Category Archives: News

medConfidential Bulletin, 10 October 2014

What just happened?

On Tuesday NHS England announced the care.data ‘pathfinder’ areas, but didn’t provide answers to basic questions like “Is it happening in my practice?” and “When will it start?” We await more details on the pathfinders, including exactly what patients (and GPs) will be told.

The four care.data pathfinder areas are:

Leeds (3 CCGs: West / North / South and East)
Blackburn with Darwen CCG
West Hampshire CCG
Somerset CCG

We sent out a background briefing on Monday with a list of questions to which we expected answers, but when none were forthcoming there was a bit of a storm in the media.

Where does your data go?

On Monday HSCIC published its latest quarterly data release register, covering the period April – June 2014. No insurers this time, but at least one recipient (Northgate) declares that its “market may also include commercial organisations” which highlights the dodginess of claims by officials that “solely commercial use” will be prohibited. Information intermediaries that service both NHS and commercial customers aren’t solely commercial, after all.

Worryingly, HSCIC’s new contracts don’t yet exclude commercial re-use. And with the over-broad “promotion of health” clause in the Care Act – the ‘McDonalds amendment’ we pointed out would include promotion through advertising, access by pharmaceutical marketers, etc. – there’s still a long way to go before patients can be satisfied that all the loopholes are closed.

Earlier this month, an updated care.data addendum in which NHS England sought to increase the types of uses to which patient data can be put, and the range of organisations and companies that can access it, was considered by the Independent Advisory Group for GPES (the system by which data is extracted from GP practices).

The addendum was approved, with conditions – including clearer definitions of “research” and “health intelligence”, independent oversight and further consideration of the expansion of purposes once the pathfinders are complete. Like us, IAG have significant concerns about the “lack of clarity about the data disclosure” after the pathfinder stage.

If patients are to be promised that all individual-level data extracted and linked during the pathfinders will be kept in HSCIC’s secure data facility, accessible to a small number of approved analysts, what’s the rush to widen future access now?

Opt-in / opt-out

Earlier in the summer, the BMA’s Annual Representatives Meeting voted that care.data should operate on a patient opt-in basis. While it does not appear that NHS England will be testing opt-in vs. opt-out approaches in the pathfinders, a representative of the Information Commissioner’s Office said at a recent conference that GPs could discharge their obligations under the Data Protection Act if they opt out their patients by default, so long as they put equivalent effort into contacting patients offering them an opt-in as they would have done for an opt-out.

What next?

Now the pathfinder areas have been announced, we are pushing to see exactly what patients (and GPs) will be told. In the meanwhile, if you do have concerns about care.data and if you haven’t done so already, our advice continues to be to opt out now. N.B. If you opted out of care.data earlier this year and had the ‘dissent codes’ added to your GP record, these will still work so you should not have to opt out again.

In the next few weeks, we expect Regulations to the Care Act – including further definition of the “promotion of health” clause, sanctions for data misuse and the operation of the Confidentiality Advisory Group (CAG) – to be laid before Parliament. We’ll publish more information as we have it.

Also coming up in Parliament is the Health and Social Care (Safety and Quality) Bill, Jeremy Lefroy MP’s Private Members’ Bill, scheduled for Second Reading on 7th November. No documents have been published as yet, but we intend to pay close attention to a Bill that intends “to make provision about the integration of information relating to users of health and social care services in England” and “to make provision about the sharing of information relating to an individual for the purposes of providing that individual with health or social care services in England”.

How can you help?

If you are registered with a GP in one of the pathfinder areas, we suggest you e-mail or write to your local HealthWatch and ask when the local public meeting will be held to talk about care.data. Please do let us know how you get on.

We are a tiny under-resourced campaign, but if you would like someone from medConfidential to address a meeting of your patient representative group or local HealthWatch please get in touch via coordinator@medconfidential.org. We’ll do our best to provide a speaker, or slides for you to use.

And finally

There is a great deal of confusion about forms relating to the Summary Care Record, local data sharing and care.data – some patients report having three or even four separate opt outs at their GP practice. One even offered a “Summary Care Data” opt out form. To be very clear, the Summary Care Record (SCR) is entirely separate from care.data:

a Summary Care Record contains your last 6 months’ prescriptions, any major allergies or adverse drug reactions you may have and any information you have asked your GP to put on it. It is for access by medical staff providing you with direct care, and they should normally ask your permission before viewing it. The official form to opt out of having an SCR is here.
There may also be local data-sharing arrangements in your area, usually for direct care purposes such as sharing information between your GP and a local hospital. Your practice should be able to tell you more about these, and provide an opt out form.

care.data is all about ‘secondary use’ of your medical information – it has nothing to do with your direct care. No data has yet been extracted under the care.data scheme, so if you have concerns you can opt out now. You can always opt in later. There is no official opt out form, so we have provided a form or a letter for you to send to your GP.

If in doubt, please do talk to your practice staff but be aware that GPs and practice managers have not been told anything more about care.data since February.

Please do also forward this newsletter to your friends and family. They can receive future editions by joining our mailing list at http://medconfidential.org/contact/

Phil Booth and Sam Smith
Coordinators, medConfidential
10th October 2014

care.data ‘pathfinders’ announced – but what don’t we know?

On 7 October, NHS England announced the four areas in which the care.data ‘pathfinders’ (pilots) will go ahead. They are:

Leeds (3 CCGs: West / North / South and East)
Blackburn with Darwen CCG
West Hampshire CCG
Somerset CCG

The announcement does not say which individual GP practices will be involved, and provides no actual date for when the pathfinders will start.

At this point we still don’t know exactly what GPs and patients in pathfinder practices will be told – or even if every patient will be written to directly with a form. NHS England says practices will send “individual letters, emails or texts” to patients, but that these are amongst “a variety of communications” that will be tested. A text notification is hardly better than a junk mail leaflet.

There are other significant unresolved issues:

Given the widespread confusion between care.data – which is for ‘secondary use’ only, i.e. purposes other than the direct care of the patient – and the Summary Care Record (SCR), will people who were confused between SCR, which may be used in direct care, and care.data, which will not, be made very clear about their existing consent settings?
What will patients who opted out in January or February, or since, be told? Will NHS England require any patients to visit their GP practice to opt out? Will an online opt out be provided?
Patients who opt out should have this respected by the Health and Social Care Information Centre (i.e. no data will be extracted from their GP record) but when will the opt out – currently the gift of the Secretary of State – be put on a statutory basis?
The Government claims to have added legal protections but when will the Care Act Regulations detailing crucial definitions such as use “for the promotion of health” and sanctions for misuse be laid before Parliament?
Who have the Department of Health consulted on the Care Act Regulations, to be implemented by HSCIC and the Health Research Authority, which are the basis for NHS England’s assurances to patients?
Claims to rule out “solely commercial” use look like a loophole; will any company which gets data from the HSCIC still be able to sell it on for ‘re-use’ by third parties? Will “the promotion of health” still permit uses such as marketing?
When will the new contracts and agreements be in place? Drafts on the HSCIC website still appear to permit commercial re-use and make no mention of ‘one strike and you’re out’ sanctions or access via safe settings.
The planned secure data facility (‘safe setting‘) at HSCIC to hold linked GP and hospital data is not yet built. What will patients be told about the use of their data?
Where will NHS patients’ individual-level data go in the longer term? Will their data ever be permitted to leave the secure data facility in any form other than publishable aggregated statistics?
As NHS England doesn’t know what will be effective, what principles will be followed to correct deficiencies in communications for any particular trial? medConfidential supports managed testing of processes, but we have seen no commitments to address trials that go less well.
What will patients and GPs be told about future changes to the care.data programme?

With so many unanswered questions and no detail at all on some of the most obvious – such as “Is my practice involved?” or “When will this happen?” – patients have every right to feel concerned. Unfortunately it seems the Director of Patients and Information still hasn’t provided patients with all the information they need.

Expanding the scope of care.data; no “back door” changes

While care.data is still on “pause”, it is clear that NHS England intends to proceed with the programme. Announcement of the ‘pathfinders’ (pilots) in between 100 and 500 GP practices, spread across up to 4 CCGs across England, is expected within the next few weeks.

medConfidential continues to insist that, unlike last time and as an absolute minimum, every patient must be written to and be given an opt out form. It remains to be seen if some practices will run an opt-in, as the BMA voted earlier this summer.

But when patients are written to, what will they be told?

One thing that may have escaped many people’s attention is that the information NHS England intends to extract from the GP records of every man, woman and child in the country is not permanently fixed. It has already been noted that the care.data ‘code set’ [2.3MB Excel spreadsheet] excludes musculoskeletal conditions – a notable absence, given these are amongst the top reasons why people visit their GP.

If care.data (or whatever replaces it) does proceed then, over time, the information it gathers will quite clearly change. This may be to do with ‘missing’ areas such as musculoskeletal conditions, or even new conditions that can be recorded – Read Codes are updated twice annually. And NHS England has already declared in its usual unsubtle fashion that it intends to include “sensitive” conditions in due course.

Setting aside for the moment the inclusion of any particular condition, what is absolutely necessary is that any and all changes to the scope of care.data must have robust and transparent oversight and governance processes, and these processes must be clear before patients are asked for their consent.

Whether patients are asked to opt in or opt out it must be made absolutely clear what data will be used, for what purposes, and the processes by which these decisions can be changed by NHS England.

An open and unambiguous change process is necessary to ensure that NHS England’s promises to patients are meaningful – “We will follow this process” – and that GPs can say to their patients, “We will ensure they do”. To this end, medConfidential has written a short paper outlining the sort of process that we feel would be appropriate.

Any such process must be straightforward and understandable and should not merely be taken on trust, but based on knowledge. Patients or doctors with any concerns should be able to read the document containing the process that NHS England has agreed to follow in advance of them accepting that promise.

If care.data is to proceed, there must be a process in which the public can have confidence – and in which the public can be seen to have confidence – for how the programme changes over the next years, or decades. It’s not just that modifications should not be sneaked through the backdoor; the process must not have a back door.

medConfidential Bulletin, 5 September 2014

It’s been just over 6 months since NHS England pressed “pause” on care.data, so we thought now would be a good time to provide a round-up of what’s been happening. Some things have changed since you last heard from us, some things unfortunately haven’t.

What just happened?

Minutes published by the revived Data Access Advisory Group (DAAG) at HSCIC earlier this week revealed that an unnamed organisation has been using HES and ONS data “for commercial activity in addition to the purposes they had stated when applying for approval”.

This is deeply concerning, especially given repeated assurances by Ministers and officials that commercial exploitation of NHS patients’ data will not be permitted. We wrote with urgent questions on Tuesday and are waiting for a reply; it seems that while the ‘new world’ detection regime may be beginning to work, we are still stuck with ‘old world’ incident handling.

This is precisely the sort of offence that ‘one strike’ sanctions would address; the perpetrator would have to delete the data, provide proof that it had been deleted, would have their current contract(s) revoked, and would not receive data in future. Merely “asking the data recipient to cease using the data” shows how far we still have to go.

Consensual

A survey by GP magazine Pulse over the summer suggests nearly one third of GPs would opt their patients out of care.data if NHS England ignores the BMA’s vote for the scheme to be opt-in. GPs across the country report that patients are continuing to opt out; one in St Helens confirms that “opt outs in her surgery currently stood at 20%”. And even NHS England’s Deputy Medical Director has called for parts of care.data to be opt-in.

medConfidential proposed a way in which NHS England could empower GPs who want to protect their patients’ confidentiality and also allow consensual research, but it appears the official still pushing the scheme just doesn’t want to.

Safe

We’ve said many times that the nation’s medical records are more valuable than the Crown Jewels; it appears parts of the system have got the message, and the Health Select Committee was given assurances (Q433 & Q504) that – for the ‘pathfinder’ phase at least – care.data extracts will only go into a ‘safe setting’. This is the secure data facility that some have called a “fume cupboard” and which we have previously discussed as ‘HRRDL’, a tightly locked-down Health Remote Research Data Laboratory.

We have to hold them to these assurances, and one of our current tasks is to make all parts of the system understand and respect the promises some parts have now made. Meanwhile, there have been a slew of consultations to respond to – hardly light beach reading! – including the Department of Health’s on ‘Accredited Safe Havens’, HSCIC’s Confidentiality Code of Practice and new data sharing contracts and agreements. And we continue to point out problems and ask difficult questions when attending the care.data advisory group.

Transparent

Unfortunately NHS England’s senior staff are still clueless on this front. They won’t confirm whether every patient will be written to, with an opt out form. We keep asking. They won’t even confirm if they wrote to every Clinical Commissioning Group asking if they’d like to volunteer to be a care.data ‘pathfinder’. So we wrote to the CCGs ourselves, who confirmed that NHS England hadn’t.

Meanwhile, the search for a replacement ‘Senior Responsible Officer’ for care.data continues. It’s the archetypical hot potato. We had some questions for candidates to ask the panel at interview. Things at HSCIC seem a bit more organised, and – with certain unfortunate exceptions – there are real signs they are working to improve their systems and procedures. But ongoing scrutiny is required.

Over the summer, we learnt more about the operations of the ‘National Back Office’ and access by law enforcement agencies – first outed in the Partridge Review, with more detail in July’s Data Release Register. Given the co-location of so much sensitive data at Smedley Hydro, it may be the permanent solution for this would be to move birth, marriage and death registrations out of the Home Office.

Where next?

Details of the care.data ‘pathfinders’ of “between 100 and 500 GP practices in the autumn” are still sketchy. NHS England won’t – or can’t – say where they will be, when they will start, or what exactly they’ll be doing. We’ll update you as soon as we know anything definite.

Meanwhile, Phil will be speaking at a number of events in coming weeks, including:

Healthwatch Oxfordshire and Oxford Health Experiences Institute on 10th September
Health Service Journal roundtable event at the King’s Fund on 15th September
EMIS National User Group Annual Conference in Nottingham on 26th September
RCGP Annual Conference in Liverpool on 4th October

How can you help?

We still need your help spotting inappropriate consent forms – and this is not just about enforced Subject Access Requests by insurance companies. We’ve seen forms requiring patients to agree to having their data used for purposes other than their medical care or to having their medical information processed overseas. Help us root out these abuses of consent and confidentiality wherever they occur.

And finally

medConfidential’s work continues. For example, we are pushing for patient-level audit trails – not just a quarterly data release register – that would mean you could see exactly how your data, your experiences, your life, had contributed to particular pieces of research, and read the papers from the researchers that advance knowledge.

What we do may not always be headline-hitting, but we believe keeping every use of your medical information consensual, safe and transparent is essential. There are benefits to be had, but only if things are done right.

Please do forward this newsletter to your friends and family. They can receive future editions by joining our mailing list at http://medconfidential.org/contact/

Phil Booth and Sam Smith
Coordinators, medConfidential
5th September 2014

The Department of Health: Protecting Personal Health and Care Data?

Despite the name, this consultation has nothing to do with care.data, but has to do with commissioning, care and data, which was allegedly the point of care.data. Yet another example of, when a major problem is confused and fundamentally flawed, those flaws get copied into random other places because of the confusion that assumes that the people running care.data were competent.

Oops.

The DH consultation itself was relatively confusing, and our response was constituted in 5 parts, 2 of which had been published before. We’ve also recently created two supplementary submissions, in response to specific discussions with DH on topics where it wasn’t entirely clear that what academia and we ourselves meant by a term, is what DH considered it to mean. Longitudinal studies form an important part of research, but you can’t just leave some data lying around a safe setting and plead that it’s a longitudinal study.

Special pleading for your medical records

The Nuffield Trust’s submission says: “We strongly support the recognition that appropriately pseudonymised data used for research, service evaluation and other approved purposes are not ‘personal data’ within the meaning of the Data Protection Act.”

It is “recognitions” like that, that led to the debacle of HES being used for purposes that the public disagreed with. We’re not sure that grabbing data at any point and pretending that individual level data is not identifiable is likely to increase public confidence.

Other organisations who don’t gain direct benefit from special pleading, such as the Royal Statistical Society and British Computer Society have made somewhat more balanced submissions.

The BCS submission makes an interesting point, that should any non-public entities to have the ability to become an ASH, or any form of safe setting, BCS would expect them to explicitly agree to the same level of audit that the public sector has: no notice inspections.

Our submission documents, in order for sequential reading:

Letter from medConfidential to all CCGs and Healthwatches

In recent weeks, we have been asking why NHS England has refused to say whether they have written to all CCGs regarding becoming a care.data pathfinder. We still have no answer.

medConfidential has now written to all CCGs (and their corresponding Healthwatch organisations), raising “a number of issues” beyond just care.data, “which may significantly affect patients and healthcare providers within your Clinical Commissioning Group in coming months. Issues raised include:

care.data pathfinders
Storage of patient objections
Respecting patient dissent
Coerced ‘consent’

A copy of the letter is available here (footnote listing known research databases now updated, with links).

We look forward to working with CCGs as they consider the questions raised and implications for their CCG and GPs.

A brief Early August update – things not to read on the beach

Question: Did NHS England contact CCGs inviting them to become care.data pathfinders?

It seems all of the NHS England press office are relaxing under a tree, as they wont answer that question. In two other care.data articles also published yesterday, Pulse reports the ICO’s view that responsiblities are “good customer service” and that doctors are getting closer to opting their patients out.

A quote from a GP in that last article says, “opt outs in her surgery currently stood at 20%”, which is a significant amount of the population in that area, when at best only 50% will likely have heard of it. Tim Kelsey may argue “there is no percentage at which this becomes useful or not”, yet the statisticians may begin to have views as more figures are revealed. We’ve previously posted some thoughts on how NHS England can choose to empower GPs and also allow consensual research. Maybe NHS England can read that on their holidays, while figuring out how to be very clear and transparent with everyone on what they’re doing. Secrecy and confusion benefits no one.

The current level of confusion is highlighted by one GP who says patients initially think it a “good idea if the emergency doctors knew about their medical conditions.”. That of course, is unrelated to of care.data, which has no direct care applications at all, but a feature of an entirely different scheme, with a different set of problems and consent questions, the Summary Care Record (as it was known before being rebranded due to it being “toxic”). We can see why even GPs get confused though.

As NHS England recommunicates with GPs, hopefully they wont continue to cross-sell the benefits of other programmes as benefits of care.data. NHS England have no excuse for confusion remaining, as they near the end of the 6 month pause that was supposedly to solve all the problems

Consultations

As everyone’s on holiday, there are a number of open consultations at the moment that may be of interest:

Department of Health on Accredited Safe Havens. We’ve posted our outline replacement proposal here before, and will post a fuller submission when it’s completed. Deadline, this Friday
HSCIC Confidentiality Code of Practice. The long awaited HSCIC Confidentiality Code of Practice is out for consultation. Deadline: Next week
And a new one, which isn’t so much of a formal consultation as asking a bunch of people who have shown some interest, is on the new HSCIC contracts and agreements for data sharing, including rules for sub-licensing. We’ll have quite a lot of questions about these. If you yourself have any comments on either the drafts or documents, the HSCIC would like to receive your comments by August 29th, marked FAO Simon Gray via <enquiries@hscic.gov.uk>.

Job hunting?

The Department of Health is recruiting 3 lay members, at a day a month, for the “National Information Board”, which was set up in January to try and fix the trainwreck that DH saw coming. This is an important panel with oversight of both DH and NHS England’s overlapping remits and strategies.

[this para added later]: The academicly funded “Administrative Data Research network” is looking for a member of the public willing to give over a day a month, for free, reviewing their applications. The commitment includes relevant reading time, plus a video conference a month, with 4 in person meetings a year. Details now appear here (their website was broken, so here’s the word document they mailed to their existing lists).

NHS England is also trying to hire someone to be Senior Responsible Owner for Care.data, having failed to find an internal candidate — we can’t imagine why. If you’re interested, we put together a list of questions that you may wish to ask at inteview. Apparently the risk that they may have to answer them in a binding way has caused some furrowed brows, as an interview board misleading candidates is considered bad form.

I can’t imagine why.

NHS England hiring someone Responsible for care.data

NHS England are hiring for a new Senior Responsible Owner for Care.Data, having internally failed to find someone willing to be responsible for fixing the mess.

The Senior Responsible Owner is the individual who must sign off on major decisions, and is responsible for project delivery. Heretofore, Tim Kelsey has been in the role, and we can see why he would like to pass responsibility onto others. Whether he’ll remain pulling the strings behind the scenes, is a different matter. It wouldn’t be the first time that Tim has looked for a human shield for his programme, having tried to persuade Geraint Lewis and more junior staff as a press buffer.

Hopefully a new external owner will accept the state of the mess they inherit, and as that new entrant, they may wish to ask some questions at interview:

If individually addressed letters to each patient are sent, will this be financially and politically supported by NHS England?
Are forward looking statements re free text true? How will the public position change over the course of my responsibility?
Are forward looking statements re DNA true? How will the public position change over the course of my responsibility?
What will happen to CPRD, and other research supporting datasets?
What is the state of the implementation of the more sensitive parts of the IGAR review?
What was the process that led to the BMA rejecting these proposals so emphatically? What concessions have NHS England offered to meet those concerns? Why do NHS England believe they failed?
care.data has had many benefits claimed for research, ie beyond the commissioning for which it is currently permitted. What is the current roadmap for consent for those? If they are so vital, why were they dropped in the first instance?

We would hope that any successful applicant understands why people would choose to opt out, and would not demonise them for that choice, nor consider them a “consent fetishist”. We do not believe that the personal choice of any candidate to opt-in or opt-out is relevant to their suitability for the role, but they must be able to demonstrate a human understanding of the range of reasons that an individual may make a different choice to theirs. We hope the interview panel will ensure this is the case.

We look forward to working with the successful applicant for the role when they take office. If you’re interested in applying, details are here, and feel free to ask the the above questions. If you get the job, we’ll be asking you for the answers.

HRRDLs for commissioning: a discussion towards Safe, Consensual and Transparent use of data in commissioning

Yesterday, medConfidential and others attended the HSCIC’s “Driving Positive Change” event, to briefly look back at the Partridge Review, and forward to future work of the HSCIC. The two major topics were communications of various types, and the proposed HSCIC “safe setting” where bona fide research could be conducted on data (currently subject to opt-out). Both of these things are welcome areas, and we seek to be closely involved in what happens next with the first public steps in the next week or so.

The Department for Health is running a consultation on “Accredited Safe Havens” for commissioning purposes, or, as they call it slightly less clearly, “Protecting personal health and care data”. The consultation gives NHS England companionship in terms of public engagement quality, and has led to a great number of puzzled looks by area experts. I’m currently attending a variety of meetings with a variety of organisations, and not only is no one really sure what the answers could be, few people agree on what the questions are intending to ask. This seems less than ideal.

Yet, as we are now in week 5 of a 7 week consultation, and no one really has a solid articulation of what the Department of Health are trying to do, I’ve put together this draft of a substantive paper on a way forward: “HRRDL’s for commissioning”. It’s based on previous work which has been adopted by HSCIC but after DH began their consultation drafting, which was as care.data was imploding around NHS England. If you think that the consultation as drafted takes no account of HSCIC’s progress since February, that’s because it mostly doesn’t. Comments by email are very welcome.

What is a safe setting? A safe setting is a physical venue where (usually remote) data can be accessed under tightly controlled and audited conditions. Restrictions are placed on who and what enters the room, what they do when in there, and what they can take out. This allows for research to be conducted on individual level records which have minimal protections (which, for health data, has other problems). They were previously discussed for legitimate research, along existing models. This paper takes the proposal further. We fully expect, and have no reason to disbelieve, that the optout codes for care data (and beyond) would be fully honoured. We intend that this proposal is fully compatible with the consent mechanisms that are in place, and that should be in place, and does not deny screening to those who have opted out of secondary uses. A safe setting can also restrict which individuals can see which data, which has implications for a granular approach to parity-of-esteem questions.

I don’t think that this is currently a final proposal so can evolve, (it’s dated so you can tell, and we’ll put a note here: when we do), and some may need more explanation, but if you’re interested in how we think commissioning data for invoice reconciliation and risk stratification (neither of which are direct care, so all come under the opt out process) could work in a way that is safe, consensual and transparent, I’d like to hear your comments below or to sam@medConfidential.org

Please note that making comments to us is not the same as responding to DH itself, which you can do online.

HSCIC fills in some gaps, while DH and NHS England seem to have forgotten something

‘National Back Office’

After repeated denials about police access, one of the big surprises in the Partridge Review was the discovery of a whole department dealing with ‘trace requests’ from law enforcement agencies and the courts. Such requests, if approved, attempt to track down individuals using the national electronic database of NHS patient demographic details.

The latest register shows there was a large spike in requests from the Home Office in 2013. It’s not clear if the UK Border Agency’s absorption into the Home Office explains some or all of this increase, nor if other subsidiary agencies of the Home Office make requests. Police requests are recorded separately – and are broken down in a bit more detail in the press release – but we do wonder which other agencies are using section 29(3) of the Data Protection Act.

Given the number of bodies and agencies working out of Smedley Hydro, these relationships cannot afford to be murky – absolute clarity is required.

Crashing consultations in the ‘IG universe’?

Also in the last week we’ve seen a new consultation from the Department for Health on, amongst other things, “Accredited Safe Havens” (ASHs) for commissioning.

Individual-level patient data is already being passed around for purposes such as invoice reconciliation, using what was supposed to be ‘emergency’ Section 251 support. This consultation is about doing it slightly less badly. Though clearly desperate to avoid the contamination of any association with the toxic care.data scheme, DH appears to be saying that patient-level data gathered under care.data could be passed around Accredited Safe Havens.

Uh oh.

One thing that had begun to generate confidence was HSCIC’s statement that, under care.data, the only place to which any data extracted from GP systems would go was into a safe setting – what medConfidential calls a Health Research Remote Data Laboratory. (We think ‘HRRDL’ sounds better than ‘fume cupboard’.) This was good news, and a necessary step for public confidence in any extraction of their identifiable data.

But despite HSCIC having said this in public statements and directly to Parliament’s Health Select Committee, the Department of Health clearly hasn’t thought through the implications for this consultation, which is on the flows of data for commissioning – the sole use of care.data for which NHS England has at this point received approval.

This isn’t necessarily a complete contradiction, as patient data will be collected from providers other than GPs and be passed around in other ways – but one might hope that DH would have thought through the implication of its own arms length body’s commitments, rather than taking NHS England’s steamroller approach to governance and schedules.

Another notable feature of the DH consultation is the way it contradicts assumptions made in an NHS England consultation on “Priority Issues in Information Governance“, which opened in February 2014 and should have closed at the end of April. As with much of NHS England’s Information Governance, its ‘Priority Issues’ consultation is an ill-considered mess: surely NHS England has shifted its world view since early February? Given all that has come to light, why has the consultation not been withdrawn or re-issued?

So, other than statements by HSCIC, we’re seeing scant evidence that lessons have been learnt.
HSCIC proposes to limit the number of copies of the nation’s medical records that it hands out for various purposes. This is both welcome and achievable, but it requires both DH and NHS England to accept that business as usual is no longer an option.