Record, but is planning to do so before 31st March 2017.

Pennine Care NHS Foundation Trustis not currently extracting and uploading information to the Stockport Health and Care Record, but is planning to do so in the future.

You do not have to have a Stockport Health and Care Record created about you if you do not want one.

You have the right to opt-out of The Stockport Health and Care Record (at any time) and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for both primary and secondary purposes.

Opting out will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.




Although the Stockport Health and Care Record processes uploaded personal confidential data for both primary and secondary purposes, it ignores any objection that you might have expressed to your GP surgery to the processing of your GP record for secondary purposes (the addition of the 9Nu0 read code flag).

Opting out of secondary uses of your GP record (such as risk stratification and the national audits) will not prevent your GP data from being extracted and uploaded to the Stockport Health and Care Record.

Opting out of secondary uses of your GP record (such as risk stratification and the national audits) will not prevent your uploaded GP data from being processed for any secondary purposes, such as commissioning, healthcare planning, audit, commercial and political purposes.


A Type 1 objection (9Nu0) to secondary uses ought to prevent data from your GP record from being extracted and uploaded, from your GP record, to this database - but it doesn't.

"Patients can object to information about them leaving a general practice in identifiable form for purposes other than direct care, then confidential information about them will not be shared. This is referred to throughout this documentation as a type 1 objection."

HSCIC, Patient Objections Management



If you wish to prevent your GP data from being extracted, uploaded and processed by the SHCR then you must opt-out of the SHCR entirely. It is all or nothing.


Back to index



The Salford Integrated Record

Detailed information about the Salford Integrated Record (SIR) can be found:

The Salford Integrated Record will only apply to you if your GP surgery is part of Salford CCG.

Click to to drop down/close more information about The Salford Integrated Record

The Salford Integrated Record is an example of a database that processes your data for both primary and secondary uses.

The Salford Integrated Record is a clinical data repository (or data warehouse) - where information from your GP record is combined with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, will be available to healthcare professionals across Salford, i.e. regionally.

The Salford Integrated Record currently holds the personal confidential medical information of approximately 565,000 people.

Your GP surgery will not be the data controller for your uploaded information - Salford Royal Hospital NHS Foundation Trust will be.

Information about you, from your Salford Integrated Record, will also be disseminated for secondary purposes in anonymised and pseudonymised formats.

Information about you, from your Stockport Health and Care Record, will also be disseminated for secondary purposes in anonymised and pseudonymised formats.

You do not have to have a Salford Integrated Record created about you if you do not want one.

You have the right to opt-out of the Salford Integrated Record (at any time) and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for both primary and secondary purposes.

Salford City Council does not, and is not planning to, send information to the SIR at present.

Salford Royal Hospital does upload personal confidential data extracted from your hospital record into the SIR, where it is combined with your GP record.

You cannot prohibit the processing of your hospital records in this way. There is no point in approaching Salford Royal Hospital to request that your personal confidential information is not exported to the SIR.

Salford Royal Hospital does not have policies or procedures in place to register and action any such objection.

All you can do is to opt-out of the SIR entirely at your GP surgery. This will not stop your data being extracted and exported from your hospital record, but will ensure that it is deleted upon arrival at the SIR database. It will have no effect on the hospital record itself, which remains unchanged and, as always, available to hospital staff when required.

Opting out of the SIR entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.

Opting out of the SIR entirely will also ensure that no personal confidential information about you from your hospital record is stored in the SIR.


A Type 1 objection (9Nu0) to secondary uses ought to prevent data from your GP record from being extracted and uploaded, from your GP record, to this database - but it doesn't.

"Patients can object to information about them leaving a general practice in identifiable form for purposes other than direct care, then confidential information about them will not be shared. This is referred to throughout this documentation as a type 1 objection."

HSCIC, Patient Objections Management



The Salford Integrated Record has a truly bizarre approach to how it handles objections to the processing of uploaded data for secondary purposes.

Opting out of the SIR entirely, by means of the 93C1 or 93C3 read code flags, will prevent any data from being uploaded to the SIR, and therefore prevent all primary and secondary processing.

Assuming that you have not opted out of the SIR entirely, then the following will apply.


If you have opted out of all secondary uses of your GP record by means of the 9Nu0 read code, then:

Opting out of secondary uses of your GP record (such as risk stratification and the national audits) will not prevent your GP data from being extracted and uploaded to the SIR.


If you have opted out of the Summary Care Record, by means of the 9Ndo read code, then:

Opting out of the Summary Care Record will not prevent your GP data from being extracted and uploaded to the SIR.


If you have requested that the 9Nd1 read code flag is added to your GP record, then:

The 9Nd1 read code flag will not prevent your GP data from being extracted and uploaded to the SIR.


So if you wish to prevent your GP data from being extracted, uploaded and processed by the SIR, for all secondary purposes, then you must opt-out of the SIR entirely.


Back to index



The Cheshire Care Record

Detailed information about the West Cheshire Care Record (CCR) can be found here, and in an article here.

The Cheshire Care Record will only apply to you if your GP surgery is in Cheshire.

Click to to drop down/close more information about The Cheshire Care Record

The Cheshire Care Record is an example of a database that processes your data for primary medical uses only, that is for the provision of direct medical care by healthcare professionals.

The Cheshire Care Record is a clinical data repository (or data warehouse) - where information from your GP record is combined with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, will be available to healthcare professionals across Cheshire, i.e. regionally.

The Cheshire Care Record currently holds the personal confidential medical information of approximately 994,000 people.

The Cheshire Care Record will only apply to you if your GP surgery is one of the surgeries in:

Your GP surgery will only be the data controller for your uploaded GP information - The Countess of Chester NHS Foundation Trust hosts the database.

All other organisations contributing to the shared record retain data controller reponsibility for the information that they upload.

Organisations that upload, or are planning to upload, personal confidential data that they hold about you into the CCR, where it is combined with your GP record, include:

The CCR is, therefore, a single shared record but with multiple data controllers.

You do not have to have a Cheshire Care Record created about you if you do not want one.

You have the right to opt-out of the Cheshire Care Record (at any time) and not allow personal confidential information to be extracted from your GP record and uploaded.


The CCR is unusual amongst the clinical data repositories in that individual organisations extracting and uploading to the database must allow individuals to prohibit processing of their data in that way, by that organisation.

Accordingly, if you wish to prohibit any, or all, of the organisations other than your GP surgery from extracting and uploading data to the CCR database, or in addition to opting out at your GP surgery, then you will need to make a request to dissent to each individual organisation:

These forms will opt you out of the Cheshire Care Record and all other secondary uses of your personal confidential information by that particular trust or council.

Opting out in this way will have no effect on your hospital, trust or council record itself, which remains unchanged and, as always, available to relevant staff when required.


You can opt-out of the CCR entirely at your GP surgery though. This alone will not stop your data being extracted and exported from your hospital, community or council records, but will ensure that they are deleted upon arrival at the CCR database. It will have no effect on the hospital records themselves, which remain unchanged and, as always, available to hospital staff when required.

Opting out of the CCR at your GP surgery is the "master" opt-out, and will completely block viewing of any information uploaded and held in the CCR database.

Opting out of the CCR entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.

Opting out of the CCR entirely will also ensure that no personal confidential information about you from your hospital, community and social care records are stored in the CCR.


Back to index



The North Staffs and Stoke-on-Trent Shared Record

Detailed information about the North Staffs and Stoke-on-Trent Shared Record (NSSOTSR) can be found here.

The North Staffs and Stoke-on-Trent Shared Record will only apply to you if your GP surgery is part of North Staffs CCG or Stoke-on-Trent CCG.

Click to to drop down/close more information about The North Staffs and Stoke-on-Trent Shared Record

The North Staffs and Stoke-on-Trent Shared Record is an example of a database that processes your data for primary medical uses, that is for the provision of direct medical care by healthcare professionals..

Information about you, from your North Staffs and Stoke-on-Trent Shared Record, may also be disseminated for secondary purposes in anonymised and pseudonymised formats.

The North Staffs and Stoke-on-Trent Shared Record is a clinical data repository (or data warehouse) - where information from your GP record may be combined (in the future) with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, can be available to healthcare professionals across North Staffs and Stoke-on-Trent, i.e. regionally.

Currently, the shared record consists of information from GP records only, and is made available to Accident and Emergency departments (such as University Hospitals of North Midlands NHS Trust).

The North Staffs and Stoke-on-Trent Shared Record currently holds the personal confidential medical information of approximately 588,000 people.

Your GP surgery will not be the data controller for your uploaded information. North Staffs CCG will be.

You do not have to have a North Staffs and Stoke-on-Trent Shared Record created about you if you do not want one.

You have the right to opt-out of the North Staffs and Stoke-on-Trent Shared Record (at any time) and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for both primary and (possibly) secondary purposes.

Opting out of the NSSOTSR entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.




Although the North Staffs and Stoke-on-Trent Shared Record processes uploaded personal confidential data for primary and possibly secondary purposes, it ignores any objection that you might have expressed to your GP surgery to the processing of your GP record for secondary purposes (the addition of the 9Nu0 read code flag).

Opting out of secondary uses of your GP record (such as risk stratification and the national audits) will not prevent your GP data from being extracted and uploaded to the NSSOTSR.

Opting out of secondary uses of your GP record (such as risk stratification and the national audits) will not prevent your uploaded GP data from being processed for any secondary purposes, such as commissioning, healthcare planning, audit, commercial and political purposes, if indeed such processing takes place.


A Type 1 objection (9Nu0) to secondary uses ought to prevent data from your GP record from being extracted and uploaded, from your GP record, to this database - but it doesn't.

"Patients can object to information about them leaving a general practice in identifiable form for purposes other than direct care, then confidential information about them will not be shared. This is referred to throughout this documentation as a type 1 objection."

HSCIC, Patient Objections Management



If you wish to prevent your GP data from being extracted, uploaded and processed by the NSSOTSR, for any potential secondary purposes, then you need to opt-out of the NSSOTSR entirely.


Back to index



The Sutton Integrated Digital Care Record

Detailed information about The Sutton Integrated Digital Care Record (SDCR) can be found here, and in this FOI response.

The Sutton Integrated Digital Care Record will only apply to you if your GP surgery is part of Sutton CCG.

Click to to drop down/close more information about The Sutton Integrated Digital Care Record

The Sutton Integrated Digital Care Record is an example of a database that processes your data for primary medical uses only, that is for the provision of direct medical care by healthcare professionals..

The Sutton Integrated Digital Care Record is a clinical data repository (or data warehouse) - where information from your GP record may be combined (in the future) with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, can be available to healthcare professionals across Sutton, i.e. regionally.

You do not have to have a Sutton Integrated Digital Care Record created about you if you do not want one.

You can only opt-out of the SDCR at your GP surgery though. This alone will not stop your data being extracted and exported from your hospital, community or council records, but will ensure that they are deleted upon arrival at the SDCR database. It will have no effect on the hospital records themselves, which remain unchanged and, as always, available to hospital staff when required.

Opting out of the SDCR at your GP surgery is the "master" opt-out, and will completely block viewing of any information uploaded and held in the SDCR database.

Opting out of the SDCR entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.

Opting out of the SDCR entirely will also ensure that no personal confidential information about you from your hospital, community and social care records are stored in the WCR.


Back to index



The Wirral Care Record

Detailed information about the Wirral Care Record (WCR) can be found: here, and in this FOI response.

The Wirral Care Record will only apply to you if your GP surgery is part of Wirral CCG.

Click to to drop down/close more information about The Wirral Care Record

The Wirral Care Record is an example of a database that processes your data for primary medical uses only, that is for the provision of direct medical care by healthcare professionals.

The Wirral Care Record is a clinical data repository (or data warehouse) - where information from your GP record is combined with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, will be available to healthcare professionals across Wirral, i.e. regionally.

Your GP surgery will only be the data controller for your uploaded GP information - Wirral University Hospital NHS Foundation Trust hosts the database.

All other organisations contributing to the shared record retain data controller reponsibility for the information that they upload.

Organisations that upload, or are planning to upload, personal confidential data that they hold about you into the WCR, where it is combined with your GP record, include:

The WCR is, therefore, a single shared record but with multiple data controllers.

You do not have to have a Wirral Care Record created about you if you do not want one.

You can only opt-out of the WCR at your GP surgery though. This alone will not stop your data being extracted and exported from your hospital, community or council records, but will ensure that they are deleted upon arrival at the WCR database. It will have no effect on the hospital records themselves, which remain unchanged and, as always, available to hospital staff when required.

Opting out of the WCR at your GP surgery is the "master" opt-out, and will completely block viewing of any information uploaded and held in the WCR database.

Opting out of the WCR entirely will ensure that either no personal confidential information about you from your GP record is extracted and uploaded, or that any already uploaded information is "blanked" or made unavailable, and that no further information is uploaded.

Opting out of the WCR entirely will also ensure that no personal confidential information about you from your hospital, community and social care records are stored in the WCR.


Back to index



The Dorset Care Record

This NHS database is due to go live later in 2016.

Some information about the Dorset Care Record can be found here.

The Dorset Care Record is a clinical data repository (or data warehouse) - where information from your GP record is combined with information about you from hospitals, community services, mental health services and county councils, into a single shared record held in a 3rd party database.

This combined information, or shared record, will be available to healthcare professionals across Dorset, i.e. regionally.


Back to index



Risk Stratification

Many GP surgeries are uploading personal confidential information from GP records to third parties, for the secondary purpose of "risk stratification". The uploaded data is stored in massive databases (outside of your GP surgery), processed and analysed by the third party, and patients are "scored" as to their likelihood of being admitted to hospital, of attending Accident and Emergency or their GP surgery, and of costing the NHS large sums of money.

Click to to drop down/close more information about risk stratification

Sometimes the GP surgery remains the data controller for the uploaded data, and the third party analyses the uploaded information as the "data processor" on the surgery's behalf.

For any given GP surgery, only a fraction (1-2%) of patients will be identified as potentially "high-risk". For the remaining 98% of patients, the risk stratification analysis serves no purpose. GP surgeries do not narrow down the list of patients that are to have their information extracted, uploaded and analysed - instead the GP records of the entire surgery's patients are uploaded and processed in this way.

A large number of Clinical Commissioning Groups (CCGs), and their member GP practices, are involved in risk stratification - you can see a list of such CCGs here.

Currently, about 105 CCGs have permission to extract information from GP records, upload it, and process it for risk stratification purposes.

Some CCGs refer to risk management as "Personalised Care Management" instead.

Risk stratification is an example of a database that processes your data for secondary uses, that is for purposes other than your direct medical care by healthcare professionals.

As such, these schemes require special permission to upload the identifiable data without the explicit consent of patients, so called section 251 approval. However, a condition of s251 approval is that patients must be informed of the processing of their GP record for risk stratification and of their right to object, or opt-out, of the uploading of their data for this purpose.

Some of the massive NHS Databases, for example The Manchester Care Record, use that uploaded data for secondary processing as risk stratification.

The secondary uses (9Nu0) opt-out is supposed to prevent your data being processed for risk stratification. After all, it is a perfect example of secondary uses of your personal information. But only about 29 (of those 105) CCGs respect that objection for their risk stratifcation scheme.

As many as 70 CCGs (of those 105) wilfully ignore such an objection at present.

Opting out of risk stratification is an absolute and total mess.

The ICO is aware of this.

The National Data Guardian is aware of this.

Nevertheless, read codes other than 9Nu0 will prohibit the extraction and uploading of your information for risk stratification purposes, but the exact code will vary from CCG to CCG.

The NHS Database opt-form downloadable from this site should work to prevent risk stratification wherever you are in England.

The only sure way to find out whether your GP surgery is extracting and uploading your identifiable information for risk stratification uses is to ask them. Risk stratification schemes are voluntary for GP surgeries.

You have the right to opt-out of Risk Stratification and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for secondary purposes.


Back to index



National Audits, the Clinical Practice Research Datalink (CPRD), and other data extractions to the HSCIC

Some (but not all) GP surgeries upload information to the Health and Social Care Information Centre (HSCIC) as part of national audits. Identifiable information about you is extracted from your GP record and uploaded to the HSCIC, once again with s251 approval. As such, your explicit permission is neither required, nor asked for, before your information is uploaded.

One such example is the National Diabetes Audit (NDA). Another is the National Dementia and Antipsychotic Prescribing Audit (NDAP).

Click to to drop down/close more information about National Audits, the CPRD, and GPES extractions

Some national audits extract data to organisations other than the HSCIC. For example, the National CKD Audit (NCKDA) extracts personal identifiable data to BMJ health analytics.

In addition, in the near future, identifiable information about you will be extracted from GP records and uploaded to the HSCIC as part of the General Practice Extraction Service (GPES).

There is no longer any independent scrutiny of requests and extractions of data from your GP record via GPES - the advisory group overseeing this (the GPES IAG) was abolished by the HSCIC in June 2015.

Your GP surgery will not be the data controller for your uploaded information - the HSCIC will be.

Some GP surgeries upload de-identified data extracted from GP records to the Clinical Practice Research Datalink (CPRD), a governmental, not-for-profit research service, jointly funded by the NHS National Institute for Health Research (NIHR) and the Medicines and Healthcare products Regulatory Agency (MHRA), a part of the Department of Health. This is another purely secondary use of data.

Your GP surgery will not be the data controller for the information about you uploaded to the CPRD.


The national audits, the CPRD, and GPES extractions are processing your information for secondary uses only, that is for purposes other than your direct medical care by healthcare professionals.

The secondary uses (9Nu0) opt-out will prevent your personal confidential information being extracted and uploaded - without your knowledge and consent - for the national audits, CPRD and GPES.

In addition, the 9Nu0 opt-out will also prohibit de-identified information about you concerning any eMed3 Statement of Fitness to Work reports (i.e. sick notes) being uploaded to the HSCIC and subsequently passed to the Department of Work and Pensions.

Some more detail about the eMed3 extractions can be found in this FOI response from the HSCIC.

Objecting to the extraction and uploading of your information for secondary purposes will have no impact whatsoever on the way that GPES extracts and uploads anonymised information to NHS England in order to ensure that GP surgeries are paid for certain healthcare programmes (such as immunisations).

The secondary uses (9Nu0) opt-out will ensure that no identifiable information about you will be extracted and uploaded - to anyone, not just the HSCIC- without your express consent, for any other secondary uses, both now and in the future.

The only sure way to find out whether your GP surgery is extracting and uploading your identifiable information to any or all of the National Audits is to ask them. These audits are voluntary for GP surgeries, and many surgeries do not extract and upload this data.

You have the right to opt-out of any or all of The National Audits, the CPRD, and identifiable GPES extractions, and not allow your personal and identifiable information to be extracted from your GP record, uploaded, and processed for secondary purposes.


Back to index



True, interoperable data sharing (streaming)

A number of projects exist around the country that involve sharing data - in real time - from the GP record with local medical organisations (e.g. an individual out of hours GP organisation or hospital trust). Many of these use software provided by Healthcare Gateway, sometimes referred to as the Medical Interoperability Gateway (MIG), or Black Pear's interoperability framework, pyrusConnect, as used in Richmond. Data is streamed directly, in real time, from the GP record database to the viewing medical organisation.

The data is made available to a select number of organisations in your area, i.e. locally.


Click to drop down/close more information about some of these schemes












Other projects using the MIG include Liverpool's iLinks project, Connected Nottinghamshire (NEMS), University Hospitals of Morecambe Bay, Blackpool Teaching Hospitals, NHS Kernow & Royal Cornwall Hospitals NHS Trust, and across Cumbria.


A local care record scheme, again using data streaming to share information, is being established in Southwark and Lambeth.

The Lambeth and Southwark Local Care Record only apply to you if your GP surgery is part of Lambeth CCG or Southwark CCG.


In some areas, groups of GP practices, all running EMIS Web data sharing, can stream patient records across practices. One such example is the Taurus Local Health Record Network (LHRN).
This project will only apply to you if you are registered with one of the 24 GP surgeries in Herefordshire.

EMIS Web data streaming is increasingly used across groups of GP practices (so-called federations) collaborating to provide services to large populations.


Some GP surgeries use SystmOne software, and that shares data via their Enhanced Data Sharing Model (EDSM).

You can find out about EDSM in this leaflet.


All these schemes require a written, and mutually agreed, data sharing agreement, defining the information from the GP record that will be made accessible, to be in place before any such streaming can be enabled.

With these streaming schemes, there is no extraction and uploading of information from your GP record to any third party database or intermediate data repository.

Click to drop down/close more information about true interoperable data streaming

These local data streaming schemes are all examples of a primary use of your GP medical record.

These data streaming schemes have nothing to do whatsoever with the NHS Databases, in that:

Information from your GP record is not uploaded anywhere, so cannot be used for secondary purposes by third parties and misused, sold, given away, or used in ways that you might find unacceptable (such as for commercial purposes or to certain organisations).

You should always be asked for your explicit consent before anyone views your information, and you can agree or refuse as you prefer on any given occasion.

Whilst you may not be asked for your explicit consent before your GP medical record is made potentially accessible in this way, you have the right to opt-out of this type of data sharing.

No-one outside of your GP surgery will then be able to view your record. In addition, you will not be able to sign up to Pharmacy Access (see below), should you wish, as the data sharing control mechanism applies to both.

Data sharing for these schemes can be controlled by adding a read code (93C1), but increasingly it is disabled and enabled directly within the GP system for individual patient records.

In most GP systems, the default setting is for data sharing to be enabled, and opting out results in that "switch" being disabled.

For SystmOne EDSM, however, the default for data sharing is disabled, and must be enabled with the explicit consent of patients.


You can opt-out of data streaming simply by asking your GP surgery to disable it for your GP record and for your local data sharing scheme.

If your GP surgery uses EMIS Web, and if you wish to opt-out of data streaming, then you can use this form (as .doc or .pdf), and either:

Your GP surgery, or local data streaming scheme, may have their own opt-out form that you may wish to use instead.


Opting out of this type of data streaming will in no way affect any existing opt-outs that you may have in force for The Summary Care Record or secondary uses. They will remain in force whether you opt out of your local data streaming scheme or not.

However, opting out of data streaming will almost certainly opt you out of any clinical data repositories running in your area.

Opting out of any or all of the NHS Databases, or opting out of secondary uses, will not automatically disable this type of data streaming.

Be aware of the fact that if you have opted out of the Summary Care Record then the very same information (and usually much more) may well be be available, to the very same medical organisations, via your local data sharing scheme.

So opting out of the Summary Care Record will not automatically prohibit your data being accessible via local data streaming schemes - you will need to opt-out separately if you so wish.


Many of these schemes combine data from your GP record with your medical information from hospital trusts, social care, mental health providers and community care, into one, big, viewable personal record. These schemes are sometimes referred to as integrated care (or digital) records.

The data from your GP record is not extracted or uploaded, but streamed in real time as previously described.

However, data from the other sources isn't always, as yet, similarly streamed and is often extracted and uploaded, usually on a daily basis, to a central data repository, and then viewed from there as required.

In these cases, opting out of your local data sharing scheme at your GP surgery will prevent your GP record being shared, but will not stop data from other sources being uploaded or made widely available.

The only way to prevent that from happening is to opt-out at each provider - that is, contacting the hospital trust, social care provider, mental health provider and community care provider, individually, requesting that your information is not uploaded.


Back to index



Secure access to your online GP record

The NHS Databases have absolutely nothing to do with the ability to securely access your GP electronic record online, as you are entitled to from 1st April 2015. Secure records access (as it is known) does not involve uploading information extracted from your GP record, and your GP surgery remains the data controller for the information. Your GP records are only available to you in this way, and again are streamed in real time.

Click to drop down/close more information about secure access to your online medical record

In contrast to the NHS Databases, you will need to give your explicit consent before your records are made available via secure records access.

Opting out of any or all of the NHS Databases in no way prevents you from asking for, and being granted, secure online access to your GP electronic record.

You can find out about accessing your medical record online in this factsheet.

Only data stored within your electronic GP record is accessible in this way, and then not everything in your record may be accessible to you via secure online records access. You can ask your GP surgery what they are permitting patients to access from their GP record in this way. It will vary from surgery to surgery.

You can potentially have access to your full electronic GP record including consultations, medication, allergies, vaccinations, GP and hospital letters, blood test results and x-ray/scan reports. You are also able to check the results of any blood tests or x-rays requested by your GP, download them, print them off at home, take them to hospital appointments etc.

You are also able to show your GP record, if you wish, to any healthcare professional (or anyone else) that you might see, anywhere in the world (e.g. in a GP out-of-hours centre, A&E department or hospital), directly, or by permitting secure temporary access, or by exporting your record to a secure mobile device. You can read about these facilities here.

EMIS is one GP software supplier that offers this via their Patient Access product, TPP offers their SystmOnline product, Vision offers Vision Online, and Microtest offers The Waiting Room.

If you are interested in obtaining secure records access then just fill in this form and hand it in to your GP surgery.


In addition, the NHS Databases have absolutely nothing to do with the ability to securely access some aspects of your hospital records online, again only at your explicit request.

These portals include Patient Portal and Patient View and Patients Know Best.


Back to index



Other ways to share your GP information

So when it comes to allowing healthcare professionals outside of your GP surgery access to information from your GP record, you have options:


You can have any combination of the above, opting out of any particular data sharing schemes, and/or opting in to any that you wish to.


Back to index



Pharmacy Access

Pharmacy Access services enable GP surgeries running EMIS Web software and community pharmacies running EMIS Health's Proscript software to work together more efficiently, by allowing direct access to certain parts of your GP record.

Click to drop down/close more information about Pharmacy Access

There are two components to Pharmacy Access.

Medicines Manager enables pharmacies to electronically transmit repeat prescription requests to GP surgeries, either regualrly (e.g. monthly), or at the patient's request. GP surgeries can then approve those prescription requests and send it back to the pharmacy electronically for it to be dispensed to the patient.

The GP Record Viewer (GPRV) enables pharmacies to securely view a very limited subset of the patient's electronic GP record, which may be of use when dispensing a prescription. The GPRV uses the same EMIS Web data sharing principles as the many other local schemes mentioned above, and as such data is streamed in real time, not extracted or uploaded. A "GP to Pharmacy Record Sharing" data sharing agreement must be in place, and activated, and a full audit trail is available to the surgery.

The data that the pharmacy can view is as follows:

No other data at all is available to the pharmacy from the GP record.

This scheme is an opt-in one. Patients must give full, explicit and written consent in order for their pharmacy to access their information in this way. Without your prior consent, i.e. your sign-up, pharmacies cannot view your data. You can withdraw your consent at any time.

This is how the consent form looks.

Pharmacy Access is a primary use of the data within your GP medical record.

Patients need to "nominate" a pharmacy for Electronic Prescription Services (EPS), as many have already done, before they can opt-in to the Pharmacy Access service.

However, the EPS is quite distinct from Pharmacy Access. You can nominate an EPS Pharmacy, and use that facility accordingly, without opting in to Pharmacy Access.

If you opt-out of one of the local data streaming schemes, as mentioned above, then you cannot sign up to Pharmacy Access, as there is a shared data controlling mechanism at your GP surgery for both these schemes.

Pharmacy Access has absolutely nothing to do with the NHS Databases.

Opting out of the Summary Care Record, the Hampshire Health Record, or secondary uses of your data will not prohibit you from signing up to Pharmacy Access at your nominated pharmacy.

Community pharmacies (across England) will soon have access to data from your GP record via the Summary Care Record (unless you have opted out), but Pharmacy Access is completely unrelated to that.

You can opt-out, or remain opted out, of the Summary Care Record but still allow your data to be viewable via the GPRV component of Pharmacy Access (and then only by your nominated pharmacy), once you decide to give your explicit consent.

Signing up to Pharmacy Access will in no way affect any existing opt-outs that you may have in force for any or all of the NHS Databases. They will remain in force whether you sign up or not.

You can find out if your local pharmacy and GP surgery are able to work together in this way by asking at the pharmacy. The consent form is filled in at the pharmacy.

More information about Pharmacy Access can be found in this factsheet (for GP surgeries).


Back to index



Anonymised and aggregate information

All GP surgeries routinely produce information that cannot identify patients, so-called anonymised or (more usually) aggregate datasets, for a variety of reasons including monitoring, clinical audit, healthcare planning, and in order to get paid by the NHS.

Aggregate data is simply numbers, for example the number of patients registered with the surgery that have been diagnosed with high blood pressure.

This data format is sometimes called open data.

Click to drop down/close more information about anonymised and aggregate information from your GP record

Aggregate data is regularly uploaded from GP systems as part of the Quality and Outcomes Framework (QoF), required for GP surgeries to get paid.

For example, aggregate data via QoF is used to monitor the quality of care, and adherence to NICE guidance, for patients with diabetes, with the ultimate aim of preventing complications (such as amputations and visual loss) and deaths (from cardiovascular disease). Examples of such care would include assessment of the risk of foot complications, digital retinopathy screening, and control of blood pressure and cholesterol levels.

Many practices contribute information to QSurveillance, a real time clinical surveillance system based on data from 3,400 EMIS general practices spread throughout the UK. QSurveillance collects, analyses and reports of rates of infectious diseases and vaccine uptake (flu, pneumococcal, DTaP/IPV/Hib, MMR, shingles and rotavirus), but crucially only extracts summary data which is aggregated (just like QoF).

Practices are also required to submit regular data extracts in order to get paid for certain procedures, for example contraceptive services. In this case, anonymised information about individuals that have had procedures performed are supplied to the local authority (public health). Such information would include the age of the patient, first part of the postcode, ethnicity (if recorded), and the procedure that had been performed. However, GP surgeries do not publish, or put into the public domain, this type of record-level information.

GP surgeries are sometimes compelled to provide certain information to the HSCIC, when the HSCIC uses their statutory power under Section 259 of the Health and Social Care Act 2012. For example, GP surgeries must provide information relating to dementia diagnoses and learning disabilities.

Soon, GP surgeries will be required to submit identifiable data to the HSCIC as part of the NHS Health Checks project.

Because all of the information that leaves the GP surgery cannot (easily) identify individuals, sometimes referred to as "effectively anonymised", there is (usually) no opt-out for the dissemination of anonymised or aggregate data.

These are all secondary uses of data.


Back to index



GP referrals

Whenever your GP refers you to a clinic, hospital, specialist service or community service, or has reason to admit you to hospital in an emergency, then information is passed to the relevant healthcare team. This can be by telephone, letter, fax, email, online or e-referral.

Appropriate information from your medical record will be necessarily included in those referral details, including your past medical history, medication, allergies, and sometimes other relevant letters from your medical record.

Click to drop down/close more information about GP referrals and your GP record

This is a primary use of your GP medical record.

This type of information sharing is of course necessary as, for the purposes of direct medical care, relevant personal confidential data should be shared among the registered and regulated health and social care professionals who have a legitimate relationship with the you, the patient.

You can discuss with your GP what information is being sent for that referral, should you wish (and if you are in a position to). You have the right to express any objection that you might have to specific information being included, particularly if that information is of no obvious relevance to your current medical situation.


Back to index



The Health and Social Care Information Centre (HSCIC), now NHS digital

The HSCIC receives, holds, and processes information that it obtains from across the NHS, including GP surgeries and hospital trusts, and makes that information available in a variety of ways, both to the public and to other organisations. Sometimes it charges for the information that it provides (i.e. it sells information), and the information is given to organisations both within and outside of the NHS (such as commercial organisations).

There are three ways to control how the HSCIC disseminates and sells information about you.

Click to drop down/close more information about controlling the information that the HSCIC holds about you

You can express a Type 1 opt-out to secondary uses of your information, to your GP surgery, as detailed above (in the National Audits section) and included on the universal opt-out form on this site. That objection then prevents your GP surgery from extracting and uploading information from your GP record to the HSCIC, including certain extracts even though completely anonymised.

You can express a Type 2 opt-out to secondary uses of your information, to your GP surgery, as detailed above and included on the universal opt-out form on this site. That objection is then passed to the HSCIC and will prevent the HSCIC from disseminating and selling data information about you, that it holds - but only information that clearly identifies you.


In addition, you can contact the HSCIC directly and instruct it to prevent any information held about you from being used for purposes other than your direct health and/or social care (i.e. secondary purposes).

The HSCIC will remove, on such a request, all identifiable information held on you, other than what is required by law to have you registered as an NHS patient. Such action will in no way stop you, for example, from being invited to appropriate screening or immunisation programmes,

You will still be invited to cervical screening, breast screening, bowel cancer screening, diabetic retinopathy screening, abdominal aortic aneurysm screening, and any other current or future national screening programmes, if you are eligible. This objection will have no impact whatsoeveron the medical care that you receive anywhere with the NHS or privately, nor will it affect in any way the information held by your GP surgery or hospital trusts in their records.

Effectively, this objection ensures that information obtained by the HSCIC is anonymised upon receipt. The HSCIC can only publish (as open data), disseminate and sell completely anonymised information about you.

The form that you need to fill in is here, and you send it directly to the HSCIC.

Detailed information about this particular opt-out is included within that HSCIC form.


Despite the Government stating that people would have the right to opt-out of anonymised data about them being shared for secondary purposes by the HSCIC/NHS Digital, you cannot prohibit this type of data sharing about you.

"we said that if we are going to use anonymised data for the benefit of scientific discovery in the NHS, people should have the right to opt out"

"this Government decided that people should be able to opt out from having their anonymised data used for the purposes of scientific research"

"every single NHS patient should have a right to opt out of having their data used in anonymised scientific research. I think that was the right thing to do"

House of Commons Hansard, GPES and care.data, Tuesday 25 February 2014 (col 147,148)



Back to index



Google DeepMind Health AI

The Royal Free NHS Foundation trust (RFNHSFT) has signed a data sharing agreement allowing the extraction and uploading of personal confidential information from its 1.6 million hospital records to Google, to be processed by its DeepMind Artifical Intelligence division.

You can read more about this project in the following articles:

And in this FOI response by the Royal Free.

Moorfields Eye Hospital has also signed a data sharing agreement to allow retinal scans to be extracted and uploaded to Google, again to be processed by its DeepMind Artifical Intelligence division.

You can read more about this project here.

The Royal Free project will apply to you if you are - or ever have been - a patient at The Royal free Hospital, Chase Farm Hospital or Barnet Hospital.

The Moorfields Eye Hospital project will apply to you if you are - or ever have been - a patient at that hospital.

You will not have been asked for your explicit consent before information from your hospital records was extracted and uploaded to Google.

Click to drop down/close more information about controlling the information that these hospitals upload to Google

The data uploaded to Google from the Royal Free Hospital clearly identifies you. It is not anonymised.

The data uploaded to Google from Moorfields Eye Hospital is anonymised.

You do not have to allow Google to have access to your hospital records, or retinal scans, if you do not want it to.



You have the right to opt-out of allowing the extraction and uploading of your hospital records to Google by the Royal Free.

Opting out of this project will in no way interfere with, or prohibit healthcare professionals from accessing your electronic hospital record - as they always have done when required.

You can opt-out completely, and not allow the extraction and uploading of your information at all to Google.

A suitable letter that you can use to opt-out completely can be downloaded here.

You can, alternatively, allow Google to have your information but opt-out of any secondary uses of it, whilst still permitting any primary uses (that is, information analysed and fed back to healthcare professionals providing you with direct medical care).

A suitable letter that you can use to opt-out of just secondary uses can be downloaded here.

As per their website, you need to send, or email, your opt-out to the data protection officer at the Royal Free NHSFT:

Data protection officer
Royal Free London NHS Foundation Trust
Royal Free Hospital
Pond Street
London, NW3 2QG
Email smondal@nhs.net
Tel 020 3758 2000

Be aware - opting out of risk stratification or any other NHS data sharing scheme will not automatically opt you out of the Royal Free/Google AI project.
You need to opt-out separately, and directly to the Royal Free.




You have the right to opt-out of allowing the extraction and uploading of your retinal scans to Google by Moorfields Eye Hospital.

Anonymised clinical diagnoses, information on the treatment of the eye disease, the model of the machine used to acquire the images, and demographic information about your age is also uploaded.

Opting out of this project will in no way interfere with, or prohibit healthcare professionals from accessing your retinal scans or your electronic hospital record - as they always have done when required.

As per their website, all you need to do is to email Moorfields requesting that you wish to opt out of research by the Trust, including the DeepMind Google AI collaboration.

You need to include your NHS number, or your Moorfields hospital number, and send your email to IG.Team@moorfields.nhs.uk

The Moorfields optout will apply to all future research projects (involving your anonymised data) at Moorfields, not just the DeepMind collaboration. However, you can opt in to any individual research project, for example if suggested by your specialist, as and when you like, with your explicit consent.


Back to index



Feel free to send me constructive comments about this site.

Neil.Bhatia@nhs.net

PGP public key: 9651 BDC9 46B5 7768 3B3F AF79 8FE1 DACC FEFA 344F

I will read every comment sent, though please do not be offended if I do not reply to your message.

Privacy policy: I will not sell, trade or otherwise transfer to any third parties your personally identifiable information (your email address or the content of your email)



Last updated: 16.03.17

This website does not accept or host any advertising.

This is a non-commercial website and receives no external source of funding from any organisation.

This website does not use cookies.