Hello to all of our new newsletter readers – a lot of people have joined in the last week.

medConfidential only sends out a newsletter when there is something worth saying. There might be a few more of them over the next few months…

What just happened?

On 12 May, NHS Digital quietly announced there would be a new GP data collection, known as ‘GP Data for Planning and Research’, ‘GPDPR’ – or the #GPdataGrab, for clarity. 

NHS Digital and the Secretary of State, who on 6th April had Directed NHS Digital to run the scheme, hoped no-one would notice.

Matt Green did a very good, and funny, explainer of what it was they were planning, which you can also watch (or share) on YouTube:

https://www.youtube.com/watch?v=QqZXH0CJYcM (the deadline date has since changed)

Because it was rushed out, all sorts of issues were missed. Just one being that if you are pregnant, there’s no guidance on what to do for the GP data of babies born shortly after the deadline; there is no digital process for unborn children…

And then, less than a month later – after a media firestorm, a bunch of contradictions and corrections, and huge public outcry – the programme got paused.

Here’s just a sample of some of the media coverage:

• The Register – first to pick this up
• Byline Times – their “most-read piece ever”
• Financial Times – starts getting wider attention
• British Medical Journal – “should patients worry about their data?”
• BBC – Government: there will be no delay
• BBC – Government: there will now be a delay
• The Register – following up on the delay

Just yesterday, NHS Digital confirmed that its Data Protection Impact Assessment (DPIA) for GPDPR is still not in a publishable state, suggesting that fundamental contradictions within the programme have not been resolved. The DPIA being the one document where everyone has to write down what it is that the programme actually does, why, and the consequences – i.e the ‘impacts’. So, of course, any contradictions become obvious.

The GP data grab programme was clearly not ready, and is still not ready – and looks like it cannot be ready by the 1st September. (At least…)

What’s the new deadline?

Originally, the GPDPR scheme had no official opt-out forms. medConfidential said we would publicise ours (including our logo) and so they created one. As a result, the Government and the GP Profession agreed that it could take up to a week for a GP practice to process their patients’ opt-out forms – they are rather busy at present! – and the 23rd June deadline date was written into a document, one week before the 1st July start (i.e. data upload) date. 

That ‘time lag’ applies equally to any new start date, which is now (no earlier than) 1st September. The September date was entirely up to the Government, and did not need to be agreed with anyone. So Ministers could announce the new start date.

But any deadline has to be agreed with the GPs.

And it is notable that the Government, hiding behind NHS Digital, “wasn’t able to specify” officially what the new deadline is. Ministers and civil servants have calendars like you and us, so they could work it out – but the Government can only announce those actions the GPs have agreed to.

That, at the time of writing, NHS Digital appears to be prohibited from saying exactly when the new deadline is suggests that far more substantive changes to the GP data programme are coming than the Government is currently willing to say.

Having said that, the deadline for opting out to your GP practice relates to the processing time it takes your GP – something that is not within the power of the Government to arbitrarily shorten. (Though it could be made longer, by extending the 1st September arbitrary date; an “artificial deadline” for protecting your GP data.) 

Of course, the correct sequence of actions and deadlines is that no GP agrees to any upload of their patients’ data until each patient has been notified; that patients have been given the opportunity to make a choice, and the information and forms they need, and that those choices have been processed. 

This may be why NHS Digital cannot say what the opt-out deadline is, because it has more work to do on its communications and the opt-out process – especially for dependant children – a process which will likely take months, not days.

Since the Department of Health (DHSC) can’t even announce a deadline that is based simply on being able to read a calendar, medConfidential currently has little expectation that the GPDPR programme will start in 2021. In all likelihood, and as with the previous attempt in 2014, this new GP data scheme will likely drag on until it gets fully reset by the next Secretary of State for Health. 

Of course, we can’t afford to be complacent; we do have a Secretary of State in office who believes in data over everything else. (Apart from start dates, apparently…)

What should be next?

The letter from research funders, “Patient data must be safeguarded”, should still have applied this week – but it seems some on the Euston Road have slid backwards in their approach.

One narrow idea from some within the research community is to try to win a “research boffins vs privacy people” argument. That framing is eternally unstable; whoever is winning that argument this month doesn’t matter, because someone else will be winning it next month. 

Any stable and sustainable patient data programme must take a “research boffins and privacy people” approach – with everyone in the same room, working towards a goal that everyone can stand behind. 

We see no sign of that happening.

The best way for uses of data to be sustainable and trustworthy is for patients and the public to be informed about what data is used and how, what your choices are, and to have safeguards and governance that is both effective (with no loopholes) and seen to be effective – so individual patients and the public at large can have confidence in how the NHS uses data about them.

What can you do?

Spread the word, and please share this link to our ‘How to opt out’ page:

How to opt out

This battle is far from over.

There is still a lot of confusion – even medConfidential is being accused of ‘misinformation’! – though we do our best to always present a clear and accurate picture, and link to the evidence, about an unnecessarily overcomplicated process that is being hustled through by the Government while we are still in a pandemic.

Please do not panic, keep yourself informed. We will send further updates when we know something has changed. And be aware that this is going to run into ‘silly season’ in August, in a year when everyone really deserves a break – or, at the very least, a staycation.

Thank you to all those who have given us support. We really appreciate it, especially right now.

And you can be confident that we will be here when they try again!