NHS Digital's demise bad for 55 million patients' privacy – ex-chairman
- Reference: 1646394806
- News link: https://www.theregister.co.uk/2022/03/04/nhs_digital_privacy_bmj_article/
- Source link:
The view was that if a patient had chosen to use the NHS they had implicitly agreed that their data could be used for the benefit of the NHS
Writing in [2]trade publication the British Medical Journal , Kingsley Manning said health secretary Sajid Javid's [3]decision to merge NHS Digital into NHS England and NHS Improvement last year was a "retrograde step not least in the context of this government's [4]clear intent to weaken the constraints on the use of patient data ."
Founded as the Health and Social Care Information Centre (HSCIC), IT and data arm NHS Digital received direction from NHS England, the central health service body charged with executing government policy in the NHS and paying health service providers.
However, NHS Digital could use its discretion to not comply with a direction from NHS England to collect data and to establish specific information systems.
"Doing away with an independent statutory body in NHS Digital, charged with defending patient rights, is itself, unfortunate. But handing that body and its powers to NHS England, is a grave error," Manning said of the move.
'Biggest data grab' in NHS history stuffs GP records in a central store for 'research' – and the time to opt out is now [5]READ MORE
"In effect, NHS England will be able to decide that its legitimate interest override those of the citizen and the patient, with little or no external constraint or scrutiny. With no requirement for transparency and indeed with additional barriers to citizens asking for information about the use of their data, individuals may never know what NHS England chooses to do with their data. And this matters," the BMJ article said.
"In my experience, the general approach of NHS England, including of its clinicians, was that much of the guidance and regulations with respect to the use of patient [data] was seen as unnecessary. The view was that if a patient had chosen to use the NHS they had implicitly agreed that their data could be used for the benefit of the NHS," Manning said.
[6]
Such concerns might ring alarm bells with privacy campaigners. Last July, [7]NHS Digital announced its second delay to what had been called the biggest data grab in NHS history of 55 million Englander's health records, and introduced new caveats to the extraction of personal medical information from GP systems.
[8]
[9]
The final, indefinite delay followed outcry from privacy campaign groups and concern from the medical profession who argued patients might not have knowledge of how their data would be used and shared if it had been automatically extracted from GP systems.
[10]Dido Harding's appointment to English public health body ruled unlawful
[11]UK pins hopes on 'latest technology' to whittle down massive National Health Service waiting lists
[12]A fifth of England's NHS trusts are mostly paper-based as they grapple with COVID backlog, warn MPs
[13]Cerner, a company that scooped more than £100m in NHS deals in a year, is in Oracle's crosshairs
NHS England has its own track record with handling patient data. Last year, the [14]National Data Guardian declined to endorse NHS England's effort to be transparent by publishing details on data flows from a patient information project that put US spy-tech firm Palantir at the heart of the government's response to the pandemic.
The COVID-19 data store was launched in March 2020 and aimed to pull together medical and operational data about the spread of the virus.
Campaigners had to force the government to publish details of the companies contracted to support the project – AWS, Microsoft, Google, Brexit-linked analytics firm Faculty, and Palantir, whose technology has been employed by the CIA and controversial US immigration agency ICE.
[15]
Manning said NHS Digital was established to provide an element of protection. "If it is to disappear then what is required is to put in place robust, external, independent scrutiny of NHS England. This could be through giving the currently toothless National Data Guardian effective powers of oversight. There should also be a statutory requirement of transparency," he said.
Without proper oversight, efforts to use health data in a responsible way for the right reason might be lost because of a lack of public trust in the system.
"The demise of NHS Digital will go unnoticed by the vast majority of the population. But its absorption into NHS England is a step in the wrong direction, signalling a policy approach which not only challenging the basic right of patients with respect to their own data but may also, ultimately, prove self-defeating," Manning said.
[16]
The Register has contacted NHS England for a response to the article. ®
Get our [17]Tech Resources
[1] https://www.theregister.com/2021/05/13/nhs_data_grab/
[2] https://www.bmj.com/content/376/bmj.o361/rr-0
[3] https://www.theregister.com/2021/11/22/health_secretary_confirms_the_end/
[4] https://www.theregister.com/2021/09/10/right_to_contest_automated_ai_uk_consult/
[5] https://www.theregister.com/2021/05/13/nhs_data_grab/
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YiJFv4jCpB1OVnBruli6rQAAANg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[7] https://www.theregister.com/2021/07/20/nhs_data_grab_delayed_again/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YiJFv4jCpB1OVnBruli6rQAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YiJFv4jCpB1OVnBruli6rQAAANg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2022/02/15/dido_harding_appointment_to_english/
[11] https://www.theregister.com/2022/02/09/nhs_tech_consultancy_procurement/
[12] https://www.theregister.com/2022/01/07/nhs_trusts_parliament/
[13] https://www.theregister.com/2021/12/17/oracle_cerner/
[14] https://www.theregister.com/2021/08/31/nhs_england_palantir_covid_19_dataset/
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YiJFv4jCpB1OVnBruli6rQAAANg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[16] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YiJFv4jCpB1OVnBruli6rQAAANg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[17] https://whitepapers.theregister.com/
Re: Sad but true
"As such, I don't visit GPs, hospitals etc."
Idiot.
You might be fit, young and healthy but that is not true for everyone.
So what if you develop cancer or some other life threatening illness? Are you going to self-medicate for those as well?
A lot of us have no choice, we have to rely on the services of the NHS and in the UK we are blessed by being able to do so.
So what is your answer to the problem of some people associated with the NHS wanting to make money off of people's most personal and sensitive data?
In your case it seems to be to try and side-step the threats but it might be better to actually do something about it and put curbs on the acquisitive tendencies of those at the top of the medical hierarchy
Re: Sad but true
I never said other people couldn't or shouldn't use medical care.
Merely that I myself do not use it. Plus I see it as a benefit to other people, one less person using the NHS is gives the ability for our NHS to help someone more deserving than me.
If I get cancer? Well I'll just die of cancer. I wouldn't be diagnosed of it in the first place either, so it would just take me and probably quickly too.
We all die eventually anyway.
I don't fear death, you can't escape it so why fear it? I just enjoy the time I'm alive now.
Protections rather limited
"In effect, NHS England will be able to decide that its legitimate interest override those of the citizen and the patient..."
Actually, in respect of Article 9 data, legitimate interest is not a lawful basis for processing. NHS England would have to rely in Article 9(2)(g), (h), (i) or (j). However that's a pretty wide gateway, particularly as NHS England would be the arbiter of factors such as 'substantial public interest', necessity for 'management of health or social care systems and services', necessity for 'reasons of public interest in the area of public health' and so on.
Unfortunately, as government agencies make the rules, they can award themselves pretty much any freedoms they want.
FTFY
"NHS Digital's former chairman is warning has just realised that the merger of the agency with NHS England threatens the privacy is designed to facilitate the sale of people's personal data."
Re: FTFY
As far as I recall NHS(D) was set up to funnel public funds into private pockets as effecienty as possible and sell the data it gathered at the best possible price to its chums. Sounds like sour grapes on the outgoing organisation's behalf...
Re: FTFY
My thoughts exactly. I thought NHS-D were a bunch of data bandits?
Is the chairman not the pot calling the kettle......
arrrr!
Re: FTFY @42656e4d203239
I agree. I read the sentence "Doing away with an independent statutory body in NHS Digital, charged with defending patient rights, is itself, unfortunate. " and thought it was a statement designed by Putin's media mis-information team.
NHS digital were the ones trying to sell off our "anonymised" data and [1]still have a page on the intertubes allowing you to opt-out. Which by the way is non-GDPR compliant in that it has the analytics and social media boxes pre-checked.
Mind you care.data was just as bad and it was NHS England
[1] https://digital.nhs.uk/services/national-data-opt-out
Re: FTFY @42656e4d203239
Replying to myself here as I have just checked and care.data was an NHS England project. There is a common point here and that is that both projects were initiated by the Conservative government. - Those guardians of our data who recently had a "consultation" on replacing/hobbling the GDPR in order to make it easier for anyone who donates to the party to use our data in any way they see fit, as long as they say it is for research. That is "research" in any form - not specifically science.
Re: FTFY
I think you got that wrong, it was NHS Digital that was set up to facilitate the sale of peoples medical data. This move effectively puts NHS Digital back inside the NHS and thus subject to all its data processing constraints.
Now there might be a case that the NHS uses patient data without proper disclosure and consent.
NHS
The sainted institution of central control is expected to put patients first? Damn cheek!
Re: NHS
What do you mean third-parties can only use the NHS patient data within the constraints set by the NHS and not be free to exploit it in anyway they see fit.
Re: NHS
One wonders what constraints might be imposed by an organisation that appointed Dido Harding as its now thankfully departed chair of improvement [sic].
Re: Dead on arrival
In fairness, there have been many instances of successful research projects during the pandemic that were only possible through access to shared, linked data from within the NHS. In many of those cases, the systems designed to ensure the due consideration of impact on individuals versus the common good were bureaucratic, and slowed things down. There are checks and balances in place and they do work.
I would rather have an environment where data sharing is permitted, with those checks and procedures in place, than one where no data sharing is allowed. Remember that sharing _identifiable_ data is remarkably rare and requires huge levels of justification (rightly). Opting out of sharing data removes your data from _everything_, including all those projects where it's just the characteristics of the data, not the individuals that are the important features.
Those of you up in arms about people seeing _your_ data should also remember that lots of the advances in medical treatments that we all take for granted were derived on the back of sharing other people's data. Without that, we'd all be like the earlier AC, living in a cave and slapping a nettle poultice on everything.
Re: Dead on arrival
Their past efforts lead to a degree of mistrust as to just whether the checks and balances really exist and work. There needs to be a lot of effort to rebuild trust. We need to see that this is really working.
Re: Dead on arrival
"Those of you up in arms about people seeing _your_ data should also remember that lots of the advances in medical treatments that we all take for granted were derived on the back of sharing other people's data. Without that, we'd all be like the earlier AC, living in a cave and slapping a nettle poultice on everything."
Agree with the sentiment BUT I do not trust 3rd parties to use my data safely.
The monitisation of the data is too much of a temptation to 'fudge' the checks & balances.
I have opted out in all possible ways, as previously advised in el Reg, but now those actions are looking to be redundant as NHS Digital is no more !!!
:(
Old model still in use in Scotland makes more sense
NHS Boards (Trusts)
separate legal entities, working together but each legally responsible as Data Controllers for their own population. Any central body wanting to misuse data has to get it past multiple governance groups any one of which can throw a spanner into the works.
Not perfect, but as a citizen I'm far happier with that approach than dumping all the decision making power in one place and realistically one individual.
Sad but true
Sadly these days everything and everyone wants your data.
I can't do a lot about the data NHS already holds about me, but I can change what they collect in the future.
I think of it much like Social Media, I don't use it, therefor I can significantly reduce what they know about me.
As such, I don't visit GPs, hospitals etc. I just deal with my medical problems if they occur on my own with home remedies.
(recently had to stitch a wound shut by myself for example)
With that said I did get all the COVID vaccines to ensure other peoples safety.
Sad to say, but it's the cost of privacy. I'm willing to pay that price.