December 17, 2013 by Protect Our NHS
We have had people asking us how to go about opting out of personal data transfer. The draft letter below is a template for you to use if you wish to opt out.
Dear Dr …
I am writing to give notice that I refuse consent for my identifiable information to be transferred from your practice systems for any purpose other than my medical care.
As you are probably aware, on the direction of NHS England you can now be required to transfer patient-identifiable data from the electronic medical records that you hold to the Health and Social Care Information Centre (HSCIC), via the General Practice Extraction Service (GPES) or other means. This is to be done without seeking my explicit consent and for purposes other than my medical care.
There are substantial concerns about the privacy and confidentiality of any information transferred to HSCIC, not least because NHS England has been given legal exemptions to pass identifiable data gathered by HSCIC between itself and a range of regional processing centres, local area teams and commissioning bodies that came into force on April 1st 2013. I am also disturbed to note that HSCIC provides access to patient data, some in identifiable form, to a range of ‘customers’ including private companies.
I do not believe that these widely distributed systems with so many potential users and such a wide range of uses, some as yet undefined, can be regarded as secure. And no guarantees can be given as to the future re-identification of pseudonymised or de-identified data; indeed HSCIC admits this is a risk.
I cannot know what specific information my medical records might come to hold but I regard the entirety of my medical records, existing and future, as private and personal.
Please take whatever steps necessary to ensure my confidential personal information is not uploaded and record my dissent by whatever means possible.
This includes adding the ‘Dissent from secondary use of GP patient identifiable data’ code (Read v2: 9Nu0 or CVT3: XaZ89) to my record as well as the ‘Dissent from disclosure of personal confidential data by Health and Social Care Information Centre’ code (Read v2: 9Nu4 or CTV3: XaaVL).
I am aware of the implications of this request, understand that it will not affect the care I receive and will notify you should I change my mind.
I recognise the need for health care providers to be paid for services provided to me. I believe the limited information required for such purposes can be wholly anonymised by the provider, before it is released to the relevant commissioning authority. Please ensure that any of my information used for these purposes is treated in this way, and that any other providers are made aware of this mandate, e.g. by forwarding a copy of this letter along with my information when it is passed to them.
Further information for GPs can be found on the BMA website at: