Category Archives: News

The first Goldacre Review

The Goldacre Review is a road map; it is also much more. In many ways it represents an alternative world view to that which is currently being built in ways that have failed at least three times before – not through any lack of political will or even resources, but through a failure of vision.

The choice now facing the country is whether the NHS will fully embrace and build a data infrastructure – which as the Review points out is “code and people with skills”, not beige or black boxes – that is open, collaborative and reproducible or whether, some honourable exceptions aside, it will persist with the status quo of closed, secretive and exploitative data use. 

A DHSC-commissioned Review has stated that the dissemination of pseudonymised (i.e. linked and/or linkable, individual-level) patient data is dangerous; something the Government itself acknowledged in Parliament last summer, which this Review has now confirmed.

Professor Goldacre says this is not a “new emergency” – indeed, the practice is endemic – but he is also very clear as to why alarm lights should be flashing. His Review details many of the specifics on pages 85-93.

This is a review of institutional processes, and while it recognises that critical patient-facing aspects of NHS data are damaged and/or unfit for purpose, the Review correctly notes that this is not the place to try to fix them. The NHS has to get its own data house in order before going back to the public. 

The success of a review such as this can only be measured by the things that change in the real world as a consequence. Will the research community, the institutions that claim to lead and support that community, and other institutional and corporate users of data now make the necessary changes with the levers available to them?

Open ways of working

The Review describes how open ways of working can be trustworthy and, more importantly, how they can work – but no review can mandate delivery. Nor does it dictate policy.

For example, DHSC has long attempted to “ban” “exclusive” data deals – which the Goldacre Review repeats as expected, while dancing around business models – but both miss the point. Those seeking to use NHS data rarely if ever do so on an “exclusive” basis, not least because it is in the nature of data to be non-rivalrous. What they seek is exclusive control of the insights generated from that data, which contracts entered into by NHS bodies repeatedly sign away.

An “exclusive” deal for data would in practice be harmful only in the context of a single data controller. Even were one hospital to sign up to such “exclusivity” – which as far as we know, none have – then the hospital down the road clearly would not, and should not, be constrained by that exclusivity.

Following previous messes involving, amongst others, Google DeepMind and Sensyne Health plc – none of which prevented those Trusts from cutting other deals with different companies – DHSC told Trusts not to sign ‘naive’ and ‘unsophisticated’ patient data deals and set up the “Centre for Data Expertise”, which has ever since been looking for something to do. The principles of the Goldacre Review should become the core task of that centre – since renamed the “Centre for Improving Data Collaboration” – that is, to assist and guide NHS bodies that are willing to implement open ways of working and the sharing of both code and outputs. 

Those who do not wish to modernise, whether they be NHS bodies or HDR UK, can sit on the sidelines and continue to waste public resources they have been given. The Centre, meanwhile, should help those who agree with the Review to implement it faster – including whatever DHSC and NHSEx commissions, and whatever the Service Transformation Directorate prioritises. That assistance should include supporting those who can already build better tools, not just favoured suppliers.

Just as HDIS was for the HES data, there should be similar arrangements for ICSs/ICBs and other geographies so that organisations can see the data they need to see. Some of these views will be from care providers / provider level, and some from higher level aggregators – with commissioners being able to see both the different models for their area, and the models for different interventions. 

The abolition of PHE and the move of some public health functions to the NHS should help ease historic turf wars. That this would be useful is demonstrated by the answer to the question, “Is there a public URL where anyone can see, for known defined geographic areas (councils, ICBs, etc.), the current top health issues in those areas, compared with areas nearby?”  (The closest answer to which appears to be one blogpost.)

That PHE was unable to publish NHS health measures at the level of CCGs – i.e. where the decisions were made – was not entirely its own fault, but it was never able to do so. In the more open culture of academia, we got openPrescribing for GP prescribing, but even that was limited as it wasn’t able to cover the £7.5 billion spent on hospital medicines.

Safe(r) ways of working

The Review’s call to apply different approval processes according to different data risks is far from unprecedented; ONS has been doing this for many years, for different datasets of different types. This approach has not previously been applied in the NHS, not least because of the acknowledged excessively high risk of giving out full raw datasets to anyone who wants them.

NHS Digital also operates under different constraints, in a different data culture. So while ONS is able to reject access to people it is not assured will follow the rules, NHSD is obliged to supply data to other public bodies which may make their own assurance decisions about their own suppliers, and where governance sanctions are practically non-existent.

There is also something of an obsession with “100%” health datasets, when those producing reliable national statistics know that ‘full coverage’ – such as with the census – is to all intents and purposes the same as a health dataset that has removed the records of every patient who has made a National Data Opt-Out. Indeed, even if NDOO was applied to GP data or hospital data, the remaining data would still have coverage greater than the census.

The suggestion of a ‘one stop’ approval shop is attractive to those who want to water down governance. IGARD and PAG (the BMA and RCGP’s ‘Professional Advisory Group’) have largely worked for GP data, but not entirely – in particular when NHS England “forgot” to inform them of various actions. While a group like PAG minimises the need for every GP to review centralised data extractions and access themselves, the basic principle that any data controller can ‘pull the plug’ is what keeps other parties honest – especially those whose strategic interests mean they are less than completely transparent.

TRE ‘wrappers’

The ONS ‘Five Safes’ model relies on the fact that everyone who comes into the safe setting is already within a trust boundary. Its own processes show that the NHS cannot and does not trust all of the people who would access data, and yet it has to give them data that is intrinsically unsafe. 

That NHS England trusts NHS England may be obvious; that’s not to say it is entirely wise. And NHSE’s ‘gatekeeping’ of data research post-merger will likely result in more limitations and rejections of bona fide research, given that in more than a few instances it is likely NHSE won’t like the answers…

Seeing which way the wind is blowing, meanwhile, HDR UK is shovelling money into “sprints” to discover ‘new tech’ for TREs. Its call is flawed and seems designed to to funnel money to incumbents. (That HDR UK wastes UKRI / MRC / ESRC / public funds is not our primary issue of concern. This does matter to all our research friends – but whether the 250+ who signed HDR’s open letter on research access to GP data last summer knew this was what they were signing up to is unclear. HDR did tell them… right?)

HDR UK was designed to build infrastructure. It has failed, and NHS England plans show that the NHS will be the reliable infrastructure provider for NHS data. On UKRI’s proposed budget allocation, MRC / HDR cannot currently afford to continue funding all of the hubs listed in the slide in its latest presentation. 

In reality, HDR UK has no framework to maintain infrastructure; it doesn’t know how to build infrastructure that people wish to use; and it doesn’t have any control over the data that can be used. No research programme can have lasting confidence in any research infrastructure provided by HDR or the hubs, for the simple reason that they have defined funding periods and cannot make commitments beyond those periods.

What happens to the next iteration of Farr / HDR UK is up for debate, and we have suggestions of where to start – but whatever it is must be much smaller than the 100+ people at HDR HQ, currently draining resources away from research.

While everyone tries defining “TRE” to mean what they want it to mean, a  number of likely models are emerging:

  • NHS England: addicted to its COPI powers, Palantir Foundry and dashboards; it may or may not commission its quarter-billion pound ‘Federated Data Platform’ from Palantir – but even if it doesn’t, will this historically closed platform (also) be NHSE’s ‘Planning TRE’? (Noting that, if it does plump for Palantir, NHSE will have the capability to automatically produce Personalised Data Usage Reports for every administrative use of NHS patients’ data by NHSE…)
  • OpenSAFELY: currently operating under COPI powers, NHSE’s data controllership and CMO sign-off; a ‘table server’, not a remote-desktop-style setting – but nonetheless a scaleable, safe way to produce non-disclosive results from specified, approved queries run on data in situ. (Could be used almost immediately to reduce burden on other stretched systems, but NHSE is refusing to make any policy decision until it has decided whether to ‘go / no go’ on Palantir.)
  • NHS Digital: has a functioning TRE in which COVID and cancer research is already being done. This TRE is sustainable, its scaling up was funded in March 2022 (amount unknown), and it replicates the ONS model which has been proven to work for researchers and analysts, and whose statistical outputs inform policy and decision makers for years.
  • DHSC / UKHSA’s ‘EDGE’ (now ‘eDAP’?): is described as “near critical national infrastructure” in its tenders, though I bet you’ve never heard of it. It’s not for direct care, so what it does clearly falls under the ‘Research and Planning’ (i.e. secondary) uses about which patients have choices.
  • ONS has the Secure Research Service, which already handles mortality data; there’s SHIP eDRIS in Scotland, and SAIL in Wales; Genomics England Ltd does genomic data; and there’s a proposed National Imaging TRE for training AI models…

Delivering the future

The Goldacre Review recognises, channelling Baroness Onora O’Neill, that the key to the future of health data is trustworthiness.

The merger takeover of the statutorily independent safe haven by NHS England will place the obligations on the public body that is NHS Digital onto NHS England. Some of those obligations are related to use of particular powers, some apply to the public body itself.

DHSC has thus far refused to produce a Keeling Schedule of how Part 9 of HSCA 2012 will look in the statute books when “the Information Centre” is replaced with “NHS England” – we assume because they’ve done the same work we have, and realise how ridiculous it looks. We look forward to seeing how Ministers’ statements at the despatch box will be implemented, if indeed they are even implementable.

NHS England does its own thing because its main job is to ensure there is always someone to blame other than DH and the Secretary of State. DHSC and NHSEx’s shared vision appears limited to “abolish NHS Digital, buy Palantir”, maintaining and expanding closed, secretive and exploitative data use that is not clearly in the public interest. 

This latest ‘transformation’ is not just a technical process or platform ‘upgrade’; it’s all about trust and the relationship between a modern, data-competent, data-functional NHS and the people it exists to serve – not the system itself.


We have plenty of evidence on the way officials convince themselves their last mistake was due to factors beyond their control. How they fail to learn lessons, and gradually walk themselves (and others) around in a circle to a new justification of the same old bad decision, with exactly the same goals.

This time, we have to do better.

“No one down here but the NHS’s most unwanted?”

Twitter exhaust suggests the cohort of tech-backgrounds who came into the NHS via NHSX have discovered ‘Seeing Like A State’, and may even be beginning to understand (a little of) why NHSX could not succeed. 

Some of the more advanced thinkers may have found Zacka’s ‘When the State Meets the Street’, a tech view of service delivery and moral agency. Moral agency in practice means realising that while those working on AI in NHSX may themselves be well meaning, the DHSC AI lab will always do things that are important to DHSC; that service design at NHS England will always prioritise things that are important to NHS England – and that patients and the NHS frontline lose in both scenarios.

The first Goldacre Review says the data risks are not a “new emergency”, but anyone who reads it will understand why alarm lights should already be flashing. It is likely that ‘Goldacre2’ will have to pick up the pieces where this Review went undelivered, and where the unevidenced assertion of a lack of urgency may have turned out to be overly optimistic.

The success (or not) of Goldacre1 will be measured in the Terms of Reference for Goldacre2.

No-one goes to work in the morning to be transformed; those who go to work to help people especially not. Matt Hancock appeared to understand this when he came up with the idea of an NHSX ‘with vision’, in ways that NHS England clearly didn’t when setting up the (National Health) Service Transformation Directorate – which in many ways is still Hancock’s Service Transformation Directorate, albeit without as much interest from political leadership. 

No longer named like the popular TV show from Matt Hancock’s youth, the STD risks replicating Mulder’s opening line from the X-Files. Goldacre1 could actually make it useful. It’s a vision thing.

Coverage of flying saucers and Nessie largely went away once we got good camera phones; data headlines should go away when the NHS gets open methods and reproducible analytics, all running in TREs. Any dashboard needed at any level of the system can be run that way.

The NHS is currently making a choice – or, more accurately, appears to be trying to rationalise choices it has already made – between investing in genuinely open, collaborative and reproducible data for planning and research, as laid out by the Goldacre Review, or persisting and spreading the status quo of closed, secretive and exploitative data use that is so toxic to trust.

Which is not what anyone wants.

Enc docs:

Good TREs Work

Each December we look at the year’s progress towards telling patients how data about them is used (from 2014 2020).

Good TREs Work, and good Trusted Research Environments are working. The remaining hold-outs are those whose ideology requires data to be copied in the shadows, avoiding both transparency and accountability.

All dissemination of linked patient-level data is unsafe, but some is self-evidently more dangerous than others – such as organisations receiving the same data for the same people for the same month, one set with opt-outs applied and one without opt-outs applied. We have ‘red flagged’ such organisations on TheySoldItAnyway.com, and they should be required to use the TRE for all future projects that need data each month.

Data recipients like these pose an unjustifiably high, systemic risk – especially when it has been shown that Good TREs Work.

2021, and what’s next? 

GP Data for Planning and Research (GPDPR) collection is paused until NHS Digital’s TRE is working for all GP data, which it is not yet in a position to deliver. While Good TREs Work, NHS Digital has not yet delivered a TRE which is as good for everyone as the Secretary of State has committed them to doing – and as NHS England is actively undermining it from doing.

GP data cannot be collected until access is TRE-only, and there’s still quite some way to go on that. We would include details of how long that is likely to be, but NHS Digital does not publish the data that would allow that figure to be worked out.

The Goldacre Review should have been out by now – it is still due ‘soon’ – and in data terms it is expected to be largely uncontroversial. The handling practices of both GP and Hospital data have been dangerous for decades, but they can and must be reformed.

Hopefully NHSX, NHSD and NHSE will finally recognise that danger, and what the 2021 ICO Code of Practice on Data Sharing, (UK) GDPR and the 2018 Data Protection Act all say – that dissemination of highly detailed, sensitive personal data on the entire population of England can result in re-identification, including through the event dates that are entirely unprotected in the datasets. Continued denial of this danger will result in NHS patients being identified, as happened in Australia

For 2022, we have updated the data usage report mock-up we first drafted in 2014

The most noticeable changes in the report are the organisational names and logos, but the principles of consensual, safe, and transparent data handling remain. All data handling by NHS bodies could be transparent, and the data uses register format NHS Digital moved to in 2021 is an improvement – but bodies like NHS England, for example, still choose not to say how its COVID-19 Data Store was helpful in the pandemic.

With only twenty projects admitted to by NHSE, the panoply of missteps that occurred in the pandemic seems less surprising – if no less shocking – and there’s no published evidence of any value in Palantir Foundry at all. (We go into more detail on this in the available next steps to Data Usage Reports (2021).)

AI and data governance

As AI moves out of DHSC and the civil service into the “real” NHS, it will have to justify the budget and resources it has been given. Though there is a point in time in the history of everything that works when it didn’t work, there is never a point at which those things that don’t work did, no matter how much money was spent.

The AI strategy will re-emerge at some point, and NHS England will get to reconsider it. Our straightforward advice is this: one third the length, one third the budget, and three times the vision. Under NHSX, things have gone in the opposite direction…

DHSC and corporate interests are not the same as doctor’s interests or patient interests. Not even close. Recognising the AI advisory and former No10 Chief of Staff’s view of international agreements – that subterfuge and double-dealing are legitimate between parties – every supplier to the NHS should be required to provide a “datasheet for datasets” for every dataset it was trained on (and to check all the IG) so as to stop ‘data shortcuts’ being profitable.

Public and professional unease around both genomic data and AI is not limited to data governance. That Genomics England handles data safely does not eliminate concerns around how it may be used, e.g. for newborn baby screening. Just because something can be done with data, and can even be done safely, does not mean that it should be done at all.

COPI renewal – choosing a better timing cycle

COPI remains in force, and it is unlikely that DHSC will be able to make a good decision on renewal in any February or August. The March and September dates are simply a legacy of when the pandemic started and a 6-month renewal. This being the case, if HMG believes the pandemic really is ending, the next COPI extension should be for just three months – which would also put things onto a more reasonable cycle of making decisions before and after winter, not in the middle of it, should another variant emerge. 

Will they ever learn?

In the context of the Government’s “new direction” on data that will make it harder for people to understand what is being done with their data, and easier for companies and authorities to use it beyond people’s expectations, NHS England’s hostile takeover of NHS Digital means all of these risks and responsibilities will become theirs.

The public may have been generally confused by who and what NHS Digital is – a symptom of what the Wade-Gery Review referred to as ‘split responsibilities’ and a ‘fragmented’ landscape – but everyone can understand that the institution Directed by Government that is NHS England is neither your doctor’s friend, nor yours.

In 2014, NHS England blamed the Health and Social Care Information Centre for its own care.data debacle, requiring HSCIC to cede more control, have an NHS England Board chair, and an organisational rename to NHS Digital – which is precisely who NHS England and NHSX (i.e. NHSE + DHSC) now blame for the collapse of GPDPR in the summer of 2021, a programme over which they had final say. Clearly no-one learned the lesson the architect of care.data was forced to, seven years ago: “We do not subscribe to artificial deadlines here – we will roll it out nationally only when we are sure the process is right.”

DHSC’s commitment to TRE-only can be delivered, and NHS Digital has started to deliver it – with 125+ organisations using some form of NHS Digital “system access”, according to its release register.

Trust requires transparency

The risks and issues around Hospital data and those of GP data are by and large the same. And in medConfidential’s dealings with NHS Digital / HSCIC over the past decade it has always been clear that hoped-for improvement was not just possible but eminently feasible. Yet, despite this, progress towards a TRE for all secondary uses of patients’ data and personalised data usage reports for each patient has been minimal, at best in only minor increments. 

Lack of progress has in large part been due to DHSC disinterest, lack of adequate resourcing, and the outright intransigence and active kneecapping of positive intentions by NHS England. The evasions and lack of transparency around NHS England’s COVID-19 Data Store only highlights its culture of secrecy and contempt, suggesting a new corporate attitude and approach will be absolutely essential should NHS England come to govern all patient data in the English NHS. 

NHS England’s fear of transparency and accountability are not necessarily irrational, however. Senior officials know what they and their NHS England colleagues already do with data, and clearly believe it would not stand up to public scrutiny – issues that Baroness Harding will know from experience have very real consequences. Is it really true that during the entire pandemic, with the unprecedented amount of health data it hoovered up under extraordinary powers, only 20 projects used the tens of millions of NHS patients’ data in NHS England’s COVID-19 Data Store? 

If it persists in the absence of good governance that characterises its handling of our data, and with its favoured scapegoat no longer available to blame, NHS England may in the next act be exposed as the true cause for data despair.


Enc:

ONS analogies with NHS Digital datasets

Data Usage Report (2021) example

Available next steps for Data Usage Reporting (2021)

GOV.UK’s Black App: and in the darkness (Departments) bind them…

When DHSC specified the NHS App’s features, it was was a near-certainty that GDS would (eventually) copy the game plan: a cross-GOV.UK app – a webview onto existing GOV.UK information and services – being almost inevitable due to the machinations, and lack thereof, by Whitehall Departments.

NHS and gov.uk app logos

Unsurprisingly, in the closing weeks of a spending review, with new digital management, and after a crisis in which such an app probably wouldn’t have made much difference, but in a world where HMG wants to own vaccine certificates, and NHSX(etc) very much wishes not to, the GOV.UK ‘black’ app was announced.

The approach being taken will in all likelihood dissolve the ‘hard boundary’ between the NHS and government – but, of course, do nothing to actually help social care where that boundary is already blurry…

A GOV.UK app won’t provide anything an online GOV.UK service doesn’t do already – or will do, by the time you are ‘nudged’ to use it – but it will give the Cabinet Office new and greater powers over other Departmental services. And with these new powers will come (some) new responsibilities, such as for the hostile decisions Departments make in their own narrow interests (which our work elsewhere has found widely: e.g. 1A, 2A, 4D, 4E, 5E, 5J, 5L).

On the one hand, GDS’s excuse of “It’s not our service” will cease to be sustainable; on the other, the “One Login” for the (whole of) GOV.UK will give it a stick with which to rein in the worst of the Home Office / DWP digital divide…

Will the dark arts permeate the Black App? And since the answer is yes, where?

Cross-service tracking and analytics

The introduction of cross-service tracking and web analytics will allow unprecedented monitoring and investigation of causality and consequences, such as:

  • Does being sanctioned cause you to look up food banks?
  • How many people do that in the app each week?

Even if it chooses not to publish the statistics – as it really should for public services, paid for by public money, serving members of the public – civil society will be able to FOI official Government analytics to show how harmful a policy is, down to specific constituency level…

Also, when one service accessed via the Black App asks about a vulnerability, and when there is a ‘single view of Government’ via the app, will the legal position be that “all” of Government should then know about it?

  • Will DVLA be permitted to maintain institutional ignorance?
  • Will DWP?
  • What about where one Department accepts a UK resident is a victim of modern slavery, but another Department on the next screen refuses to believe it?
  • What about Settled Status

Where will the balance of benefits between the citizen and state lie?

As Richard Pope highlighted in his investigation of the systems of Universal Credit, “are the advantages of digitisation being shared fairly”, or will Government’s focus on automation once again prioritise its own ‘efficiencies’ over those of the public – offering no substantive benefit to citizens beyond “Look, it’s an app!”.

User-hostile design choices

Typical of the world view of many we deal with, Home Office front line officers have demanded to see the e-mail that the Home Office itself sends out about Settled Status as “proof” of people’s Settled Status. Yet that e-mail clearly states that it and the letter attached to it are not proof of status.

We revisited the Settled Status scheme, where refusal to provide offline alternatives to a ‘digital first’ service is causing widespread difficulties, distress and discrimination – which could be avoided by something as simple as recognising paper credentials, which is the way Home Office officials appear to be treating the letter from Home Office in any case. Initiatives such as the ‘COVID Pass’ in the NHS App have demonstrated it is entirely feasible to provide a signed credential for people to hold on their phone at high volume events.

Of course, such user-hostile choices are not just made by the Home Office but across Government.

Those who encounter the greatest burden in one place will face it in many (Annex 2 and 2A). At some point, someone will have justified adding each one of the different procedural burdens that we list in Annex 5; sometimes those justifications may even have made sense. But some of those justifications will have included a Departmental assumption that it is the role and function of citizens and service users to satisfy the whims of the Department…

That those who encounter the greatest burden in one place face it in many is one reason we focused on parents of newborns in Annex 7: “Baby then bureaucracy – the paperwork of new parenthood”, where one would think (or at least hope!) that the policy intent would be closer to, “We’re keen to help, we just need to check a few things first”.

The choice of permissions for Geolocation

While many are accustomed to using them in their daily lives, apps introduce scope for unprecedented levels of surveillance. One of the things a permanently-installed app on your phone can do that a web page cannot do is permanent geolocation. While it’s impossible for a web page to track your location (‘with permission’, of course) when it is not open; an app can do so. 

Our work on UC shows DWP will use any form of algorithmic cruelty it can find. Requiring UC claimants to submit to permanent geolocation is exactly the type of thing DWP would demand, and keep demanding, until it got permission. Could the Central Digital and Data Office and GDS, as a split leadership, reject those demands? (Noting the Home Office will probably find a reason to access geolocation too…)

In response to COVID-19, DWP figured out that the easiest option for DWP is to treat claimants like hostage takers and demand ‘proof-of-life’, with selfies holding up newspapers. 

As an aside, when the postcode centroid algorithm (and the errors therein) is compared with the GPS location (and the errors therein), who will suffer? UC would rather punish claimants than admit systemic failings.

For these and many other reasons, prior to launch, GDS must therefore explicitly ban any geolocation that isn’t on an “allow once while using the app” basis and for platforms without that as an option, GDS must design and implement a best-quality user journey which takes the user via their system web-browser to perform a one-time location and then return them and the single-use coordinates to the app

Departments may be even less accountable for user hostile decisions than facebook or youtube, as the view of the Government’s internal ‘Fraud Profession’ is that citizen requests are frauds until proven otherwise, beyond doubt – and that the civil service never makes an error, until proven otherwise beyond a reasonable doubt. (And for the latter, such investigations rarely take place.)

The use of devices and device services to exploit users by underhand means in pursuit of power and profit has been led by Facebook. Unfortunately, unless abusive techniques are explicitly forbidden, Home Office and DWP acolytes will most likely see the ‘ingenuity’ of Facebook’s engineers as a playbook, and a feature list – not a recognition of the moral decrepitude of their monster factories.

Civil Service silos 

That DWP is forced to accept a GOV.UK Account for Single Sign On via the Black App means it will also have to accept it via the main UC website – both because the app is at its core just a view onto a web page, and because it would be untenable to force people to only ever use the app if they first used the app.

As soon as the Black App is launched, absent formal monitoring and enforcement otherwise, any Department will be able to exploit the full range of sensors in any device on which it is installed. The delegated nature of services means the Home Office, DWP, et al. do not and will not need to ask for central permission; what the web view does will be entirely within their control, especially on Android where protections are weaker. 

Meeting whose needs?

An app satisfies the CDO / CDDO / CDIO / CDEI / EIEIO / etc. need for the perception of institutional simplicity. Commentary on Twitter suggests at least some civil servants have read ‘Seeing Like a State’, which illustrates and explains how Governments do things because they make Government’s job easier, rather than necessarily helping the people they claim to serve.

In this context, Zacka’s ‘When the State meets the Street’ should also be required reading, as the business GDS is getting into with the Black App is front line service delivery for all of Government, at a level far deeper than just “meet user needs*”. 

In terms of needs, both individual and institutional, and given so much time in public services is taken up by complex cases – those with past traumas causing current difficulties – what would a trauma-informed interface look like?

It’s unlikely to appear in the Black App, but it could well do somewhere else…



For more detail and background, see our core report, ‘Decoding the Algorithm and Data Choices in DWP’s Monster Factory’ and complete list of Annexes – of which these are most relevant:

COVID Passports

Any requirement for an in-country COVID passport after a declaration of “freedom” will be an admission of domestic policy failure by the Government; the greater the requirement for COVID passport mandates, the bigger the failure of Government to manage the pandemic well.

If do you need a domestic COVID passport, we recommend the paper documents made available, but you also have to black out unnecessary information (see below):

  • Once you have been vaccinated in England, we suggest you use this English online form to get your paper certificate. It should arrive within 5 working days. If you prefer, you can ask for a letter by calling 119.
  • In Scotland you can request a copy of your letter online for Scotland here, or you can get a copy of your vaccine status letter by phoning the COVID-19 Status Helpline on 0808 196 8565. NHS Scotland says you should allow at least 14 days for your vaccination status letter to arrive.
  • The only Wales online option requires you to have an NHS Login, or you can request a paper NHS COVID certificate by calling 0300 303 5667 – though it can take up to 10 working days for your certificate to arrive.
  • To get a certificate for Northern Ireland online (which may take 3 days to process) you must have an nidirect account. Or you can request a paper COVID certificate by telephone on 0300 200 7814, though it will take up to 10 working days to arrive. 

The COVID passport apps in each nation are different; they work differently, and require you to prove your identity in different ways. The paper certificates tend to be valid for a longer time than the app versions, and don’t require you to show your logged-in phone to strangers.

Unfortunately the paper versions being sent out currently include information like your address and date of birth – so if you must use one for domestic purposes, make sure you block out any other personal information on it, leaving only your name and the QR code.

In our responses to Michael Gove’s original consultation on ‘Vaccine Passports’, and to the recent call for evidence on ‘Plan B’ in England, medConfidential pointed out many of the risks of app-based COVID passes. As the schemes roll out, we and others are picking up on additional problems – like people whose medical records are already flagged as sensitive not being able to get a pass.

And, as the introduction of the Scottish ‘COVID Status’ app has already demonstrated, the use of international COVID certificates for domestic purposes is unsafe, unwise and potentially unlawful; the QR codes designed for use at borders can ‘leak’ unnecessary personal information when checked at domestic venues.

medConfidential Bulletin – 23rd July 2021

If you asked NHS Digital for opt-out forms and the forms didn’t show up, or took ages to arrive, people tell us that happened a lot. You can get forms from us here.

We’d like to be able to tell you that you will have more information on the ‘GPDPR’ data scheme in the future than you have today – but, as you’ll see below, that’s not a promise the Government was willing to make

What just happened

The GP data grab has now been paused for longer than patients were originally given to opt out. This week it has been delayed for a lot longer, almost certainly into 2022. You can read our situation report from 13th July which predicted what would happen, and what is still left to happen. But whenever the scheme restarts, there’s still no promise from Government that you’ll hear anything about it directly.

When medConfidential gave evidence in Parliament on Tuesday, the Government could have committed that you would hear something from the NHS. Instead, the Minister ducked the one remaining big question, leaving the suggestion hanging that the only way you’d hear about it is from medConfidential.

They have tried that approach twice so far – first in 2014, and now in 2021 – and it has failed both times. Not to write to everyone a third time would be a textbook example of doing the same thing over and over again, somehow expecting a different result.

In his last act before becoming mired in scandal, Matt Hancock announced that GP data would only be used in a Trusted Research Environment – we hope this is true. (Similar was said in 2014, but never delivered.) This time, however, all of the examples given were agreed to be dangerous, and all of the examples were from hospital data

The Health and Care Bill that’s now working its way through Parliament does nothing to address this. So, through the rest of the year, there’ll be discussions about the Health and Care Bill, and probably some (late? sneaky?) amendments that affect patients’ data…

What’s next

There will no doubt be a series of sessions in ‘smoke-filled back rooms’, where there’ll be any amount of intense lobbying to water down promises to patients – which is the most likely reason the Government won’t commit now to telling you what it will do, in a letter, when it’s been done.

There is good reason to be sceptical that the promise for Trusted Research Environments (TRE) will be delivered. The “national institute for health data science” refuses to tell us how much money it has spent on its TRE attempts – largely because the only thing it has to show for those attempts appears to be the prize it awarded to its contractors. That team delivered nothing useful for researchers, but got a prize. We have no idea how many millions were wasted, but we will find out.

Many will have heard about the opioid epidemic in the US, where a Pharma company encouraged its sales teams to pay as many doctors as they could to prescribe as many painkillers as they could, disregarding any harms to patients or the public. The details of that scandal are now in a book, and the legal case was settled earlier this month – one of the outcomes being that billions of documents will be made available for public research


One question we may therefore be able to research definitively is the effect of ‘pharmaceutical marketing’ in the US, and possibly beyond – noting that NHS Digital not only makes patients’ data available to third parties (and fourth parties too, via intermediaries) for just such purposes, but also some prescribing data, which the NHS isn’t allowed to let others analyse…

It will be interesting to see how issues like this, which have been brushed under the carpet for years, play out in coming months.

What can you do?

Keep spreading the word! The Minister wrote to GPs but, once again, no-one thought how to inform patients of what’s going on. And GP data extraction is still going to happen, albeit not in quite such a rush.

Promises have been made, but are yet to be delivered – much less be seen to be delivered – so, if people do have concerns, their best option at this point is still to opt out. If and when their concerns are addressed, they can always opt back in.

Other than that, we hope you are able to get both jabs, to enjoy the summer, and that you don’t catch and won’t spread COVID. That the politicians seem to be doing their level best to screw things up doesn’t mean we can’t all get through this, together.

The inevitable and afterwards – GPDPR Situation Report 7

medConfidential’s GP data grab Situation Reports are a series of updates sent to stakeholders; this one is public.

The long delay was inevitable

The announcement of the short delay in June to 1st September was largely due to NHSx and DHSC thinking they understood their mistakes; as the GPDPR Data Provision Notice has now been withdrawn, and any new DPN will have process to go through, GP data collection can now begin no earlier than the 2nd September.

The next announcement, of a longer delay, will mark the inevitable realisation of the magnitude of these past mistakes – a delay already referred to by the former Secretary of State in his last speech at the despatch box, where he said:

It will take some time to move over to the new system, hence I have delayed its introduction, but we have also made that delay to ensure that more people can hear about it.


Both the Secretary of State and David Davis MP also entirely agreed in that debate on the risks of dissemination. It is therefore clear that the (very welcome) commitments on the use of Trusted Research Environments must apply to hospital data, e.g. HES, as well as GP data.

This realisation may yet come slowly. On HES, it may take a legal opinion quoting the Secretary of State’s speech, next to the ICO’s guidance on UK GDPR and DPA 2018, next to current DHSC policy that requires NHS Digital to disseminate the sensitive, identifiable personal data of every hospital patient in England – even if they have dissented – thousands of times a month. 

We understand it will be difficult to decide today, that from tomorrow HES is identifiable special category personal data, when the data was disseminated yesterday (and for years before).

The best time to have complied with the UK’s 2018 Data Protection Act was in May 2018; the second best time is now.

Sequencing of Events

While the delay was announced so the Trusted Research Environment (TRE) could be built to the satisfaction of research, there is now time to do everything in the right order. Hopefully.

NHSx may have gotten to choose the starting point but, as the Health and Care Bill demonstrates, it missed the boat. The headline focus of the Bill, Clause 1, formally re-names NHS England, but nowhere in the Bill does NHS Digital get a re-name. Perhaps DHSC expects to use its new powers to abolish NHS Digital – thereby abolishing the statutory safe haven? That is untenable.

There is, however, still time for the proposed legislation to be amended to resolve some critical data trust issues. The Bill should, for example, have a hook to put the National Data Opt-out onto a statutory footing – so patients can know and have confidence in what the rules are, so the profession all know what the rules are, and so the various national bodies know what the rules are – and so that everyone knows how those rules can be changed (in either direction) in future.

As the use of GP data evolves, there should be discussion as to whether the National Data Opt-out (NDOO) should apply to data leaving GP systems and going to NHS Digital, or not. If the conclusion is that it will not, then the Type 1 GP data opt-out must live on. If the NDOO were to be clarified in legislation to have the same effect as the current GP opt-outs, then Type 1s could effectively be deprecated for all but the most critical concerns – for a statutory opt-out is much better than a non-statutory one.

Hospital data

All of the examples given in David Davis MP’s adjournment debate were to do with hospital data, and the Secretary of State agreed on the risks of disseminating patients’ identifiable GP data, explicitly stating his intent that “The dangers that come with the dissemination of pseudonymised data are removed.”

So why is NHS hospital data not also being made ‘TRE-only’ from summer 2021 onwards? 

If NHS Digital and NHSEx wish to demonstrate to the GP profession (and to patients and the public at large) that the TRE-only approach will work, the most straightforward way to do so would be to show it working for the hospital data NHS Digital already collects – with a variety of researchers and, say, NHS England’s ‘Data Services for Commissioners’ Regional Offices (DSCROs) demonstrating good use of it. 

Such a transition should also make the DSCROs and other ‘DHSC / NHS family’ users far happier, as they will be getting both a much better data analysis environment for their ongoing work, while increasing safety as well. 

As the Health and Care Bill puts obligations on Integrated Care Systems to ‘use more data’, such patient-level data usage should also all be in formally NHS-accredited Trusted Research Environments – initially NHS Digital’s, also ONS’s or Genomics England’s. (‘Five Safes’ TREs are entirely achievable, but some will claim they meet the standard when they do not. Hence the need for formal, likely mutual, accreditation; trust in all being dependent on the weakest link in the chain.)

Communications

The need to communicate directly to the entire public actually makes other problems easier to resolve; with the data opt-out definitions written down in legislation, what is left for debate (as was the case in 2014) is exactly what text will fit on two sides of A4 – the text for the opt-out / opt-back-in form being derived from the legislation itself. 

This process could start with the last consensus draft of the care.data Advisory Group letter because, as a public advocate of the programme said, GPDPR is care.data.

NHS Digital, NHSx, and the new power to amend legislation

While NHSx may choose how many (NHSx-liveried, crowd pleasing…) elephants are in the ‘tech vision’ parade, it continues to be NHS Digital that has to follow it around with a shovel. And whoever holds the shovel will forever be in tension with those who want more elephants.


Many of the persistent problems around data are the result of such tensions, not necessarily the organisation itself that is making a decision. The same criticisms of NHS Digital would apply to the cancer registry, which learnt the hard way that giving data to a “causes of cancer study” is not such a good idea when the study is run by a tobacco company.

Someone has to enforce the rules that DHSC advertises as “strict”; that is currently NHS Digital.

It is not NHS Digital that decides what data uses there could be – it responds largely to requests. Sometimes it recognises that a request is valid but that an analysis would be better done by someone else. (A “causes of cancer study” is not inherently a bad thing.) But, as a result, NHS Digital gets a reputation for saying no to people – mostly because few notice the thousands of data file releases it does make every month.

It is, and should be, the job of a statutory safe haven to have a deep understanding of what is possible, what is legal, and of the necessity of keeping promises to patients. (Keeping promises not being a recognised strength of this Government.)

Any body fulfilling the role of safe haven must be transparent about where data goes. NHSEx have been actively dishonest in that regard, and – even if that was initially a mistake – have then explicitly refused to correct the record, and have repeated the dishonesty.

Differing interests may not like individual decisions that NHS Digital takes, medConfidential included – but what must be recognised and emulated is that it tells the public what those decisions are and why they were made, and people can know what we don’t know.

With DHSC and NHSEx, however, the cronyism and corruption of the Government’s approvals processes means not only is there no picture of what we don’t know, there appears to be an explicit desire to make sure no-one knows. 


Perhaps we are being unfair on the ‘organisation’ behind the first version of the NHS COVID-19 app that barely made it to pilot stage; the group which pushed GPDPR forward against expert advice, and which vetoed suggested improvements of GPDPR before it collapsed; the outfit that misleads stakeholders on what it publishes; which simultaneously added domestic vaccine passports for users of the NHS app, and which (still) expects NHS patients to hand an unlocked smartphone to the border guards of a hostile nation,  but we believe one’s actions speak for themselves.

(Of course, the person who signed the GPDPR Direction got promoted shortly thereafter. When NHSx is abolished, NHSx policy functions should really revert to DHSC – not because any particular incumbent has any particular talents, more because officials always move on.)

If NHSx – or any actual NHS bodies, for that matter – wish to be seen as trusted, they must show themselves to be trustworthy. Downgrading the statutory safe haven and/or transferring its statutory powers without reference to Parliament is unlikely to help in this regard.

New Secretary of State and Life Sciences 

To push our earlier analogy, some of Sajid Javid’s team will be retracing the path of Matt Hancock’s elephant – with a shovel to clean up those emissions that still litter the building.

And those whose ‘Vision’ is less rose-tinted will recognise the “alignment” claimed in the restated Life Sciences strategy was prompted more by the overwhelming necessity of combating a common enemy than any real change in institutional politics or public attitudes. It is notable also that the stakeholders on whose data the Vision depends, the public, get short shrift in a document whose focus is to “deepen collaboration and trust between Government, the NHS, and the [Life Sciences] Sector”.

Aspirational statements for “the full support of patients, the public and NHS, and must build trust into [the Vision’s] delivery” are hard to square with the far more clearly-defined intent that: “governance and oversight of NHS health data must be simplified to drive research and innovation”.

We welcome the commitment to consensual, safe, and transparent data infrastructure for a 21st century health and care system; as we have been saying for years, a modern TRE for research and all other secondary uses is inevitable. The best time to have started was in 2013; the second best time is now.

Available next steps:

[PRESS RELEASE] Government’s new (draft) ‘data strategy’ for health boils down to “Data saves lives, so we’re going to sell it”

The Government’s new draft strategy, “Data Saves Lives: Reshaping Health and Social Care with Data” is published today. [1] 

The draft document – which took guidance on data and innovation from the same team as the OfQual A-levels mess last summer [2] – was developed by Matt Hancock’s ‘tech vision’ unit, NHSX (notably not an NHS body) being best known for its first draft of the COVID-19 app, and for thinking that no-one cares about the privacy of their GP records any more.

The draft manages just one, single, passing reference to last month’s catastrophically mishandled and miscommunicated GP data grab, [3] cited in “Progress so far” [4] to be implemented “later in 2021”. (Is this the announcement of the delay beyond September?)

Key paragraphs:

Aside from the stalled GP data grab, GPDPR, that same “Progress so far” list also mentions the highly secretive NHS England / NHSX COVID-19 Data Store, which feeds data to Palantir for Government’s favourite AI mercenaries, Faculty Science, to build dashboards. [5]

For over a year now, NHSE/X have refused to publish the list of projects and organisations to which they release data. The Government claims benefits, but shows none at all – if this is “progress”, then evidence, transparency and good governance are clearly out of the window.

One line that really matters is buried in section 3, “Supporting local and national decision makers with data”, [6] which says:

…we will use secondary legislation in due course to enable the proportionate sharing of data including, where appropriate, personal information for the purposes of supporting the health and care system without breaching the common law duty of confidentiality (ongoing)

[Further down the same section, it shows how they’ll give patients’ data to DWP…]

Does this Government really believe it can use “secondary legislation” to overturn the millennia-long trusted principle of doctor–patient confidentiality that lies at the very heart of healthcare?

The strategy regurgitates, almost unchanged, a set of “principles for data partnerships” [7] that were a Pharma-Bro-friendly Goat Rodeo [8] when they first surfaced two years ago, and which haven’t improved since. Its plaintive references to “transparency” and “citizen engagement” [9] don’t really hold water if – as medConfidential was – you participated in, gave expert testimony to, or were on the advisory panel to these efforts.  

We’ve also heard quite a lot of this “strategy” before. Compare, for example, the “commitment” at the bottom of the first section of 2021’s draft strategy, [10] to “give citizens the ability to see what research their data has informed, and who has had access to their data, as soon as the technology allows (ongoing)” with the “Paperless 2020” vision of the previous administration, in particular the section on page 50, [11] about “Digital Services – the offering to the Citizen and his apps supplier (Phased 2015 –2018)”

Phil Booth, coordinator of medConfidential said:

“Boris Johnson’s Government says “Data Saves Lives”, but buried in the small print is a rather more dubious deal: “If you want better care from your data, you must let us sell it.”

“Once, the PM remembered it was nurses and doctors who saved his life – and the next time Matt Hancock pontificates that patients “own their own data”, he should remember that taking something someone “owns” without their permission isn’t ‘sharing’ or ‘innovation’, it’s just plain theft.”


Notes to Editors

1) The draft strategy is published here: https://www.gov.uk/government/publications/data-saves-lives-reshaping-health-and-social-care-with-data-draft – as was first announced in the Government’s wider ‘National Data Strategy’ last September: “For example, NHSX is developing a Data Strategy for Health and Social Care in Autumn 2020, which will aim to build on the permissive approach to data sharing for care seen during the coronavirus response…” https://web.archive.org/web/20200909080611/https://www.gov.uk/government/publications/uk-national-data-strategy/national-data-strategy 

2) CDEI’s (the Centre for Data Ethics and Innovation) advice is cited across the document; its outgoing Chair was in post at the time the advice was given: https://twitter.com/medConfidential/status/1357037423172141061

3) Links to news coverage of the 2021 GP data grab here: https://medconfidential.org/information/media-coverage/

4) In section 3, “Supporting local and national decision makers with data”: https://www.gov.uk/government/publications/data-saves-lives-reshaping-health-and-social-care-with-data-draft/data-saves-lives-reshaping-health-and-social-care-with-data-draft#supporting-local-and-national-decision-makers-with-data

5) Even Dominic Cummings seems unaware that NHS patients’ personal data, collected by NHS England under the COPI powers, was being fed to Palantir so that Faculty could build dashboards: https://twitter.com/EinsteinsAttic/status/1403496331965050881 

6) Section 3, “Supporting local and national decision makers with data”: https://www.gov.uk/government/publications/data-saves-lives-reshaping-health-and-social-care-with-data-draft/data-saves-lives-reshaping-health-and-social-care-with-data-draft#supporting-local-and-national-decision-makers-with-data 

7) In section 7, “Helping developers and innovators to improve health and care”: https://www.gov.uk/government/publications/data-saves-lives-reshaping-health-and-social-care-with-data-draft/data-saves-lives-reshaping-health-and-social-care-with-data-draft#helping-developers-and-innovators-to-improve-health-and-care 

8) https://medconfidential.org/wp-content/uploads/2019/10/business-models.pdf – see page 3 for links to examples of how the proposed ‘business models’ have already all failed in practice.

9) At the bottom of the “Next steps” section, immediately above Annex A: https://www.gov.uk/government/publications/data-saves-lives-reshaping-health-and-social-care-with-data-draft/data-saves-lives-reshaping-health-and-social-care-with-data-draft#next-steps

10) Section 1, “Bringing people closer to their data”: https://www.gov.uk/government/publications/data-saves-lives-reshaping-health-and-social-care-with-data-draft/data-saves-lives-reshaping-health-and-social-care-with-data-draft#bringing-people-closer-to-their-data

11) Tim Kelsey, the architect of the previous GP data grab (“care.data”) in 2013/14, was the ‘Director for Patients and Information’ at NHS England when he presented this strategy: https://www.kingsfund.org.uk/sites/default/files/media/NIB%20Master%20Slide%20Deck%20v6.pdf

__

medConfidential has tracked the development of both Data Strategies since they surfaced last year: https://medconfidential.org/2020/the-national-data-strategy/ and has followed the evolution of ‘Shared Care Records’ for years before that: https://medconfidential.org/2021/shared-care-records/ – graphics on how the data will be used are in the second half of the page.

medConfidential campaigns for confidentiality and consent in health and social care, seeking to ensure that every use of data in and around the NHS and wider care system is consensual, safe and transparent. Founded in January 2013, medConfidential is an independent, non-partisan organisation working with patients and medics, service users and care professionals.

For further information or for immediate or future interview, please contact Phil Booth, coordinator of medConfidential, on phil@medconfidential.org

– ends –

medConfidential Bulletin, 11th June 2021

Hello to all of our new newsletter readers – a lot of people have joined in the last week.

medConfidential only sends out a newsletter when there is something worth saying. There might be a few more of them over the next few months…

What just happened?

On 12 May, NHS Digital quietly announced there would be a new GP data collection, known as ‘GP Data for Planning and Research’, ‘GPDPR’ – or the #GPdataGrab, for clarity. 

NHS Digital and the Secretary of State, who on 6th April had Directed NHS Digital to run the scheme, hoped no-one would notice.

Matt Green did a very good, and funny, explainer of what it was they were planning, which you can also watch (or share) on YouTube:

https://www.youtube.com/watch?v=QqZXH0CJYcM (the deadline date has since changed)

Because it was rushed out, all sorts of issues were missed. Just one being that if you are pregnant, there’s no guidance on what to do for the GP data of babies born shortly after the deadline; there is no digital process for unborn children…

And then, less than a month later – after a media firestorm, a bunch of contradictions and corrections, and huge public outcry – the programme got paused.

Here’s just a sample of some of the media coverage:

Just yesterday, NHS Digital confirmed that its Data Protection Impact Assessment (DPIA) for GPDPR is still not in a publishable state, suggesting that fundamental contradictions within the programme have not been resolved. The DPIA being the one document where everyone has to write down what it is that the programme actually does, why, and the consequences – i.e the ‘impacts’. So, of course, any contradictions become obvious.

The GP data grab programme was clearly not ready, and is still not ready – and looks like it cannot be ready by the 1st September. (At least…)

What’s the new deadline?

Originally, the GPDPR scheme had no official opt-out forms. medConfidential said we would publicise ours (including our logo) and so they created one. As a result, the Government and the GP Profession agreed that it could take up to a week for a GP practice to process their patients’ opt-out forms – they are rather busy at present! – and the 23rd June deadline date was written into a document, one week before the 1st July start (i.e. data upload) date. 

That ‘time lag’ applies equally to any new start date, which is now (no earlier than) 1st September. The September date was entirely up to the Government, and did not need to be agreed with anyone. So Ministers could announce the new start date.

But any deadline has to be agreed with the GPs.

And it is notable that the Government, hiding behind NHS Digital, “wasn’t able to specify” officially what the new deadline is. Ministers and civil servants have calendars like you and us, so they could work it out – but the Government can only announce those actions the GPs have agreed to.

That, at the time of writing, NHS Digital appears to be prohibited from saying exactly when the new deadline is suggests that far more substantive changes to the GP data programme are coming than the Government is currently willing to say.

Having said that, the deadline for opting out to your GP practice relates to the processing time it takes your GP – something that is not within the power of the Government to arbitrarily shorten. (Though it could be made longer, by extending the 1st September arbitrary date; an “artificial deadline” for protecting your GP data.) 

Of course, the correct sequence of actions and deadlines is that no GP agrees to any upload of their patients’ data until each patient has been notified; that patients have been given the opportunity to make a choice, and the information and forms they need, and that those choices have been processed. 

This may be why NHS Digital cannot say what the opt-out deadline is, because it has more work to do on its communications and the opt-out process – especially for dependant children – a process which will likely take months, not days.

Since the Department of Health (DHSC) can’t even announce a deadline that is based simply on being able to read a calendar, medConfidential currently has little expectation that the GPDPR programme will start in 2021. In all likelihood, and as with the previous attempt in 2014, this new GP data scheme will likely drag on until it gets fully reset by the next Secretary of State for Health. 

Of course, we can’t afford to be complacent; we do have a Secretary of State in office who believes in data over everything else. (Apart from start dates, apparently…)

What should be next?

The letter from research funders, “Patient data must be safeguarded”, should still have applied this week – but it seems some on the Euston Road have slid backwards in their approach.

One narrow idea from some within the research community is to try to win a “research boffins vs privacy people” argument. That framing is eternally unstable; whoever is winning that argument this month doesn’t matter, because someone else will be winning it next month. 

Any stable and sustainable patient data programme must take a “research boffins and privacy people” approach – with everyone in the same room, working towards a goal that everyone can stand behind. 


We see no sign of that happening.

The best way for uses of data to be sustainable and trustworthy is for patients and the public to be informed about what data is used and how, what your choices are, and to have safeguards and governance that is both effective (with no loopholes) and seen to be effective – so individual patients and the public at large can have confidence in how the NHS uses data about them.

What can you do?

Spread the word, and please share this link to our ‘How to opt out’ page:

This battle is far from over.

There is still a lot of confusion – even medConfidential is being accused of ‘misinformation’! – though we do our best to always present a clear and accurate picture, and link to the evidence, about an unnecessarily overcomplicated process that is being hustled through by the Government while we are still in a pandemic.

Please do not panic, keep yourself informed. We will send further updates when we know something has changed. And be aware that this is going to run into ‘silly season’ in August, in a year when everyone really deserves a break – or, at the very least, a staycation.

Thank you to all those who have given us support. We really appreciate it, especially right now.

And you can be confident that we will be here when they try again! 

Let us tell you about the massive new GP data grab the Government would rather you didn’t hear about…

The countdown has already begun. The Government’s plan is to copy your entire GP medical history – including all the most sensitive parts – and make it available for third parties to apply for and buy access. Even though Matt Hancock Directed it to happen he’s not going to tell anyone about it. Neither will Boris. 

Details are still a bit sketchy; critical documents like the programme’s Data Protection Impact Assessment aren’t written published yet, and some of wha’s being said to patients seems… contradictory. The promise that “you can opt out at any time”, for example, doesn’t fit with the fact that once your data has been copied, it will never be deleted. 

We will provide more information as it emerges, but for now…

If you’re wondering why you haven’t heard about this, it’s because they haven’t told you! The Government are playing the odds that you, your family and your friends and colleagues won’t have noticed some information they buried on a website, or the handful of tweets they’ve made.

While you can opt out, they’ve made it deliberately confusing and difficult. Unlike the single form medConfidential provided at the beginning of the previous attempted GP data grab in 2014, you must now use several:

  • The most important one is the ‘Type 1’ opt-out form – this is the only opt-out that will prevent your GP data being copied to NHS Digital, and then onwards. If you haven’t done so already, you need to fill one in and send it to your GP practice within the next six weeks. (If you opt out after 30 June, your GP data could be copied from your practice at any point and, once copied, it will never be deleted.)
  • If you opted out from care.data in 2014, your opt-out will still be valid. Your own GP practice may still be using a form from that period, but it is completely different from the ‘National Data Opt-out’, which used to be called a ‘Type 2’ opt-out. Bottom line, if you opted out of care.data in 2014, you should be OK for now.
  • The National Data Opt-out, introduced in 2018, limits NHS Digital from selling access to some of your data in some circumstances. (They still sell it 85% of the time.) This opt-out process is supposedly ‘digital first’ but in 2021, for people and families with dependents, NHS Digital’s process still involved multiple PDF forms – which we’ve combined into one. And because the process is so overly complicated, we’ve created a page to help guide people through it: https://medconfidential.org/2021/children/ 

If you don’t opt out before 30 June 2021, the Government will take a copy of everything medical that ever made it into your GP record, throughout your whole life – apart from some limited aspects of information around gender recognition or IVF treatment (if you have received any).

The first upload will be of your entire GP medical history to date – which will happen as soon as your next GP appointment, possibly even before that – and then there will be daily updates thereafter, to copy every new thing that is recorded about you.

There will doubtless be much more to come, but the headline is this: 

The Government intends to take YOUR entire GP history, and isn’t even planning on TELLING you that you have a CHOICE, i.e. by writing you a letter.

This time they’re not even sending out a junk mail leaflet, but they might do some tweets and social media ads. (As we write this, their YouTube video appears to have fewer than 260 views.) 

To summarise, the process to dissent fully from the copying and then further use of information from your GP record for purposes beyond your direct care is as follows:

  • Give a Type-1 form to your GP, for your whole family’s GP records;
  • Do the online National Data Opt-out (NDOP) for yourself;
  • Download, fill in and e-mail the multi-page NDOP form for your children.

There should be better options, but this Government apparently doesn’t want to listen.

medConfidential has been fighting to ensure every use of patients’ data is consensual, safe, and transparent since 2013. We aren’t there yet, but there’s every reason to believe that if enough people take action, we will get the protections you and your family deserve.

This Government sees so little value in any form of protest that it is trying to ban it through legislation. And its Ministers’ (and senior officials’) view of profit seems to be that ‘any means are acceptable’. Indeed, in a global shortage in the throes of a pandemic, politicians picked their friends to profit off the NHS to provide PPE for nurses. 

Why would anyone believe they wouldn’t seek to profit in exactly the same way from your health data?

If you believe they can be persuaded to change course, or if you simply want to be kept informed, please join our mailing list for more news. And don’t forget to forward this e-mail to your friends and loved ones, who may wish to make their own choice before the end of June. 

Our thanks to those who have donated, especially monthly, over the last couple of years – we kept your money in a pot for times like this. We’re currently using it to pay for sending out forms to those who don’t have printers, and for some other things that we might ask you for help with, next time.


The opt out process for children

In order to register dissent for your children’s medical records to be used for purposes beyond their direct care (and why):

1) Protect your GP data: fill in and give this ‘Type 1’ form to your GP practice [PDF] [or MS Word version] – this form allows you to include details for your children and dependants as well. This is the most important step; the Type 1 opt-out is the only opt-out that will stop NHS Digital extracting your GP data.

2)  If you want to stop your non-GP data, such as hospital or clinic treatments, being used/sold for purposes other than your direct care (e.g. for “research and planning“) you must use this process: 

    • If you have children under 13, you need to fill in this form [PDF] and e-mail or post it back to NHS Digital – this form works for both you and your children.
    • If you have an adult dependant for whom you have legal responsibility, you must use this form [PDF] and send it back to NHS Digital on their behalf

If you don’t have a printer

If you don’t have a printer, and can’t fill in the electronic forms above, you can e-mail children@medConfidential.org with your postal address and how many people you need forms for, and we will post you copies of the GP paper forms, for free, no questions asked (also tell us if you have children under 13, or the online hospital data service hasn’t worked for you, and so you need the hospital data form as well).

We will, of course, only use your details to send you the forms you want and we will delete them as soon as we have done that. (medConfidential is registered with the ICO to process personal data in this way.) If you can afford to make a small donation to support us in offering this service to others, we have a donation page where others have donated so we can send the forms to you for free.


Why does DHSC put you (and other families) through all this hassle?

The pandemic changed many things, but until 23 April 2021 and for much of the last year, the forms to express dissent for your children and other dependents were missing from the NHS Digital website. Instead, for up to a year it said:

Screen capture from 6 October 2020

The explicit decision back in 2018 that there would not be a digital route for families with children came back to bite those who had to implement it.

Postal processing being temporarily unavailable might be considered understandable at the height of a pandemic, though it was clearly someone’s decision to remove the links from the website to prevent new processing.

This may not have been a concern in and of itself, but buried in NHS Digital’s Board papers is a statement that the Direction and Data Provision Notice for “GP Data for Planning and Research” was due to be published “to enable collection to commence (March 2021)”, according to the papers for NHS Digital’s Board meeting on 31st March 2021. That the new children’s opt out form did not appear until three weeks later suggests the discriminatory and inappropriate approach to dissent continues. 

Before 2016, when the dissent process had been considered primarily from a patient’s perspective, the way to opt out was to give one piece of paper to your GP, which covered your entire family – and then the NHS would deal with any complexity. It did, and it worked. Over 1.2 million people used that process, which was possibly more than some would like…

In 2018, NHS England and the Department of Health and Social Care made a series of choices about how the National Data Opt-out Process (NDOP) would work; the effect of each of those decisions made it harder for someone to express their wishes: 

  • By cherry-picking who was invited to meetings, and on a narrow reading of the Data Protection Act 2018, one of those choices was that if you are over 13, you must do it yourself online. (The people to whom NHS England chose to listen at that point were those who believed your GP shouldn’t be an interface between you and ‘the NHS’.) 
  • Another such choice was that the databases used to validate that you are who you say you are online were not to be used to check if you had children who lived at home and who were registered with the same GP.
  • In fact, the decision was then made that there would be no digital process for children at all – parents’ and carers’ choices for any of their dependents would have to be done via a form sent in the post. First that form had 8 pages, then 7, now 4, and (finally!) the option to send forms by e-mail, after feedback about the punitive nature of the process.

As a result of all this complexity, the GP opt out form – which, prior to 2018, used to work for your entire family for all NHS records – still works for your entire family, but only for your GP records. And since NHS England and DHSC chose to create another process, you now have to do that too!

The process doesn’t have to be this complicated. Most families have children registered with the same GP as the parent, living in the same house, so the NHS identity checks for adults should cover their dependent children. There will always be exceptions, families with more complex situations – the current PM’s for example – which is why a paper form is a necessary backstop. But having no web process at all starts to look more like a procedural punishment for families.

The Secretary of State or NHS England could have said that the process for dependent children (and other dependents) should be the same as for adults. Instead they shifted the bureaucratic burden from the NHS onto patients and families, in the hope you would care less about your GP data than their cronies who wish to buy it.

To register dissent for your children’s medical records to be used for purposes beyond their direct care (and why):

1) For your and your dependants’ GP data, give this Type 1 form to your GP.

2) For your children’s and your own hospital and other non-GP data, fill in and e-mail or post this ‘National Data Opt-out’ form to NHS Digital.

3) Not forgetting that for your own hospital and other non-GP data, individuals aged 13 or over can also opt out (or opt back in) online.