Decision

[withdrawn] Coronavirus (COVID-19): notice under regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 – NHSE, NHSI

Updated 30 June 2022

This was published under the 2019 to 2022 Johnson Conservative government

This decision was withdrawn on 1 July 2022

See the current Notice to organisations to share information.

Read NHS guidance for organisations on processing of confidential patient information when the COPI notices expire.

To:

Amanda Pritchard
Chief Executive Officer
NHS England & Improvement
Skipton House
80 London Road
London
SE1 6LH

10 February 2022

Dear Amanda,

The health and social care system is taking action to manage and mitigate the spread and impact of the current outbreak of COVID-19. Action to be taken will require the sharing and processing of confidential patient information by and with health organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak.

I am therefore writing to you to serve notice on NHS England & Improvement, under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 (COPI) to require NHS England & Improvement to process confidential patient information in the manner set out below for purposes set out in Regulation 3(1) of COPI (insofar as those purposes relate to the current outbreak of COVID-19).

Purpose of this notice

The purpose of this notice is to require NHS England & Improvement to process – as defined in Regulation 3(2) (including dissemination to organisations permitted to process confidential patient information under Regulation 3(3) of COPI) – confidential patient information for the purposes set out in Regulation 3(1) of COPI to support the Secretary of State’s response to COVID-19 (COVID-19 purpose).

I consider this notice is necessary to ensure that NHS England & Improvement will lawfully and efficiently process confidential patient information.

Requirement to process confidential patient information

I hereby provide NHS England & Improvement with notice under Regulation 3(4) that, for the purposes set out above, I require NHS England & Improvement to process confidential patient information.

NHS England & Improvement is only required to process such confidential patient information where it is:

• requested to do so by an authorised officer of the Department of Health and Social Care acting on my behalf or requested to do so by another organisation permitted to process confidential information under Regulation 3(3) of COPI (the Requestor)
• the confidential patient information is required to be processed for a COVID-19 purpose and will be processed solely for that COVID-19 purpose and in accordance with the restrictions set out in Regulation 7 of COPI
• from the date of this notice for the period up to 30 June 2022 (which includes a case where the dissemination of the information in question was authorised by a previous regulation 3(4) notice and began before the date of this notice but which continues on or after that date)

Notification when disseminating confidential patient information

NHS England & Improvement is requested when disseminating confidential patient information under this notice to remind recipients of confidential patient information of their responsibilities under COPI when processing the confidential patient information, including the restrictions which apply to their processing of it under Regulation 7 of COPI.

Recording of processing

A record should be kept of all data processed under this notice.

Review and expiry of this notice

If no further notice is sent to you by me, this notice will expire on 30 June 2022.

I am grateful for your continued support at this critical time.

Yours sincerely,

Simon Madden

On behalf of:
Secretary of State for Health and Social Care