26 March 2020

Covid-19 – Notice under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002

The NHS applies strict rules around the sharing of patient identifiable data (PID), but in order to track and record information on COVID-19 impacts, and plan service provision, on 20 March 2020 a letter has been issued by the Department of Health & Social Care in relation to COVID-19 patient data.  Below is some guidance regarding the implications of this notice for CNWL.

The general message of the notice is clear – that any data processing/sharing of confidential patient information which can be demonstrated to have a legitimate COVID-19 related purpose is to take place without impediment from the date of the letter until the date of expiry of the notice (30 September 2020), unless the notice is otherwise extended or rescinded. This is important to track the progress and impacts of the pandemic, and will enable NHSE to plan accordingly.

This notice refers to data sharing of COVID-19 related information both within CNWL, but also data sharing with other organisations, as follows:

  • the Public Health Laboratory Service;
  • persons employed by or engaged for the purposes of the health service;
  • other persons employed or engaged by a Government Department or other public authority in communicable disease surveillance.

It is important to note that the notice also makes it clear that this is not a blanket de-restriction of data protection processes. All normal legislation and governance still applies, including responses to information requests (FOI, SAR, etc). Further guidance can be obtained from the Information Governance Team.

The notice also makes clear that in any situation where data sharing is being requested for a COVID-19 purpose, this request must be clearly documented. Therefore, please ensure that in any situation where data sharing is requested for a Covid-19 purpose that this is recorded appropriately in the clinical record.