Sharing and Consent
Your personal information will only be shared in accordance with your rights under the UK General Data Protection Regulation, Data Protection Act 2018, the Common Law duty of confidentiality, the NHS Constitution and in keeping with professional and NHS Codes of Practice.
NHS England has published a guide to confidentiality in health and social care that explains the various laws and rules about the use and sharing of confidential information.
Safe and effective care is dependent upon relevant information being shared between all those involved in caring for a patient. When an individual agrees to being treated by the wider care team, it creates a direct care relationship between the individual patient and the health and social care professional and their team. All health and adult social care providers are subject to the statutory duty under section 251B of the Health and Social Care Act 2012 to share information about a patient for their direct care. This duty is subject to both the common law duty of confidence and the UK GDPR and Data Protection Act 2018.
For common law purposes, sharing information for direct care is on the basis of “implied consent”, which may also cover administrative purposes where the patient has been informed or it is otherwise within their reasonable expectations. This means that information is shared without the individual having to give verbal or written agreement each time and only applies within the context of direct care.
Under UK GDPR the lawful basis for the processing of personal data in the delivery of direct care, and for providers’ administrative purposes, will be undertaken using Article 6(1)(e), “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority”. Personal data in relation to health are special categories of personal data and the processing of this data for direct care or administrative purposes is undertaken using Article 9(2)(h), “…medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems…”
In some circumstances other duties or obligations to share information outweigh confidentiality, and personal information is shared without consent, for example to ensure the safety of a child or vulnerable adult or to report a notifiable disease.
Your information will be used in a de-identified or anonymised form for purposes other than direct care, such as statistical and analytical information needed to assist the ICB, the NHS, Department of Health and health care partners.
Unless your information is being used for direct care or there is a legal requirement to share your information, you have the choice to opt-out. This opt-out is managed through the National Data Opt-Out programme.
You have the right to withhold consent or object to your information being shared, but in some circumstances this may delay or affect the care you receive. Always consult your GP or relevant health professional before deciding to withhold consent to sharing your information, as they will be able to advise you on the possible outcomes of this decision.