What’s happening?

By next summer, we will have a new Data Protection law, and a new NHS opt out model.

We should have a good idea by the end of November what the details all look like. The Department of Health are still playing coy – as until everything is final, then nothing is final.

Decisions in recent weeks have moved from a “big bang” launch next March, into a more gradual rolling start, which can deliver when things are ready. This is a great improvement.

Whatever happens, as things continue to change, we’ll update our scorecard of loopholes to keep you informed. It was first published as part of our recent “annual report”, but things will move on as the process rolls on.

 

NHS data: The rolling start has begun

As the rules stand today, any existing opt out will be upheld automatically within the new system. You can go to your GP receptionist, with our existing form, and they will make the change on their system which takes effect. As a patient, how it works – which system is in use – shouldn’t matter to you.

Shortly, the NHS Digital website will appear to give patients the information on how any data is used, and later a service to tell them how your data is used.

At some point next year, hopefully after you can see how your current wishes have been respected, you can express new wishes (as you can now). But the rolling start added by the last Direction to NHS Digital makes this better and simpler: There is no big bang launch, but a steady rollout as things start. If one thing is delayed, the consequences are fewer.

Your consent choice should follow your data, and when/why your wishes were honoured, or not. There are legitimate exceptions, but there are no legitimate secret exemptions.

As progress rolls forward, our scorecard can keep you up to date on where things are.

 

What else might happen next?

Any future Direction from either the Secretary of State or NHS England, must either leave the effects of your existing opt out in place, or explicitly take an action to remove it. Will the Department of Health or the National Data Guardian going to allow the removal of opting out that NHS Digital has already begun?

That would be a dramatic and novel change to public trust in a new system – undermining the point somewhat.

There is potential for a good outcome :

• Single tick box, online, covering all secondary data uses in and outside the NHS
  • This includes commercial reuse of cancer data by Public Health England. The ICO is investigating our complaint on this topic, which boils down to a simple question: does PHE tell the truth? (evidence says no)
• Existing care.data opt outs merged into the new one giving a clear path forwards
• Letters to every patient about the new arrangements.

Any of these would undermine any other good work:

• Undoing opting out that is already in place
• Multiple forms being needed
• Letters not going to every patient who did not opt out
• Multiple steps (and digital dark patterns – paragraph 2) in the opt out process.

We do not yet know all the details – and we’ll tell you when there’s evidence in practice. But there is progress.

While the NHS is moving towards a rolling start, the road they’re on is akin to an ambulance going down a busy high street with lights flashing – there’s a good idea how long it should take, but if someone does something unwise in the belief that thinking their goal is more important, it might take a little longer while an obstacle is removed. It’s been nearly 4 years since care.data collapsed. If it takes another few months, that’s ok.

But if the NHS data environment is like a normal street, the rest of Government is more like the Wacky Races.

 

What’s next?

In a couple of weeks, we’ll have an update on the National Data Guardian Bill, which is currently queued up in the House of Commons, and the Data Protection Bill, which is currently in the House of Lords.

While our main focus is on medical data, in our free time, we look at the rest of Government – both central and local.

They are themselves doing some thinking about how data is used, and while views are variable, it mostly reflects the initial reactions to care.data in the NHS. That it couldn’t happen there, and why do they need to change anything.

The lesson from the last 4 years, is that doing this properly takes time. We have taught the NHS this once, and will remain here to make every data flow in the NHS consensual, safe, and transparent.

It would be a surprise if the Government chooses to have worse data handling than the NHS. They will have only themselves to blame.