Guidance

Diabetic eye screening: use of personal information

Updated 17 October 2024

What sort of information does the NHS Diabetic Eye Screening Programme hold about me?

Your GP provides your information to the programme because they have a duty to make sure you receive an invitation for eye screening as part of your diabetes care.

The information the programme has about you is:

• your name

• date of birth

• contact details

• NHS number

• details of your GP

• information to help establish your preferred language and contact method

• whether you might need large print documents

• whether you have been diagnosed with Type 1 or Type 2 diabetes

The programme might also hold information that allows your invitation to be based on clinical need. This includes your ethnicity and the date you were identified as having diabetes.

Who will see information about me?

• staff involved in the administration of the programme

• staff who carry out the screening process – including administering eye drops, checking vision, taking your history, taking photographs of your eyes and grading the photographs

Screening staff are either employed by the GP practice, an NHS trust or other NHS body, optometrists, self-employed ophthalmologists or staff employed by independent companies. The screening programme will provide you with a list of non-NHS personnel and companies if you are concerned in any way about who will see information about you. You should let programme staff know if you have any concerns about a particular individual or company. If you are referred to hospital for further assessment, we will forward information about you to the hospital so they know as much about your history as possible.

Clinical auditors and others involved in quality assurance assess the work of the screening programme to make sure the programme is operating effectively. To do this they may need access to your data.

Fully anonymised data may be used nationally to carry out research to try to improve the way diabetes is managed in the long term. Any request to use identifiable information for research purposes requires the involvement of the programme’s confidentiality advisory group to make sure all necessary agreements are obtained.

Problems may occasionally occur in the software which supports the programme. The software suppliers do not normally need to see any information identified to a specific individual. But if there are problems with the software the suppliers may need to receive some basic patient identifiable information to ensure the correct information is maintained by the programme securely. Software suppliers who work with the NHS are bound by requirements of confidentiality and should be supervised by NHS staff if they need to look at information linked to a named individual.

Your results and screening information will be sent to your GP.

How can I opt out of my data being transferred to the screening programme?

If you do not want your GP to provide information about you to your local diabetic eye screening programme you should contact your GP.

You should be aware that local programmes are unable to invite patients for screening who withdraw their consent to the transfer of their patient information. This is because it is not possible for local programmes to provide a safe and reliable method of invitation if they do not have reliable information from GPs.

Your GP may ask you to sign a form confirming that you wish to opt out of screening. They will need to inform the local programme that you have withdrawn your consent. They will only do this once so that you do not receive any further screening invitations.

GP2DRS IT system

GP2DRS is a system for automating the sharing of patient information between general practices and local diabetic eye screening programmes.

GPs are responsible for referring eligible patients with diabetes for diabetic eye screening, by communicating each patient’s contact details to their local programme.

Local programmes collate the information received from GPs and other health professionals to maintain an up-to-date list of eligible patients in order to invite them for screening. To support this, the GP2DRS system enables GPs to share patient information with local programmes in an accurate and timely fashion so patients can be invited for screening.

GP2DRS uses the General Practice Extraction Service (GPES) provided by NHS Digital to obtain the information of eligible patients from computer systems used by GPs. GP2DRS stores this information and provides local programmes with secure access to their patients so they can ensure their records are kept up to date.

Patient records are shared on the basis:

• that it is necessary for a medical purpose
• of implied consent

Consent is implied from patients being made aware that their information needs to be shared in order for them to receive direct care. When a patient is diagnosed with diabetes, clinicians will normally explain that they will be invited for diabetic eye screening. The patient will also be made aware that their details will be passed to a local programme. Patient information is not provided by GP computer systems where a patient has withheld their consent to the transfer of their data.

What information GP2DRS uses and why

GP2DRS obtains relevant patient information for eligible patients on a monthly basis from GP practices in England that are signed up to the GP2DRS system.

It identifies patients who are:

• diagnosed with diabetes
• aged 12 or over
• registered with a GP in England
• not withholding their consent to the transfer of their information

GP2DRS obtains and uses the following information about each eligible patient so they can be identified and invited for screening:

• name
• address
• sex
• date of birth
• GP practice
• NHS number and first language
• diagnosis of diabetes
• consent status to the transfer of information

GP2DRS obtains and uses the date on which any change is recorded to a patient’s diabetes status. This enables the system to calculate whether a patient has a current diagnosis of diabetes. However, GP2DRS does not obtain or provide a patient’s diagnosis date because this clinical information is not required to identify those patients who should be invited for screening.

Screening providers cannot infer the earliest date for a patient’s ‘diagnosis date’ from their ‘recorded status change date’.

GP2DRS obtains and uses other demographic information, including the patient’s ethnicity, their previous screening attendance dates, preferred language and if they need an interpreter.

GP2DRS compares the information received each month with the data received previously in order to highlight:

• patients who are new to the local programme (such as those who are newly diagnosed with diabetes or newly moved into the geographical area of the local programme)

• patients with changes to their details (including changed names or moved house)

• patients who are no longer within the screening cohort (such as those who have moved outside the geographical area of the local programme or have withdrawn their consent to the transfer of their information)

This allows local programmes to update their patient records more easily and systematically.

GP2DRS stores patient information on an ongoing basis to ensure local programmes can access up-to-date patient records. PHE itself does not access patient records and does not directly contact patients.

How GP2DRS protects the information it uses

The information GP2DRS collects is securely transmitted from general practices (via NHS Digital) to the GP2DRS database. The GP2DRS database complies with all national guidance on the secure storage of patient information. Local programme access to information on the GP2DRS database is restricted and protected with firewalls and secure user authentication in line with national guidance that ensures only authorised users can access information from designated computers.

PHE and local programme staff are bound by clear legal and professional obligations to protect the confidentiality of the information they collect and use. As well as limiting the amount of personal information we hold, we make sure local programme staff can only see the information that relates to their programme and which is essential for them to do their job.

Who GP2DRS shares information with and why

GP2DRS shares patient information with local programmes so patients can be invited for diabetic eye screening using accurate and up-to-date information. This information is shared through a secure web portal which allows local programmes to update their patient records systematically. If GP2DRS identifies that an individual is no longer within the list of patients it previously provided to a local programme then it shares this fact with that programme.

Local programmes are unable to invite patients for screening who withdraw their consent to the transfer of their patient information. This is because it is not possible for local programmes to provide a safe and reliable method outside GP2DRS to transfer patient information from general practices.

Your personal information and your rights

By explaining the important reasons why we use personal information, and the careful steps we take to protect confidentiality, we hope patients will be content for their data to be processed in this way. However, if they do not wish to have their information transferred via this system they should contact your GP.

If you would like any further information on this system please contact the screening helpdesk:

Population screening helpdesk

UKHSA Screening
Floor 5
Wellington House
133-155 Waterloo Road
London
SE1 8UG

Email [email protected]

Helpdesk phone number 020 3682 0890

The helpdesk is not for media enquiries and does not have access to screening results. For queries about results, contact your GP or local screening service. Order screening leaflets at www.gov.uk/phe/screening-leaflets.