This notice describes how we may use your information to protect you and others during the coronavirus (COVID-19) outbreak.

It supplements our main Privacy Notice for Patients

The health and social care system is facing significant pressures due to the COVID-19 outbreak.

Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health.

Information will also be vital in researching, monitoring, tracking and managing the outbreak.

In the current emergency it has become even more important to share health and care information across relevant organisations. 

Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak.

Using this law the Secretary of State has required these health organisations and GPs to share confidential patient information to respond to the COVID-19 outbreak:

  • NHS Digital
  • NHS England and Improvement
  • Arms-length bodies (such as Public Health England)
  • Local authorities

Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data.

For further information, please see:

During this period of emergency, opt-outs will not generally apply to the data used to support the COVID-19 outbreak, due to the public interest in sharing information.

This includes national data opt-outs - please see the NHS website: Choose if data from your health records is shared for research and planning.

However, in relation to the Summary Care Record, existing choices will be respected.

Where data is used and shared under these laws your right to have personal data erased will also not apply.

It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak. 

In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111.

We may also use the details we have to send public health messages to you, either by phone, text or email. 

During this period of emergency we may offer you a consultation via telephone or video- conferencing.

By accepting the invitation and entering the consultation you are consenting to this.

Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation. 

We will also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak.

For further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the COVID-19 response, please see the NHSX website: How data is supporting the Covid-19 response.

NHS England and Improvement and NHSX have developed a single, secure store to gather data from across the health and care system to inform the COVID-19 response.

This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves - please see the NHS website: Tell the NHS about your current experience of coronavirus.

All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.

To support the Government response to Coronavirus (COVID-19), we are sharing data on the medicines prescribed and administered to patients in hospital settings with NHS Digital.

Hospital trusts are legally required to share medicines and prescribing data with NHS Digital under the Health and Social Care Act 2012.

NHS Digital will analyse the data they collect and securely and lawfully share the data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for COVID-19 response purposes only.

Data is also being shared with the local CCG (Clinical Commissioning Group) to assist the most vulnerable patients.

The data that is collected and used refers to patient data but may also include staff data in the event that a member of staff is confirmed or suspected of having the virus.

We have a duty to keep our patients and our staff safe.

To do this we will need to include some sharing of staff data so that we can protect individuals, manage the workforce and staffing levels, and also offer staff support as required.

In such circumstances where you tell us you're experiencing COVID-19 symptoms we may need to collect specific health data about you.

Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.

For key worker testing and how the data is used, please see the Department of Health and Social Care website: Testing for coronavirus: privacy information.

We may amend this privacy notice at any time, so please review it frequently.

The date at the top of this page will be amended each time this notice is updated.

Transparency Notice for Hospital Trusts - Sharing of Electronic Prescribing Medicines Administration (EPMA) data for COVID-19 response

To support the government response to Coronavirus (COVID-19), we are sharing data on the medicines prescribed and administered to patients in hospital settings with NHS Digital.

The health and social care system is facing significant pressures due to the COVID-19 outbreak.

Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health.

Information will also be vital in researching, monitoring, tracking and managing the outbreak of COVID-19.

In the current emergency it has become even more important to share health and care information across relevant organisations.

Our legal basis for sharing data with NHS Digital

NHS Digital has been legally directed to collect and analyse patient data to support the government's response to the COVID-19 pandemic.

NHS Digital will become the controller under the General Data Protection Regulation 2016 (GDPR) for the personal data collected and analysed jointly with the Secretary of State for Health and Social Care under the COVID-19 Public Health Directions 2020.

Hospital trusts are legally required to share medicines and prescribing data with NHS Digital under the Health and Social Care Act 2012. More information about this requirement can be found in the Data Provision Notice issued by NHS Digital to hospital trusts.

Under the GDPR, our legal basis for sharing this personal data with NHS Digital is Article 6(1)(c) - legal obligation and our legal basis for sharing personal data relating to health (known as special category data) is Article 9(2)(g) - substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the COVID-19 Public Health Directions 2020.

The type of personal data we are sharing with NHS Digital

The data shared with NHS Digital will include what medicines have been prescribed to patients in hospital settings, how and when the medicine was taken by the patient (administration), the reasons for prescribing if this is available (known as indications) and the patient's NHS number.

Where available the data will indicate what stage of the patient's journey through the hospital the data relates to (admission, inpatient, discharge, outpatient). 

Where the sharing of identifiable patient data is restricted by law, the Human Fertilisation and Embryology Act 1990 (as amended by the HFEA 2008) (we refer to this as legally restricted data) and The NHS Trusts and Primary Care Trusts (Sexually Transmitted Diseases) Directions 2000 (we refer to this as sensitive data below), NHS Digital when landing the data will remove identifiable patient data on behalf of the Trust from any rows containing such legally restricted and sensitive medicines data in accordance with an agreed Data Processing Agreement.

This ensures that no personally identifying data on legally restricted and sensitive medicines is available for analysis by NHS Digital.

How NHS Digital will use and share your data

NHS Digital will analyse the data they collect and securely and lawfully share the data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for COVID-19 response purposes only.

These purposes includes using medicines prescribing and administrations data to support identification of patients who might be at higher risk of harm if they contract COVID-19, supporting research into medicines and severity of disease of COVID-19 positive patients including medicines that provide greater protection, or in turn may be linked to poorer outcome.

Providing data on treatments prescribed for COVID-19 patients, and data to highlight patterns of prescribing before, during and after COVID-19.

NHS Digital has various legal powers to share data for purposes relating to the COVID-19 response.

It is also required to share data in certain circumstances set out in the COVID-19 Directions.

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the COVID-19 purpose will be shared.

Organisations using your data will also need to have a clear legal basis to do so and will enter into a data sharing agreement with NHS Digital.

Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital Coronavirus (COVID-19) Response Transparency Notice

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used.

This is because during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your rights over your personal data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see: