Pseudonymising NHS Continuing Healthcare Assessment Packs – UK GDPR-compliant anonymisation per DPA 2018 Sch.1 Pt.1
An NHS Continuing Healthcare (CHC) assessment pack is a multi-domain clinical and funding record constituting special-category data under DPA 2018 Schedule 1 Part 1, linking a patient's identity to diagnoses, care needs, and eligibility determinations. CHC records are retained for 8 years under NHS RMC 2023; the CQC registers over 41,000 providers. anonym.legal pseudonymises patient and assessor identifiers, preserving domain scores for appeal review.
When this applies
This task applies when CHC assessment packs are reviewed by appeal panels, NHS England regional teams, or independent advocates who require the clinical evidence base and domain scoring but do not need to identify the individual patient. Under the NHS Records Management Code of Practice 2023, CHC records are classified as adult health records and must be retained for 8 years from the end of care.
How anonym.legal handles it
- Upload the CHC assessment pack (PDF or DOCX) to anonym.legal.
- The engine identifies patient name, date of birth, NHS number, address, and the names of named assessors and care coordinators.
- Each individual is pseudonymised consistently across all sections of the pack.
- Domain scores, clinical evidence citations, and eligibility determinations are preserved in clear text.
- The decision rationale and any dissenting assessor opinions are preserved in full.
- A reversible mapping table is produced with UK data residency.
What you provide
- NHS Continuing Healthcare decision support tool and assessment documents
- Any accompanying care plan or needs assessment report
Limitations & cautions
- CHC appeal documentation submitted to NHS England must contain the patient's real identity — the pseudonymised version is for preparation and internal review only.
- The tool does not assess the clinical or legal correctness of the eligibility determination — obtain specialist CHC advocacy or legal advice. Breaches can attract fines of up to £17.5 million or 4% of annual global turnover under DPA 2018 s.157.
- Named NHS care coordinators in the pack are pseudonymised; confirm that the pseudonymised version still identifies assessors by role for audit trail purposes.
FAQ
Can the pseudonymised assessment pack be shared with a patient's independent advocate?
Sharing with an advocate authorised by the patient would typically involve re-identifying the relevant patient. If the advocate requires the pack for training purposes only, the pseudonymised version may be appropriate — confirm the purpose and lawful basis with your Data Protection Officer. The 8 Caldicott Principles (updated 2013, Principle 8 added 2020) require that data sharing is justified and proportionate.
Are the domain scores and eligibility determination preserved intact?
Yes. All domain scores, priority / severe / high / moderate classifications, and the eligibility determination are preserved; only the personal identifiers of the patient and named assessors are pseudonymised. According to the ICO's 2021–22 guidance, pseudonymised records remain personal data under UK GDPR and must be governed as such.
Does the tool handle multi-disciplinary assessment packs from different clinicians?
Yes. Input from multiple named assessors across different clinical specialties is pseudonymised consistently; each assessor receives a distinct pseudonym. The NHS Records Management Code of Practice 2023 requires CHC records to be retained for 8 years from the date of the eligibility decision.