'Big Brother' and medical data

[Premi5]

https://www.opendemocracy.net/en/opendemocracyuk/matt-hancock-has-quietly-told-your-gp-hand-over-your-health-data-why/

Matt Hancock has quietly told your GP to hand over your health data. Why?

If you live in England, all your encounters with your GP – information about your physical, mental and sexual health – could be ‘sold’ to third parties

 

 

Phil Booth

 

 

From 1 July this year, if you’re registered with a GP in England, the government will be taking a copy of every medical event your GP recorded on their systems since you first registered with them. (Your children’s records, too, if you have children.)

According to the NHS website, the events – called ‘codes’ – it will collect include: “Data about diagnoses, symptoms, observations, test results, medications, allergies, immunisations, referrals, recalls and appointments, including information about physical, mental and sexual health”.

Every single one of these events will be linked to your NHS number, your full postcode and your date of birth. Does that sound like “anonymous” data to you? (The ‘pseudonyms’ that will be used to obscure those bits of information are readily reversible, and the body running the database freely admits it has the ability to do so.)

All your encounters with your GP, once copied to the central database, will be “disseminated” for payment to third parties, including companies outside the NHS. (In case you find that hard to believe, here’s this year’s price list for the data already held centrally, such as that of your hospital visits). Did you have any idea your medical data was worth so much... or so little?

Once it has been taken, your GP data – much more sensitive than data about hospital visits – will never be deleted.

You’d be forgiven for not knowing any of this, because the government is making little effort to tell you. Indeed, NHS Digital – the central NHS body that health secretary Matt Hancock last month ordered to extract all of this health data – appears not to have sent out a press release, announcing the programme via a news item on its own website on 12 May.

You might, at this point, be getting a sense of deja vu. The last time the government tried to get its hands on our GP data, through the notorious ‘care.data’ programme announced in 2013, there was an outcry from patients and professionals. The scheme collapsed, with the government unable – or unwilling – to convincingly reassure people about who exactly would end up having access to our GP records.

This new 2021 plan is the government's failed 2014 programme, 'care.data', on steroids

This new 2021 plan is care.data on steroids. It’s far bigger, taking far more data. It’s far more intrusive, collecting highly sensitive codes, such as those relating to sexual health or drug and alcohol history, that even care.data wouldn’t dare touch. And it’s being rushed out in far more of a hurry – with less notice, less communication, and less time to act than in 2013 – while we’re in a pandemic and GPs are “overwhelmed” with a backlog of care and delivering vaccinations, as the BBC reported on 27 May.

At least care.data sent a junk mail leaflet to every household in the land about its planned massive data slurp, kicking up such a stink that people got wind of how to opt out of it. Indeed, part of the reason for the scheme’s collapse is that so many people did exactly that.

So the main lesson that the government appears to have taken from the care.data debacle is that if you want to obtain people’s GP data, to share with whoever you see fit, you need to do so on the quiet.

NHS Digital’s ‘mythbusting’ web-page about data sharing confusingly directs people to a different, weak ‘opt-out’ link that won’t actually prevent your GP records being taken from 1 July.

So why does the government want your data so badly?

One reason is the good it can do. No one disputes that health data can be used to help with planning, in legitimate ethical research, or to improve systems for health and social care. But in order to preserve the trust that is necessary to the health of the health system, both doctor-patient confidentiality and public confidence, every use of patients’ data must be consensual, safe, and transparent. After all, your GP record is the most rich and most valuable kind of health data there is; while hospitals treat ‘conditions’ and discharge you, general practice builds lifelong care relationships – and records everything relevant to your medical history; be it your physical, mental or sexual health.

The other reason, and the one the government is talking about the least, is because it’s so valuable to others. To the “entirely new industries” the government’s life sciences adviser, John Bell, proposed in 2017 as part of its Life Sciences Industrial Strategy. To the profit-seeking corporations that are already gaining access to copies of patients’ hospital data – often via ‘information intermediaries’, who need only pay a one-off extra £10k to guarantee their customers’ names don’t show up in any public lists. And even to customers (firms and public bodies) who have broken the rules (or the law) in the past, despite a promise from the government after care.data that those who did so deliberately or repeatedly would face a "one strike" ban from any future access.

And it’s your GP data next.

The additional statutory protections the government added in 2014, limiting data-sharing to being used for the “promotion of health”, clearly haven’t stopped the international trade in patients’ data with US companies, pharma, even big tech – all of whom continue to access the data they’re so hungry for, via “sub-licensees”.

A look at the kind of companies that are already accessing the data, shows them offering services to their customers including market insights for commissioners, strategic market access, even selling back to the NHS... but still NHS Digital says “we don’t approve requests for marketing purposes”.

Maybe it doen’t. Not directly. But it does regularly hand millions of people’s linked hospital histories to companies that serve those who do. And that’s the very same approvals process it will be using for your GP data later this year.

It’s also instructive to look at what has happened to the GP data that has been gathered under the extraordinary pandemic ‘Control of patient information’ powers for nearly a year. We were reassured that COVID-related data would largely be analysed in a highly secure ‘safe setting’, preventing onwards use and dissemination. But MedConfidential's analysis of the official release registers show that nine times out of ten, that ‘safe setting’ has not been used.

So much for reassurances. Trust is not about the good you could do, it’s about the less savoury stuff that still gets done. And no process is secure or trustworthy if there are ways to get around it.

But save your anger at NHS Digital. It’s more scapegoat than instigator; as a statutory body it can, and must, do with data what Matt Hancock and Boris Johnson tell it to do.Hancock directed NHS Digital to do this and not tell you.

The government wants your GP data, and it hasn’t given GPs much of a choice – but you can do something. Opt out. By 23rd June.

[Premi5]

https://medconfidential.org/how-to-opt-out/?fbclid=IwAR2SSY8Ot2R45DU-FKj9Emo0wKiP01mTgHz6KRjAmky3XTd88p60VK4od4k

How to opt out

Choices available to you in the new GP data collection

None of the choices below will affect your medical care, or the data that is available for your care. A longer and different process is required for families with children or other dependents, which we walk you through.

If you live in England and want to stop your GP data leaving your GP practice for purposes other than your direct care, you can do so by filling in and giving or posting the form in step 1 to your GP:

1)  Protect your GP data: fill in and give this ‘Type 1’ form to your GP practice [PDF] [or MS Word] – this form allows you to include details for your children and dependants as well. This is the most urgent step; the deadline to get your form to your GP practice is 23 June 2021, according to NHS Digital.

2)  If you want to stop your non-GP data, such as hospital or clinic treatments, being used/sold for purposes other than your direct care (e.g. for “research and planning“) you must use this process:

• • If it’s just for yourself, use NHS Digital’s online National Data Opt-out process – this process only works for individuals aged 13 and over.

• • If you have children under 13, you need to fill in this form [PDF] and e-mail or post it back to NHS Digital – this form works for both you and your children.

• • If you have an adult dependant for whom you have legal responsibility, you must use this form [PDF] and send it back to NHS Digital on their behalf.

There is no deadline for step 2, the National Data Opt-out (i.e. your non-GP data), but the sooner you do it, the sooner it takes effect. The National Data Opt-out will not stop your GP data being extracted by the new GP data collection.

N.B. If you opted out of care.data in 2014, then you shouldn’t need to do anything now. As most people did both a ‘Type 1’ opt-out and what is now a National Data Opt-out, you can check your NHS Digital opt-out status online at NHS Digital. Your GP opt-out status will probably match the opt-out status shown there; although if you’re not sure, giving a a ‘Type 1’ form to your GP Practice now doesn’t have any risk.

If you don’t have access to a working printer, you can ask the NHS Digital Contact Centre to post you the forms you need. Their phone number is 0300 303 5678 and they are open Monday to Friday, 9am to 5pm (excluding bank holidays).

Or, if you prefer, you can e-mail printer@medConfidential.org with your postal address and we will post you copies of the paper forms, for free, no questions asked. If you don’t have e-mail, you can text your address to us on 07980 210 746. If you can afford to make a small donation to support us in offering this service to others, we have a donation page. We will, of course, only use your details to send you the forms you want and will delete them as soon as we have done that. (medConfidential is registered with the ICO to process personal data in this way.)

As new information or actions that you can take become available, we inform people via our mailing list:

 

Join our mailing list

We will not share your details with anyone else.

---

GP data: As your ‘front door’ to the NHS, your GP holds the lifetime history of your GP care; all of your prescriptions, your diagnoses, your ailments, your tests and referrals – and the context for them all as well. You have the choice whether information from your GP record is copied outside of your GP practice for purposes other than your direct medical care. (This choice was created in 2010, and is between you and your GP only.)  Your GP treats you; other parts of the NHS tend to treat ‘a condition’.

Other data: The National Data Opt-out is intended to cover your data being copied from all other care providers, and NHS Digital, for purposes beyond your direct care. This choice will in time cover all hospitals, etc. but can at present only be set via NHS Digital, the option to do so via your GP having been withdrawn in 2018. (N.B. The National Data Opt-out does also cover your data leaving bodies such as Public Health England, which used to run the database of every patient who has ever had cancer, as well as other databases.)

Opting out: While in 2014 you could opt out of secondary uses (i.e. non-care uses) of your NHS data with a single form, now you must use at least two different processes – three, if you have children or dependents.

---

Re-use of your records beyond your direct medical care:
Choices not available to you

Exercising the opt-out choices linked above will protect you from some risks – certainly more risks than if you do not express those choices. Both opt-outs do precisely what the Department of Health claims they do, but they do not protect you as they could.

These choices do not, for example, currently:

• Prevent the sale of your hospital history to companies;
• Prevent the use of prescribing data by pharmaceutical marketers to influence your doctors;
• Prevent public bodies doing work with the data they have for commercial companies, such as tobacco companies;
• Prevent mistakes by those who have copies of your medical information from the above, cf. the Partridge Review recommendations.
• Prevent the non-clinical body NHS England insisting that you opt out all over again if it decides to create a new project…

As of 2021, some NHS bodies’ actions are still not compliant with the 2018 Data Protection Act, which implemented the General Data Protection Regulation (GDPR) into UK law. And several of the important safeguards promised in 2014 are still entirely missing:

• The commercial re-use loophole remains open;
• No ‘single-strike’ penalties are in place;
• No significant contractual sanctions have been applied, despite serious breaches;
• No Regulations have been laid to guide the Confidentiality Advisory Group;
• NHS Digital is still releasing huge volumes of linked, individual-level patient histories rather than using safe settings;
• The sole independent advisory group on collecting GP data – GPES IAG, the group that first raised concerns about care.data – was abolished without a full replacement.

The best way to have confidence in how your wishes will be respected, and in how your data will be used next month, is to see how your data was used last month. This, for all the reasons we list above, remains impossible.