For immediate release – Wednesday 3 April 2014
The Health and Social Care Information Centre’s register of data releases, published at noon today, is incomplete and fails to reveal some of the most potentially embarrassing and damaging releases of patient data.
The register does list dozens of commercial companies that have received patient information in various forms over the past year, but fails to list companies known to be holding significant amounts of patient data under ongoing commercial licences.
For example, PA Consulting was awarded a licence for HES data in 2011 which was extended in 2012 to last until November 2015 [1]. The Information Commissioner’s Office is currently investigating a complaint by medConfidential, the Foundation for Information Policy Research (FIPR) and Big Brother Watch on PA Consulting’s uploading of this data to Google’s BigQuery cloud servers [2] so it is inconceivable that HSCIC is not aware the licence remains active.
Another significant omission is the lack of any Police Forces in the register. A Freedom of Information request revealed that Police Forces routinely request data about patients from HSCIC, and that data has been released in dozens of instances within the last year [3].
Phil Booth, coordinator of medConfidential, [4] said:
“Despite saying it has turned a new leaf, HSCIC is deliberately concealing releases of data that might cause itself, or ministers or other officials, embarrassment or political damage. The Information Centre’s lack of transparency is clearly not as “innocent” as its Chair has claimed. [5]
“HSCIC continues in its ridiculous assertion that pseudonymised data is not sensitive or identifiable when tools its customers have built show you can track individuals visit by visit through hospital – and with information published in press reports, social media posts or the date your child was born make it possible to pick out a named individual and read off their entire record. [6]
“Billions of patient records continue to be sold for commercial use without patients’ knowledge or consent, using as justification the very law that minsters have said provides additional safeguards. How long does HSCIC think it can get away with ignoring Jeremy Hunt’s promise to stamp out the commercial exploitation of NHS patients’ information?”
—
Notes for editors
1) See http://www.hscic.gov.uk/article/3948/Statement-Use-of-data-by-PA-consulting
2) See http://medconfidential.org/wp-content/uploads/2014/03/2014-03-13-ICO-PA-FIPR- complaint.pdf for medConfidential, FIPR and Big Brother Watch’s complaint to the ICO and http://www.theregister.co.uk/2014/03/04/tripleheaded_nhs_privacy_scare_after_hospital_data_rea ch_marketers_google/ for a description of what happened.
3) The FOI response states: “The Health & Social Care Information Centre (HSCIC) was formed on the 1 April 2013. Since the HSCIC was formed there have been 472 requests received from British Police Forces for information.” A spreadsheet detailing just 180 of these requests shows that 51 releases were made during the period covered by today’s register, all but 3 of which were made under Section 29(3) of the Data Protection Act – not under warrant or Court Order.
4) medConfidential campaigns for confidentiality and consent in health and social care, seeking to ensure that every flow of data into, across and out of the NHS and care system is consensual, safe and transparent. Founded in January 2013, medConfidential is an independent, non-partisan organisation working with patients and medics, service users and care professionals.
care.data opt out forms and letters available here: www.medconfidential.org/how-to-opt-out/
5) “Quite rightly however, the public are suspicious that these arrangements are in some way unfairly tipped in favour of the profit makers. This suspicion has been fuelled by our innocent lack of transparency.” Full text of Kingsley Manning’s speech at HC2014 conference – file was (re)moved by HSCIC following this press release. This link is to a copy downloaded by medConfidential on 24/3/14.
6) See http://medconfidential.org/2014/commercial-re-use-licences-for-hes-disappearing-webpages/ for a screen grab and explanation of a tool developed by OmegaSolver – one of the companies listed in the register of releases – for use by pharmaceutical marketers.
For further information or for immediate or future interview, please contact Phil Booth, coordinator of medConfidential, on 07974 230 839 or phil@medconfidential.org
– ends –