Decision

[withdrawn] COVID-19: notice under regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002, which were made under sections 60 (now section 251 of the NHS Act 2006) and 64 of the Health and Social Care Act 2001 – Biobank

Updated 30 June 2022

This decision was withdrawn on

See the current Notice to organisations to share information.

Read NHS guidance for organisations on processing of confidential patient information when the COPI notices expire.

© Crown copyright 2022

This publication is licensed under the terms of the Open Government Licence v3.0 except where otherwise stated. To view this licence, visit nationalarchives.gov.uk/doc/open-government-licence/version/3 or write to the Information Policy Team, The National Archives, Kew, London TW9 4DU, or email: psi@nationalarchives.gov.uk.

Where we have identified any third party copyright information you will need to obtain permission from the copyright holders concerned.

This publication is available at https://www.gov.uk/government/publications/coronavirus-covid-19-notification-of-data-controllers-to-share-information/coronavirus-covid-19-notice-under-regulation-34-of-the-health-service-control-of-patient-information-regulations-2002-biobank

To:

All GP practices in England whose IT systems are supplied by TPP or EMIS

11 February 2022

The health and social care system is taking extensive action to manage and mitigate the spread and impact of the current outbreak of COVID-19. Today, I am writing to GP practices in England, whose IT systems are supplied by The Phoenix Partnership (TPP) or Egton Medical Information Systems (EMIS), under Regulation 3(4) of COPI to require them to release primary care patient data, in respect of UK Biobank’s consented participants only, to UK Biobank, for the purposes set out in Regulation 3(1) of COPI.

This notice requires all GP practices, whose IT systems are supplied by TPP or EMIS, to instruct them to release the relevant primary care data to UK Biobank for purposes related to the outbreak of COVID-19.

If no further notice is sent to you by me, this notice will expire on 30 June 2022.

Purposes related to the outbreak of COVID-19 include, but are not limited to, the following:

  • understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks
  • identifying and understanding information about patients or potential patients with or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19
  • understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of COVID-19 and the availability and capacity of those services or that care
  • monitoring and managing the response to COVID-19 by health and social care bodies and the government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
  • delivering services and information to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of healthcare and adult social care services
  • research and planning in relation to COVID-19

A record should be kept of all data processed under this notice.

Why we are doing this

UK Biobank has explicit consent from all its c.500,000 participants to be provided with, hold and process their healthcare records (both primary and secondary).

UK Biobank has secured frequent feeds from UK Health Security Agency for the confirmed COVID-19 cases and these data will be incorporated into the main UK Biobank database for researchers to study determinants of COVID-19 infection. However, as the COVID-19 situation worsens it is likely that many presumed cases will not be tested (especially among the elderly) and many individuals will remain at home (even when their symptoms are severe).

Consequently, the ability of UK Biobank to be able also to incorporate primary care data into its resource is likely to be of enormous value to obtain a more complete assessment of the determinants of COVID-19 outcomes. This is something that we need to continue to do now.

Key points

  • the validity of UK Biobank’s participant consent for this purpose has been reviewed and endorsed by the Information Commissioner’s Office
  • only primary care data from UK Biobank’s consented participants will be extracted
  • the proposed extraction is fully consistent with the provisions of the UK GDPR
  • UK Biobank only release de-identified data to its approved researchers (for the conduct of health-related research, relating to COVID-19 in this case, which is in the public interest) and so patient confidentiality is maintained
  • the extraction will relate to the primary care coded data, including data on diagnoses (important for co-morbidities), on prescriptions (important for drug interactions) and on investigations (for pathology reports)
  • following the instruction provided above, there is no further action that any GP practice needs to undertake
  • this notice is limited to those GP practices whose IT systems are supplied by TPP or EMIS because UK Biobank has appropriate agreements in place with these companies

Yours faithfully,

Simon Madden

On behalf of:
Secretary of State for Health and Social Care

Back to top