medConfidential brings together individuals and organisations from all sections of the community, seeking to ensure that the case for confidentiality and consent in health and social care is strongly represented in the media, in the corridors of power and across the country.
We provide briefings for patients, medics, service users, care professionals and anyone concerned with care – as well as for the media, and in Westminster and Whitehall. If your organisation would like a briefing, please contact firstname.lastname@example.org
The below briefings were the state of play when care.data was suspended in 2014. Later briefings and work are covered on our news page. Specific issues, such as AI, have separate pages and non-time sensitive proposals are covered elsewhere.
2014 Briefings and reports
2014 Parliamentary briefings and amendments:
- Proposed amendments to the Health and Social Care (Safety and Quality) Bill 2014-15:
- medConfidential briefing on the Draft Health and Adult Social Care (Continuity of Information) Bill, 12/6/14
- medConfidential Briefing on amendments for Care Bill ping-pong, May 7th 2014
- Oversight Panel amendment, tabled by Lord Owen
- Plus background briefings:
- Proposed Amendment to the Care Bill 2013-14 with Briefing Note, 9/3/14
- medConfidential’s written evidence to the Health Select Committee’s care.data inquiry, 25/2/14
- Link to video of both sessions
- medConfidential briefing on clause 115 of the Care Bill 2013-14
- Link to final Commons Committee session on the Care Bill, 30/1/14
2014 Complaint to the Information Commissioner’s Office:
- Complaint with FIPR and Big Brother Watch re. PA Consulting’s uploading of HES data to Google BigQuery
- Article describing what happened and PA Consulting media release on “Cloud Innovation” award for project!
2014 Other documents and reports:
Notes to the British Medical Association’s Local Medical Committees conference and Annual Representatives Meeting:
- BMA LMC conference, 23 May 2014 – ‘Offering local choice’
- BMA Annual Representatives Meeting, 25 June 2014 – ‘9Nu6: implementing local choice’
Our original public briefing, ‘A new threat to your medical privacy’, relating to plans for the NHS in England is available to download here:
- A new threat to your medical privacy (54 KB PDF file)
Given the Department of Health’s announcement in February (493 KB PDF file) that it intends to create “electronic child health records” designed to track every child across health, education and local authorities using their NHS number as a ‘unique identifier’, we provide a copy of ‘Protecting the virtual child’ – a study commissioned by The Nuffield Foundation that examines the law and practice around children’s consent to sharing information:
- Protecting the virtual child (493 KB PDF file) – 2009 study commissioned from Action on Rights for Children by The Nuffield Foundation.
2013 Protect your medical privacy FAQ (2013) Originally written for the intended roll-out of care.data in 2013, these FAQs will be superseded when details of the new scheme become available later in 2014. For now we have added comments to clarify which of the information is still valid. Most of it is.
So what has changed? The government has passed legislation and the NHS Constitution has been rewritten so that confidential information will be extracted from your GP-held record in identifiable form, and no longer be under the control of the doctor you shared it with. Until recently the default position was that your medical notes were confidential and remained within your GP’s surgery systems. This is no longer true. The new default is that, on the direction of NHS England, excerpts from your records will be uploaded to the new Health and Social Care Information Centre (HSCIC) unless you say otherwise. – ALL STILL CORRECT
When is this happening? Pilots of the new scheme – called ‘care.data’ – took place in around 75 GP practices in England. The original plan was to begin extracting data in the Autumn of 2013, but after pressure from GP leaders, medConfidential and others, NHS England bowed to confidentiality concerns around care.data, agreed to mount a publicity campaign and delayed the first extractions until Spring 2014. HSCIC will start extracting information from GP practices in England – not Scotland, Wales or Northern Ireland – in March 2014. We are led to believe that the first extraction will be around 1% of the population, the second extraction in April will be 10% and the third in May will extract information from 100% of the population. Data is expected to flow to HSCIC ‘customers’ a couple of months later. – EXTRACTION NOW DELAYED UNTIL AUTUMN 2014
What information will be taken from my medical records? Every month, details of your diagnoses, referrals, health conditions and treatments plus ‘lifestyle’ information such as smoking / drinking habits and whether you are obese will be extracted. They will be uploaded to HSCIC together with your NHS number, date of birth, postcode, gender and ethnicity. – ALL STILL CORRECT
But they say my data will be ‘anonymised’… First of all, the information will not be anonymised when it leaves your GP’s surgery; it will be extracted with your personal details still attached. HSCIC will then determine which parts of your information it will share with others and requests for identifiable data will be passed on to another body, the Confidentiality Advisory Group based in the Health Research Authority. Don’t be fooled by the word ‘research’ in the name, though – NHS England, for example, has already been granted a legal exemption to pass identifiable data about patients between various commissioning bodies. Even if your information is passed on or published without identifying details, your anonymity can never be guaranteed. Re-identification of apparently ‘anonymous’ data can be surprisingly easy, and the way HSCIC will treat the data is specifically designed to allow it to link and match records at patient level. – ALL STILL CORRECT
How will my information be used? Aside from the de-identified data that HSCIC intends to publish, your information may also be shared with or sold to researchers and private companies; registered ‘customers’ pay extra if they receive data in identifiable form. This will be done without your knowledge and you will have no control over who receives it. Identifiable data will also be passed to regional processing centres, local Clinical Commissioning Groups and the units that support them – which include private companies. These commissioning bodies will use your information for a number of administrative purposes, including audit and monitoring, service planning and targeting, validating invoices and to provide evidence about the effectiveness of services. – ALL STILL CORRECT
Is it just my GP-held records that will be treated this way? No. Extracting GP records is only the first step in a far bigger programme. Hospitals have been uploading patient records for years, and social services have been told they will have to begin from 2015 – this is, after all, the ‘Health and Social Care Information Centre’. Ultimately information about all of the medical and social care you receive will be collected and stored on the HSCIC system. – ALL STILL CORRECT
Will I be asked for permission? No, and they’re not intending to tell you directly either. In fact – though it finally conceded to run a junk mail door drop – NHS England initially ruled out running any sort of national publicity campaign. Instead they tried getting GPs to put up posters in their receptions or notices in newsletters. – THE JUNK MAIL LEAFLET WAS SENT, BUT NO OPT OUT FORM
What can I do? The good news is that you can opt out. But if you don’t want your confidential information collected or passed on by HSCIC, the onus is on you to tell your GP. Under the new legislation, GPs will not be able to stop your information being released to HSCIC unless you specifically tell them not to upload it and to make an official note of this in your record. We provide a letter on our website that you can download, fill in and send to your GP or use as a framework for writing your own letter: If you do have any particular concerns, we recommend you talk to your GP about them. – ALL STILL CORRECT
Will opting out affect my care in any way? No. Opting out of these ‘secondary uses’ of your data will not affect your direct medical care. Nor should it affect the way your GP is paid for providing you with care; that is done with aggregate, non-identifiable data. – ALL STILL CORRECT
Why are there two opt out codes in the letter? As we said, extracting GP records is only the first step in a much wider programme. Information about you may be collected by HSCIC from sources other than your GP, e.g. from hospitals or clinics. This information will also be identifiable, and may be linked to other data it holds or passed to other agencies and third parties. If you want to stop HSCIC from passing on your confidential information in identifiable form to any other bodies, including private companies, you have to tell your GP to add that opt out code to your record as well. – STILL CORRECT, BUT OPT OUT MECHANISM MAY NOW BE ‘SIMPLIFIED’
Isn’t this the same as the Summary Care Record (SCR)? No, but it does cover some of the same data, e.g. your prescriptions. The SCR was a far more limited collection, whereas this new scheme –known as ‘care.data’ – involves a wholesale, monthly extraction of identifiable information about every patient in England. – ALL STILL CORRECT
I’ve already opted out of SCR. Do I need to do anything? Yes, you must opt out all over again. Though the Secretary of State for Health, Jeremy Hunt, originally stated that existing opt outs “would be respected”, there has since been a U-turn and opt outs for SCR will not be carried over to this new scheme. – ALL STILL CORRECT
What about my data being used for medical research? In December 2011, the Prime Minister promised an opt out for those who specifically didn’t want their information to be used for medical research . This has not happened. Your only option at this point is therefore to opt out altogether from uploads to and passing on from HSCIC or accept that your information will be used for a wide range of purposes, only some of which are to do with medical research. – ALL STILL CORRECT