Skip Navigation
Search site

This is our old website. Most information can now be found on our new NHS Digital website. Let us know what you think.

Your personal information choices

Health and social care information is used in a number of ways to support your personal care and to improve health and social care services for everyone.

When you attend a health or social care provider in England the clinicians and administrators you see will record information about your care. You can decide with your clinician on how your data will be used for your direct care. The second Caldicott Report defined direct care as a clinical, social or public health activity concerned with the prevention, investigation and treatment of illness and the alleviation of suffering of individuals. It includes supporting individuals' ability to function and improve their participation in life and society, the assurance of safe and high quality care and treatment through local audit and the management of untoward or adverse incidents.

There are choices you can make about how information is used, and you can choose to opt out of your information being shared or used for any purpose beyond providing your care.

If you do not want your information to be used for any purpose beyond providing your care you can choose to opt-out. If you wish to do so, please inform your GP practice and they will mark your choice in your medical record. There are two types of opt-out. You can withdraw either opt-out at any time by informing your GP practice.

Type 1 opt-outs

If you do not want information that identifies you to be shared outside your GP practice, for purposes beyond your direct care you can register a type 1 opt-out with your GP practice. This prevents your personal confidential information from being used other than in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease.

Type 2 opt-outs

NHS Digital collects information from a range of places where people receive care, such as hospitals and community services. If you do not want your personal confidential information to be shared outside of NHS Digital, for purposes other than for your direct care you can register a type 2 opt-out with your GP practice.

A direction from the Secretary of State sets out the Department of Health policy as to how type 2 opt-outs must be applied and instructs NHS Digital to apply type 2 opt-outs from 29 April 2016.

It was not possible for NHS Digital to honour type 2 opt-outs made before this date. This means that information may have been shared without respecting these opt-outs between January 2014 and April 2016. NHS Digital  publishes registers of approved data releases showing where data has been released.

When we have collected information about your type 2 opt out from your GP practice we use that to create a record of all current type 2 opt outs. We then use that record to check against any set of data that is to be made available by NHS Digital  to another organisation and remove all of your personal confidential information if it is in that data set, before that data are made available.

The direction sets out the scope of when your type 2 opt out does not apply such as when there is a legal requirement to release information, or where you have given your consent to a specific release of your information.

There are also some limited circumstances, which are set out in the direction, when we don't apply your type 2 opt out to information made available. These are cases where:

• The Secretary of State for health has identified the information flow is very important.

• There are complex technical barriers that make it very difficult to apply opt outs.

For more information on how we collect and use opt-out information see Applying Type 2 Opt Outs

For more information about care records and how to access them see NHS Choices. For details about how public bodies must make information available, see the model publication scheme published by the Information Commissioner's Office.

Subject Access Request (requesting information about you)

Under the Data Protection Act 1998 anyone can ask to see the information that an organisation holds about them. To ask us what information we hold you should complete and send us a Subject Access Request form, see policies and procedures.

Close iCM Form