An undertaking to comply with the Data Protection Act 1998 has been signed by HSCIC. The ICO has found that patients were offered an opportunity to opt out from their data being shared with other organisations, but that the opt outs were not implemented. HSCIC have agreed a series of steps to remedy this.