Covid-19: Rules on sharing confidential patient information are relaxed in England

The Department of Health and Social Care for England has relaxed the rules on sharing patients’ confidential data and is requiring healthcare bodies to provide patient information to each other to help fight covid-19.

The health and social care secretary, Matt Hancock, issued a notice under the Health Service Control of Patient Information Regulations to general practices, organisations that provide health services, local authorities, and arm’s length bodies of the health department, such as its digital transformation arm, NHSX.1

Separate notices have also gone out to NHS Digital and to NHS England and NHS Improvement, and the UK Biobank project is also being required to share data.

“For patients, this means that their data may be shared with organisations involved in the response to coronavirus (covid-19), for example, enabling notification to members of the public most at risk and advising them to self-isolate,” the department said in an explanatory note.

“The health and care system is facing an unprecedented challenge and we want to ensure that health organisations, arm’s length bodies and local authorities are able to process and share the data they need to respond to coronavirus (covid-19), for example by treating and caring for patients and those at risk, managing the service and identifying patterns and risks.”

Hancock told general practices and other healthcare bodies in a letter dated 20 March that issued the notice, “Action to be taken will require the processing and sharing of confidential patient information amongst health organisations and other bodies engaged in disease surveillance for the purposes of research, protecting public health, providing healthcare services to the public and monitoring and managing the covid-19 outbreak and incidents of exposure.”

Some general practices have posted privacy notices on their websites outlining the new measures. A typical notice says, “In order to look after your healthcare needs during this difficult time, we may urgently need to share your personal information, including medical records, with clinical and non-clinical staff who belong to organisations that are permitted to use your information and need to use it to help deal with the covid-19 pandemic.

“This could (amongst other measures) consist of either treating you or a member of your family and enable us and other healthcare organisations to monitor the disease, assess risk and manage the spread of the disease. Please be assured that we will only share information and health data that is necessary to meet yours and public healthcare needs.”

NHSX is developing a smartphone app, expected to be deployed in weeks, that instantly traces close contacts of people carrying the virus and advises them to self-isolate.

The notice requiring the data sharing measures will expire on 30 September unless extended in writing.