During the pandemic, your data was collected from every GP under the promise that its use would be for “pandemic only”purposes. That promise is still on your GP’s website. Mr Streeting has decided to tear up that promise and is seeking to do so behind patient’s backs by instructing GPs not to tell patients of the change. 

This is going to become a very large mess.

GPs were told in 2020 to put on their websites a promise that the data would only be used for the pandemic. That wording is still there. Mr Streeting has Directed NHS England to reuse the data however he wishes, but GPs have been told that “no action” is required and is therefore not monitoring acceptance – despite the fact that taking no action means the practice website will still be telling their patients that the “pandemic only” constraints are still in effect when they have been torn up and Mr Streeting does what he wants with their data. This is the first time, but there are repeats on the horizon.

And this matters even more because Mr Streeting ‘crossed a political rubicon’ when he signed the Direction saying that the NHS can lie to patients about how data is used. Like a Silicon Valley techbro, his actions show he can make a promise today and break it with a swish of his pen tomorrow. (Of course this also means he could choose to reverse this decision and stick to the “pandemic only” promise; if he doesn’t, the die is cast.)

Latest in a line of breached promises

The secretive charity HDRUK already broke the “pandemic only” rules when they trained an AI on “pandemic only” medical records for any purposes they like. When NHS England asked its independent Advisory Group on Data to assess those projects (item 5.1), the majority did not support them. 

NHS England refused to do a meaningful investigation, instead limiting itself to simply asking HDRUK whether a project was only used for pandemic purposes and believing their answer, despite the assessment of their independent advisors. HDRUK persists with the levels of transparency and accountability of the Boris Johnson administration. 

“Lying to the press is not a crime”, says Baroness Mone, OBE – and the shared culture of HDRUK and Biobank has applied that same principle to patient data.

Biobank still sends patient data around the world and does not disclose which users are given exceptions to Biobank’s supposed rules. Our list of unanswered questions is long. Biobank continue to allow the company related to the eugenicists to access their servers (which are subsidised by UK tax payers), and Biobank claims “Byte Dance Ltd” are doing genomics research via their Cayman Islands holding company, despite claims the project is based in the United States from staff in China. (Byte Dance makes the TikTok app). After Biobank angrily insisted there was no problem with Biobank giving to insurers data that was donated for research, they later quietly slipped out that they had stopped; a US shell company called Flying Troika was never investigated, and Biobank approved last month a new project explicitly to give undergraduates in China real NHS/Biobank data to use in exercises.

This all matters not only because of the plans for a Single Patient Record and the Health Data Research Service, but because HDRUK and Biobank share a culture and say they designed the HDRS. This all matters because of the proposals for a Health Data Research Service, and because of the proposal for the Secretary of State to be Data Controller for the Single Patient Record.

If a patient has a National Data Opt Out covering research, none of their data should go into HDRS. The Biobank Direction threatens that. The published Direction is only for “consented cohorts”, but a future second half is under discussion covering “unconsented cohorts”, which likely be as broad as HDR’s past requests; cohorts such as “people who have hearts”, or “who are breathing”.

The extent to which HDRS delivers on the goals, delivers for patients, or does neither of those things depends on decisions not yet officially made. As DHSC takes over NHS England, and takes over the data release registers, those DH registers must include all NS data that flows out of any DH entity, otherwise they are by definition incomplete. The NHS itself has largely avoided data re-use scandals over the last decade by having complete registers of decisions made and where data flowed. They may have got in trouble about new datasets, but the decisions on old ones were clear. (until HDRUK tore up that consensus by breaking the covid-only rules – will HDRS look more like the transparent governance of NHS England or the secretive cartel of HDRUK or the unaccountable club that is UK Biobank). There are now many moving parts, and who will gain a short term advantage is unclear. 

HDRS could be good

The new Health Data Research Service could be good; it could be consensual, safe, and transparent. But there’s widespread concerns that it will not be. (We’ll have more on HDRS soon).

HDRS has the opportunity to get it right from day one, and we see no sign of DH allowing them to do that – the job ad for the Chair/CEO of HDRS said that HDRS decisions will be “directly accountable to Ministers”.

If patients who have opted out of their personal data being used in research are overridden by politicians and HDRS so they have their data used in research against their wishes, then that will likely go as well as some of the other pre-u-turn decisions of this government. 

Patients have choices

Polling says that up to 20% of people think they have opted out, but official statistics show only 5.5% actually have a National Data Opt out. If a patient is concerned about whether they have opted out, they can check with the online system, and then they need to do the two or more step process to actually opt out: online individually for your National data, and then on paper for your GP data for your whole family, and then a different paper form for National data for your kids! (The previous government designed this system to create administrative barriers to opting out; the new Government hasn’t made it worse yet at least)

Government is currently going through a ‘process’ (involving push polls about which we have had complaints from those attending the focus groups) to look at whether opt outs should be “reformed” in ways which mean an opt out after some date in the future may do less than the opt out does today. As seen with HDRUK, some in research think patients views don’t apply to them – and NHS England doesn’t want opt outs to apply to their “planning” (i.e. everything Government does in health).

It is important for patient confidence that there be “no surprises”, and that genuine transparency shows that promises are being kept or being carefully changed. Without this, how can any patient have confidence in the decisions being made as it takes control of their medical notes in the Single Patient Record?