(this is part 4 in a series – you may want to begin with part 1)

For some, care.data wasn’t a mess. It was practice...

But practice for what?

The new patient choice suggested on page 41 of the Review is: “information about me can only be used by the people directly providing my care.” That meets the promise in the Conservative’s election Manifesto, and it is a promise that is capable of being kept.

A longer term aim of the Review was to begin to restore public trust. It is only after the consultation, when we see the implementation, that we will be able to judge whether it was successful. Details of implementation were outside of the Terms of Reference, which is why there is so little detail on implementation.  It is also why the “NHS/non-NHS” proposal could be considered, as there was no need for anyone to think about how to do it.

This is the shadow boxing that has gone on for nearly two years since it become clear that care.data wasn’t coming back. But the problems remain unresolved.

To prevent the outcome of this consultation being changed at the whim of a future Secretary of State, the outcome has to be put into Legislation. Given the slow process to put the National Data Guardian on a statutory footing, that is entirely possible. If there are going to be new changes to patient dissent, they must be given a democratic basis by Parliament.

The Review has decided that there should be a “Caldicott Reset of Consent” even if the mechanism is currently unclear. Will they be positive, or in retrospect, will they turn out to be as compromised as the care.data “vision”?  It could go both ways.

Consensual, Safe, and Transparent?

Consensual: What is the promise to patients, and how will they know it was kept? How does it change from the current offer? How will patients be able to make an informed choice of whether to express dissent? The option of maintaining the current opt out for GPs, and extending the HSCIC opt out to cover all other care, is still possible.

Safe: “don’t leave medical records on trains” The Caldicott Review is strong here, and it just needs to happen. How will patients know if it hasn’t?

Transparent: Patients should know how their data gets used. At the moment, it’s a secretive process because there is no transparency. If DH wishes to override patients’ dissent (whatever that is), the patients should be able to know about it. It makes all of the discussions practical. This is the informed part of informed consent (dissent), and also the mechanism for Dame Fiona’s conversation into the future.

The opt out language

The “hard” part of Dame Fiona’s task was to suggest new language on opt outs that would both have public trust and was capable of being delivered. And it succeeded in offering that option, amongst others.

How that is interpreted is currently solely up to the Department of Health.

Data sharing will continue, as will AI, genomics, and whatever comes after AI and genomics. At some point, Google Deepmind will do something creepy, or the next startup in shoreditch will do something stupid. If a media firestorm is the only way to tell patients what happened, then eventually public confidence will lose, and lose badly.

Every patient should know how their data is used, and from that, innovation can be celebrated. At the moment, everyone prays really really hard that nothing goes wrong.

A transparent communications mechanism can build trust. It can also be used to talk about all the other innovations and benefits that already happen – it’s just no one knows about them.

Currently, the best way to find out whether your retina scan was fed to an AI, is by being on Google’s press list. That can not be right. If the only way Jeremy Hunt wants patients to hear how their medical records were used is via the press, then that is sheer lunacy.

There are few opportunities to make changes such as this. The Caldicott Reset of Consent coming after the collapse of the care.data is likely to be one of them. We hope the outcome will reflect the choices and interests of everyone, not just those who wish to ignore consent and profit off patients.

Patients have been given an option to opt out. Any attempt to remove it is likely to exacerbate the concerns of the vast majority who have so far not used it.

(This is part 3 of a 4 part series looking at the future. If you are concerned about the privacy of your health data now, our advice remains unchanged)

The expectation of the Review was that it would create new opt out wording for the public – Care.data had many false starts as “mistakes” kept being discovered.

The new patient choice suggested on page 41 of the Review is: “information about me can only be used by the people directly providing my care.” That meets the promise in the Conservative’s election Manifesto, and it is a promise that is capable of being kept.

But what may happen in practice? Everything below is covered in the consultation that we discuss link to – it is not yet certain, it is just a proposal that can be changed. It may turn out the way you want, or the way you don’t – it depends on whether you make your views heard. For now, nothing changes, but it may in the future, and how it changes, is something you can help with.

Will Parliament be involved?

You may have already told your GP that you don’t want your data to leave their practice. But the Department of Health believes it alone can decide to ignore what you have told your Doctor… What happens when “too many” people opt out again?

The only safe way to “improve” past arrangements is for Parliament to put the opt-out into law. That should include how to get to the new model from where we are – topics that were outside the Terms of Reference of the Review.

1.2m people have explicitly ticked a box and personally delivered a form into their GP that says to their doctor “don’t pass on my records”. NHS managers want to instruct doctors to ignore it. For the medical profession, this is an ethical question, not a data protection question. Parliament therefore has to be involved.

Resolving this must be done democratically, with debate, if it is done at all. Otherwise trust in the NHS will be fundamentally damaged. What will stop a future Secretary of State changing the rules underneath patients and doctors, yet again?

This issue goes to a patient and professional trust — will the public have reason to believe the system will do what it says it will do?

Proposal: Your data will still leave your GP…

The Review suggests removing your existing opt out for GP data going to the HSCIC (page 31). Information you share with only your GP, will be copied into the HSCIC against any wishes you have already expressed.

This is the removal of an option that pre-dates care.data – and breaches many promises of confidentiality that GPs have made to patients in the past. Currently, these promises are being kept by the GPs, but the new proposal is that GPs will be required to break them.

We have seen no compelling case for this to be necessary.

…and then data about you will leave the HSCIC…

Back in 2014, you may have opted out of “data about you leaving the HSCIC for purposes beyond your direct care”. If you did, data about you is still included in the hospital data sold for commercial reuse. The review proposes this continues (page 34).

As we showed in part 2, de-identification is not anonymisation. The Government continues to pretend that it is, so they can continue to sell your medical data and ignore the opt out you used to prevent that. While the Government say “marketing” is banned, use for “market access” is not – as the latest data release register shows.

When it was announced that opt outs were being respected, they kept the exclusions secret. It was not announced that the scope of the opt out had been slashed to exclude the data that was the primary source of patient concern. This is half the basis of our complaint to the ICO: the opt out does not do currently everything you (and we) were told it would do.

…and you may have to opt out again

If the “two box” model discussed in the second blog post is implemented, the Government will require you to opt out again. It will ignore your past choices, and you will have to fill in another form. That was the intent of those who didn’t want you to be able to opt out in the first place.

Question 15 of the consultation shows whether the Government has thought about how to do what it is consulting on: it hasn’t. Which is a recipe for the repeat of care.data.

No one can know the problems with what is proposed until the Government is clear on what it wishes to do. If they respect your   wishes, that’s pretty easy to tell patients… If they choose to ignore them, the chances of them telling you are somewhat lower.

The question the consultation should ask, is what will give you confidence that your wishes were honoured?

How will the outcome of this consultation help when the next data project gets mishandled, with a high price of patient trust,

Nothing has changed yet, but it will in the future; how it changes, is something you can help with.

The proposal in the review: “Information about me can only be used by the people directly providing my care” is strong, simple, and deliverable. You can help it become reality.

All parts can change – Here’s how you can help:

You can respond to the consultation online. You don’t need to answer every question, and can only answer question 15 if you wish.

You might want to mention some of these points in your own words:

• Why is what you tell your GP private for you?
• Why must the NHS keep the promises it makes to you?
• Is this promise clear: “information about me can only be used by the people directly providing my care”?
  • Do you want that promise to be given and kept?

You can say as much or as little as you like.  

You may also want to tell your friends…

(we also take donations)

See part 4 of the series

In part 2 of this short series, we look at the “Bad” parts of the The Caldicott Review of Data Security, Consent, and Opt-Outs. (link to part 1)

A good part was the suggestion of a continuing conversation with professionals and the public. What will inform that continuing conversation?

Silence on transparency to patients

While the Review suggests a range of improvements, there is no recommendation that patients should be told what happens to data about them – ie whether their wishes have been honoured or ignored.

There is also nothing in the Review to require transparency, or prevent it; but nothing to change the status quo of secrecy. We will see in the next part of this series how the bureaucracy wishes to continue to do things to your data without your knowledge.  All future scandals, concerns, and catastrophes will flow from this decision, and it will also limit innovation and harm research for every patient who does wish their data used in new ways.

As part of the “paperless 2020” agenda, the Secretary of State has told the National Information Board to look at telling patients how data about them is used. But this Review has committed to nothing, beyond a recognition that there should be a “continuing conversation”. A conversation requires parties that are willing to listen and change based on what it’s heard…

Hospital Episode “statistics” – Privacy Impact Assessment

Also currently out for consultation, is a Privacy Impact Assessment on the Hospital Episode Statistics. The hospital episode statistics are patient level, unprotected, individual records covering hospitals in England over 25+ years. They are not statistics in the Office of National Statistics sense – it is the raw data on your treatments, linked over time.

The assessment was written in 2014 when public disquiet at how their hospital records were being used led 1.2 million people to opt out, the document has finally been published for consultation. What is most disappointing is how little has changed. Companies are still getting data for commercial re-use, and copies are still being sent outside of HSCIC’s control to be lost, stolen, or abused. According to HSCIC, it’s “anonymous”…

Whether those data are anonymous is covered by the UK Anonymisation Network, which says quite clearly on page 16:

“Anonymisation – refers to a process of ensuring that the risk of somebody being identified in the data is negligible. This invariably involves doing more than simply de-identifying the data, and often requires that data be further altered or masked in some way in order to prevent statistical linkage.27

We can highlight further the difference between anonymisation and de-identification (including pseudonymisation) by considering how re-identification might occur:

 

• Directly from those data.

• Indirectly from those data and other information which is in the possession, or is likely to come into the possession, of someone who has access to the data.28

 

The process of de-identification addresses no more than the first, i.e. the risk of identification arising directly from data. The process of anonymisation, on the other hand, should address both 1 and 2. Thus the purpose of anonymisation is to make re-identification difficult both directly and indirectly. In de-identification – because one is only removing direct identifiers – the process is unlikely to affect the risk of indirect re-identification from data in combination with other data.”

As such, claims in the Caldicott Review that the ongoing release of HES data is compliant with the ICO’s Anonymisation Code are deeply flawed. We have complained to the Information Commissioner, as, according to the PIA, this is the risk to patients of re-identification: “This may happen in future” (risk 7).

A Two box model – “NHS” vs “non-NHS”

This choice is fundamentally confusing.

This suggestion allows aggressively commercial entities to acquire a figleaf NHS contract, and reuse data for any purpose they wish, while legitimate and public spirited academics and not for profit researchers are stuck in the “non-NHS” box. For those worried about the privatisation of the NHS, this proposal should be of deep concern.

In a review with such limited time, it was never going to be possible to fully design a new consent model. However, due to the obstinacy of existing data projects who have no desire to improve their ways, and no political leadership to enforce such improvement, those who got to lobby at the table made sure their interests were protected; patients, not so much. This intentionally murky choice is the result – it is right that this was put to public consultation to demonstrate the problems with the approach of existing commercial data use.

It is right that the patients who choose to opt in to particular studies do not have their preferences overridden; yet the review doesn’t do the same for those who chose to opt out.

It gets worse in part 3…

The Caldicott Review of Data Security, Consent, and Opt-Outs was published a few weeks ago. Commissioned by the Secretary of State after Tim Kelsey lied to the Care.Data Advisory Group, it was tasked with solving the outstanding problems of care.data.

In this series of blog posts, we’ll look at the outcomes, and other related issues. The Caldicott Review was a look at a large set of concerns, without enough time for consideration of implementation. The Review was finished before it emerged that Google DeepMind wasn’t entirely accurate about what it was doing.

Page 40 of the Review offers an example “Restricted setting – information about me can only be used by the people directly providing my care”. It seems like a water tight opt out of all other uses, but it is potentially undermined by other parts. What will turn out to be accurate?

After all, if the nuances of the review have to be relied upon, that means all the political promises and systematic improvements have failed. The system should be so good that no patient has unaddressed concerns, and the opt out is there, but that personal circumstances aside, you shouldn’t need to use it. Will the implementation of the Review fall short?

All data flows in the NHS should be consensual, safe, and transparent. Let’s see how this measures up…

Professional continuing education

The long term solution to all these issues has to be education. This is fundamentally a human problem.

Professionals understand what a duty of confidence is, they understand Direct Care, and they are trusted by patients in ways few others are. That may be undermined.

The seventh Caldicott principle is “The duty to share information can be as important as the duty to protect patient confidentiality” – and knowing the difference requires knowing what the words involved mean. There are many examples of past failures on this topic.

Education of non-Professionals

Everyone in the NHS is committed to improving the health of the nation; not everyone does direct care.

Direct care can be described as an Identified Patient receiving Individual Care from an Identified Clinical Professional. Many other people are necessary to support Direct Care by providing tools, but they do not provide it themselves.

Providing a working computer system, or electricity, or cleaning services is a necessary task, it is improving the health of the nation, but it is not providing direct care. To summarise our presentation on the topic – not everyone gets to be an astronaut.

Other clinical professionals in an organisation, while they are doctors, are not your doctor. Someone can be a father and doing childcare, but that’s not the same as being your child’s father. That they provide care to some, does not necessarily mean they provide care to you. The only reason to others argue that there is “gray area” here, is to justify the ignorance behind decisions already made.

Opt-Out coverage should be NHS wide

Because HSCIC were not involved in giving 5+ years of hospital data to DeepMind, the opt out didn’t apply – and couldn’t apply because the hospital didn’t know who had opted out. The review recommends that, just as when you walk into any part of the NHS, they can find out who you are; every part of the NHS should know and respect your objection to data about you being used beyond your direct care.

This is important, and means other problems can be solved.

Clinician led

We welcome that clinicians, doctors, should be partially responsible for explaining how data is used to patients. However, that requires doctors to be told how the bureuacracy uses data, and to have control over it.

The situation where Doctors are responsible for explaining the decisions of the Secretary of State is unlikely to turn out well for patients, for Doctors, or the Secretary of State. What Doctors tell patients has to be true, and those promises have to be kept into the future, otherwise patient trust will suffer.

Data Safety

It is the majority of the work, and so the majority of the review looked at data security, working with other bodies to ensure that standards are followed. Patients, rightly, just assume that this happens, in the same way no patient should need to check that the surgeon is using a sterile scalpel.

The review found that there was good practice but not everywhere. It’s the CQC’s job to assess and improve.  The CQC have broad powers to assess GPs, and also look at medical records in the practices they are inspecting. A high standard of safe data practices is necessary, it is important, but inspectors should not be able to rummage through medical records without those patients knowing it happened and why. Transparency protects all sides.

Handling of Patient data, and Information Governance as the NHS terms it, must improve, and the Review is a necessary step in that process.

It is highly welcome that the review has patient agency as a key theme throughout. But the accountability back to those patients: will those benefits be seen to be done, or is it all in secret?

Continue reading part 2…

There’s a lot of buzz in the digital health world about “blockchains” – unalterable records of history. Those looking to make money are looking adoringly at the health IT budgets.

No health app, data, or service, involving blockchains, should be considered credible without publishing specific worked examples of what data is written to the blockchain.

That must be the key test to allow a discussion of privacy. Without that, no credible assessment can be conducted. Is there a worked example of what will be recorded, for each of 7 entities involved, for an average of 5 transactions each?

If you don’t know what information is recorded, it’s impossible to analyse whether the promise is a sweet dream or a beautiful nightmare.  For different scenarios, it will be different – Beauty is in the eye of the beholder

In the 1990s, Iceland decided that it would give “a single company monopoly control of the country’s health records”. The system was cancelled when it was demonstrated that individuals could be identified.

As so often in the tech world, there is an incentive for a shiny press release which ignores past failures. Those failures being forgotten until they are repeated. With blockchains, that may be a much less private event.

We welcome Home Office Minister John Hayes’ statements that additional protections for medical records will be added to the Investigatory Powers Bill.

He said: “I am prepared in this specific instance to confirm that the security and intelligence agencies do not hold a bulk personal dataset of medical records. Furthermore, I cannot currently conceive of a situation where, for example, obtaining all NHS records would be either necessary or proportionate.”

Additionally, because he “felt that it was right in the national interest, with the benefit of the wisdom of the Committee” … “I feel that the public expect us to go further” than currently on the face of the bill, because he “cannot bind those who hold office in the future, so it is important that we put additional protections in place.”

Having agreed in principle that there should be “additional protections”, there are multiple ways to implement them.

For these purposes, it is sufficient to consider that Bulk Personal Datasets are used where the identities of the individuals being targeted are unknown, and you need to search by attributes across whole databases rather than names. Think of it like searching your phone book by phone number, rather than by name.

Existing mechanisms to get this information

As a Home Office Minister speaking in Committee, there is no reason he would be aware of the existing gateways available for doing precisely the things he was thinking about needing to be able to do in rare circumstances, for the exceptional reasons he was thinking they may need to be done.

In the course of an investigation, especially in a terrorism incident, the police can ask the NHS questions. The police or agencies won’t be able to go fishing for answers, they can ask the relevant hospitals questions, and the hospitals can take a view on whether it is appropriate to answer based on full details. There can be a process followed which can command public confidence.

Doctors are permitted to override the common law duty of confidentiality and release such information to the police when they “believe that it is in the wider public interest,” under GMC guidance. After a terrorism event, it is inconceivable they would not do so. When investigators know what to ask for, they have the ability to use existing processes for those individuals’ details on a targeted basis, should they be relevant.

There is existing guidance on this, and if it needs to be updated, that does not prevent stronger protections on bulk access to medical records being added to the the Bill.

Even if there is only a “risk” that those individuals may have been involved, or may be involved in terrorism in future, the duty of confidence for providing information to the Agencies was lifted in part 5 of the 2015 Counter Terrorism and Security Act.

The Home Office has lowered the bar of confidentiality protection dramatically over the last several years. Unamended, these powers remove it entirely.

What the protection must cover

The committee rightly identified that there must be protections for “for material relating to “patient information” as defined in section 251(10) of the National Health Service Act 2006, or relating to “mental health”, “adult social care”, “child social care”, or “health services””. All sections of that are important, although there are different ways to put them together.

It is insufficient to simply exempt data held by DH/NHS data controllers, as that does not cover social care, nor does it cover data with data processors contracted to the NHS (which is a different loophole of concern to the ICO).

The Agencies should also never be permitted to use covert means against the NHS or health professionals to acquire patient information.

Should the Agencies create a scenario where there has been a secret incident where medical professionals are not allowed to know the characteristics of a suspect, and that search can only be done at some future point by the Agencies, rather than now by the medical staff, then some mechanism may be appropriate. This seems highly unlikely, but the Home Office may be able to make such a case to the satisfaction of both Houses of Parliament. We invite them to do so.

In that scenario, it is likely to be necessary to have multiple levels of protection. A general ban on warrantry for such data, except where the data responsible Secretary of State has submitted to the Judicial Commissioner an approval for its handover and retention for a defined period for a defined investigation, and no others.

In effect, this removes from the Agencies permission to acquire the data, but retaining the ability for the Secretary of State elsewhere in Government to hand it over should they believe it appropriate. The Commissioner and Intelligence Services Committee should then be required to be notified that this has been approved, and state on how many individual level records were affected in any annual report covering the period.

Whatever the Home Office come up with, it must be robust and be seen to be robust. We remain happy to discuss this further with all parties.