On 7th February, GP magazine Pulse reported that “Patients who have opted out of the [care.data] scheme will still have their records sent to the HSCIC stripped of identifiers” – see 4th paragraph from bottom of this article. This confirmed something buried on page 9 of NHS England’s care.data Privacy Impact Assessment [PDF], which states:
Where patients have objected to the flow of their personal confidential data from the general practice record, the HSCIC will receive clinical data without any identifiers attached (i.e. anonymised data).
So the intention was to extract information from the medical records of people who had opted out, just without their NHS number, postcode, date of birth and gender attached.
This is not what any reasonable person would understand by opt out – if you opt out, no information from your medical record should leave your GP practice.
We immediately got to work, engaging with the Secretary of State and Department of Health and HSCIC amongst others. By the middle of the following week it was clear that the opt outs were going to have to be fixed, in ways we were invited to put to the Secretary of State for Health in a letter. By Friday 14th we were pretty sure that they would be fixed, but no-one seemed willing to confirm this – maybe because to do so would confirm that NHS England had been caught misleading the public.
Things moved on rapidly the following Monday with the launch of the first online opt out, faxyourgp.com, following on from critical statements by the Royal College of General Practitioners, British Medical Association and the Information Commissioner’s Office, clear signals that 38Degrees and SumOfUs supporters might opt out en masse – not to mention the fact that medConfidential had over the previous 4 weeks served out over 300,000 opt out forms and letters. And we instructed Leigh Day Solicitors to write a ‘letter before action’ to NHS England, i.e. we began a legal challenge based on misleading information in its junk mail leaflet.
On Tuesday 18th we received a letter from Dr Mark Davies, the outgoing Director of Clinical and Public Assurance at HSCIC, confirming the way in which the opt out codes would work. His letter ended: “This proposal will be considered by the GPES Independent Advisory Group (IAG) in February for their confirmation” – thus confirming that the opt outs had changed. This wasn’t an outright admission that the public had been deceived, but it clearly shows that the opt outs were not set up to work as patients would expect at the point we intervened.
And then later that afternoon, bowing to serious pressure, NHS England announced a second six month delay – while allowing themselves the possibility of uploading patient data from some ‘pilot’ practices before September.
Without fanfare that same afternoon, a new web page was published on the HSCIC website. You will probably want to read this – it’s a public document, clearly explaining the operation of the opt out codes:
http://www.hscic.gov.uk/article/3915/what-we-will-collect-from-gp-records-under-caredata
Hopefully from this point on, this page will be where any further changes to the process are published.
BUT…
You will note that the HSCIC page says, “Currently, no other data relating to those who have made this objection will be extracted from their GP record in relation to care.data”
“Currently”? Are they intending to change how the opt out codes work all over again? We sincerely hope not!
Following yesterday’s evidence session on care.data before the Health Select Committee we shall be writing to the Committee to ask that they (i.e. Parliament) ensure that the final few loose ends are tied up.
So our advice remains as follows; if you have any concerns – and the performance of Tim Kelsey (NHS England), Max Jones (HSCIC) and the Under-Secretary of State for Health in front of the Committee yesterday was less than confidence-inspiring – then opt out now. And don’t forget your kids!
If NHS England manages to convince you that they’ve got things right by September, you can always opt back in. But if you’re in one of the proposed ‘pilot’ practices (no, we don’t know where they are yet) and you don’t find out that you are until after your data has been uploaded, you may regret delaying taking action.