Improving Access to Psychological Therapies (IAPT) data set fair processing guidance

We have provided information and guidance to IAPT service providers around the IAPT Data Set, to support understanding of the purpose and processing of the data set and their responsibilities for transparency with patients. 

This guidance also contains suggested fair processing information for inclusion within existing patient information material. 

This is to comply with the requirements of the common law duty of confidentiality, the Data Protection Act 2018, the General Data Protection Regulation (GDPR), NHS Constitution and the Department of Health and Social Care’s Directions to NHS Digital, formerly known as the HSCIC, issued in 2015, 2017 and 2018 on upholding patients’ national data opt out preferences. 

This section provides additional guidance to that stated within the Implementation Guidance, to support IAPT service providers understanding of the purpose of the data set and how patient data is used for secondary uses.

In summary, patients cannot specifically opt out of their IAPT data flowing to NHS Digital. Services must now inform patients that their data will be included in the data set and highlight the national data opt out. The National Data Opt-out Programme provides a broader opt-out for all their NHS data. This guidance provides further detail around this change and how services may choose to add this locally.

Under GDPR, our lawful basis for processing is Article 6 (1) (c), which relates to processing necessary to comply with a legal obligation to which we are subject. Our lawful basis for processing special category data is GDPR Article 9 (2) (h) and Schedule 1, Part 1 (2) (2) (f) of the Data Protection Act 2018. 

A Data Provision Notice (DPN) is available which means that all providers of NHS-funded IAPT services are required under Section 259 (5) of the HSCA 2012 to provide the data set as specified by NHS Digital within the DPN.

The Requirements Specification DAPB1520: Improving Access to Psychological Therapies Data Set - NHS Digital defines the scope of the data set, what is required from providers and how NHS Digital will assess that a provider has complied with submitting the data to meet this legal requirement.

This section provides additional guidance to that stated within the implementation guidance, to support IAPT service provider understanding of transparency responsibilities and patient rights with respect to the IAPT Data Set. 

As the IAPT data is to be used for secondary care rather than direct patient care, patients using NHS-funded IAPT services must be made aware that their confidential data will be used for this beneficial, additional purpose i.e. to improve care.  

Acting fairly and transparently ensures compliance with the common law duty of confidentiality, the NHS Constitution and legislation such as the Data Protection Act 2018 and the GDPR. 

Ensuring fairness is the responsibility of the care provider from which the data will be collected (NHS Digital has provided some suggested wording later in this document). 

Patients must also be informed of their right to set a national data opt-out preference to prevent their confidential patient information from being used for purposes beyond their own direct care and treatment (for research and planning purposes, for example). This complies with the Department of Health and Social Care’s Directions, issued to NHS Digital in 2015, 2016 and 2018 on the upholding of patients’ national data opt out preferences. 

Data protection laws in the UK give people a number of rights concerning their personal data. Not all rights apply equally to all our processing activity as certain rights are not available depending on the lawful basis for the processing. 

With respect to the IAPT Data Set, providers are legally required to submit full returns of IAPT data, as the DPN issued under section 259 (10) of the Health and Social Care Act (HSCA) 2012 sets aside the common law duty of confidence in respect of this data. However, providers may themselves exclude records where they are subject to any other restriction on disclosure, such as by other laws. 

Patients however, do have a right to set a national data opt-out preference to prevent their confidential patient information being used for research and planning. Where an opt-out is received from a patient (or their parent or guardian in the case of a child), NHS Digital will exclude the relevant records from any applicable onward dissemination of the data. 

Patients using these services have the right to change their minds about a disclosure decision at any time before the disclosure is made and can do so afterwards to prevent further disclosures. 

Further information on the national data opt out programme is available from our data opt out guidance for health and care staff.

Providers should maintain awareness of developments in legislation around opting out, as this may impact the required approach to opt-outs during the lifetime of this information standard. 

Record level identifiable data is submitted to NHS Digital’s secure Strategic Data Collection System (SDCS) Cloud facility. The identifiable information is needed to join patient data across time periods upon receipt. The data is then pseudonymised and stored within NHS Digital as a central data set to support national reporting and NHS Digital has a central reporting system where an anonymised version of the IAPT Data Set will be held for reporting and serve the following purposes: 

These uses of IAPT data may also be linked to data held by NHS Digital from various other data sets and collections to provide richer information and develop new and existing publications, and to respond to requests for data and information. More information about the data sets and collections that NHS Digital hold and that may be used for linkage can be found on our data collections webpage. IAPT data may also be linked to external data sources such as Office for National Statistics (ONS) or Public Health England data. 

For further information regarding these secondary uses, please refer to the IAPT Data Set Data Protection Impact Assessment (DPIA), which is available upon request from NHS Digital. 

We have made available a range of supporting information to explain our role and remit to supply information and data to the health service and how we keep patient data safe. 

Suggested wording for fair processing information

This suggested wording is intended to be incorporated into a service's existing information for patients. It does not need to be a separate leaflet. 

IAPT service providers MAY choose to use this wording (or elements of) or may use locally agreed wording, providing that responsibilities for fairness and transparency are met.

"We share information about you (your personal data) for the Improving Access to Psychological Therapies (IAPT) Data Set, to help achieve better outcomes and experiences of care.

The data set collects information about demographics (such as postcode, date of birth, ethnic category), referral, treatment and outcomes details.

The data is securely sent to NHS Digital which is the central organisation that receives the same data from all NHS-funded IAPT services across England.

The data set is used to produce anonymised national reports that show summary numbers of, for instance, numbers of patients referred to different IAPT services across the country as well as average waiting times and outcomes.

The reports help the NHS to improve the care it provides to you and other patients. No information that could reveal your identity is used in these reports.

The data may be linked with other sources of data to support a wider range of information within these national reports, such as to investigate the relationship between IAPT services and other care services.

For more information about how NHS Digital uses IAPT data including their lawful basis for processing, how long they hold it for and your rights, please see our GDPR register.

To manage your choice about how your confidential patient information is used for research and planning, please visit the following website: https://www.nhs.uk/your-nhs-data-matters/. Alternatively, you can call 0300 303 5678.

More information about the IAPT Data Set is available.