UK government set to extract hospital data to Palantir system without patient consent
(2022/11/04)
- Reference: 1667574912
- News link: https://www.theregister.co.uk/2022/11/04/uk_governement_set_to_extract/
- Source link:
The UK government is set to extract patient-identifiable data from NHS hospital systems and share this with its data platform based on technology from Palantir, a move that seems set to provoke another legal challenge.
Without consulting patients or giving them the choice of opting out, NHS England and NHS Improvement — the non-departmental government body which runs the NHS in England — has instructed NHS Digital to gather the data for the purpose of understanding and reducing the crisis in treatment waiting times resulting from the COVID-19 pandemic.
In [1]NHS Digital board meeting papers (see Faster Data Flow - 3.1.2 - on page 163), NHS England instructs NHS Digital to "collect patient level identifiable data pertaining to admission, inpatient, discharge and outpatient activity from acute care settings on a daily basis."
[2]
The move is an expansion of NHS England's use of Palantir, which had been subject to the threat of a judicial review in 2021. Under legal pressure, [3]the government caved in and agreed not to extend Palantir's contract beyond the pandemic without consulting the public.
[4]
[5]
The judicial review was set to be brought by the news website openDemocracy, backed by tech campaign group Foxglove.
Speaking to The Register , Foxglove director Cori Crider said: "We're very concerned that this latest move to force more patient data into Palantir has been done with zero public input or consent. That's not what we were told would happen in our case, and we're seriously concerned it's unlawful. The government will be hearing from us shortly."
[6]
In the board papers, NHS England directs NHS Digital to use Foundry, a Palantir product for the collection.
While NHS England owns the contractual relationship with Palantir, the new instruction creates "a complex relationship" where, in terms of data protection law, NHS Digital will be the data controller for the collection but will use NHS England as a data processor and Palantir will be a sub-processor, the document said.
NHS England said that patients would not be allowed to block the transfer of their data under the National Data Opt-outs programme since the data was due to be "anonymized in accordance with the Information Commissioner Office's Anonymisation Code of Practice before being released."
[7]
However, the same document talks about the data being pseudonymized "to provide daily services" under the plan.
In February 2022, the country's information watchdog, the Information Commissioner's Office [8](ICO), published draft guidance on pseudonymization [PDF], that said "…personal data which have undergone pseudonymization, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person…"
The guidance followed the introduction of the EU's General Data Protection Regulation, the local implementation of which (the UK GDPR) is [9]under review in the UK following Brexit. The proposed replacement – the Data Protection and Digital Information Bill (DPDIB) – is still progressing through [10]Parliament .
[11]UK government refuses public review before launch of NHS data platform
[12]Decisions on health data sharing should not be taken by politicians, citizen juries find
[13]NHS data platform procurement delayed for a second time
[14]NSO claims 'more than 5' EU states use Pegasus spyware
In a [15]Twitter thread explaining the issues with NHS England's approach Phil Booth, coordinator of campaign group medConfidential, said: "The fact is that patients have a #RightToObject to the #processing of their #PersonalData, so – while @NHSEngland may want to ignore people's opt-outs… and contorts itself to say their data's not 'confidential patient information' – the law(s) says otherwise."
An NHS England spokesperson said: "By collecting data in a more streamlined way the NHS is better able to plan and allocate resources to maximise outcomes for patients, whilst ensuring that data control remains with the NHS at all times. Ultimately, it will help all NHS organizations to better understand their waiting lists and pressures in near real time, work as systems, and the burden of manual reporting on staff will be significantly reduced."
There are currently a record 6.3 million patients waiting for treatment in the NHS in England, with 2.54 million patients waiting more than 18 weeks. The median waiting times remain "significantly higher" than pre-COVID levels, NHS England said, while a hidden backlog of patients yet to present with conditions may be even greater.
In the board papers, NHS England calls the new Palantir data initiative the Faster Data Programme. A separate Federated Data Platform is officially still in the pipeline, although the £360 million (c $406 million) procurement has been [16]delayed by several months . [17]Palantir is said to have made that competition a "must-win" , having recruited Indra Joshi and Harjeet Dhaliwal, key figures in NHS England's data science and AI teams.
Palantir has provided technology used by the CIA and controversial US immigration agency ICE. ®
Get our [18]Tech Resources
[1] https://t.co/EQINnWfTd2
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/03/30/ukgov_caves_over_nhs_palantir_lawsuit/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://ico.org.uk/media/about-the-ico/consultations/4019579/chapter-3-anonymisation-guidance.pdf
[9] https://www.theregister.com/2022/10/06/new_dcms_head_newly_independent/
[10] https://bills.parliament.uk/bills/3322
[11] https://www.theregister.com/2022/07/20/nhs_data_platform_consultation/
[12] https://www.theregister.com/2022/08/31/uk_health_data_share/
[13] https://www.theregister.com/2022/09/15/nhs_data_platform_procurement_delayed/
[14] https://www.theregister.com/2022/06/24/nso_customers_eu_pegasus/
[15] https://twitter.com/EinsteinsAttic/status/1587413103125311488
[16] https://www.theregister.com/2022/09/15/nhs_data_platform_procurement_delayed/
[17] https://www.theregister.com/2022/06/13/nhs_england_palantir/
[18] https://whitepapers.theregister.com/
Without consulting patients or giving them the choice of opting out, NHS England and NHS Improvement — the non-departmental government body which runs the NHS in England — has instructed NHS Digital to gather the data for the purpose of understanding and reducing the crisis in treatment waiting times resulting from the COVID-19 pandemic.
In [1]NHS Digital board meeting papers (see Faster Data Flow - 3.1.2 - on page 163), NHS England instructs NHS Digital to "collect patient level identifiable data pertaining to admission, inpatient, discharge and outpatient activity from acute care settings on a daily basis."
[2]
The move is an expansion of NHS England's use of Palantir, which had been subject to the threat of a judicial review in 2021. Under legal pressure, [3]the government caved in and agreed not to extend Palantir's contract beyond the pandemic without consulting the public.
[4]
[5]
The judicial review was set to be brought by the news website openDemocracy, backed by tech campaign group Foxglove.
Speaking to The Register , Foxglove director Cori Crider said: "We're very concerned that this latest move to force more patient data into Palantir has been done with zero public input or consent. That's not what we were told would happen in our case, and we're seriously concerned it's unlawful. The government will be hearing from us shortly."
[6]
In the board papers, NHS England directs NHS Digital to use Foundry, a Palantir product for the collection.
While NHS England owns the contractual relationship with Palantir, the new instruction creates "a complex relationship" where, in terms of data protection law, NHS Digital will be the data controller for the collection but will use NHS England as a data processor and Palantir will be a sub-processor, the document said.
NHS England said that patients would not be allowed to block the transfer of their data under the National Data Opt-outs programme since the data was due to be "anonymized in accordance with the Information Commissioner Office's Anonymisation Code of Practice before being released."
[7]
However, the same document talks about the data being pseudonymized "to provide daily services" under the plan.
In February 2022, the country's information watchdog, the Information Commissioner's Office [8](ICO), published draft guidance on pseudonymization [PDF], that said "…personal data which have undergone pseudonymization, which could be attributed to a natural person by the use of additional information should be considered to be information on an identifiable natural person…"
The guidance followed the introduction of the EU's General Data Protection Regulation, the local implementation of which (the UK GDPR) is [9]under review in the UK following Brexit. The proposed replacement – the Data Protection and Digital Information Bill (DPDIB) – is still progressing through [10]Parliament .
[11]UK government refuses public review before launch of NHS data platform
[12]Decisions on health data sharing should not be taken by politicians, citizen juries find
[13]NHS data platform procurement delayed for a second time
[14]NSO claims 'more than 5' EU states use Pegasus spyware
In a [15]Twitter thread explaining the issues with NHS England's approach Phil Booth, coordinator of campaign group medConfidential, said: "The fact is that patients have a #RightToObject to the #processing of their #PersonalData, so – while @NHSEngland may want to ignore people's opt-outs… and contorts itself to say their data's not 'confidential patient information' – the law(s) says otherwise."
An NHS England spokesperson said: "By collecting data in a more streamlined way the NHS is better able to plan and allocate resources to maximise outcomes for patients, whilst ensuring that data control remains with the NHS at all times. Ultimately, it will help all NHS organizations to better understand their waiting lists and pressures in near real time, work as systems, and the burden of manual reporting on staff will be significantly reduced."
There are currently a record 6.3 million patients waiting for treatment in the NHS in England, with 2.54 million patients waiting more than 18 weeks. The median waiting times remain "significantly higher" than pre-COVID levels, NHS England said, while a hidden backlog of patients yet to present with conditions may be even greater.
In the board papers, NHS England calls the new Palantir data initiative the Faster Data Programme. A separate Federated Data Platform is officially still in the pipeline, although the £360 million (c $406 million) procurement has been [16]delayed by several months . [17]Palantir is said to have made that competition a "must-win" , having recruited Indra Joshi and Harjeet Dhaliwal, key figures in NHS England's data science and AI teams.
Palantir has provided technology used by the CIA and controversial US immigration agency ICE. ®
Get our [18]Tech Resources
[1] https://t.co/EQINnWfTd2
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2021/03/30/ukgov_caves_over_nhs_palantir_lawsuit/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/databases&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Y2VFMc0IAyEyYxhyQiZMrAAAAEg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[8] https://ico.org.uk/media/about-the-ico/consultations/4019579/chapter-3-anonymisation-guidance.pdf
[9] https://www.theregister.com/2022/10/06/new_dcms_head_newly_independent/
[10] https://bills.parliament.uk/bills/3322
[11] https://www.theregister.com/2022/07/20/nhs_data_platform_consultation/
[12] https://www.theregister.com/2022/08/31/uk_health_data_share/
[13] https://www.theregister.com/2022/09/15/nhs_data_platform_procurement_delayed/
[14] https://www.theregister.com/2022/06/24/nso_customers_eu_pegasus/
[15] https://twitter.com/EinsteinsAttic/status/1587413103125311488
[16] https://www.theregister.com/2022/09/15/nhs_data_platform_procurement_delayed/
[17] https://www.theregister.com/2022/06/13/nhs_england_palantir/
[18] https://whitepapers.theregister.com/
We will lose all control of the data
alain williams
once it hits Plantir - no matter what the contract says.
I for one
Anonymous Coward
Welcome our Lord Emperor Thiel
(Anonymous so they know who I am)
We serfs do not have a voice
VoiceOfTruth
Do not think that we live in a democracy. We are considered subjects not citizens. The "clever" people with their useless PPE + law degrees decide this sort of thing.
Re: We serfs do not have a voice
Mike 137
" The "clever" people with their useless PPE + law degrees "
Those PPE degrees don't seem useless at all. They apparently serve as PPE in another sense.The fact that once so qualified one can be ejected from office and almost immediately re-appointed in the same role shows how well the protection works.
Re: We serfs do not have a voice
Martin Gregorie
Unfortunately all too many Members of Parliament don't have any qualification as useful in the real world as a legal degree. Instead the popular path to a seat in Parliament seems to be:
1) Go to University and study politics
2) Join the party of your choice
3) After graduation, get a job as an intern and/or researcher for the party of your choice
4) Try to keep your nose clean at least until you get nominated for seat
5) Repeat (4) until elected
IOW, the current crop seem to enter Parliament knowing 2/5 of bugger all about anything except politics and boy is that obvious when you look at the current shower.
Requiring at least 10-15 years doing any non-political job before being allowed to stand for Parliament would almost certainly make a vast improvement in the way we're governed, simply because we'd get elected Members with some knowledge of the world outside politics
pseudonymization
Fruit and Nutcase
ouputText = inputText.reverse()
Data for planning
"This organisation handles an average of N operations of type X per week. We have a backlog of M cases."
Repeat for all operation types and other activities.
If the data is for planning purposes, what more do they need?