NHS Digital ceased sharing updates to the SPL with organisations after September 2021.
We previously shared relevant information from the SPL with organisations who have responsibilities for providing care and support to the patients on the List. This included:
- GP practices about their own patients on the List
- NHS hospitals about their own patients on the List
- healthcare staff in prescribed places of detention (for example prisons) about their own patients on the list
- other NHS organisations, government departments and local authorities for the purposes of the national and local response - this included the Cabinet Office who were responsible for providing the Extremely Vulnerable Persons Service which closed in September 2021
We also used and shared information for planning, commissioning and research purposes, including clinical trials, relating to coronavirus. This included sharing information with NHS organisations, government departments, other public authorities and research organisations.
We only shared identifiable information about those patients on the SPL where it was lawful for us to do so and under a terms of release letter which:
- detailed the terms of release and the agreed purposes for which the data could be used
- identified other organisations who may be permitted to use or receive the data and for what agreed purposes
- set out the lawful basis for sharing and use of the data
- obtained commitment from the recipient to the secure handling and management of the data, including its destruction once the agreed purposes had been met
In May and June 2022 NHS Digital informed recipient organisations that the SPL was closing. Where necessary, organisations were reminded of their responsibility as Controllers to destroy the data they held by 30 June 2022 or request to hold the data for other purposes. We envisage that there may be two reasons why an organisation might need to extend their Terms of Release:
- Need for continued COVID-19 purposes – in such cases organisations have been asked to provide an alternative legal basis both under the UK GDPR and to address the common law duty of confidentiality and meet all current standards to continue to process the data.
- Need for Public Inquiry – this option will require an organisation to have an alternative legal basis and meet all current standards to continue to process the data.
Where an organisation is providing direct care to a person and the information has been entered on to the person’s local health or care record, it would not be expected their health or care record would require deletion of the fact that they were previously on the SPL. In such cases a further Terms of Release will not be required.
We have also published and shared data from the List which we have anonymised, so that no individuals can be identified from that data. This enables the NHS and other organisations to use this anonymous data for statistical analysis and for planning, commissioning and research purposes as part of the response, or evaluation of the response, to coronavirus. Anonymous data may also be shared to respond to queries in relation to the COVID-19 Public Inquiry.
Read more details here about the organisations with whom we have shared information from the Shielded Patient List.