Assuring transformation data – a guide on fair processing and managing individual objections

Version 1.2, August 2023

The NHS Commissioning Board (NHS CB) was established on 1 October 2012 as an executive non-departmental public body. Since 1 April 2013, the NHS Commissioning Board has used the name NHS England for operational purposes.

About this guide

Assuring Transformation (AT) data collects information about people with a learning disability and autistic people with a mental health condition, in mental health inpatient settings, giving commissioners broad oversight of their care.

This document outlines what NHS commissioners (Integrated Care Boards, NHS England’s specialist commissioning teams and NHS provider collaboratives) that participate in the AT data collection are legally required to do. In summary they are required:

  • to inform those that are receiving care, and where appropriate their families/carers, on what they should do if they do not want their information to be included in the AT data*; and
  • if an individual, and where appropriate their family/carer, objects to their information being included, to inform them of the process for handling objections.

Background on the AT data collection

Why we collect the AT data

The decision to collect and track data for people with a learning disability and autistic people was agreed as part of the Winterbourne Review Concordat: Programme of Action, with the following requirements for commissioners and providers:

  • commissioners should hold, manage and maintain a register of people with a learning disability and autistic people in mental health hospitals that covers their current care provision;
  • providers should provide data to populate the registers to ensure that patients receive the right care and that their care is tracked and managed across providers and commissioners; and
  • individuals’ care plans must be reviewed regularly to ensure they continue to meet their needs.

* Children under the age of 16 can give consent if they are considered to have sufficient competence and understanding to fully appreciate what is involved (Gillick competence). Where this is not the case, , the person with parental responsibility should make this decision. For those aged 16 and over with mental capacity they should make the decision. If a person over the age of 16 lacks mental capacity, informed consent should be sought from someone with parental responsibility, the holder of a valid and applicable Lasting Power of Attorney or a court appointed health and welfare deputy. If there is no lawful representative, a best interest decision should be taken on the person’s behalf, applying the Mental Capacity Act (MCA) 2005 and its most recent Code of Practice.

What the AT data covers

The AT data is collected by NHS England and is collected from NHS commissioners. It covers all people with a learning disability and autistic people with a mental health condition that are being cared for in mental health inpatient settings and includes: the number of people in mental health inpatient settings; reasons for admission; numbers of discharges and admissions; whether individuals have a care plan, a care co-ordinator, regular care reviews, regular visits by their commissioner and access to independent advocacy; the age, gender and ethnicity of individuals; and the type of inpatient setting that is providing their care. The AT data is published monthly by NHS England.

The Confidentiality Advisory Group (CAG) review applications made under Regulations enabled by Section 251 of the NHS Act 2006. The Secretary of State can approve an application and set out the conditions of that approval. The application and approval will state who can use the data, what they can use the data for and what data is included.

The approved applications [reference CAG 8-02(a-c)/2014] provide the legal basis for the flow of AT data. This enables the flow of confidential patient information without consent from organisations to commissioners about the services that they provide for people in inpatient beds with a learning disability and autistic people of:

  • any age
  • any level of security (non-secure/low/medium/high)
  • any status under the Mental Health Act (informal/detained) However, the information cannot be shared if:
  • the individual has objected to the use of their information as part of the AT data and the objection has been upheld; or
  • the individual is unable to make their own decision, until a decision has been made by others who may have a legal right to make the decision for the individual or a best interest decision is made under the Mental Capacity Act (see Appendix A on assessing capacity) and that decision has been upheld.

More information on CAG and the application can be found at here.

The list of applications approved by the Secretary of State can be found here.

The NHS constitution tells patients:

‘You have the right to be informed about how your information is used.’

It also states:

‘You have the right to request that your confidential information is not used beyond your own care and treatment, and to have your objections considered, and where your wishes cannot be followed, to be told the reasons including the legal basis.’

This means that

  • providers need to inform individuals in inpatient settings how any information that identifies them, and is collected about them as part of their care, is used for anything other than their direct care e.g. for research purposes. This is called ‘fair processing’ and is a legal requirement of the Data Protection legislation. The requirement to notify patients is ‘patient notification’ and is a condition of approval by the Secretary of State in the use Section 251.
  • NHS commissioners are required to have a process in place to handle individuals’ objections to their data being used for anything other than their direct care.
  • NHS commissioners need to ensure that providers are offering information to individuals and/or their carers about the data collection and the option to object to their information being included. Commissioners should seek assurance from providers that this is happening e.g. review examples of materials advising individuals about the use of their data. They can also use contractual levers e.g. the NHS Standard Contract requires providers to comply with the law.

Ensuring material is accessible for individuals

As part of this, healthcare providers need to ensure that any materials – to enable ‘patient notification’ – are accessible for people with a learning disability and autistic people.

Information should inform individuals whilst assuring them that any identifiable information is only shared with NHS England.

Providers also need to ensure that the information includes details of:

  • who is asking for their data i.e. the healthcare provider will be sending a summary of their care to the organisation that pays for their care;
  • why their data is being collected (see 2.1) and how it supports their care; and
  • how they can find out more information about objecting to their information being included, with a contact point at their local commissioner.

To support providers and commissioners, NHS England has produced examples of patient notification leaflets in easy-read and plain English that enable commissioners to add local contact details for queries. These must be made available to patients and their families/carers and must include local contact details explaining who to contact if a patient wishes to raise an objection (the patient’s commissioner). These are available on the NHS England website here.

Managing individual objections

As outlined above, an individual has the right to object to their information being included in the AT data collection and to have their objections considered. Personal and confidential information may be disclosed, only where the balance of public interest favours disclosure.

Under Section 251 CAG 8-02(a-c)/2014, if an individual objects, their data cannot be used as part of AT collection. However, it is still important for commissioners to consider whether the public interest in processing the data for the safety of patient(s) overrides the common law duty of confidence owed to an individual patient.

Understanding the implications of objecting

When a person is deemed to have mental capacity to make the decision and objects to their data being included in the AT data set, commissioners should explain the following:

  • the AT data collection process has been developed with the views of people with a learning disability and autistic people, families, advocacy groups and carers
  • it helps to improve care and prevent instances of poor care
  • the impact of the individual’s information being excluded is that it will not be possible for NHS England to track their care across providers or to have broad oversight of their care. This may mean they do not access reviews such as Care (Education) and Treatment Reviews and the subsequent additional review and challenge about the reasonable adjustments and differentiated care that may be required due to the individual’s autism or learning disability.

Process for handling objections

If an objection is raised, the commissioner (Integrated Care Board, NHS England or NHS provider collaboratives) needs to consider the basis for the objection and gain assurance that:

  • the person is assessed as having mental capacity to make an objection;
  • there is no evidence to suggest that the person has made the decision to object as a result of inappropriate influence by the provider or by another individual; and
  • there will be no harm or distress caused to the person as a direct consequence of them not being included on the AT dataset.

The commissioner will need to convene a panel to decide whether it is appropriate to continue processing the data and the panel should include:

  • an appropriate learning disability and autism professional;
  • a case manager or care-co-ordinator from the commissioning organisation with responsibility for the person’s care;
  • a relevant clinician with responsibility for the person’s care; and
  • the Caldicott Guardian or an appropriately nominated deputy (such as the medical director) to advise the board about the decision and the rationale.

The panel will consider the factors set out above. If the panel is assured that a) the person has the capacity to make the decision; b) has not been influenced to object and c) understands the implications of not being included in the AT dataset, then it should uphold the objection unless there is a further legitimate reason for overriding it, which should be explained to the person and set out in writing.

Whilst the commissioner is making a decision, the patient’s data can continue to be processed under the ‘public interest override of the common law duty of confidentiality’, but not CAG application. This effectively overrules the objection until it has been considered.

This ensures that no harm comes to the patient, that their care is monitored and that the AT data continues to cover everyone in in-patient settings.

The patient must be informed of the outcome and it should be recorded. If an objection is upheld, the Learning Disability and Autism Programme’s Data and Analytics Team at NHS England should be informed via their secure group mailbox at

The Data and Analytics team will also be able to provide additional information and advice if required.

Appendix A: Background information on capacity

This appendix is for information only.

The NHS Code of Confidentiality specifies that:

‘If a patient is … unable… to give consent or to communicate a decision, the health professionals concerned must take decisions about the use of information. This needs to take into account the patient’s best interests and any previously expressed wishes, and be informed by the views of relatives or carers as to the likely wishes of the patient. If a patient has made his or her preferences about information disclosures known in advance, this should be respected.’

Any issues of capacity must be managed separately to the ‘objections’ process, using the more detailed guides referenced below.

Assessing mental capacity

It should never be assumed that people over the age of 16 are not able to make their own decisions because they have a learning disability or are autistic. Adults are always presumed to be capable of making health and social care decisions unless there is evidence that this is not the case.

Where any doubt exists, the capacity of the person to make the decision should be assessed, drawing on both the individual’s carers and the assistance of specialists, such as learning disability teams and speech and language therapists as required. It is important to remember that capacity can change over time for some individuals.

Practice should be in line with the Mental Capacity Act and the related Code of Practice.

Further detailed guidance is available from the British Medical Association (BMA) as part of their mental capacity toolkit.

Individuals who lack capacity

Following confirmation that a patient lacks capacity and cannot provide consent, a decision can be made in the best interests of the patient. The BMA specifies that ‘a best interests’ decision is not an attempt to determine what the person would have wanted, although this must be taken into account. It is an objective test of what would be in the person’s best interests, taking into consideration all the relevant factors.’

A further toolkit card from the BMA covers this aspect.