Local authorities sharing information with NHS England

A new legal data provision notice provides the legal basis under the common law duty of confidentiality for local authorities to share the specific information set out in this guidance with NHS England.

The legal bases under the UK General Data Protection Regulation (GDPR) that support this sharing are Articles 6(1)(c) legal obligation and Article 9(2)(h) management of the social care system.

Details of the information that local authorities are required to share with NHS England are available in the adult social care client level data (CLD) specification. The CLD data specification can be found on the adult social care client level data communication and information page by expanding the top menu option labelled ASC CLD specification.

A local authority should submit the information it holds if it is listed in the data specification, including information which has been shared by another provider. For example, where the local authority has a contract with a provider also involved in the individual’s care, the local authority should submit information arising from this arrangement to NHS England.

You do not need to ask service users for their consent for this information sharing. In common law, there is a duty of confidentiality which means that when someone shares information in confidence it must not be disclosed without some form of legal authority or justification. In practice, this usually means explicit consent is required for a purpose beyond individual care.

However local authorities are being required to share information by law (as set out in the new data provision notice). This data provision notice sets aside the common law duty of confidentiality and therefore explicit consent is not required.

The right to object or opt-out of this data sharing does not apply to the information shared by local authorities with NHS England. Where there is a legal requirement to share information, neither the UK GDPR right to object nor the national data opt-out apply.

Local authorities must update their privacy notice and other transparency materials, such as service user information leaflets. Transparency materials must set out what data is being shared, for what purposes, and what people’s rights are. NHS England’s privacy notice has been updated.

The new direction only applies where information is being shared with NHS England. Where a local authority needs to share confidential information with another organisation a clear legal basis must be in place.

Local authorities should check, with their Integrated Care Board (ICB) or Integrated Care System (ICS) partner organisations, what is planned to enable the legal sharing of information across the ICS for purposes beyond individual care, for example for risk stratification. Advice should also be sought from IG leads and Caldicott Guardians as appropriate.

NHS England will share the information that it collects from local authorities with other organisations such as local authorities, ICBs and the Department of Health and Social Care to benefit health and care. Wherever possible, NHS England will share anonymous data. Identifiable information can only be shared by NHS England where there is a clear legal basis and appropriate approvals in place.

Local authorities will receive the data they submitted with data quality checks completed and missing NHS numbers traced.

Local authorities can also request access to the pseudonymised data (with identifiers removed and replaced with a pseudonym) with links to other NHS England commissioning datasets, to support with their duty to monitor and manage the local care system.

The Data Access Request Service (DARS) provides further information about the process for requesting access to information held by NHS England.