Keeping your personal data safe is central to the GM Care Record

THIS INFORMATION ON OPTING OUT OF THE GM CARE RECORD CAN ALSO BE DOWNLOADED AT THIS LINK.

The Greater Manchester Care Record (GMCR) is used by health and care professionals to make sure you receive the best possible treatment and care.

An anonymised view of the data is also used to support important research and the planning of health and care services.

The information below explains how you can opt out of your information being included in the GMCR to support your care and treatment, or how you can opt out of your anonymised data being using for planning and research.

Benefits of sharing your care records

The Greater Manchester Care Record allows health and care staff to see more up to date limited information regarding your health and care history. It includes vital information such as allergies, medication, test results, and any interventions you may be receiving, or have had in the past.

When staff are more informed, it helps them to make the right decisions quickly, providing better, safer care. This is especially important during emergency situations or out of normal working hours.  Only staff involved in your care, and who have a legitimate reason are allowed to view your records.

It is your choice to be part of the Greater Manchester Care Record. Everyone registered with a Greater Manchester GP is automatically opted-in to limited information from their health and care records being accessible via the Greater Manchester Care Record unless they have previously opted out of sharing their GP records.

If you are happy for your records to be available, you don’t need to take any action.

The implication of not having a GM Care Record

You have the right to opt out of having a shared care record.  However, we want anyone who does opt out, to understand that it could negatively impact the care the NHS and social care services can provide. If health and care staff can’t access your medical record:

• It might mean that tests or investigations are repeated because results from other organisations can’t be accessed.
• You may need to repeat the same information to different staff.
• The staff treating you won’t be able to see what has happened to you in different parts of the NHS. They will only be able to see the record in their organisation such as that particular hospital or GP practice.
• They might not know what medication you are taking.
• It may delay treatment.
• It will not stop health and care staff contacting one another to ask questions about your history.
• You may not be conscious or able to share details about your medical history if you arrive at hospital.

How to opt out of your data being included within the GM Care Record

Contact your GP who can discuss the option with you and can apply a code to your GP record to prevent a shared care record being created for you.  You can opt back in at any time by informing your GP.

How to opt out of your data being used for planning and research

The GM Care Record has been created to ensure you receive tailored, individual care and treatment but we also create an anonymised view of your data to allow us to plan health and care services and carry out vital research to improve patient care through the development of new drugs and treatments.

You can still have a shared care record to support your treatment and care, but you can opt out of your data being used for planning and research in 2 ways:

1. Stop your GP practice from sharing your data for planning and research

This is called a Type 1 Opt-Out.

• To do this you need to fill in an opt-out form and return it to your GP practice. Either Download a Type 1 Opt-out form, or contact your GP surgery who may be able to assist you to complete the form on the telephone or may be able to provide you with a printed copy.
• Only your GP surgery can process your opt-out form. They will be able to tell you if, and when, you have been opted out.

If you choose a Type 1 Opt-out, your GP will not share your data for research and planning but your data will still be used to support your direct care.

Find out more about Type 1 Opt-out from NHS Digital’s transparency notice

Once the Type 1 Opt-Out has been applied by your General Practice the GM Care Record system will acknowledge this Opt-Out and automatically remove your record from further processing for planning and research purposes.

2. Stop NHS Digital and other health and care organisations from sharing your data for planning and research

This is called a National Data Opt-Out.

To opt out online or find out more, visit Make your choice or contact the NHS Digital Contact Centre by ringing 0300 303 5678.

If you choose this opt-out, NHS Digital and other health and care organisations will not be able to share any of your personal data with other organisations for research and planning, except in certain situations. For example, when required by law.

If you want to check if you have opted out, you can enter your details again at Make your choice or check your settings in the NHS App.

You can opt out, or opt back in again, at any time.

Right to Object under data protection law
Under data protection law e.g., the UK GDPR you have the right to object to the use of your data in certain circumstances and to have your objection considered. More information can be found on the Information Commissioner’s website here.

GDPR (UK):
The General Data Protection Regulations (UK) requires us to have a legal basis for processing information that can be used to identify an individual, including pseudonymised data, but not anonymised data. For further information please visit: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/

To process personal data, as defined by the GDPR (UK) the following lawful bases from Article 6 are used, and may be used for either data related to individual care or data related to secondary uses:

6.1(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

In certain circumstances the following may be used when sharing information is necessary to protect an individual from harm:

6.1(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person

Additionally when more sensitive data is processed, we require a further legal basis as laid out by Article 9. Sensitive data is defined by GDPR (UK) as special categories of personal data requiring further protection, for example racial or ethnic origin and health data. The following lawful bases from Article 9 are typically used:

For the purposes of improving individual care the condition which lifts the prohibition on processing of the special category of data is:

9.2(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.

If the data processed for the purposes of planning NHS Services, improving patient safety or evaluating government and NHS Policy is still considered to be personal data under GDPR the condition which lifts the prohibition on processing of the special category of data is:

9.2(i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy

If the data processed for the purposes of research (for example to understand more about disease, or develop new treatments) is still considered to be personal data under GDPR the condition which lifts the prohibition on processing of the special category of data is:

9.2(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject

In certain circumstances the following may be used when sharing information is necessary to protect an individual from harm:

9.2(c) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent

Data Protection Act 2018 (DPA):
The DPA 2018 is legislation that further defines sections of the GDPR specifically for the UK.

Schedule 1, Part 1, condition(s) for processing:

(2) Health or social care                       

For health or social care:

(d) provision of health care or treatment

(e) provision of social care

Schedule 1, Part 1 makes further reference to the legal basis in the GDPR and whether or not the condition is met for the DPA.

In relation to Secondary Uses (Secondary Use Definition)
Schedule 1, Part 1, condition(s) for processing:

(2) Health or social care                       

(3) Public health

(4) Research

For health or social care:

(d) provision of health care or treatment

(e) provision of social care

(f) management of health care systems or services or social care systems or services

For the purpose of public health:

(b)(i) by or under responsibility of a health professional                

(b)(ii) by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law

For research purposes:

(a)  is necessary for archiving purposes, scientific or historical research purposes or statistical purposes

(b)  is carried out in accordance with Article 89(1) of the GDPR, and

(c)  is in the public interest

Common Law Duty of Confidentiality (CLDC):
The Common Law Duty of Confidentiality is not a codified piece of legislation but is an amalgamation of case law that allows data to be processed via specific legal gateways.

For individual care purposes implied consent is used as a reasonable expectation for the use of health and care records.

For uses beyond health and care the following gateways may be used:

Explicit Consent – Requesting consent directly from the individual that the record refers to.

Overriding Public Interest – When sharing the information can be clearly evidenced to be of overwhelming interest to public safety.

Other Statutory or Legal Duty – In the cases of court orders for instance or required by routes such as those below:

Confidentiality Advisory Board for section 251 approval – Section 251 of the NHS Act 2006 allows the use of confidential patient information for audit or medical research when it is not possible to use anonymised information and when seeking consent is not practical. An application needs to be made for this approval.

In order to process data for secondary uses and research from the GMCR we have made an application to the NHS Health Research Authority’s Confidentiality Advisory Group (CAG) to allow our GMCR system supplier (Graphnet Health Ltd.) to remove identifiers e.g. name, address, date of birth etc.  This will enable us to then use that de-identified data to support our planning and research without the ability to identify any individual patients.  You can find out more about how we use data for research and planning by clicking on this link. 

The CAG approval reference is as follows:

• 22/CAG/0169 – Non research
• 22/CAG/0170 – Research

Control of Patient Information Notice:

A notice from the secretary of state for health that disclosure is required for the public benefit, as an example this was used during the Covid-19 Pandemic.

Further Related Legislation:
The Health and Social Care (Safety and Quality) Act 2015 inserted a legal Duty to Share Information In Part 9 of the Health and Social Care Act 2012.

Official authority: