Hello again from medConfidential,

Given the upcoming general election on 4 July, we thought it might be helpful to give an update on what’s happened since our March newsletter, and to give a brief summary of the current ‘state of play’.

What just happened?

NHS England’s “Federated Data Platform” (FDP), running on the half-billion pound Palantir platform, went live with two national ‘dashboards’ in late March. NHSE officials say it is now being used for four such dashboards – none of which use individual-level patient data directly, at present. 

Meanwhile, the Data Protection Impact Assessment for the FDP is being withheld by ‘the Department of Health in England’ (i.e. NHSE) because it is so controversial that its publication could affect the election. Statements made before launch that FDP would be used for direct care omitted to say that it would also be used for anything else…

Around the country, a number of NHS Trusts across England are continuing to use Palantir without telling their staff what to tell patients, or even what they are using it for. According to the Department of Health in England, you should be able to check if your hospital is one of them on this list – but as you will see if you click on the link, they’re keeping the membership of that list secret, so you have no way to know if your hospital is involved. 

The Department of Health in England has also been doing a bunch of ‘public engagement’ work, to try to justify taking your choices away in future. Ignoring the ‘spin’, the first published results are in fact very damning: 21% of patients either strongly or slightly disagreed with the statement, “I trust the NHS to keep my patient data secure” (Table 2), for example – and two thirds said they wouldn’t want anyone who isn’t directly treating them to have access to their medical records (Figure 3). The numbers who are concerned that the NHS may sell their data to companies without their permission speak for themselves.

Digging further into the detail, Table 4 suggests that up to 11% of patients are not happy for the NHS to use their data for purposes beyond their direct care, a proportion which increases to over 25% if that means “work[ing] in partnership with companies” (Table 3). Meanwhile, when the ‘dashboard’ isn’t broken, official figures show that only just over 5% of patients have actually opted out. There’s clearly still a lot to do.

Published days after the election was announced, the Public Administration & Constitutional Affairs Committee’s report on Transforming the UK’s Evidence Base says, on page 35:

101. Although statisticians and researchers publish a wealth of information on which data sources they hold, and how they are used, very little information is made available about how personal data are being used for the purposes of government analysis.

102. We recommend that the analysis function explore options for improving transparency around the use of personal data in official analyses, and that this work be made publicly available.

We agree. And hopefully a new Government will do something about it.

The General Election

The best time to commit to transparency is early in a new Government of a new Party, when the legacy of toxic behaviours all belong to the previous Government.

Public and manifesto statements to date, however, show there is no substantive difference on uses and misuses of your health records between the two major parties. You should of course know how your medical records are used, but the government of the day will always prefer a quiet life…

Behind the scenes, the Conservatives have been lobbied by Palantir – and those lobbyists are led by a Labour Peer. Meanwhile, Labour’s ‘kingmaker’ at the Tony Blair Institute continues to receive funding from the runner-up for the FDP contract, Oracle. So whatever election spin you encounter, whether or not there will be any changes to your rights around confidentiality, consent, and non-care uses of your medical records is not the partisan issue you might think. 

medConfidential will, of course, continue to keep a close eye on whoever wins.

In order of publication, the Liberal Democrat manifesto says they will be “’Protecting patient data and patients’ rights to opt out of data sharing”; the Conservative manifesto means continuing with the Palantir platform while widening (the risks via) ‘Pharmacy First’ and access to GP data; and the Labour manifesto hints at large changes to data policy, but offers no detail as to what they will be – beyond giving children identifiers that ‘follow them for life’ (remember ID cards?). 

On one specific data item, Labour’s “data library” could perpetuate the calamity of contradictions in the outgoing Government’s “Integrated Data Service”, or it could enable commercial exploitation of data in secret, as desired by UK biobank and HDR UK. Or it could be closer to the safe and transparent approach of OpenSAFELY… as ever, the detail and execution matters.

Neither the Green Party nor Reform say anything specific on health data policy that affects the Department of Health in England. And if you would like some longer analyses, others have focused on data and health.

Whoever wins the election, the new Government is going to be doing more on data. Beyond health, and whatever its focus, central Government should copy the model of the NHS National Data Opt-Out – creating something like a ‘Data Preference Service’ for the (non-NHS) rest of Government; a single place to opt out once. (Outside government, that same model – akin to the Telephone Preference Service – would help reign in the secretive companies that make money selling data about you without your knowledge or consent.)

After the election, actions will speak much louder than words.

What’s next

Next comes the voting. We hope all candidates offer clarity on their own views, and we encourage you to vote however you think best for the future of the country. 

We will still be here, whatever the result of the election – and whatever it is that the next Government wants to do to your medical records…

Just to confirm, as of this Bulletin, your current opt-out choices still boil down to this:

If you want to express your objection to your NHS data (“confidential patient information”) being used for purposes beyond your care, i.e. to opt out, you should use this paper form for your GP and post this paper form to Leeds Redditch for your kids and you.

(If you’re single and over 13 years old, this online page works only for you – and NHS England states that this opt-out will not apply to the Federated Data Platform, which rather undermines it as a so-called ‘National Data Opt-Out’…)

For other data flows around your direct care, you should ask your hospital doctors what your hospital currently does and what your choices are there.

Please note: in the current situation, your GP Data Opt-Out is just as crucial as your National Data Opt-Out. 

As ever, as we learn more, we will let you know. Thank you for your support.

Phil Booth & Sam Smith

21st June 2024

Everyone deserves privacy, and everyone deserves medical privacy. 

Whomever you are, Princess of Wales or not, you have the right to know where and when your records have been accessed, and in being able to see that those accesses were legitimate – and for action to be taken if they were not. As events have shown, the princess had access to her records monitored for abuses, the NHS won’t let you do that. The ‘Department of Health in England’ (NHS England) could tell you, but they don’t want to; doctors have been struck off for accessing records inappropriately, but abuse is far more common than punishment.

At the start of the 2019-2024 Parliament, we had no idea if mRNA worked at scale, and no real idea how to find out safely. A pandemic intervened, and we figured it out. At the end of the Parliament, trials to detect and cure cancers using mRNA seem promising and could revolutionise treatment (and the NHS budget) over the term of the next Parliament – if done properly. 

The outgoing Government’s choice to implement the recommendations of the Cass Review within hours shows that care choices can and are being politicised, with criminal penalties being created so very quickly. If only the independent Windrush Review, the many safe staffing reports, or conclusions on Grenfell had been so rapidly adopted by Ministers. The Cass Review will now undergo the slow, meticulous process of academic peer review – assessing the choices made, and seeing which parts demonstrate rigour and which show cherry picking, misunderstanding, or simply prior policy beliefs masquerading as independent impartial evidence. 

Whether the HDR / Sudlow Review will ever be published is unclear, but – if it is – any narrow evidence base and distortions that favour HDR UK’s own institutional policies will enter that same process of scrutiny and assessment which HDR does its best to avoid when nudging funding decisions to cronies. It is entirely possible to write a report focussing only on the subset of reality that is convenient to the institutional culture towards which you want to steer cash; permanently attaching your name and reputation to a temporary star is, however, a choice that remains fixed as time moves on, and temporary incongruences have been resolved. Career priorities are political. 

The Department of Health in England would prefer to control a single consolidated record of every health ‘event’ in your entire medical history – including things like copies of readings from the sensors on your smartphone and smartwatch (see Annex 8 of our UC work) – and to make them available not only to anyone in the NHS but to any private provider, to do with as they see fit. 

“Pharmacy First” can diagnose you with a UTI, prescribe accordingly, and then write that to your NHS record; DH policy imperatives show they believe a private GP doing the same thing is no different. But if you receive a diagnosis of ADHD or gender dysphoria that fulfils all NHS criteria, why does that not become an NHS diagnosis in the same way? Why does the system oblige your family doctor to follow some non-NHS diagnoses, but seek to criminally punish them for others?

(As an aside, allowing people to write arbitrary diagnoses into arbitrary records provides a system-wide ability for any rogue doctor to write anything they choose into a record – giving the Minister of the day, for example, SNOMED code 247667002 or 247670003. And of course, once entered into an NHS record, “diagnoses” are supposedly impossible to remove…)

The politicisation of care has become utterly incoherent. Things will eventually be resolved, but the real question is how many serious harms there will be in the interim.

Sustainability of data decisions

Sustainable decision structures are those which can exist for the longer term – and in which any individual decision is secondary to the process continuing. Where organisations aren’t disinvited from the process for giving private critiques or briefing Parliamentary Select Committees. (The culture of Paula Vennells is not unique to the Post Office.) And while imposition of a contract or rules is an emergency act, institutional ignorance is a temporary choice. It may feel easier to engage only with those who agree with you – something the ideologies of the outgoing Government made a policy goal – but what is temporary will eventually end. 

Whatever happens with NHS data it must be stable to survive. Every important stakeholder must have what it needs, which may not be what it wants. NHS England wants to do analyses; GPs need confidence and clarity in their responsibilities to all patients; interested patients need trustworthiness and dissent; researchers need to be able to do research ethically.

OpenSAFELY and Palantir are both tools; how the tech will be used remains unclear.

If the Department of Health in England were being honest, the public narrative of the ‘Federated Data Platform’ in Palantir and the NHS App would be that they are, in their view, the future of NHS care. If an algorithm running in Palantir and displayed in the App says No, then you won’t get NHS care – in exactly the same way as when the A-Level algorithm said No in 2020, students didn’t get their University places.

Culture of Coverups

The internal culture of NHS England has barely changed since the care.data debacle in 2014. That shouldn’t be a surprise, as it’s largely the same people doing the same jobs – and their ongoing actions suggest they have learned very little in the past decade. It is a common argument around Government that the civil service does churn too much, but perhaps lack of churn has harms too…

While the faces remain the same, the culture of the current “new NHS England” (aka the Department of Health in England, as NHSE has de facto seniority over policy staff) has degraded to the level of trustworthiness and integrity demonstrated by the Boris Johnson administration, while the current power structures were last defined by Matt Hancock’s DHSC.

The Department of Health in England takes reckless risks on your behalf without you even knowing. And UK Biobank and Our Future Health have evolved in that culture – the NHS England form to buy patient data is around 30 pages long; the biobank form is less than four pages long. There is no way that could cover everything required, but they have made the calculation that investing in PR and bluster will be more successful with Government and the Department of Health in England than offering real substance and evidence. Indeed, that approach clearly has worked for biobank and HDRUK under the outgoing Government. But all Governments end.

No Privacy, No Transparency, No Trust

Information such as service performance, which NHS Digital (RIP) proudly published proactively, is now routinely covered up and FOI requests are only answered after complaints to the ICO about stonewalling and non-response. “Transparency” may be something the new NHS England says – it is demonstrably not what it does.

Since the absorbtion of NHS Digital, the so-called ‘Privacy, Transparency, and Trust’ group is where NHS England dumps these vital issues in order that the rest of the organisation can ignore them, and so that group can focus on how to avoid them. The only outputs are performative statements – rather than building a trustworthy organisation that is worthy of public confidence, by demonstrating trustworthiness.

That this is the case is best demonstrated by the Department of Health in England’s sustained incoherence around a patient’s legal rights to object to unnecessary data processing. And their complete lack of interest in telling you where and when your medical record has been accessed.

Every NHS GP record is now supposed to be accessible in every pharmacy in the country, via a service called “Pharmacy First”. But you will have no idea if someone has accessed your GP record – let alone if that was a legitimate access, or one where your stalker or creepy bad date was ‘going fishing’ – entirely because the Department of Health in England refuses to tell you. Until recently, pharmacy staff could only read records. Now they can write a diagnosis into your record and, if they do, it’s almost impossible for you to know that it happened, or to challenge or have it removed. MPs (rightly) changed the law to allow the removal of malicious child safety reports, but that’s just the tip of the iceberg.

If your GP uses TPP/SystmOnline you may have access to an “online audit”, but this is not available in the supposedly “main” NHS App. Despite this audit trail being a contractual requirement imposed by NHS England, they never implemented it for you. Its actions demonstrate that the Department of Health in England believes they, not your GP, should decide what your GP can tell you about your health, what medical care they can provide, and which organisations can buy the personal data in your health records.

While patients should be able to see the correspondence about them, the reckless imposition of this by the Department of Health in England pushed all of the risks onto the patient and GP. It may be clinically essential for a letter between clinicians about genomics involving family risk to mention that the patient is adopted; but surprise! An entirely benign letter about a child can disclose that an investigation is underway simply by implicit reference to documents a potential abuser can’t see. The Department of Health in England’s view is that ‘This is not our problem’, and they adopt the same approach and attitude time and again – such as with the form that allows anyone to register with a new GP from anywhere, which can be weaponised by abusers.

As time goes on, various “national services” will interpose “national” goals between you and your family doctor, and the care they provide you. Is this really the NHS you want?

Being seen to Respect Patient Choice 

The opt out for secondary uses of your health data exists; the opt out for Shared Care Records is a ‘postcode lottery’ – making promises to patients that others in the NHS believe don’t apply to them when they copy the data again and again. 

When it comes to data use for purposes beyond your direct care, the Department of Health in England still believes that no opt outs should apply to them, even while saying opt outs that clearly do apply in law are via mechanisms that they simultaneously ignore. No process involving NHS England ‘Privacy, Transparency, and Trust’ (PTT) can be considered trustworthy in the current setup. That’s not to say that every outcome is always wrong – but outcomes are self-evidently incoherent, and disconnected from the processes supposedly creating them.

Even the Tony Blair Institute recognises that the current opt out process is punitive and destructive. medConfidential always said that it should be as easy to opt in as it is to opt out (and vice versa) so we agree on that. While the current process may be used to opt both ways, it’s still punitive – especially if you have dependent children living at home. TBI, however, prefers the intrusive power of the state be used to support its goals – and it is notable that Mr Blair’s proposals for the sale of NHS patients’ data don’t appear to have been implemented in any of the dictatorships he advises.

Claims from TBI and from the Department of Health in England about what Palantir will do for direct care – the care that is delivered by hospitals and GPs, not by centralised computer systems – are completely disconnected from the reality of NHS systems that already exist, and that work, and that are both used well and abused badly. Meanwhile, NHS England has covered up the Data Protection Impact Assessment for its Federated Data Platform, allowing FDP to launch without publication during the (local) election period, because the text says that public claims made previously about FDP being ‘for direct care only’ were abandoned before FDP launch.

The (first) Goldacre Review in 2022 was clear that the risks of the current use and misuse of patient data are an “emergency” – and “not a new emergency” – and yet, as back in the Kelsey years, the Department of Health in England is still hoping things will go wrong on someone else’s watch.

The outgoing Government may have had one success in that Review; the new Government could choose to announce in its first weeks that, retroactive to the date of the election, patients will be able to see in the NHS App – or in the TPP/EMIS apps if NHSE can’t get its act together – a list of when and where every patient’s records have been accessed via all national NHS services.

The list should begin with accesses to your Summary Care Record, your Shared Care Record, to GP Connect, and in FDP – all of which are capable of such audit functions. If it is claimed that any aren’t, then those who commissioned them were either grotequely incompetent or wilfully negligible. The ‘trial period’ could begin with digitally-engaged patients who have prospective access to correspondence enabled already. The new Government could then say that the secrecy ends, and patients would from that point forward have a clear evidence base of how data about them is used, and whether it has been misused.

For a new Government wanting more use of technology and more system access, this would have another significant additional benefit. One of the hardest aspects of such systems is getting clinicians to use them. If every patient can see how data about them has been used, they can also see where these new systems have not been used when they should have been – providing an evidence base and empowering patients to ask why these expensive data systems weren’t used to benefit their care.

Rest of Government: UC, Governments and computers

In the last days of the Parliament, the Administration Committee of the House of Commons said:

“Although statisticians and researchers publish a wealth of information on which data sources they hold, and how they are used, very little information is made available about how personal data are being used for the purposes of government analysis.”

“102. We recommend that the analysis function explore options for improving transparency around the use of personal data in official analyses, and that this work be made publicly available.

(paragraphs 100/102, Public Administration and Constitutional Affairs Committee report on Transforming the UK’s evidence base)

We entirely agree.

If you were to hear the description of a computer system whose users are overpowered by the system designers and operators, which tells users how much money they owe without showing any detail on how that figure was created, where staff working for the system designers can change those figures at will, and when figures change there’s no way for the users to know about it unless they keep their own independent records –and where discrepancies result in prosecutions, sometimes deaths – you might think someone was talking about the Post Office Scandal.

The previous paragraph is also a 100% accurate description of the systems of Universal Credit, about which we recently published Annex 8 and the wrap-up report.

The final section of Annex 8 relates to the rest of Government as much as it does DWP, and we’ve written a short note on what GDS / CDDO / CO should choose to do.

After all, all Governments end.

Enclosed new documents:

• Universal Credit
  • Annex 8: Government ‘Super-Apps’
  • Annex 8B: How digital services and apps get built
  • Related available next steps for CDDO / GDS
  • UC work wrap-up
• Letter to biobank about sending data to hostile states

Hello again from medConfidential,

It’s been a while since our last newsletter, and if you signed up to find out if NHS England would provide more details to help you with your choices around its half-billion pound Palantir platform before it “goes live” at the end of March, the answer is now clear. They won’t.

NHS England has said pretty much nothing new in public since before Christmas. The ‘Department of Health in England’ is instead leaving you to puzzle out the process, and to do all the work. As of this newsletter, your choices boil down to this:

If you want to express your objection to your NHS data (“confidential patient information”) being used for purposes beyond your care, i.e. to opt out, you should use this paper form for your GP and post this paper form to Leeds for your kids and you.

(If you’re single and over 13 years old, this online page works only for you – and NHS England states that this opt out will not apply to the Federated Data Platform, which rather undermines it as a so-called ‘National Data Opt Out’…)

For other data flows around your direct care, you should ask your hospital doctors what your hospital currently does and what your choices are there.

Please note: in the current situation, your GP Data Opt Out is just as crucial as your National Data Opt Out. 

What’s going on?

Your GP sees you as a whole patient; they know it’s important to maintain trust in your family doctor. The Department of Health in England clearly doesn’t share this concern, and – though they’re not being entirely transparent about them – NHS England’s plans and actions show they intend your GP data to be copied again and again.

For example, the Frequently Asked Questions for the Palantir Project state:

“…if there is data sharing agreement between integrated care system (ICS) and GPs locally to share data for care co-ordination then they can use the local version of FDP for that purpose.”

There are many such agreements across England, and once your data is in Palantir, it can be “federated” – i.e. copied – again and again. 

NHS England’s Board were told in December 2023, “Absolutely, primary care data can go in” [time code 1:43:20] and “For direct care, it’s not in their [patients] interests to opt out, but they can” [time code 1:48:30]. And in February, the Government confirmed that GP data could be “brought in” to Palantir and Ministerial answers show they are content for NHS England to break past promises to be transparent and honest about how they use your data. 

What just happened?

Last week’s Budget effectively mandated Palantir for NHS Trusts and ICSs, even after the public were told it would be ‘optional’. And the public’s views won’t even be listened to until later this year, when it may be too late for many.

Budget week obscured another unauthorised data collection of all GP records across England, which was inadvertently revealed on NHS England’s official GitHub page.

On that page, officials at the Department of Health in England stated in terms that “the aim is to grab the data” from every patient in every GP practice. (This, despite having strenuously complained at medConfidential’s characterisation of its GPDPR programme, less than three years ago, as a “GP data grab”…)

The ultimate intention, as ever, is for the Department of Health in England to sell (access to) patients’ data in one form or another. As with previous attempts, officials didn’t inform GPs, who are responsible for their patients’ data in law. Instead, a team at NHS England wrote code to simply “grab” the data… because they could. 

This story is still emerging, but NHS England’s denials don’t match its actions thus far. And, as with their continued secrecy around Palantir, Department of Health in England officials don’t appear to think alternative perspectives on their intentions are worth considering – or even seeking.

Looking forward, legals and otherwise

Lawyers are lawyering about Palantir – our best advice for most people is to make your own choice for yourself and your family, and to leave the lawyers to do their work. (We’ll continue to help them.)

Legal action involves more than just ensuring government bodies follow their own rules; it’s about ensuring that they follow the law. We’ve never received clear answers from NHS England on this, only statements that they will “comply” with policies that they themselves have written to permit them to pursue their own desired actions.

This is far from reassuring. Whether it is legal or not remains to be determined. 

Decisions made by the Department of Health in England’s “Privacy, Transparency, and Trust Unit” fail to provide patient privacy and professional confidentiality, have self-evidently failed to provide meaningful public transparency, and – combined with the actions of the body it is supposed to ‘challenge’ – critically undermine trust in both the process and the wider NHS. (Legally-speaking, this deficit of robust, coherent internal processes makes it unlikely NHS England will be able to present such things to a court of law.)

The Federated Data Platform was meant to “end the era of chaos” in health data. But while a platform like Palantir could in theory make secrecy much harder, NHS England seems as determined as ever to try to keep its uses of – and ambitions for – your data hidden.

Unfortunately, the next Election won’t protect your NHS data; Opposition statements and actions already show the next Government won’t do any better than the current one.

The culture of data grabs continues spreading all across UK government, fuelled by tech salesmen promoting their platforms, magic thinking about tech not people, and officials (and others) with their own agendas. And even if the companies don’t make a sale, they embolden those who seek to operate without constraints – and who disregard the rules that are there to protect you.

What you can do

If you want to express your objection to your NHS data (“confidential patient information”) being used for purposes beyond your care, i.e. to opt out, you should use this paper form for your GP and post this paper form to Leeds for your kids and you.

(If you’re single and over 13 years old, this online page works only for you – and NHS England states that this opt out will not apply to the Federated Data Platform, which rather undermines it as a so-called ‘National Data Opt Out’…)

For other data flows around your direct care, you should ask your hospital doctors what your hospital currently does and what your choices are there.

You may also want to tell your friends and other family members about this, and/or forward this Bulletin to them with a short note of your own.

Finally, if you are in a Patient Advisory Group for a hospital, an ICS or your GP practice, please do ask for official answers on what information patients will receive on the ‘Palantir Platform’ / Federated Data Platform, and what their choices will be about their care and the use of their data as a result. The (lack of) guidance and meaningful options for patients should be on record. 

NHS England’s Board were told that patients would be able to make different choices about their care and their data; NHS England itself is refusing to give guidance on implementing those choices. Should this situation continue, things may come down to NHS doctors being forced to present their patients with the ultimatum, “Your data or your life” – as dictated by Palantir and the Department of Health in England.

The suggestion of using NHS numbers to track children in schools and children’s social care has reappeared again, with labour talking about recreating contactpoint (again).

The arguments in favour haven’t changed, simply using 2023 examples rather than 2003 examples, and the arguments against remain.

Using the NHS number to track children means also tracking adults who were once children, because NHS numbers don’t change.

DfE discloses data on children to anyone who wants it (including the school records of every state educated MP younger than 40). Using the NHS number means the security of the NHS number will be dependent  on DfE’s data handling practices (which do not satisfy the NHS rules, to say the least).

Some council will argue that because your school recorded a problem “managing self” at age 4 (“Manage their own basic hygiene and personal needs, including dressing, going to the toilet…”), adult social care should be reduced and incontinence pants used instead; or the crimes someone fell victim to become their fault in court because of the linked school records of every detail of every day they were in school. 

If you argue they should link health records to school records to support children’s education via the consistent identifier, then you equally believe (in special pleading, or) that they should link school records to others to “support young people affected by crime”. Using the NHS number to track ‘opinion-based’ policing data, or arrest people is a high risk extension of linkage, similar to Tony Blair’s Institute supporting the suggestion that (future) receipt of Universal Credit be dependent upon injecting wegovy (which will also require DWP data to be linked too). 

What gets linked for one reason gets reused by others – health records get linked to “clubcard” spending “for research”, and then pressure to use that data for more things is as “obvious” as the current arguments for more linking and more use. Always more.

The ideas aren’t new; neither are the problems. The only debate is about which victims they are choosing not to care about.

The NHS has spent 25 years getting the NHS number used for direct care. A new government may destroy that in 25 weeks.

It’s been several weeks since our last newsletter, and a few things have happened.

A Good Thing: OpenSAFELY

The GP data analysis environment which is capable of being consensual, safe and transparent – known as OpenSAFELY – has announced that the NHS will continue support for their analytical environment, which does not create any additional copies of the data and which respects patient choices to opt out of data being used in ways they don’t want it to be.

Things of another kind

You may have received some junk mail (with an NHS logo) from a company called Our Future Health which would like to sell access to your DNA and medical history to allow others to find new medicines. We’ll have more on that in the New Year.

Government spending £480m on Palantir

The Department of Health in England announced they will spend £330m on Palantir software and an extra £150m on ‘improving’ Palantir – so it’ll cost more next time – which has proved a little controversial.

Palantir will get one or more copies of all health data used by the national NHS across England, and the Department of Health in England has also bought the software for your local NHS Integrated Care System (ICS), and may impose it on your hospital.  Whether your local hospital or ICS wishes to take up this “offer” from the Department of Health in England is supposedly up to them. Some officials have however said that while using Palantir might not be “mandatory” for other NHS organisations, there are disincentives to spend money on anything else. 

This announcement is a start line, not a finish line. Nothing much changes before March 2024.

The National Data Opt Out exists and works as it always has, although it could always be stronger. The Department of Health in England has not published enough details to know whether patients’ objections will be respected, whether and where it believes your objections don’t apply, and/or whether the Department of Health in England will make everyone opt out again. We have a lot more details here.

As things develop, if you wish to protect your and your family’s medical information, you will likely need to have both an (online) National Data Opt Out and a GP Data Opt out, as your GP data could be used locally in Palantir.

As lawyers continue to pore over the text, if the Department of Health in England does disclose that it has created a new opt out that you have to apply for, we will tell you. To find out, use the box on the right to join our mailing list.

Remember, the announcement of the winner of the contract is the start line for this national data programme. It has to get to March 2024 without collapsing, and there are plenty of precedents for such programmes not managing that.

What you can do

The National Data Opt Out does what it always has. We agree with the Department of Health in England that it could be better – they could do something about that, but they refuse to. 

The Department of Health in England currently only links to the National Data Opt Out, once again neglecting to point out that the GP Data Opt Out exists and works to block secondary uses of your GP data that may be copied into Palantir if it is not applied to your GP record.

Meanwhile, Palantir shareholders want twitter warnings on anything that suggests the opt out works… 

Seasons’ greetings

This is probably our last newsletter before the New Year. We wish you well for the festive season with your loved ones. If you are feeling inclined, medConfidential is always grateful for your support of any kind, and we are grateful that so many of you are on our mailing list. As ever, please do pass this Bulletin on to anyone to whom you think it may be relevant.

Warm wishes,

Phil & Sam

Having had a few days to find some more surprises and omissions in the statement to Parliament and the press release confirming that Palantir won the £330m FDP contract, we understand why it is confusing. The goal is, after all, to copy everything into Palantir and only get support afterwards – and to not allow anyone to say no.

On Saturday The Times (incorrectly) said there is no opt out; a day later, the Sunday Times correctly said there is. Things are clearly in a mess, but it must be remembered that last week’s announcement was a start line for this project, not a finish line.

In brief: The opt out exists just as it has previously, and nothing changes until around March 2024. Everything else is a currently mess; we’re working on it.

Slightly less brief version: The National Data Opt Out exists – it works as it always has, though it could always be stronger. NHS England has not published enough details to know whether patients’ objections will be respected, whether and where it believes they don’t apply, and/or whether the Government will make everyone opt out again. This is because there are no details of individual data flows in the FDP as yet; maybe by March 2024 we will know more. Maybe.

Some have read NHS England’s briefing to argue strongly that patients cannot opt out; medConfidential and others, however, work for a world where patients’ wishes are respected. Join our mailing list to find out how it goes, or opt out at any time.

We will continue to scrutinise details. NHS England could still decide that people’s opt outs don’t apply where they should, and officials will probably try doing this – which is akin to making you opt out again. NHS England talks about its five high level “priorities”, but data choices and uses and paperwork is about very specific purposes – exactly what data, to and by whom, treated how and for what uses (e.g. “strike analysis”), with or without respecting opt outs? The devil is in all the details.

We do not yet know whether those who have already expressed their wishes will have to do anything else – NHS England has not yet said whether Government will make patients opt out again, but as of now, the opt out process is enough.

The Details Do Matter

The Government is as committed to giving Palantir £500m over seven years (the current contract is for five) as it was to HS2 and Net Zero. If you wish to opt out, we have a page on how to do that. Many details are still to be argued about by lawyers and others, but you currently have the same choices after last week’s announcement that you had before.

As an administrative body, not the NHS in England, NHS England (NHSE) can only make decisions for NHS England. It can try to bully NHS Trusts and Integrated Care Systems into going along with its decisions – seemingly with limited success – but, as separate legal entities, ICSs and Trusts get to make their own decisions. Sometimes NHSE says Trusts “can” choose to use it, sometimes NHSE says they “will”. The comments published by the Science Media Centre demonstrate the lack of support that NHSE tends to respond to with strong-arm tactics.

While it is good that NHS England has an “engagement portal” of sorts, it will be far better when there is meaningful content in it – and when that content is entirely accurate and complete. 

We note that NHSE’s public press release was less informative than its statement to Parliament. And while the press release talks about “Trusts and ICSs” having access “from spring next year”, NHS England itself is notably absent from that timeline. 

Our current understanding is that NHSE will get access to data at the same time as Trusts and ICSs, when the “Privacy Enhancing Technology” is available. Previously, officials had suggested NHSE would have access before that. Of course, there is no obligation on NHS England staff to be fully candid in meetings, and someone decided not to make this all clear in the press release. This kind of decision has caused and continues to cause many problems.

NHS England has until around March next year to get its story straight, and for its officials to be transparent about governance and patients’ choices – hopefully far better than they managed on Radio 4’s Today programme last week.

(For example, GP data could at some point be copied into Palantir for where you live, and then copied elsewhere, unless you have done the separate GP Data Opt Out. Despite asking repeatedly, details on this are unclear. The Palantir Federated Data Platform is the first time that National Data Opt Outs and GP Data Opt Outs will overlap in this way, and we still have no idea how this is going to be handled – based on past behaviour, NHS England will probably just try to grab the data, because that’s what they instinctively do.)

“Direct care”

The heavy lobbying from NHS England has focussed on “direct care”. While it is unclear what direct care the bit of the Government that calls itself NHS England actually does, NHSE’s FAQ initially said (and some versions still do):

Then they took that text away. 

NHS England was correct that, in some circumstances, you can object to aspects of care that you don’t want, for any reason you like – this is normally referred to as “patient choice” – but it has apparently been decided by NHSE that such choice is not here and not now, any more. Or, to put it most generously, there’s no clarity. Again. (This is becoming a theme…)

NHSE is only clear that the National Data Opt Out and GP Data Opt Out do not cover direct care uses, and it is critical that that remains true; were it not true, that would be a resignation issue.

That an administrative body which treats no patients and runs no hospitals wishes to define some (or any) of its activities as “direct care” as a figleaf for processing data it otherwise could not access is spookily reminiscent of the failed GP data grab of 2021 and the catastrophic care.data programme before that.

Confusion about purposes beyond direct care

Many people have noticed that the National Data Opt Out (NDOO) is somewhat limited – and, if you rely solely on the way NHS England chooses to describe it, it appears far from effective. But it exists. And it does work. Some argue that it is useless; we and others work to make it stronger and better.

For now, if you have chosen to do a National Data Opt Out, it does as much as it can be made to do currently, and will hopefully do more in the future without you needing to take any further action. (The same applies for a GP Data Opt Out, if you have done one of those.)

The National Data Opt Out was created to avoid a proliferation of new opt outs as new data programmes came along. So while NHSE could say that the NDOO doesn’t apply in a particular scenario, under the law (see below) and in effect it would be saying, “there’ll be a different opt out for that”. In practice, this is untenable, and it is precisely the reason why the NDOO came about. A single National Data Opt Out will eventually cover all dissentable processing, but that will take more campaigning. And lawyers. And time.

The day before the contract announcement, on the same page as the text above which confirms that you can opt out of data use for direct care, the FAQ said:

“Can patients opt out of their data being shared in the FDP?

No. Patients can only opt out of sharing their identifiable data for research and planning.”

A week later, the answer to that question now provides a link to the National Data Opt Out – so the answer was clearly not ‘No’ but ‘Yes’. Additionally, while NHSE attempts to narrow the opt out at any opportunity, the choice of words both initially and now reflect NHSE’s persistent belief – since its inception, and the ‘bad old days’ of Tim Kelsey and care.data – that patients have limited rights, and that if NHS England wants to do something with data, or Government wants to do something with data, then they can ignore patients’ express wishes.

The FAQ does not say that NHS England will respect all of the rights of a data subject – for example, the right to object to unnecessary processing – instead it simply ignores that any inconvenient rights even exist. Courts tend to take a wider view…

NHS England might tell people in future that there is or will be processing of their data to which they can object, but to which NHSE will not apply the National Data Opt Out. This would be creating (yet) another opt out, and making everyone have to opt out all over again. Alternatively, NHSE could apply the National Data Opt Out to all such processing, despite what it is saying today. 

These are the two choices facing Government – and it should be clear that this is a Government decision, not an NHS decision. And when that decision is made, either way, the paragraph will have to be changed again. The current version is less wrong than simply saying “no”, but it’s still not right. Yet.

medConfidential does not believe anyone should have to opt out again – we can’t make that a promise because that’s a Government decision – so you should be able to make your NDOO choice now and not worry; but if you want to keep informed, join our mailing list for more as we know it.

Making inaccurate statements to the public

The FAQ mess – that it publicly stated contradictory things between last Monday and Friday – means that someone, somewhere inside NHSE, agreed that both statements were accurate at some point. Who changed their mind?

The same FAQ has previously claimed, “The existing web copy was produced in conjunction with Med Confidential”. This was not true, and in the weeks it took NHS England to remove that entirely false claim, we were assured that the FAQ ‘had process to follow’, and that it couldn’t be done quickly, as everything was checked. We never received a proper answer as to how that claim came to be made – officials seemed to be relying on a meeting in August 2022 for the claim they made a year later, as if they believed they had learnt nothing in the interim period. (Perhaps they didn’t.)

Even if one were to accept statements that such occurrences were honest mistakes, how many other similar mistakes are there in NHS England’s decisions? And why is it that those mistakes inevitably tend to benefit NHSE and fit its intentions, and remove choice from patients? Every. Single. Time.

Honest mistakes would go both ways; systemic failings only benefit NHSE.

No meaningful check, no meaningful challenge

NHS England’s “Check and Challenge” group met for the first time on Friday, but is only scheduled to meet once every two months. That means its first substantive meeting will be in January, and NHSE expects to start using Palantir in March, possibly even before the second substantive meeting of the group.

Even if the best possible questions having been provided with perfect information were to be asked at the January meeting, officials could (entirely reasonably) say, “We’ll come back to you on that,” and NHSE could do whatever it wanted – Palantir could even start running before the group meets again. It should be noted that some decisions made at this stage are irrevocable, and some very hard to roll back once begun.

We don’t expect the “Check and Challenge” group will be allowed to do much of either checking or challenging, and to make doubly sure they don’t – and in stark contrast to previous debacles like care.data – medConfidential were not invited to join it.

One “check” the new group might discuss is “pseudonymisation”, and the extent to which NHS England will once again ignore that pseudonymised data remains personal data – and that, as such, any unnecessary processing is dissentable. So the NDOO should be applied. If not, the “check” group will be allowing NHSE to create a new opt out.

The group is not expected to publish minutes or papers, so we shall be FOIing them regularly which is a waste of everyone’s time. It should be noted that since “new NHS England” was formed, it does not promptly respond to requests for such things – the “Digital Data and Technology” subcommittee of NHS England’s Board, for example, refuses even to disclose its membership. 

Palantir Access To Data?

We don’t know what data flows will be in the Federated Data Platform as yet, as NHSE hasn’t told anyone. And we don’t yet know who will be auditing NHS England’s setup of Palantir – but we’ll certainly have questions for whomever it is. All we can do in the meantime is look at the data flows that were in the precursor system to the FDP in January and July of this year.

Notable in January was “strike analysis”, for which NHSE apparently used spreadsheets instead of Palantir Foundry – an item which conspicuously disappeared from the list in July, despite other items being “included for completeness to show a reconciliation with the original list of purposes”.

The July list gives sixteen purposes described as “system admin”, and we don’t know who those admins are. (This is why purpose descriptions are helpful; a feature Palantir Foundry has by default, which NHSE chooses not to reveal.) 

Hopefully when NHSE publishes the full list of which flows of data are being used for what – something they could choose to publish today on their engagement portal – we will know, and so will you. NHS England has signed the FDP contract, and all we know is that it would be illegal for Palantir to use data in ways that NHSE doesn’t allow – the problem being we don’t know what they don’t allow, and still know precious little about what they do allow.

Hopefully NHS England is better at writing and managing contracts than they are at writing FAQs. We don’t think this is a severe risk, but NHS England has failed at managing so many obvious risks, and so many bland reassurances have been shown to be untrue, that further bland reassurance at this point is clearly insufficient. 

If NHSE wants to use NHS patients’ data, it must provide full information about all of  the data it wants to use, how it will use it, and precisely what for, and for each flow, at each stage, either respect opt outs or explain clearly (and accurately!) why not.

The NHS procurement was done carefully, and had to be, despite some interests wanting to cut corners. But the contract was awarded, the facade fell, and Palantir sent round an unpublished briefing saying how wonderful Palantir is – ending with a quote from NHS England saying, “you have to liberate the data, and as we have done that”… 

Join our mailing list for more information as we know it.

---

---

Below is the text put together in pieces as we went through the documents for the first time:

According to the written statement to Parliament, Palantir won the £500m contract. The announcement is a start line, not a finish line. NHS England will now have to keep their contradictory promises. We’ll be here.

The Government is as committed to giving Palantir £500m as it was to HS2 and net zero. You still have choices.

If you wish to opt out, we have a page on how to do that (there are details to be argued about by lawyers), but you have the same choices today that you had yesterday.

NHS England can make a decision only for NHS England. NHS England can bully Trusts and ICSs into going along with it (seemingly with limited success), but as separate legal entities, ICSs and Trusts get to make their own decisions.

It appears Trusts/ICSs will not be able to start using it until “spring next year” (April?), because that is when the “privacy enhancing technologies” start, but NHS England will use the platform immediately, with or without those technologies.

NHS England’s FAQ used to say that opt outs don’t apply, but it now says they do. The day before the announced, The FDP FAQ started the answer to a question about opt outs applying with “No.”, and now is much of a vague yes. NHS England can still decide that the opt outs don’t apply where they should. We’ll continue to scrutinise details, because you shouldn’t have to opt out again. NHS England talks about 5 high level “priorities”, but data choices and uses and paperwork is about very specific “purposes” – what data, to what point, for what purpose (e.g. “strike analysis“), with or without opt outs? The devil is in all the details.

We do not yet know whether those who have already expressed their wishes will have to do anything else – NHS England have not yet said whether Government will make patients opt out again, but as of now, the opt out process is enough.

NHS England has until around March to get their story straight, be transparent about governance and patient choices, better than they managed on radio4; NHS England’s “mistakes” only seem to make life easier for NHS England…

NHS England gave a chosen few organisations different briefings on the 20th November, ahead of the announcement on the 21st, and we don’t yet know what else they’ve mislead people on, in the same way the FAQ used to say “no” to opt outs, and which now confirms you can opt out. We’ll update this page as we have more considered views.

Join our mailing list for more as we know it.

After 1st November 2023: If you have found this page after coming across something distressing and googling various terms, we’re sorry the Government has made the NHS and your GP put you in this position.

If immediate attention is required by what you have read, your GP will get in touch with you as soon as they read what you have already read (as you may have seen it before them). If you are immediately concerned and your GP has an out of hours message box, you can leave them a message asking for a call back when they’re open, or you can call 111. When this feature was being tested, people would think to call 999 or go to A&E (this is when to do that), and neither the Government nor NHS England did anything to minimise the fear or confusion you feel; they should have done so.

If someone else has become aware of information from misusing your app, NHS England give you no recourse. If you have become aware of something that was being withheld from you for legal reasons, please don’t harm your children, yourself, or anyone else.

The Government has contractually required your GP (in England) to facilitate access to “prospective medical records” from your GP record to the NHS app. From 31 October 2023, any correspondence sent to your GP will be available to you through the NHS app (and, over time, the NHS website).

In simple terms, these are letters about your care, not “to” you as such, but to/from different doctors providing your care, who may also send a copy to your GP. The doctors outside your GP have not been effectively told this is happening, and so won’t know to take it into account when writing the letters.

These may be distressing, as they may contain medical language you’d need to look up, they may discuss your mental health, and may contain bad news and diagnoses that the author of the letter expects a doctor to break to you with compassion.  You may also see how much work is shifted onto your GP from other parts of the NHS, and how secondary care “manages” their waiting lists. 

With the usual lack of attention to detail, Government and NHS England have not told anyone other than GPs that this is happening.

Online access will be helpful for most patients, but the process of making this available has created unnecessary risks and The Government with NHS England has chosen to leave them unaddressed, as described by domestic violence charity Refuge.

What happens next?

To implement the requirement placed on them, some GPs will text you to ask what you choice you would like to make, and some will turn it off until you ask them to turn it on for you. There are no government provided communications on this – every GP will have to do this all themselves. The Health Secretary has demanded it be on for everyone from day one, saying as his Tory Conference speech that family GPs “are even threatening to take the Government to court over our plans to let patients see their own test results on their own phones, rather than taking up a GP appointment. This clearly shows that the BMA leadership is not on the side of change, and they are not on the side of patients”. You will see these test results potentially before your doctor, and you may have to interpret them alone.

If this is harmful to you, you can ask for it to be turned off

If your device is not your own or is shared in a way which makes this uncomfortable, or you have reason to be concerned, you can send your practice a message asking for “prospective access” to be turned off for your record. (Deleting the NHS app isn’t enough if someone else knows your NHS Login username and password and has the app on their device).

You can’t see if others have accessed your record this way

Despite requiring access be made available, there is no requirement to see whether your record has been accessed to give the reassurance that your record has not been abused by others who may gain temporary access to your device.   If this feature were to be abused, the app gives you no indication that it has happened, so NHS England doesn’t care to protect you.

You should be able to see what’s in your record if you wish, and equally, you should be able to know how that record is accessed, but this government is playing contractual games with the biggest bit of the NHS that hasn’t yet gone on strike.

Access to records is a useful tool for the majority of people (and those it harms should be better protected than they are), but we await, more in hope than expectation, any announcement that NHS England will also provide the details of when your record has been accessed and from where. Will NHS England hold themselves to the same standards they mandate from others?

This process is a mess, and patients and GPs pick up the pieces. Again.

(That this change is being imposed at the same time as the “Palantir procurement” continues is a source of confusion, the reasons for which are… speculation)

As Our Future Health promotes itself ever more loudly and ever less clearly, this is medConfidential’s current view on the project, the commercial company that lurks within a charity, and promotes itself using the NHS logo. While our view may change as new information becomes available, we are concerned about the transparency and integrity of current public communications from Our Future Health Trading Ltd, and the scope for future changes.

If you don’t want to be involved, you don’t have to be, and you can just ignore Our Future Health (OFH) and any communications it sends. If you have already given them a DNA sample, you can tell them to destroy the DNA they collected from you using the multiple step process that begins on this page – do the “partial withdrawal” online, then email support@ourfuturehealth.org and state you wish to a “full withdrawal”.

If you have (or even if you don’t have) questions about the transparency and integrity of OFH statements, we observe that their FAQ entry entitled “How can I leave the programme?” does not include the above link to the page that tells you how to leave their programme…

Whether you sign up or not is entirely a decision for you and your loved ones – handing over your DNA and NHS medical history to a commercial company to sell has consequences on those biologically related to you, and as OFH expands to access other government data about you, it will include information on those you live with, both now and in the past.

The UK has a non-commercial Biobank with clear governance whose governance failed under scrutiny, whereas OFH exists to help “kick start” the life sciences industry with a company selling access to data and a charity doing marketing and publicity for the company.

There is a historical analogy. In the 1990s, there were two competing “genome projects”: the Human Genome Project was supported by the public purse and committed to public knowledge; a private competitor – the ‘Venterpillar’ – tried to privatise the lot, and went bust. Sir John Bell helped the Human Genome Project succeed, but switched sides to capitalise on the “life sciences strategy” he wrote.

Shortly after they were not mentioned in the “growth package”, OFH’s communications suddenly changed to highlight they had now half a million volunteers… What does “volunteers” mean? Why did the count of “appointments where they give a blood sample primarily for DNA analysis” largely disappear?

[This page was updated in June 2023 after the CEO resigned. A link to the opt out form was added in August, and a line was added in October 2023 when OFH started sending junk mail letters under an NHS logo, some of which offered a £10 shopping voucher (others did not). In December 2023 we added a line about risk scores. We will update the page again as new information becomes available.] 

The viability of the commercial company is unclear

Our Future Health has sent out around 10-12 million letters, and claim they have achieved half a million “volunteers”. At that signup rate, they cannot achieve the five million signups from the remaining population as required by their business plan. The consequences of this are unclear.

If you have a National Data Opt Out, you will not receive a letter addressed to you inviting you to sign up. You will still see all the adverts and the press coverage, and members of your family can still sign up and give a DNA sample which will relate to you as all DNA samples do. medConfidential understands (as of summer 2023) that OFH has not yet received approval to access NHS patient data, only to have addresses provided to a third party to invite people to sign up. In addition, OFH may also buy junk mail lists which contain your address, and may then send you a “Dear residents” letter as a result – this will not be addressed to you personally as they have no idea who the recipients are, only that an address might exist.

In 2024, OFH is wanting to create a ‘health risk score’ and place the burden on your GP to explain it to you. Replicating the decline of Zoe and other influencers towards selling “food supplements”, all of the incentives on OFH are to maximise that score while minimising their help and blaming the NHS for not doing more. Your doctor has professional obligations to you; OFH does not.

Here are our outstanding questions about Our Future Health which we don’t currently have reassuring (or, in some cases, any) answers to.

Questions For Individuals…

…about the signup process

1. Which organisations have reviewed the current signup process and language for accuracy and transparency and to see whether it is misleading about (not) being an NHS project (which it isn’t)?
2. If you don’t complete the process, at what stage does Our Future Health count you as a “volunteer” – the first time you click the first link? Is that inflating the “volunteer” count?
3. Why doesn’t Our Future Health confirm that no data you provide will be used to help your care directly? (Something may be found that is eventually used to help everyone with that condition, but it does not come back to you directly.) Why does some marketing material suggest that ‘OFH will help your health’? 
4. OFH does not currently offer rewards or incentives to sign up. Is this being changed? To be targeted at particular subgroups?

… about data

On the NHS confederation podcast, the new CEO of Our Future Health said:

“in the future, what we’d like to do is take consent to link to other records that the Government, and the Office of National Statistics for example, collect through the census, and other administrative databases”.

5. Will any NHS body review requests for NHS data by projects approved by OFH?
6. What data are currently proposed to be linked? How can that process change?
7. What data are being discussed for linkage in future? What choices will be offered to about inclusion?
   • Specifically, are there discussions to link to data that “Government” holds about children’s education history from pre-school to post-education employment?
   • What plans are there to link to DWP’s (benefits/pension) data?
   • Will staff from DfE / DWP / etc have access to the data on the same terms as others?
8. Do you know how consent for inclusion in the dataset can be withdrawn? What happens to data / samples held by OFH? Will they be destroyed?

Questions for Our Future Health

… about process

9. When did OFH last confirm that all of what they told IGARD and CAG previously remains accurate? Are they willing to publish those documents? (our FOI hasn’t come back yet) 
10. Why did the CEO resign so abruptly in June 2023? Was it related to the sudden change in public communications around the same time?
11. When Our Future Health says “we will publish a list and summary of all approved studies on our website”, why is that less transparent and contains less detail than NHS England?
12. We include more quotes from the new CEO’s appearance on a podcast below, but how many of those “future” promises are delivered today?

… about business models

13. Can the company be sold to benefit the charity? (Just as Wellcome PLC was sold to benefit the Wellcome Trust, or as ancestry.com was bought by private equity…)
14. When the company runs out of cash and goes bust, which it probably will, what happens to the data? Who can buy the DNA records and other assets in a firesale? [December 2023: the £51m of public funds announced in the November budget should help with that]
15. Just as OFH is company owned by a charity, so was the creator of orkambi, who made decisions for the charity which proved extremely expensive to the NHS. Will any OFH success come at at the expense of NHS budgets?

Questions for public bodies

16. If there is a discovery that can improve the nation’s health, will Our Future Health (“charity”) keep it secret for profit, or it will become available on the NHS for everyone?
17. OFH is writing to everyone in the country; the vast majority are not signing up. Will OFH and associated projects be able to receive data on people who didn’t sign up using other methods?
18. OFH lauds the supportive comments they hear from stakeholders; are all stakeholders kept fully informed of changes to OFH since they gave that support? Have you been?
19. In light of the “broad consent” question / debacle with the vaccine taskforce, what happens if the “informed consent” that OFH collects turns out to be invalid?
20. What possibilities has OFH discussed for expanding data linkage to other areas of Government, such as DWP or DfE? Will an NHS body be expected to review all or any projects using NHS data?
    • Given the approach being taken by OFH, what are the consequences for similar data linkage in the rest of Government and ADRUK/HDRUK?
21. The Government’s “Data Protection and Digital Information Bill” (our briefing) removes penalties for misuse of data that is said to be “anonymous”, even if it isn’t. What are the consequences of that Bill on OFH’s customers and the promises it makes to “volunteers”?
22. Sir John Bell, founder and prime mover behind Our Future Health, got his CH recently. What questions would the Palace ask before William/George would sign up? What are the answers? Why isn’t that information available to everyone?

It does not seem unfair to describe Our Future Health as two steps away from offering a chocolate bar in return for DNA and lifetime data access. [October 2023 update: OFH is now offering some people – but not all – a £10 shopping voucher in return for their DNA and lifetime data access.]

Recent quotes

As part of Our Future Health’s publicity push, they appeared on the NHS Confederation podcast to promote themselves. Strangely, the new CEO didn’t mention that he was about to get that job, and instead said: 

“…what it [UK Biobank] didn’t do was to allow individual level feedback to participants or volunteers in the study and see what action they could take themselves to prevent those diseases. That’s what we’re trying to do with Our Future Health now. It’s a successor study to UK Biobank, those who take part will have the opportunity to get individual disease level feedback in the future…”

“As of today, we have 500,000 people have signed up… and about 200,000 have attended appointments where they give a blood sample primarily for DNA analysis, and also have some physical measurements taken…”

“…in the future, what we’d like to do is take consent to link to other records that the Government, and the Office of National Statistics for example, collect through the census, and other administrative databases…”

“We’re not just giving people information that cannot be acted upon, as that’s not good for them, neither physical nor mental health. Initially, we’ll feedback information on disease where there are existing programmes for them to be dealt with, so for example, diabetes, ischaemic heart disease, heart disease, we have the existing NHS health check programme for people aged 40-74. What the additional information will gather through OFH is people will have more accurate information about their disease which can be dealt with when they go for their health check. Additionally, diseases like breast cancer, where we have a screening programme, being able to identify women who are at higher risk of breast cancer based on their genetic risk who are not identified, so who are not part of the screening programme, that will have to be done in close coordination with the NHS screening programmes as well. The whole programme is being done in partnership with the NHS, but its implementation, once the research phase is over, the implementation phase is a key challenge which we are aware of.”

Addendum

Shortly after this page was first published, this FOI response came back:

Amendment 2

• CAG Application April 2023 ADDITIONAL INFORMATION.pdf
• CAG response regarding letter variant testing May 2023 FINAL.pdf
• CAG-Amendment-Application April 2023_FINAL1 redacted_Redacted.pdf
• CAGSF6-Annual-review-April 2023 – FINAL_Redacted.pdf
• Response to questions raised by CAG Amendment Application April 2023.pdf

Amendment 1

• 22CAG0051 CAG Amendment request Jan 2023_Redacted.pdf
• CAG 22AG0051 Our Future Health Amendment Application 9-11-22_Redacted.pdf
• CAG Amendment Application ADDENDUM on opt out and PPIE Feb 2023.pdf
• CAG response from Our Future Health 07032023.pdf
• CAG-Interim Amendment Application March 2023_Redacted.pdf
• NHS Digitrials invitation_V3.2_tracked.pdf
• [CLEAN] 3 Protocol V4.0 FINAL_15DEC2022_Redacted.pdf
• clarification on proportions_Redacted.pdf

Original request

• 22CAG0051 CAGSF1 CAT advice form OFH _FINAL.pdf
• 293316_21EE0016_(RTB)_Favou_Redacted.pdf
• 4372 OFH – Consent Form_June_print_Redacted.pdf
• Appendices 1-5 OFH Comm plan.pdf
• Appendix 7_Detailed Data Production Flow 1.1.pdf
• Appendix6.pdf
• CAG_RTB_Form_04Mar2022_signed_Redacted.pdf
• Data Protection Registration_Z8959110.pdf
• OFH – Ethics_Governance_Letter of Support_Redacted.pdf
• OFH_PIS_booklet_v1.1.pdf
• Protocol v3.2 _Redacted.pdf

When McKinsey was advising on the structure of the then “new” NHS England in 2013, McKinsey was simultaneously advising other clients how to take advantage of the structure they were recommending.

This year McKinsey won a £1m contract to advise on the structure of the (2023) “new NHS England” following the takeover of NHS Digital (and Health Education England). Presumably it continues to advise other clients how best to take advantage of those new structures, and past practice suggests McKinsey will be paid more money by others to subvert the model they proposed.

McKinsey doesn’t talk about their clients, but sometimes they are forced to by courts. One such client was IMS Health, which was set up to be the “information intermediary” between doctors and the makers of oxycontin, the drug whose sales practices were partially responsible for the opioid epidemic in the US, and which still operates in the UK (under the current brand of “IQVIA”) doing much the same thing as they have done before.

Does NHS England know who McKinsey’s other clients are? Does NHS England know whether they’ll benefit from knowing McKinsey’s advice to NHS England? Does NHS England know whether McKinsey advice was written in a way which might help those other clients? 

The ongoing trade in NHS information

NHS England is both a consumer of data via their analytics, and a producer of data for themselves and others. McKinsey’s report should have recognised this conflict of interest, and potentially managed it in better than the usual way (either of McKinsey or NHS England). The functions of the data safe haven, which should be to hold data, be accountable for what data is used and how, and offer multiple environments in which it can be analysed, should be transparently separated from the functions of the analysts who consume data they need to do their work.

Realisation will creep across NHS England that the data they hold is now almost all identifiable patient data, as they have the Personal Demographics Service, identifiable copies of HES, and the ability to match across different datasets on fields which they take no steps to protect. 

Indeed, Palantir is very proud of the fact that it offers exactly that functionality to clients, and Palantir never ceases to point out that whether any functionality is used is purely a choice of their client – it’s up to NHS England and the government of the day. Of course, not everyone at NHS England is racist and incompetent, but there are informed individuals with legitimate fears that someone elsewhere in the organisation is doing something stupid with the identifiable patient data that NHS England now hold; and they’re probably right.

McKinsey and Palantir aside, there’s a different contract with our old friends at PA Consulting for implementing the recommended changes, PA Consulting being the company who agreed in contract not to upload a lot of data to google’s cloud, and then did so anyway.

NHS England is not a data literate organisation

The new NHS England is not (yet) a data literate organisation – you only need to look at the difference between NHS Digital’s board papers, full of numbers, RAG ratings and trajectories of change over time, and the NHS England’s board papers, of essays which contain the minimal numbers. The old NHS Digital showed what it really was, whereas NHS England describes what it thinks something will be, with enough people commenting on drafts that anything interesting will be taken out.

Insight into flows of data between NHS Digital and NHS England disappeared when NHS Digital got abolished. We were expecting NHS England to restore that transparency by publishing their “internal data flow records” this week; they didn’t.

If the new model goes as expected, McKinsey may advertise a case study of the leadership of Tim Ferris, epitomised by his monologue to the first post-takeover NHS England Board meeting. “Taking the paper as read”, he then talks through it, (probably correctly) knowing that even this superficial detail was below the attention of the board. The integrity of his examples is clear from his anecdote about the value of the NHS App, delegated access, and his kids’ records.

It is possible that the papers of the digital subcommittee of NHS England’s board (which takes over the oversight role that used to be managed in public by NHS Digital’s board) will have such information, but none of it will be public.

After all, the structure of the “new NHS England” data functions will be reflective of the late-but-still-forthcoming statutory guidance for data functions in NHS England, which should have been in place before the merger happened. They weren’t, and still aren’t.

Is McKinsey’s “rightsizing” recommendation to get rid of experts who know something?

Professor Mazzucato’s recent book on consultants and consultancies explains how the choices and outsourcing of key work results in a hollowing out of Government, and a brain drain that makes them ever more dependent on ever more consultants. 

The opening chapter of the McKinsey book covers how those with the most experience are let go as McKinsey helps “rightsize” organisations, and the deaths that resulted from those choices. As McKinsey give the same advice over and over again, did they do something new this time?

Large consultancies only offer solutions which involve some future role for large consultancies. Approaches like Reproducible Analytical Pipelines, which are cheaper and more effective for all kinds of analysis, get deprioritised by the consultancy world as there’s little consulting money from that approach. 

Consultants everywhere, so how long until the NHS spend around Palantir costs more than the NPfIT? The currently published £480m tender only includes NHS England’s role, and NHS England is increasingly saying that Trusts, ICSs, GPs, and others will be expected to shoulder their own burdens for interacting with the system, and the way to minimise those costs is to pay Palantir more money, because interaction between Palantir and other systems is still manual (and will be unless a Trust cedes decision making to NHS England, importing the US model with NHS England acting as the insurer and decision maker rationing care).

We started our response to the current GDS consultation with an unanswered question: “Has Gov.UK ‘One Login’ metastasized from a “better login to government” project, to a “one identity to government” project?” The answer appears to be yes.

A recent meeting held during the consultation was told that the Government intent is to actively prevent individuals from having multiple Login accounts. A person may be able to have multiple email addresses – indeed, they may already do –  but Government would attach them to a single “identity”. This regulation allows that database to be shared in bulk.

This turns Login into a weapon of the database state that HMG has previously assured many times that it was not building. Were civil society lied to? Or has Cabinet Office changed its position without bothering to tell anyone?

At a roundtable on the consultation, GDS said about the Regulation that the “first use is one login”, which suggests there will be a second use. It is unclear to what extent DWP embrace one Login for Government for UC, or HMRC’s accountant services, or MoJ’s digital courts, or … Requiring judges or accountants to use their work identity for personal purposes seems an odd thing to do without consulting MoJ/HMRC.

Identities are multi–faceted

Indeed, many of the civil servants reading this will have a “work phone” as well as their own (personal) phone, and use separate work and home email addresses (as they should).

Some users of government services are required by regulatory bodies to use work email addresses, and while the left hand of GDS could require them to route personal use through their work address, the right hand of HMRC/MoJ/etc would tell them not to.

In practice, there will be “many to many” mappings as people are complex (consider an accountant who is also a magistrate and uses their maiden name for some things), and GDS will be unable to keep the “one account” promise to departments. 

Departments will have to assume that individuals will have the ability to have multiple logins (because they do, they will do, and will continue to do so), and can manage that if they know; whether GDS also adds burdens on citizens is something they can choose to impose.

Any attempt to deny this is the database state of the most naïve form.

This database will require people to have a working email and phone number

The GDS account creation process requires both a working email address and an active phone number to login. If you are missing either of them, then no access for you – and they have to work to login each time. 

GDS originally chose to require a UK phone number for refugees fleeing Ukraine who wanted to come to Britain to receive an update by email when the rules changed (since those people by definition were not in the UK, it was blatantly unreasonable to require them to have a UK phone number, which GDS refused to accept in private, and only updated the process after questions were asked in Parliament). GDS also required a UK phone number for Afghanistan refugees seeking email updates on how to come to the UK, but that group are still excluded. The current Government simply didn’t care enough to help that group.

GDS expects everyone to have an account over time, and therefore for this to become a full population database, consisting of verified ID, plus mandatory email and mandatory mobile phone number, whose only statutory basis is this Regulation. 

Creating a big database and taking unrestricted powers to share it 

To avoid digital disengagement for identity verification, we understand Government are expecting to have an “offline” process, which will store a set of identities to avoid offline revalidation each time, and that this caching would be equivalent to the digital system, which suggests that all identity data will be retained by GDS for an unclear period of time. 

The surprise, late and incomplete disclosure of this new identity database in Government raises some additional questions about the sharing of the identity information possible under the power being consulted upon:

1. How long will “verified” identity information be held by GDS after verification?
2. How often will someone with a 10 year passport have to revalidate? Does it change for a driver’s licence?
3. For what purposes does GDS currently believe it will use the database it creates?
4. This consultation proposes allowing the entire database to be shared, in bulk, to almost anywhere in Government for any purpose; why?
5. Was anyone outside Government shown this policy before this consultation?

It appears that GDS simply made the decision for itself, with no informed input or discussion with civil society. That relevant information was withheld until after the consultation had opened reflects how recent engagement with PCAG/PIAF could be considered less than “lipservice”.

In some meetings, supposedly informed speakers have demonstrated a clear need to be reminded of the importance of the PCAG principles, and why they’re there, most notably the multiplicity principle where users with multiple identities – such as a work email address and a home email address – may use both without Government requiring them to connect the two. 

This week’s joint Blair/Hague handwaving is emblematic of a Regulation allowing Government to use and share ID databases however it wishes, without democratic restriction, oversight, or transparency, which ends badly.

Documents:

• Consultation response (submitted on 26/2) –if you have read the above text, see footnote 13.

Addendum 24/2: Some in Government apparently read our final link as suggesting that the HMG decisions on identity in and after 2023 will reflect the policies and practices of the Taliban, rather than as an illustration of the entirely foreseen consequence of HMG decisions from 2003 to 2021. This unexpected choice of affiliation may say more about the reader than the authors.