GP practices must set deadline for patients to opt out of GP data extraction

GPs, as data controllers, must set their own deadlines for patients to opt out of the impending mass extraction of GP data, NHS Digital has said.

It apologised that a member of its press office previously stated 25 August was the national deadline, saying this information was given in error.

The only deadline, it clarified, is that opt-outs need to have been applied by GP practices to patient records before 1 September, when the extraction will take place.

Any opt-outs received after this date will still be applied, but the data extracted to date will not be retrievable, it stressed.

An NHS Digital spokesperson said: ‘Patients are able to register an opt out at any time and the data will cease to flow. This does not apply retrospectively to data that has already been collected prior to the individual opting out. With regards to GPDPR specifically, the data will start to flow from the 1 September and patients would need to opt out ahead of this date if they do not want their data to be shared.’

However, GPs warned that the lack of a nationally mandated deadline for patients to make their wishes known could lead to complaints against practices – especially if last-minute opt-out requests could not be processed before the first extraction.

They also warned of workload implications for practices in the run-up to 1 September.

The BMA GP Committee’s latest newsletter quoted IT lead Dr Farah Jameel as saying: ‘The public needs a clear deadline by which they can opt out, alongside clear instructions on how to do this if they so wish. 

‘We have been urging the government and NHS Digital to consider making the process of opting out simpler, and in effect remove any additional burden [that] large volumes of Type 1 opt-outs could place on already under-pressure general practice. 

‘We urge NHS Digital to clarify this with both the public and practices.’ 

She added that NHS Digital ‘must also make clear to patients what will happen to their data if they do not opt out before the deadline, and how long this data will be stored for, as well an explanation as to why it cannot be retrospectively deleted should patients subsequently decide to opt out’.

Bristol GP partner Dr Simon Bradley told Pulse: ‘People always leave such things to the last minute, so there is inevitably going to be a last minute surge, and it’s going to create a bottleneck for practices. 

‘There is a risk that GPs will fail to complete the process in the practice for a number of patients, and if it’s one patient, it’s one patient too many.’

He added that processing the opt-outs will be a ‘low priority’ if this requirement ends up competing with meeting the health needs of patients, which could also lead to some not being opted out in time. 

However, practices should not be expected to work into the night on 31 August, to process last minute opt-outs, he said.

‘You can’t ask [staff] to do that after all they have already done with looking out for patients with Covid and coping with the vaccination programme. I wouldn’t ask my staff to do that.’ 

Nottingham GP Dr Hussain Gandhi told Pulse that NHS Digital not giving practices the ‘usual time’ for processing patient requests is ‘negligent’, adding that the ‘worst case scenario’ would be patients having their data uploaded even though they have registered to opt out.

He said: ‘The question is whether practices will have the capacity to do something like that at the drop of a hat, and the answer is no. A week is a reasonable time frame for practices to process this kind of information, a couple of hours is not.’

He added that he suspects some people will take ‘last minute action’ to opt out of having their data shared, which is ‘going to create conflict and issues for practices as data processors’. 

He said: ‘I think the concern is that patients may blame the GP. NHS England and NHS Digital have already harmed the relationship between patients and GPs, and this will further that.’

Lincoln GP partner Dr Phil Williams told Pulse patients should have been enabled to opt out using the NHS app or online.

‘With the national data opt-out, there is a special website you have to go to. GP practices can’t opt patients out locally. We have to give them a phone number or a website to go to. I don’t understand why they can’t do that [with Type-1 opt-outs], if they can build a website that processes a million vaccination bookings in a day. I think they can sort this out centrally. They already have the tech to do this, so why don’t they?’ 

Privacy campaigners fear the new automatic extractions of data will be ‘far bigger’ and ‘more intrusive’ than the scrapped care.data project and the Government has had to delay the date for the GPDPR extraction from 1 July to 1 September, amid concerns the public has not been sufficiently informed.

This followed concerns raised by the BMA and RCGP, despite both advising on the GPDPR system that will replace the GP Data Extraction Service (GPES).

Following the announcement, Mr Hancock asked former RCGP chair Professor Helen Stokes-Lampard to advise the Government on the project.

Pulse also recently reported that each GP practice will need to perform a data protection impact assessment (DPIA) before NHS Digital extracts the data from GP systems.

As previously published on our sister title Pulse