DC164-National Data Opt-Out Policy

Registration Number: {{org_field_registration_no}}

National Data Opt-Out Policy

1. Purpose

The purpose of this policy is to outline {{org_field_name}}’s commitment to complying with the National Data Opt-Out requirements set by NHS England. The National Data Opt-Out ensures that individuals have the right to opt out of their confidential patient information being used for research and planning purposes beyond their direct care. {{org_field_name}} is dedicated to managing service users’ data ethically, securely, and in full compliance with legal and regulatory frameworks.

This policy provides guidance on how we implement and manage the National Data Opt-Out process, ensuring that service users’ rights are respected while maintaining high standards of care and regulatory compliance.

2. Scope

This policy applies to:

All staff, including carers, managers, and administrative personnel handling service user data.
Service users and their families.
Third-party organisations and data processors engaged in data handling.

It covers:

Legal and regulatory compliance requirements.
The process of checking and applying opt-out preferences.
How data is handled, stored, and shared.
Staff responsibilities and training.
Monitoring, auditing, and policy review.

3. Legal and Regulatory Framework

This policy is written to comply with the law and regulatory requirements that apply to adult social care providers in England, including:

UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (lawful, fair and transparent processing; security; accountability; individuals’ rights).
The common law duty of confidentiality and the Caldicott Principles (confidentiality and “need-to-know” sharing across health and care).
The National Data Opt-Out policy and the DCB3058 Information Standard: “Compliance with National Data Opt-outs”, published under section 250 of the Health and Social Care Act 2012 (mandatory requirements for relevant health and adult social care organisations to uphold national data opt-outs when using/disclosing confidential patient information for purposes beyond individual care).
Health and Social Care Act 2008 (Regulated Activities) Regulations 2014, including:
- Regulation 17 (Good governance): the provider must operate effective systems and processes (including audit and risk management) to assess, monitor and improve the quality and safety of the service, including information governance controls.
- Regulation 11 (Need for consent): consent must be obtained and recorded lawfully where required, and decision-making must follow the Mental Capacity Act where a person lacks capacity.
Where applicable to our systems/contracts, the Data Security and Protection Toolkit (DSPT) (assurance against the National Data Guardian’s data security standards for organisations with access to NHS patient data and systems).

4. When the National Data Opt-Out Applies to {{org_field_name}}

The National Data Opt-Out must be upheld only when {{org_field_name}} uses or discloses confidential patient information (CPI) for purposes beyond an individual’s direct care, such as research or health and care service planning.

For most domiciliary care activity, information sharing is for direct care (for example, sharing information with a GP/community nurse/social worker to support an individual’s care plan). Direct care sharing is not affected by the National Data Opt-Out.

Examples where the opt-out may apply in domiciliary care (if CPI is used/disclosed beyond direct care):

Providing identifiable care records to a third party for service planning, analytics, audit or evaluation that is not part of the person’s individual care.
Disclosing CPI to a research programme (unless a legal exemption applies).

Where the opt-out applies, {{org_field_name}} will ensure a compliant process exists (including checking opt-out status where required) before any disclosure/use takes place.

5. Understanding the National Data Opt-Out

The National Data Opt-Out allows individuals to choose, in specified circumstances, that confidential patient information from their health and adult social care records is not used or shared for purposes beyond their individual care, such as:

Healthcare and adult social care research
Planning and improving services
Certain audits and evaluations that are not part of direct care

The National Data Opt-Out does not apply where the information use/sharing is:

For direct care (care and treatment of the individual)
Required or permitted by law (for example, safeguarding, statutory duties, or court orders)
For certain public health purposes where legally required/permitted (for example, communicable disease control), or where an exemption applies under national policy/guidance

6. Managing National Data Opt-Out Requests

{{org_field_name}} ensures compliance with the National Data Opt-Out in the following ways:

Informing Service Users:

{{org_field_name}} will provide clear information to service users (and, where appropriate, their representatives) about how their confidential patient information may be used and shared, and their right to set a National Data Opt-Out choice via NHS channels (for example via the NHS App or the national “Your NHS data matters”/National Data Opt-Out pages).

Staff must not promise to “set” a National Data Opt-Out on behalf of a service user within NHS systems. The opt-out choice is managed through the national service; we will signpost and support access where needed, and record in our care records that information was provided and signposting was offered.

Checking Opt-Out Preferences:

Where {{org_field_name}} intends to use or disclose confidential patient information for purposes beyond direct care and the disclosure is within the scope of the National Data Opt-Out, we will check opt-out status using the Check for National Data Opt-outs Service (via MESH or another approved route supported by NHS England) before the disclosure/use takes place.

Checks will be performed:

Case-by-case before any planned disclosure beyond direct care, and/or
As a scheduled batch check aligned to the frequency of any recurring disclosures beyond direct care.

Evidence of checks (date, dataset/disclosure, method, outcome, and authoriser) will be retained as part of our governance records.

Upholding Opt-Outs:

Where a national data opt-out is identified as applicable, {{org_field_name}} will ensure the relevant individual’s confidential patient information is excluded from the dataset/disclosure for research or planning (unless a defined national exemption applies).

We will document the decision, the lawful basis for the disclosure/use, and the outcome of the opt-out check within our disclosure/audit trail.

7. Handling and Storing Data Securely

To meet UK GDPR, confidentiality requirements and good governance expectations, {{org_field_name}} will ensure that:

Confidential patient information and personal data are stored securely with role-based access and least privilege.
Data is protected in transit and at rest (for example, encryption where appropriate).
Where we use processors, we have appropriate UK GDPR Article 28 data processing contracts in place (note: do not use “DPA” as an abbreviation here because it is easily confused with the Data Protection Act).
Where we share data controller-to-controller (e.g., with NHS bodies/local authorities), we use appropriate information sharing agreements and document the purpose, lawful basis, and safeguards.
We complete Data Protection Impact Assessments (DPIAs) when processing is likely to result in high risk to individuals’ rights and freedoms.
If we have access to NHS patient data/systems under our contracts, we will maintain compliance with the Data Security and Protection Toolkit (DSPT) and associated data security standards.
Information is retained and disposed of securely in line with our retention schedule and contractual/legal requirements.

8. Roles, Responsibilities and Training

The Registered Manager is accountable for ensuring this policy is implemented and evidenced through governance and audit (CQC Regulation 17 – Good governance).
The Data Protection Officer (DPO) (where appointed/required) provides advice and oversight for data protection compliance, DPIAs, and breach management.
An Information Governance (IG) Lead (or equivalent) will maintain the opt-out process, the disclosure log, and evidence of checks.
All staff handling service user information must complete annual training in confidentiality, data protection, and information security, and must follow the opt-out checking process where applicable.
All actual or suspected data breaches must be reported immediately via internal incident reporting. Where the breach meets the legal threshold for external notification, the organisation will notify the relevant authority (e.g., the ICO where required) within statutory timescales and document decisions and actions taken.

9. Monitoring, Compliance, and Auditing

To evidence good governance and compliance, {{org_field_name}} will:

Maintain a disclosure log for any use/disclosure beyond direct care (purpose, dataset, lawful basis, opt-out applicability decision, check method, outcome, approver).
Conduct quarterly governance reviews/audits of disclosures beyond direct care and confirm that opt-outs were upheld where applicable, in line with DCB3058 requirements.
Review updates to NHS England guidance, relevant information standards, and DSPT requirements (where applicable), and update processes accordingly.
Keep an inspection-ready “evidence pack” (latest policy version, audit results, training compliance, disclosure log samples, DPIAs where relevant, incident logs and learning).

10. Policy Review

This policy will be reviewed at least annually and sooner if there are material changes to:

DSPT requirements where applicable

NHS England National Data Opt-Out policy/guidance or operational processes

DCB3058 or other relevant information standards published under section 250 HSCA 2012

CQC regulations/guidance relating to governance, consent, record keeping or information handling (including Regulations 17 and 11).

Responsible Person: {{org_field_registered_manager_first_name}} {{org_field_registered_manager_last_name}}
Reviewed on: {{last_update_date}}
Next Review Date: {{next_review_date}}
Copyright © {{current_year}} – {{org_field_name}}. All rights reserved.