England's controversial extraction of personal medical histories from GP systems is delayed for a second time
- Reference: 1626780709
- News link: https://www.theregister.co.uk/2021/07/20/nhs_data_grab_delayed_again/
- Source link:
In the first significant policy shift since Matt Hancock left office as health secretary last month, primary care and health promotion minister Jo Churchill [1]has written to all GPs setting out new proposals for siphoning off personal health histories of 55 million people in England into a central store, under the controversial General Practice Data for Planning and Research project.
She said the UK government was "moving away from a previously fixed date of 1 September." That date had in fact [2]already been moved from 1 July , but now there is no fixed date at all.
[3]
According to the [4]new approach , the data extraction, said to be [5]vital for health research and NHS planning , would only go ahead if three conditions were met.
[6]
[7]
In an apparent concession to campaigner demands, the non-departmental government body said it would offer patients the option to opt out at any stage, with historic data being deleted even if it had been uploaded. One of the key complaints over the scheme was that, [8]under the plans first announced in May , there was no option to have historic data deleted once it had been transferred from GP systems.
Secondly, the external researchers would only access the data through a Trusted Research Environment whereby they execute queries on the data in situ, rather than moving it for analysis. This idea had been the subject of [9]Parliamentary debate involving Tory MP David Davis and Hancock in June .
[10]
Thirdly, the extraction would only go ahead after a "campaign of engagement and communication has increased public awareness of the programme, explaining how data is used and patient choices," NHS Digital said.
The announcement is the second delay to the controversial programme. The [11]first came in June , [12]following pressure from professional body the Royal College of GPs and doctors' union the British Medical Association (BMA).
Concerns over GPDPR are such that groups of GPs were set refuse to share data with the scheme in its previous form.
[13]How many Brits have deleted life-saving track and trace app from their phones? No idea, junior minister tells MPs
[14]UK govt draws a blank over vaccine certification app – no really, the report is half-empty
[15]NHS contracts for document storage, digitisation three years after paperless deadline
[16]UK's data watchdog probes use of private email to discuss government business at the Department of Health
In an [17]open letter to the government co-ordinated by GPs in East London's Tower Hamlets earlier this month, family doctors said they would not comply with the extraction of personal medical data from their systems, saying patients had not been able to consent to the use of their data because of a lack of effective communication.
Backing the letter were Dr Jackie Applebee, chair of Tower Hamlets LMC, Dr Mark Sterry, secretary Solihull LMC, and Dr Paul Evans, chair Gateshead and South Tyneside LMC. Other signatories include Dr Zuhaib Keekeebhai, chief clinical information officer at North Central London Clinical Commissioning Group and Dr Osman Bhatti, performing the same role at North East London Clinical Commissioning Group, who is understood to have co-ordinated the letter.
We are 'data controllers and doctors with a duty of confidence to their patients'
The local medical committees (LMCs) and commissioning groups said they would not share data with the scheme because there had been a lack of informed consent about the proposals. It said NHS Digital should write to every patient telling them how their data would be used under the scheme and offering clear instructions about how to opt out.
It pointed out that "as data controllers and doctors with a duty of confidence to their patients, GPs are obliged to ensure that patients are properly informed of significant new data processing and that their permission has been sought prior to us sharing their data – and that this data is and will be handled responsibly, securely, and transparently."
[18]
It said GPDPR did not "meet these fundamental requirements" in its current state.
LMCs are groups of family doctors who contribute toward BMA policy and are represented by the powerful doctors' union.
Critics of the GPDPR scheme have argued that NHS Digital's approach to communicating its plans to patients amount to a notice on its website, a few tweets, and a downloadable poster for GP practices to print out.
In [19]an interview with The Register , the BMA said it expected NHS Digital's protector of patient confidentiality – the Caldecott guardian – to halt the project unless communication with patients is improved sufficiently to comply with [20]data protection law, which requires fairness and transparency in data sharing .
However, Dr Farah Jameel, BMA GP committee executive team IT lead, said the union would wait to see how communication from NHS Digital improved before telling members whether or not to share patient data for which practices are legally responsible.
Meanwhile, data provision notice – the legal requirement for data sharing – [21]has been withdrawn to "provide more time to speak with patients, doctors, health charities and others," according to the NHS Digital website.
NHS Digital has argued that "data saves lives" and has huge potential to rapidly improve care and outcomes, pointing towards the use of data analytics in the COVID-19 pandemic as evidence.
Former health secretary Hancock was said to be a passionate supporter of data sharing in healthcare. He [22]resigned in June after an affair that appeared to contravene COVID-19 restrictions was made public, and was replaced by Sajid Javid. The ICO is [23]investigating that data leak . ®
Get our [24]Tech Resources
[1] https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/secretary-of-state-letter-to-general-practice
[2] https://www.theregister.com/2021/06/08/uk_gov_delays_gp_data_grab/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YPbzJzkq68E72tbASpfA0AAAAFU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://digital.nhs.uk/news-and-events/latest-news/new-plans-to-increase-protection-and-strengthen-security-for-gp-data-collection-programme
[5] https://www.theregister.com/2021/06/22/uk_health_secretary_data_saves_lives/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YPbzJzkq68E72tbASpfA0AAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YPbzJzkq68E72tbASpfA0AAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2021/05/17/nhs_data_market_access/
[9] https://www.theregister.com/2021/06/25/david_davis_gpdpr/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YPbzJzkq68E72tbASpfA0AAAAFU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2021/06/08/uk_gov_delays_gp_data_grab/
[12] https://www.theregister.com/2021/06/04/bma_and_royal_college_of/
[13] https://www.theregister.com/2021/07/15/test_and_trace_app_deleted/
[14] https://www.theregister.com/2021/07/13/uk_vaccine_certificate_report/
[15] https://www.theregister.com/2021/07/13/three_years_after_nhs_missed/
[16] https://www.theregister.com/2021/07/07/ico_dhsc_private_email/
[17] https://drbhatti.com/2021/07/06/an-open-letter-to-the-government-regarding-gpdpr/
[18] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YPbzJzkq68E72tbASpfA0AAAAFU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[19] https://www.theregister.com/2021/06/25/bma_says_nhs_digitals_own/
[20] https://ico.org.uk/for-organisations/data-sharing-a-code-of-practice/fairness-and-transparency-in-data-sharing/
[21] https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research
[22] https://www.bbc.co.uk/news/uk-57625508
[23] https://www.theregister.com/2021/07/15/ico_matt_hancock_raids/
[24] https://whitepapers.theregister.com/
Establish limits?
Oh hell, please tell me how I can control what YOU do with data you buy from me?
Please tell me how I ensure that your systems are hack proof and it wont leak anyway.
Please tell me how I ensure that MY systems are secure enough that when I have all these millions of records I wont get hacked or even ransomed.
Re: Establish limits?
You seem to be arguing against GP systems in general; nothing you say is specific to research-based systems.
Re: Establish limits?
I think they're commenting on the "all eggs in one basket" problem with a single central database.
only sensible course of action is to assume nhsdigital are lying and/or acting in bad faith.
their get out of jail free card is that their basis for legal processing isn't consent...
Why can’t it be opt-in?
Answer: because nobody would.
Re: Why can’t it be opt-in?
Because the data would be useless, it would be like Facebook planning their capacity based on people who respond to Gartner questionaires
It would be good for El Rey to outline a position on why data might or might not be valuable.
For example, in Wales primary and secondary care patient data is kept in a single source that all systems talk to, so data is mastered well, shared well between clinicians in different trusts, and clean for analytics/discovery. Getting England to that state might be a better start than these short term grabs.
The article seems a little unbalanced from that perspective. Data privacy is important, but it's worth talking about the opportunity cost, I think.
Here's the keys to my house, feel free to have a good rummage through. What, you want to make a list? You'll only use it for legitimate purposes. Well, I guess that's okay, yeah, sure, go ahead.
What happens between me and my GP is nobody else's business without my explicit consent.
The the Govt. wants to aggregate NHS and GP patient data for statistical analysis pertaining to health-care, all well and good, but they can have the responsibility and social decency to do it through a really well worked out, well publicised and well tested system that does what it says on the tin, and only what it says on the tin; AND that anyone can easily opt out of, and stay opted out of, for no reason that they have to speak of.
>and clean for analytics/discovery.
And for copying to Police DNA databases
And used to identify undocumented immigrants for deportation.
And used to track biological parents for support payments
And used to disqualify people for disability benefits
And that's before it's just sold to US insurance companies prior to privatisation.
That's an interesting list of uses. I'm obviously either getting more right-wing in my old age, or maybe more of a religious fanatic. Between this and the latest ID schemes we have all the makings of the book of Revelations "Mark Of The Beast"
As penance, I will start reading the Guardian and watching Love Island
/s (In case you're worried about my mental stability)
Remember you have to think what an evil version of Priti Patel / Chief Inspector Savage would use it for.
It's not what it could be used for - it's what they think it will be used for.
I was pitching a database tool to the police force of a certain UK capital city 20 years ago. A senior plod (with lots of silver braid on his shoulders) was 'explaining' to me how this new DNA technology would give them a picture of the suspect from a sample at a crime scene. He had obviously been sold the idea by some consultant that DNA = everything about a person and so could generate a mug shot.
Must be opt in
Things like this must be opt in, not opt out.
What's that Skip? They won't get enough data? Could that possibly be a sign that what they're attempting isn't welcome and should be abandoned?
Consequences
If they just grabbed the data anyway, then what would be the consequences?
Once you transfer the data to a 3rd party, it's game over. They may claim they deleted it, but there will always be someone with a thumb drive waiting for a right moment.
Government will issue an apology and that will be it.
Re: Consequences
>If they just grabbed the data anyway, then what would be the consequences?
It only works once and screws the chance of future 'cooperation'
It works for police/immigration but not for well paying commercial customers.
If I'm an insurance company in the future looking for prime customers - having partial data from a grab 10 years ago with no updates isn't that much use to me.
Re: Consequences
10 years old data can still "paint a picture" about someone.
The next government depending on donations may play it at least two ways:
- the sky didn't fall after the "leak", but the research has benefitted massively, so we are going to let them get updates.
- we have improved the processes, so now only vetted companies (those with biggest donation) will have secure access
"a downloadable poster for GP practices"
Yeah, because we've all been going there on a regular basis to read the posters. Not.
"they would not share data with the scheme"
Good on them.
All this data sharing shenanigans is just driving me nuts. Finally some people are taking a stand and thank God it's the doctors.
They took the Hippocratic Oath, not the Hypocratic Oath, and they're doing their job.
It may very well be that there can be a legitimate use and benefit from a centralized national health database, but the UK Government is not exactly in the best of positions when it comes to providing any sort of guarantee on how that data will be protected and managed.
Especially not if any US private company is involved.
"[The LMC's letter] said NHS Digital should write to every patient telling them how their data would be used under the scheme and offering clear instructions about how to opt out."
Sounds like a starting point for an informed process about this. I've had two national letters from NHS (one for 'flu jab and one for COVID vaccination) so I conclude that the ability to contact all eligible patients is there - the mechanism works well.
I appreciate the utility of medical data for research purposes. Processing on a NHS controlled portal as opposed to wholesale exfiltration seems sensible, and the right to opt out at any time (opting out to include removal of historical data) seems to be the minimum baseline that could be asked for.
I still think that after the information campaign, data access should be opt in .
OK, I've said this before, and I'll say it again.
NHS Digital need to be totally transparent about this. They also need to establish limits on what is done with the data, and be open about what will be done. Even to the point of taking out adverts in the media. They also need to give people reasonable notice, so they can opt out for whatever reason they wish.
I would prefer something like this be opt in, but I can understand they may not get enough data this way,