The mandatory implementation of the National Data Opt-Out is fast approaching – 31 July 2022. NHS Digital has confirmed that they do not intend to extend implementation of the deadline any further.
If you are a Care Quality Commission registered provider who is partially or wholly publicly funded, you must act by 31 July 2022. If you do not, you could be in breach of the Information Commissioner’s Office regulations in relation to processing data fairly and transparently. The national data opt-out will be a requirement of completing Standards Met in the Data Security and Protection Toolkit for 2022/23 onwards.
In very broad terms it’s not something most care providers need to be concerned about unless you are involved in any research studies in which case residents/service users can opt out of having their data shared with the research body (research would not include normal market analysis done by Local Authorities it’s more specific university studies etc) It also does not include the Capacity Tracker or anonymised data. Data collected for providing day to day care is not covered by the opt out as it considered essential data so for example the data you collect through your care planning software that then goes into care plans is not covered.
If you are sure that no data you collect is used for research purposes then we suggest inserting the following clause into your Data Privacy Policy
National Data Opt Out
At this time, we do not share any data for planning or research purposes for which the national data opt-out would apply. We review all the confidential patient information we process on an annual basis to see if this is used for research and planning purposes. If it is, then individuals can decide to stop their information being shared for this purpose. You can find out more information here
If you think that you do have data that is shared for research purposes, then the relevant clause would be this:
National Data Opt Out
Insert organisation name reviews all our data processing on an annual basis to assess if the national data opt-out applies. This is recorded in our Record of Processing Activities. All new processing is assessed to see if the national data opt-out applies.
If any data processing falls within scope of the National Data Opt-Out we use MESH to check if any of our service users have opted out of their data being used for this purpose.
If you do share data for research purposes then additionally we recommend informing your residents/service users that they can opt out by visiting www.nhs.uk/your-nhs-data-matters and registering their preferences (and obviously not sharing their data) You would also need to check MESH (Message Exchange for Social Care and Health) to see if any of your residents/service users have opted out
From the DSPT point of view if you are happy with either of the above scenarios you can say you are compliant.