The strategic outline business case for the controversial care.data programme is yet to go to Treasury for approval and involves a spend of more than £50m.

A paper going to the Informatics Services Commissioning Group next week gives an update on the programme, which involves extracting a monthly set of identifiable data from GP practices, covering patient demographics referrals and prescriptions.

This will be stored in the ‘safe haven’ of the Health and Social Care Information Centre and linked with data from secondary care and other care sectors to create new Care Episode Statistics.

A report from the care.data programme board says the strategic outline case for the scheme has been developed and is with HSCIC subject matter experts for their review and comment.

It is due to be updated and distributed to programme board members for review in the middle of this month and will then go to the HSCIC corporate assurance panel and the ISCG for approval.

The final hurdle will be gaining Treasury approval for the programme spend, which is more than £50m.

The paper says the extractions will take place between March and May of this year in a phased roll-out.

“This phased approach over the three months extracts from 1% of GPs, then 10%, then 100% to enable quality checking and full testing of the process,” it explains.

Care.data hit the headlines this month with the start of a national leaflet drop informing patients about the data-sharing programme. Leaflets are due to go to every household over four weeks and a patient support line has been set-up, at a total cost of £2m.

A group of more than 40 UK medical research charities have also launched a campaign to support the initiative.

The leaflet drop was arranged in response to the concern of GPs, who as data controllers are responsible for informing patients when their identifiable information leaves the practice.

Patients are able to opt-out of the scheme by telling their GP who can add a Read code to their record, however privacy campaigners have complained that an opt-out form should have been included with the leaflet.

The HSCIC’s Independent Advisory Group last year approved NHS England’s request to extract the data and share this with commissioners in the NHS.

However, an additional request to make the CES data set available to a wider audience for a wider range of purposes was sent back last September with a series of recommendations. This request includes sharing non-identifying data with universities, commercial companies and health care charities.

One of the recommendations is that additional information is needed about which types of organisations would be eligible to receive the data and that applications to the HSCIC for disclosure of CES “should be subject to appropriate governance controls”.

“The IAG emphasised that publishing details of all organisations receiving CES data, and the specific purposes for which the data would be used, would be important to maintain public trust,” a report of the meeting says.

“It was suggested that insurance organisations would not be eligible to receive data, but it was pointed out that some organisations might provide healthcare services as well as insurance and that it could be difficult to manage this overlap.”.

NHS England’s revised customer request is due to go back to the IAG for approval in March.