GPES data for pandemic planning and research (COVID-19) (GDPPR)

COVID-19 led to increased demand on general practices, including an increasing number of requests to provide patient data to inform planning and support vital research on the cause, effects, treatments and outcomes for patients of the COVID-19 virus.

To support the response to the COVID-19 outbreak, NHS England has been directed to collect and analyse healthcare information about patients, including from their GP record, under the COVID-19 Public Health Directions 2020 (COVID-19 Direction).

All general practices in England are legally required to share data with NHS England for this purpose under section 259(1)(a) of the Health and Social Care Act 2012. General practices are notified of the requirement to provide data for this purpose through the Data Provision Notice issued by NHS England.

This collection will reduce burden on general practices, allowing them to focus on delivering health care and support to patients. It will also reduce compliance burden and risk for general practice associated with sharing data.

Organisations, including the Government, health and social care organisations and researchers need access to this data for a range of COVID-19 purposes, including to help support research into the COVID-19 pandemic and to provide insight into the recovery of health and social care services. COVID-19 purposes for which this data may be analysed and used may include:

• understanding COVID-19 and risks to public health, trends in COVID-19 and such risks and controlling and preventing the spread of COVID-19 and such risks
• identifying and understanding information about patients or potential patients with, or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19
• understanding information about patient access to health services and adult social care services as a direct or indirect result of COVID-19, and the availability and capacity of those services
• monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within health and adult social care services
• delivering services to patients, clinicians, the workforce within health and adult social care services and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services
• research and planning in relation to COVID-19

Data may be analysed and linked to other data held by NHS England or data held by other organisations to which access to the data is granted for COVID-19 purposes. This is managed via the Data Access Request Service (DARS), with oversight provided by the Advisory Group for Data (AGD) and Patient Advisory Group (PAG).

Data will be collected using the General Practice Extraction Service (GPES).

NHS England retains responsibility and accountability at all times for the dissemination of GDPPR as the Data Controller under the UK General Data Protection Regulation (UK GDPR). It will do so through ensuring that requests for data are necessary, proportionate, that the minimum amount of data necessary for the purpose only is shared and that the transfer and use of the data shared will be secure and lawful.

Organisations seeking access to the data for planning purposes may include DHSC, other government departments involved in the COVID-19 response, NHS Trusts and Integrated Care Boards (ICBs). Research organisations, including Universities and private research companies, may seek access to the data for the purposes of carrying out vital COVID-19 research. A list of COVID-19 research studies and the organisations carrying out these studies is available on the National Institute for Health and Care Research Portal.

NHS England has legal powers to disseminate the data for COVID-19 purposes under section 261 of the 2012 Act. Data applicants will need to demonstrate though the DARS assessment process that they have a lawful basis to access and process the data for COVID-19 purposes. Where identifiable data is requested, the data applicant must demonstrate a legal basis under the common law duty of confidentiality. Use of data for research purposes will also require Research Ethics Committee approval.

NHS England will consult with the British Medical Association (BMA) and the Royal College of General Practitioners (RCGP) on all requests for access to GDPPR received by DARS. An outline of the process, which has been agreed with the BMA and the RCGP, is published on the NHS England website. Requests by organisations to access record level (pseudonymised or identifiable) data from this collection will also be subject to AGD and PAG consideration and advice.

Requests will be assessed by DARS, AGD and PAG against specific criteria underpinned by information governance assessment standards. These standards include additional scrutiny where there is involvement from an organisation whose involvement may warrant public concern. The DARS process is robust and well-established, and consists of enquiry, triage, review, independent oversight through AGD, approval, access, audit and destruction phases. All data approved for release through DARS and AGD are subject to robust data sharing agreements between NHS England and the data applicant(s).

NHS England discloses in its Data Uses Register the organisations to whom it disseminates GDPPR data and the purposes of dissemination to ensure the public and the profession are informed of the benefits generated from the use of the data.

In the unlikely event that AGD did not recommend approval of a request for access to GDPPR and NHS England disagreed with that recommendation, NHS England would seek guidance from the National Data Guardian or, where appropriate, advice from the Health Research Authority (HRA) Confidentiality Advisory Group (CAG) under section 262A of the Health and Social Care Act 2012 before disseminating any data.

General practices should comply with requirement to provide the data, notified via the issuing of the Data Provision Notice, by registering their participation on the Calculating Quality Reporting Service (CQRS).

General practices have a legal duty to be transparent and to provide patients with transparency information under the UK General Data Protection Regulation (UK GDPR) about the data they are sharing with NHS England.

General practices also need to update their transparency notices on their websites to include details of this collection. NHS England has produced a template general practice transparency notice which practices can use to do this. You can also link to this by publishing the following statement and link on your website: