We still haven’t seen the proposed new opt out language (or the loopholes hiding in caveats).

It’s due to be discussed publicly this month, and is supposed to deliver on what Dame Fiona was originally asked to do:

“Develop a single question consent model which makes it absolutely clear to patients and users of care when health and care information about them will be used, and in what circumstances they can opt out.” (Annex A)

The question has already been tested in an opinion poll by the Government. This means 12,500 of the public have seen the question; but we have not…

It’ll be interesting to see what those 12,500 people weren’t told about when health and care information about them will be used:

1. What patient level data doesn’t the opt out cover?
   1. For recipients outside the NHS: is it all patient level data that originated in the NHS? Or just some? If some, what about the rest?
   2. For recipients inside the NHS: All secondary uses, or just some?
      1. Will the separation between direct care and secondary uses be maintained? How is paragraph 125 of the data lake document accounted for?
   3. Where do PHE and other DH ALBs sit – in or out?
      
2. What will patients who have opted out already have to do, to receive the maximum protection available under the law when this new choice comes in? (which, by then, will be GDPR/DPA2018).
   1. The care.data opt outs did not cover everything possible under the DPA1998 – will that failure be repeated?

3. What will patients be told who do want their records used? What are the exceptions? Where patients wish their records used, will they be able to see every way they were used, and what any benefits of those uses were?

4. Will companies continue to be able to access data on patients who haven’t opted out, in secret, without the patient being able to see who used it for what? (which includes such as commercial re-use licenses or information intermediaries)

Another way to look at it is will all the crosses in our scorecard become ticks?

Commercial re-use licenses (aka “information intermediaries”) are akin to telling an academic department that it can use data for any project by any funder. For good reason, that is unthinkable for academia – it should not be allowed for companies

The research community is building an impressive maginot line of justifications for research – a set of case studies that epitomise the best of british medical science. However, the problem with care.data was not the research uses, but all the other things being hiding behind a fig leaf of research.

Will that happen again?