GPs instructed to make anonymised patient data available for research

The Government has instructed GP practices to make anonymous patient data available to a data sharing platform to further medical research. 

A letter from NHS England to GPs said health secretary Wes Streeting has issued NHSE with ‘directions’ – a legal instrument – for practices to join the OpenSAFELY data analytics service by instructing their system providers to make the data available. 

OpenSAFELY, developed by the University of Oxford, was used by researchers during the pandemic to analyse anonymised data from GP records and help identify new Covid-19 treatments, but it will expand to cover non-Covid research.

The BMA said that OpenSAFELY has the full support of GPC England and the BMA’s joint GP IT committee.

So far, the platform has enabled 195 research projects into a variety of Covid-related issues, including the demographics of those who get the virus and the efficacy of treatments.

Under the directions, NHSE has issued a Data Provision Notice (DPN) to practices which they have six weeks to ‘review and comply with’ by informing their systems provider.

The GPC said that the functionality to allow an opt-in for EMIS rolled out last week and the functionality for SystmOne is also already in place, while Medicus is ‘out of scope currently’.

Practices have to comply with the data provision notice by law but the GPC clarified that the data will not be able to be accessed until practices, as the data controller, ‘have signalled approval’.

According to the directions, the purpose is ‘for users approved by or on behalf of NHS England’ to access patient data held by existing GP IT systems suppliers, though the data is ‘pseudonymised’ and can only be accessed for set purposes. 

These include research, health and social care policy ‘where agreed on a project specific basis’, and ‘health surveillance’.  

A GPC statement said: ‘The original Covid-19 service grew out of the pandemic and was unique in the sense that it functioned as a trusted research environment where the most disclosive data (the GP data) stayed in the system suppliers’ systems, with the GP remaining as data controller, but, via the data direction/DPN in force, made those data available for querying by NHSE, with the subsequent outputs coming under the controllership of NHSE.

‘There is a level of transparency with OpenSAFELY not seen elsewhere – this has been a key factor in gaining our support.’

GP practices will remain the data controller for the pseudonymised records, according to NHS England. 

However, once this data is queried by ‘approved users’ or linked to other NHS England datasets, NHS England would become the controller for the linked dataset. All projects using the service are approved by or on behalf of NHSE. 

Researchers looking to access the data would need a ‘favourable opinion’ from an NHS Health Research Ethics Committee, according to OpenSAFELY. 

Its scope covers ‘all general practices across England using TPP and Optum (formerly EMIS Group PLC) health record systems’, according to the accompanying DPN.

Patients who have registered a type 1 opt-out form with their GP practice will be exempt from the data sharing.

In February, Pulse reported that NHS England had shared draft documents with GP IT representatives to extend the legal basis of OpenSAFELY to make it a ‘general purpose resource’ for academic research.

And earlier this month, the Government’s 10-year plan for the NHS confirmed a ‘single patient record’ will be available on the NHS App by 2028, bringing a patient’s medical records and other relevant information into one place.

It will introduce new legislation placing a duty on providers, including GP practices, to make the information they record about patients available to them.