HSCIC finally agrees to implement opt-outs for care.data

Organisation signs an undertaking with ICO to comply with Data Protection Act

The Health and Social Care Information Centre (HSCIC) has finally agreed to opt-out patients from the NHS's controversial care.data programme.

The programme, which aims to take data from GP surgeries and other health care services and put it into a central database, has been blighted with issues since its inception, with patients, privacy campaigners and GPs all voicing concerns about the project, while there has been questions about whether patients were adequately informed that they could opt-out of sharing their data.

According to HSCIC about 1.2 million patients - 2.2 per cent of patients in England - or one in 45 - have opted out of having information that can identify them being shared outside of the HSCIC for purposes beyond direct care. This is known as a ‘Type-1' opt-out. The ‘Type-2' opt-out, which HSCIC offered patients in January 2014, is where no identifiable information held by the HSCIC would be passed to a third party - and this is yet to be actioned for the 700,000 patients who opted out this way.

Back in November 2015, HSCIC suggested that patients who wanted to opt out of the programme would have their wish granted by January 2016 - but at the time, the Information Commissioner's Office (ICO) suggested that the data could still be released by HSCIC.

Now, HSCIC has signed an undertaking to comply with the Data Protection Act. The ICO said that it found that "patients were offered an opportunity to opt out from their data being shared with other organisations, but that the opt-outs were not implemented", and added that HSCIC had agreed a series of steps to remedy this.

In the undertaking, the ICO said that HSCIC wasn't able to collect, record or implement the 'Type-2' objections that were registered by patients with their GPs due to "legal and technological reasons".

This meant that HSCIC had shared patients' data with other organisations against their wishes for purposes beyond their direct care, for example for research or other secondary purposes.

The Commissioner said he was concerned about the way in which HSCIC had communicated with affected patients that patient opt-outs had not yet been implemented. He is giving HSCIC six months to ensure those patients are made aware of this.

The ICO has also set HSCIC six other targets to meet with different time frames. This includes contacting recipients of datasets provided in the period between January 2014 and April 2016 to inform them that, where possible, the datasets should be destroyed or deleted and replaced with a new dataset provided by HSCIC.