A Facebook post with over 600 shares claims that the government “has told your GP to hand over your health data, including mental & sexual health, to third parties for payment” and the deadline to opt-out of this is 23 June 2021. This deadline has changed, and this claim needs context.
From September, NHS Digital will start collecting patient data from GP records in England about all living patients, including children. This is called the General Practice Data for Planning and Research data collection, and it will be used to help the NHS improve health and care services, according to NHS Digital.
As the post claims, this will include information about mental and sexual health, as well as diagnoses, symptoms, test results, medications, information about physical health, a person’s sex, ethnicity and which staff treated them.
NHS Digital says it will not sell your data, but does have a price list “to cover the cost of processing and delivering our service” to external organisations who want to use it for health and care planning and research uses. We have written much more about who is allowed to access the data here.
Will the data be linked to your identifiable details?
The post claims that “data will be linked to your NHS number, postcode & date of birth”. This claim needs more context.
Although the data collection won’t include people’s names or where they live, details like NHS numbers, postcodes and dates of birth will be collected. However, this will go through a process called pseudonymisation, which means codes will be generated to replace these details.
NHS Digital says this means that no one will be able to directly identify you in the data, without also having access to the key that links each patient to their code. However, NHS Digital does make a distinction between pseudonymisation and complete anonymisation, and so although the data will be de-personalised it will not be completely anonymous (you can read more about the distinction here).
NHS Digital maintains the keys to convert these codes back into data that could identify you, but won’t do that “unless in the circumstances of any specific request it is necessary for it to be provided in an identifiable form”.
The deadline has changed
The post claims that the date to opt-out of this data collection is 23 June, which was true until 8 June, when a minister in the Department for Health and Social Care, Jo Churchill, told the House of Commons the implementation date had changed from 1 July to 1 September.
To opt-out, you need to print, fill in and return this document to your GP practice. It’s not clear when exactly you have to return the opt out form to your GP to make sure it gets processed before the new implementation day on 1 September. The previous deadline, of 23 June, was a week before implementation day.
If you opt-out after this deadline, no more data will be collected. NHS Digital told Full Fact: “With regards to [General Practice Data for Planning and Research] specifically, the data will start to flow from the 1 September and patients would need to opt out ahead of this date if they do not want their data to be shared.”
The user’s caption of the Facebook post was wrong when it was written, on 21 June, although the screenshot of a Double Down News tweet it includes was posted before the deadline changed.