Following widespread criticism and the launch of a crowdfunded legal challenge, the UK government has delayed its plan to create a centralised store of data pulled from GP records in England.
Plans to move the data to a central NHS Digital database were announced on 12 May, with the Department of Health originally planning to start collecting data from 1 July. A two-month delay was announced yesterday and a new launch date set for 1 September. Patients can opt out at any time but must do so before the launch to stop any past data being transferred to the new system.
Amidst concerns that patients will stop trusting GPs with sensitive information if their health data is placed into the database, some senior GPs have called on colleagues to refuse to hand over patients’ personal data. Thirty-six doctors’ surgeries in Tower Hamlets, east London, have agreed to withhold the data when the collection begins.
While the benefits of collecting the data for research purposes have been widely acknowledged, critics are concerned that the public will not be able to make a decision about their data privacy with informed consent. The Royal College of General Practitioners and the British Medical Association released a joint letter expressing their concerns. They said, “It is unreasonable and inappropriate for it to be left to GP practices to communicate with patients at a time of extreme workload pressures and focus on the COVID-19 vaccination programme.”
Why does the UK government want to collect data?
Credit: Markus Spiske / Unsplash
To improve healthcare services, the NHS uses patient data from GP medical records in England every day. The General Practice Data for Planning and Research data collection aims to improve how this information is shared. NHS Digital’s website says this data will be used to:
- Inform and develop health and social care policy.
- Plan and commission health and care services.
- Take steps to protect public health, like managing and monitoring the coronavirus pandemic.
- In exceptional cases, provide individual care.
- Enable healthcare and scientific research.
Critics say the data collection plan is being rushed to capitalise on pandemic-related health panic.
“We should be wary of them doing this in the middle of the pandemic,” Dr Paul Bernal, associate professor in information technology, intellectual property and media law at the University of East Anglia Law School, says. “They’re trying to take advantage of the general public feeling that we’ve got to deal with health, so there’ll be more positivity about gathering health data at a time like this than at other times. The idea that this is in any sense urgent in relation to the pandemic is a red herring. It’s clearly not going to be used to inform decision making about how we deal with the pandemic.”
There are also concerns that the data transfer could be used for exploitative reasons. “There are people within the field of public health who would like to have more data to serve the public good,” adds Bernal. “But there are also people who know the potential of data for exploiting for financial gain or for reasons of control, and those people have been licking their lips at the prospect of getting health data for a very long time.”
How will my identity be protected during the data transfer?
Credit: Google Images
When your data is collected, any information that could directly identify you, like an NHS number, General Practice Local Patient number, full postcode and date of birth, will be given unique codes produced by de-identification software before the data is given to NHS Digital.
Known as pseudonymisation, this process should mean that no one is able to directly identify a patient using the data. In data terms, this means the data collected would be categorised as ‘de-personalised’, not anonymous. For individuals to be totally anonymous, the data would need to be irreversibly altered in a way that ensures the data subject cannot be identified directly or indirectly.
In ‘certain circumstances’ where there is a valid legal reason, NHS Digital can use the same de-identification software to convert unique codes back to data that can directly identify you. Only NHS Digital will have the power to do this, but this means that the data could become personally identifiable in specific situations, like if an individual consented to their identifiable data being shared with a clinical trial. This process is subject to independent oversight by the Independent Group Advising on the Release of Data (IGARD).
How will my data be used?
NHS Digital will analyse the national data sets to produce national statistics and management information, like public dashboards about healthcare. The website says, “We never publish any patient data that could identify you. All data we publish is anonymous statistical data.”
As there is no exhaustive list of who can request access, some are concerned that the data could be sold off to any number of companies.
However, there are concerns that embedding this information into national statistics could reinforce bias already present in the data. For example, if medical information has been collected with racial or gender bias, this will be absorbed into the data and could result in inaccurate and prejudiced data reports. “We know that data held may be biased, we know that GPs may not be recording information on a non-discriminatory basis,” explains Bernal. “If biased data is sucked up and used for machine learning, then you get a biased outcome. The assumption is that the data that’s being sucked up will be fair, accurate and appropriate, but it probably won’t be.”
Who will be able to access the data?
Any request to access the patient data – except the anonymous aggregate statistical data – will be reviewed by NHS Digital’s Data Access Request Service to assess whether they have a legal basis to use the data and to ensure that the data will be used safely, securely and appropriately. The Independent Group Advising on the Release of Data (IGARD) will scrutinise this process. Any approved organisation will enter a data sharing agreement with NHS Digital to regulate how the data is used.
Credit: Louis Reed / Unsplash
There are a large number of organisations who can request access to the data, including NHS England and NHS Improvement; primary care networks; clinical commissioning groups and integrated care organisations; local authorities; the Department of Health and Social Care and its executive agencies, like Public Health England; research organisations, including universities, charities, clinical research organisations and pharmaceutical companies.
What does concern us is the fact that it seems they’re almost trying to sneak it through because they’re rushing it, rather than giving people a chance to find out about it.
Any data shared will be in its uniquely coded form unless a request necessitates providing the data in an identifiable form. As there is no exhaustive list of who can request access, some are concerned that the data could be sold off to any number of companies.
“Frankly, we can’t know who they have sold it to in the past and are selling it to right now,” Phil Booth, founder of advocacy group MedConfidential, says. “As soon as they publish the big spreadsheets, we convert it and put it up on They Sold It Anyway, we can see the legitimate researchers, universities and hospitals in there, but you also see a bunch of commercial companies and they aren’t saying ‘we’re not going to sell it to commercial companies’.”
Some GPs are worried that the data transfer will impact doctor-patient dynamics. Dr Rosie Shire, a GP in Cheshire and spokesperson for Doctors’ Association UK, says, “We’re obviously concerned about patients being able to give consent to their data to be used like this and how that is going to affect the relationship between the GP and the patient, there is concern that it will erode trust.”
Although a selection of private sector organisations will be able to get permission to see the data, the government says the data cannot be used ‘solely’ for commercial purposes or for insurance, marketing, promoting or selling products or services, or market research.
What is the government’s legal basis for this?
For the analysis, collection, publication or sharing of patient data, strict laws must be adhered to. The UK General Data Protection Regulation (GDPR) requires that the government explain what legal provisions allow them to process patient data.
The Secretary of State for Health and Social Care Matt Hancock has directed NHS Digital to collect patient data from GP practices. Hancock and NHS Digital are joint controllers of this data. Under this direction and the Health and Social Care Act 2012, GP practices are legally required to share the requested data with NHS Digital. Sections 260 and 261 of the Act grants NHS Digital the ability to publish anonymous statistical data and to share patient data.
Who is fighting it and why?
Critiques of the ‘NHS Data Grab’ range from the process being unlawful to immoral. Phil Booth, who has been fighting healthcare data grabs since founding MedConfidential in 2013, says, “They didn’t even send out a general press release to the media. They just announced it on their website, this clearly in itself not lawful, because in order to process people’s information like this, the first principle is you have to be fair and transparent.”
The idea that this is in any sense urgent in relation to the pandemic is a red herring.
A coalition of five organisations and David Davis, supported by Foxglove, are crowdfunding a legal challenge against the data transfer. Campaigning law group Foxglove is supporting a coalition of organisations to oppose the scheme. The co-claimants on the case are Doctors’ Association UK, openDemocracy, JustTreatment, the Citizens, the National Pensioners Convention and Conservative MP David Davis. Dr Shire says, “We’re not against data being used for research and planning, what does concern us is the fact that it seems they’re almost trying to sneak it through because they’re rushing it, rather than giving people a chance to find out about it.”
How can you opt out of including your data?
Credit: Nicolas J Leclercq / Unsplash
You can opt out of this data collection. It will not affect your medical care or the data that is available for your care. However, the process is more complicated for families with children or other dependents.
If you decide that you do not want your personal data to be shared outside of your GP practice for any purpose other than your own care, you can opt out. This is known as a Type-1 Opt-out.
If you have already registered a Type-1 Opt-out in the past, your data will not be shared with NHS Digital.
To register a Type 1 Opt-out with your GP Practice before the data sharing begins, return this form to your GP practice as a physical copy or send it via email. If you register a Type 1 Opt-out before the system starts, your data will not be shared with NHS Digital. However, if you opt out after collection has started, NHS Digital will retain any patient data given to them before the Type 1 Opt-out was registered but no further data will be shared.
There is also a second step to take for those who want to stop non-GP data being used for any other purpose than your direct care. This is called a National Data Opt-out. If it’s just for yourself, use NHS Digital’s online National Data Opt-out process, which works for those aged 13 and over. If you have children under 13, then fill in this form and e-mail or post it back to NHS Digital. This form works for both parents and children.
For those with adult dependents who you have legal responsibility over, you must fill in this form and send it back to NHS Digital on their behalf. There is no deadline for this additional option but the sooner it is done, the sooner it will take effect.
It is important to note that the National Data Opt-out will not stop your GP data being collected under the General Practice Data for Planning and Research. You must fill out a Type 1 Opt-out to stop your data being collected. You can opt back in at any time.
MedConfidential provides a comprehensive breakdown of the opt-out process here, which includes a comprehensive list of the choices not available to you with opt-out.
