{{org_field_logo}}

{{org_field_name}}

Registration Number: {{org_field_registration_no}}

---

National Data Opt-Out Policy

1. Purpose

The purpose of this policy is to outline {{org_field_name}}’s commitment to complying with the National Data Opt-Out requirements set by NHS Digital. The National Data Opt-Out ensures that individuals have the right to opt out of their confidential patient information being used for research and planning purposes beyond their direct care. {{org_field_name}} is dedicated to managing service users’ data ethically, securely, and in full compliance with legal and regulatory frameworks.

This policy provides guidance on how we implement and manage the National Data Opt-Out process, ensuring that service users’ rights are respected while maintaining high standards of care and regulatory compliance.

2. Scope

This policy applies to:

• All staff, including carers, managers, and administrative personnel handling service user data.
• Service users and their families.
• Third-party organisations and data processors engaged in data handling.

It covers:

• Legal and regulatory compliance requirements.
• The process of checking and applying opt-out preferences.
• How data is handled, stored, and shared.
• Staff responsibilities and training.
• Monitoring, auditing, and policy review.

3. Legal and Regulatory Framework

This policy aligns with the following legislation and standards:

• National Data Opt-Out Policy (NHS Digital) – Governs patient data use for research and planning.
• General Data Protection Regulation (GDPR) 2018 – Ensures lawful processing of personal data.
• Data Protection Act 2018 – Outlines legal responsibilities for data controllers and processors.
• Health and Social Care Act 2012 – Governs the use and disclosure of patient information.
• Care Quality Commission (CQC) Fundamental Standards – Requires service providers to respect service users’ data rights.
• Caldicott Principles – Ensures confidentiality and secure data sharing in health and care settings.

4. Understanding the National Data Opt-Out

The National Data Opt-Out allows individuals to opt out of their confidential patient information being used for purposes beyond direct care, such as:

• Research studies and clinical trials.
• Planning and improving healthcare services.
• Audits and evaluations by NHS bodies.

It does not apply to data sharing required for:

• Direct care, such as communication between health and care providers.
• Public health emergencies (e.g., COVID-19 response).
• Legal requirements (e.g., safeguarding concerns or court orders).

5. Managing National Data Opt-Out Requests

{{org_field_name}} ensures compliance with the National Data Opt-Out in the following ways:

• Informing Service Users:
  • All new service users receive information about their right to opt out.
  • Existing service users are notified during annual care reviews.
  • We provide service users with leaflets, digital resources, and access to NHS Digital’s National Data Opt-Out Service.
• Checking Opt-Out Preferences:
  • Before sharing confidential patient information, staff check opt-out preferences using NHS Digital’s MESH API system.
  • Regular batch checks are performed to ensure up-to-date records.
• Applying Opt-Outs:
  • When an opt-out is confirmed, the service user’s preference is recorded in our electronic care management system.
  • All non-essential data sharing for research or planning purposes is restricted.

6. Handling and Storing Data Securely

To comply with GDPR and Caldicott Principles, {{org_field_name}} ensures that:

• Confidential patient data is encrypted and stored securely.
• Only authorised personnel have access to personal data.
• Data processing agreements (DPAs) are in place with third parties.
• Regular data protection impact assessments (DPIAs) are conducted.
• Information sharing is only done under lawful conditions.

7. Staff Responsibilities and Training

All staff handling service user data must:

• Be aware of the National Data Opt-Out requirements.
• Complete annual data protection and confidentiality training.
• Follow organisational protocols for checking opt-out status before data sharing.
• Report any data breaches or security concerns immediately to the Data Protection Officer (DPO).

8. Monitoring, Compliance, and Auditing

To ensure compliance, {{org_field_name}}:

• Conducts quarterly audits on data-sharing activities to verify opt-out compliance.
• Regularly reviews policies and procedures in line with NHS Digital updates.
• Engages with external auditors and regulatory bodies (e.g., CQC inspections) to demonstrate compliance.
• Maintains a National Data Opt-Out register to track and manage service user preferences.

9. Policy Review and Updates

This policy is reviewed annually or when significant changes in legislation or NHS Digital guidance occur. Updates are communicated to all staff, and additional training is provided where necessary.

---

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.