NHS data injection: will it hurt?
NHS data policy has gone viral and thousands of people have caught the opt-out bug. So what is the NHS really doing with our data? James O’Malley finds out
NHS data policy has gone viral and thousands of people have caught the opt-out bug. So what’s it doing with our data? James O’Malley finds out.
There’s little data more sensitive than your medical records. This is perhaps why numerous viral social media posts have sought to raise the alarm: the NHS is planning to share our data, we’re told, and therefore we should opt out of the new system before it’s too late.
Is it time to worry? What’s actually going to happen to our data? We spoke to both sides of the debate to disentangle the controversy.
The reality of the plans
Let’s start with what the new system is intended for: NHS “research and planning”. Doctors are already allowed to share your data if it is for the direct purpose of providing you with care, as that’s how the medical system functions. Research and planning, on the other hand, is about giving scientists real-world data to analyse, and NHS managers information on how resources are allocated and so on. But even using data for these purposes is not new.
“We’ve been collecting and disseminating primary care data for a very, very long time,” said Dave Roberts, head of primary care information at NHS Digital and one of the architects of the new system.
At the moment, medical record data is legally held by individual GP surgeries and stored on medical records systems built by providers that are contracted by the surgeries. What’s new is NHS Digital’s plan to create a central copy of this data, thus streamlining the process for researchers requesting access. “Rather than having to go to system suppliers every time we need to collect new data, we’ll actually have it in-house,” Roberts explained.
However, it is the creation of this central dataset held by NHS Digital that has privacy activists alarmed. “This is an unprecedented amount of data,” said Phil Booth, the coordinator of MedConfidential, a group that’s campaigning against the new data regime.
“They will take your entire life-long GP history – every recorded medical event.”
The benefits of research
At the heart of the controversy is a trade-off between privacy for the individual and the potential improvements to healthcare that can be achieved with research based on a dataset as richly detailed as the one held by the NHS.
“The really big moment for me was when we did a data collection for diabetic retinopathy screening,” said Roberts. He describes how by centrally collecting data on diabetes patients and inviting those judged at risk for a screening, early interventions can be made to limit or even reverse deterioration. “We were actually changing people’s lives,” he said.
The GP diabetes data is useful on a broader level too, as it feeds into the National Diabetes and Obesity Audits, which identify more effective and efficient treatments. Roberts also points to how GP data was critical to research carried out by the NHS’s Learning Disabilities Observatory, and led directly to improved care for those patients when they are treated by NHS services. “We’ve probably not shouted enough about the power of data,” conceded Roberts. “I think this is one opportunity to shout that quite loud.”
In terms of how the data is used in research, Roberts argues that it’s a “myth” that NHS Digital is “selling” the data to outside companies for research. Charges only cover costs, and applications to use the data are both vetted and undergo a “data minimisation” process to strip data down to the bare minimum of what is required.
But Booth remains concerned due to the track record of some of the companies and organisations that take the data. His site has a long list of organisations – including some NHS bodies – that have previously been found to be in breach of their obligations.
“When audited, [some companies have] been discovered to be breaking the law, but all of them are still getting data,” he said. “They might have had to delete a particular dataset, but they are all customers, and they’re all still receiving data.”
Booth suggests that the NHS’s Confidentiality Advisory Group should implement a “single strike” sanction against firms that break the rules, which was proposed in 2015 but never implemented. “We go into 2021 without one of the key safeguards, which is that if someone does something bad, they can’t get any more data, and they have to delete what they’ve got.”
Seeking patient consent
This isn’t the first time that NHS Digital has tried to build a central store of GP data for research. In 2014, a similar plan called “care.data” would have created similarly centralised medical records, but it was scrapped before it was implemented following a backlash. That’s why this time around, two explicit types of opt-out have been incorporated into the plan.
If a patient exercises their “Type 1” opt-out, they’re instructing their GP not to send their data to NHS Digital for purposes other than their direct care. If they exercise a “Type 2” opt-out, which is also known as the “National data opt-out”, they will be preventing their GP data from being shared with organisations outside of NHS Digital for purposes other than direct care.
However, Booth is concerned that even with the optouts, NHS Digital isn’t doing enough to seek the consent of patients to participate in the new data-sharing regime. “Generally, most people would be happy for their data to be used for genuine medical research, so long as their permission is asked,” he said. “If their permission isn’t asked, that flips. And the majority aren’t happy with that.”
Booth cites the words of Dame Fiona Caldicott, who was the National Data Guardian for Health and Social
Care until her death in 2014. She argued that the guiding principle for NHS data should be that there are “no surprises” for patients in how their data is used. This makes actively seeking patient consent important.
So how could the process be improved? Booth argues that one option could be for the NHS to simply write to everyone to inform them of the changes and offer them the chance to opt-out.
“We’re not asking for anything that has not been done millions of times in the last year,” Booth said, noting the letter from the prime minister that was sent to every home in Britain at the start of the pandemic, with instructions on what precautions to take.
Roberts disagrees, arguing that the new system is merely “a replacement and a more streamlined version” of a data-sharing regime that’s already in place.
“The national data opt-out has been available for three or four years now,” he added. “So that ability, and that communication around opt-outs has been going on for a very long time. And we’ve got over one and a half million people who have opted out already. And I think because of the publicity around this, that it might [further] increase.”
However, he does make a more general concession. “We’re providing a lot of information. We’re doing interviews, we’re trying to get the message out. And we need to do that better.
“We’re certainly not trying to hide [anything],” Roberts added. “In fact, I want to shout it from the rooftops in terms of the benefits of this data, and actually have tried to do that at every opportunity. So, the feeling was that what we’re doing in terms of our communications, is appropriate for the change that we’re making.”
Weighing the trade off
When the viral social media posts first emerged in the spring, there was a looming opt-out deadline of 23 June. Although NHS Digital is keen to stress that there’s technically no deadline, it’s true that 1 July was the earliest planned date that data could be copied from GPs to NHS Digital. Following the controversy, the date has now been pushed back, with the GP data programme officially commencing on 1 September instead.
“We want to show how important it is,” said Roberts. “But still, we need to recognise the patients’ or citizens’ right to opt out of it.”
So with the facts in hand, it’s going to be up to each of us to weigh the trade-off. What do we value more: the strict protection of our data or the potential for it to improve medical science? “If you do opt out, you may be to some extent restricting research and making the research and planning not as good as it could be,” said Roberts.
Booth argues the NHS still needs to make its case more clearly. “In order for research to be legitimate and ethical and all these other things, you have to have actually got all your ducks lined up. Get their permission, give people the information they need to make a choice.”
Most people would be happy for their data to be used for genuine medical research, so long as their permission is asked