Introduction

The National Data Opt-Out Service has been established to ensure that a mechanism is developed and available for Health and Social Care organisations to use that will enable a Patient’s preference to be honoured accordingly, e.g. if a Patient’s preference is to opt-out then their data is to be withheld from being shared from appropriate disclosures – this is known as the ‘Upholding’ of an opt-out.

Compliance, Assurance and Testing

At a high-level, Compliance, Assurance and Testing of the National Data Opt-Out will align with the following steps:

1. The NDOP Service Onboarding Team will provide Suppliers with the necessary information and materials to enable them to determine the feasibility of developing a technical product. This can be done with a combination of face to face and online sessions and by self-serving content from the Internet

2. Suppliers are prioritised for go live by approved process employed by the NDOP Service Onboarding Team

3. The NDOP Service Onboarding Lead will manage access to Path to live (PTL) environments

   1. Whilst connected to the INT environment, the Supplier will be expected to execute their own tests. The testing may be used as evidence to support the mitigation of risks identified in the Risk Log. Alternatively, SA may request tailored evidence in order to support their assurance activities

4. In parallel the ‘Supplier & Product information’ SCAL tab and Connecting Systems Risk Log will be completed by the Supplier. If the Supplier has an existing SCAL then this would be sent to them to ensure the details are correct.  The NDOP conformance tab would be inserted to the existing SCAL

5. SCAL completion and sign-off:

   1. In parallel with development and testing / technical conformance the Supplier will provide Supplier & Product information and all Service-specific sections in the SCAL

   2. The contents of the SCAL (as provided by the Supplier) will be reviewed by 'the Authority' stakeholders (co-ordinated by the Onboarding Lead) and any exceptions that are flagged e.g., ambiguous or incomplete Supplier responses to any requirements or questions, will be annotated and returned to the Supplier to resolve

6. Once the SCAL is signed off by the NDOP Service Onboarding Lead, the Supplier will be sent the legal document (Connection Agreement) for signature. This always involves the Supplier commitment to sharing the EUO AUP with all EUOs

7. The Supplier is now ready for a live deployment to a limited number of sites (known as First of Type), which will be managed by the NDOP Service Onboarding Lead with Live Services (for ‘release management’), an exception to this is GPIT NMEs, see note below

8. The Deployment Verification Criteria (DVC) for NDOP is:

   1. Stable running for a minimum of 14 days

   2. At least 1 report applying NDOP has been produced during DVP

Upon agreement that DVC has been met, the Supplier is then permitted to move to full rollout.

Note: New Market Entrants Foundation Suppliers will not be able to move to live service until the full foundation Solution has been assured. This will be managed by the Suppliers assigned delivery lead.

For further information or to onboard to National Data Opt-Out, please contact liveservices.operations@nhs.net

Requirements

National Data Opt-Out applies to all in-scope data from GP systems including any exports, extracts, releases, disseminations and disclosures from GP systems as defined by National Data Opt-Outs Operational Policy.

Supplier Solutions need to retrieve the National Data Opt-Out Status before using or disclosing data, which can be done over Message Exchange for Social Care and Health (MESH). Technical information below describes, how to access and use MESH to check for national data opt-outs:

Check for National Data Opt-outs Service

DCB3058 Compliance with National Data Opt-Outs contains further information on the Standard and information on the legal, strategic and policy context behind the requirements.

The final set of National Data Opt-Out requirements, v2.0 published April 2019, can be accessed below: 

Dependencies

Creating a compliant implementation requires implementing the following dependent interface standard:

• Messaging Exchange for Social Care and Health (MESH)

Roadmap