the opt-out information was not sent to NHS Digital
There's your problem right there.
Medical data must be opt IN. No exceptions. No bleeding heart stories about potential lives saved or medical breakthroughs etc. I bet not a one of you can tell who/what eventually accessed this private medical data and where it went/who else has copies/why. This sort of thing demonstrates exactly why opt OUT should not be permitted.