Buried deep in the new Care Bill is the first amendment we recall seeing to what is commonly referred to as ‘Section 251’ – the power of the Secretary of State to set aside the common law duty of confidentiality in order that identifiable patient information can be passed on without individuals’ consent.

The history is hellishly convoluted but Section 251 of the NHS Act 2006 re-enacted Section 60 of the Health and Social Care Act 2001, drawing on powers in the Health Service (Control of Patient Information) Regulations 2002. Officials now seem to want to drop “Section 251” and use “Regulation 5” instead, but they are basically referring to the same thing.

The restructuring of the NHS under the Health and Social Care Act 2012 has already caused quite a few problems, for which Section 251 exemptions were used to paper over the cracks.

But now we see in Clause 115 of the Care Bill 2013-14, entitled ‘Approval for processing confidential patient information’, amendments to Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002 which would make it read as follows: [changes in red]

Approval for processing information [why drop the words “confidential” and “patient” from the title of the Regulation?]

5. (1)  Subject to regulation 7, confidential patient information may be processed for medical purposes in the circumstances set out in the Schedule to these Regulations provided that the processing has been approved—

(a)    in the case of medical research, by the Health Research Authority, and

(b)   in any other case, by the Secretary of State.

(2) The Health Research Authority may not give an approval under paragraph (1)(a) unless a research ethics committee has approved the medical research concerned.

(3) The Health Research Authority shall put in place and operate a system for reviewing decisions it makes under paragraph (1)(a).

And Regulation 6 would change as follows:

Registration

6.  (1)  Where an approval granted by the Health Research Authority or the Secretary of State under regulation 5 permits the transfer of confidential patient information between persons who may determine the purposes for which, and the manner in which, the information may be processed, it or he shall record in a register the name and address of each of those persons together with the particulars specified in paragraph (2).

(2) The following particulars are specified for inclusion in each entry in the register—

(a)    a description of the confidential patient information to which the approval relates;

(b)   the medical purposes for which the information may be processed;

(c)    the provisions in the Schedule to these Regulations under which the information may be processed; and

(d)   such other particulars as the Health Research Authority or (as the case may be) the Secretary of State may consider appropriate to enter in the register.

(3) The Health Research Authority shall retain the particulars of each entry it records in the register, and the Secretary of State shall retain the particulars of each entry he records in the register, for so long as confidential patient information may be processed under an approval and for not less than 12 months after the termination of an approval.

(4) The Health Research Authority shall, in such manner and to such extent as it considers appropriate, publish entries it records in the register; and the Secretary of State shall, in such manner and to such extent as he considers appropriate, publish entries he records in the register.

While paragraph 6(4) may represent a relatively minor change from the old wording, which was “in such manner and to the extent to which he considers it appropriate”, both wordings mean that the register(s) will not necessarily be published in full. This means that in some instances – how many we would never know – there may be no public record of the setting aside of the common law duty of confidentiality for identifiable patient data to be used.

The main effect of clause 155 of the Care Bill is that approval for research access to patient confidential data – i.e. identifiable information about patients or from patients’ medical records – will essentially be made arms-length, a role of the Health Research Authority (HRA).

The Secretary of State meanwhile splits off a separate register of non-research ‘customers’ for patient data, which he may or may not decide to publish in full. (N.B. The Confidentiality Advisory Group (CAG) at HRA split the register of approved applications into research and non-research categories at its latest publication.)

Paragraph 5(2) of the amended Regulations may tend to weaken ethical approval with regard to confidentiality: as drafted, any HRA-recognised research ethics committee would suffice for approval, so HRA CAG could be cut out of the equation altogether.

For example, an potential customer could come to the HRA and say, “Our own ethics committee that has been recognised by you [under clause 112 of the Care Bill] has passed this already. Under Regulation 5(2) this doesn’t need to go past CAG – they’re busy enough already with all those other care.data related applications. All we need is the green light from you, as we’ve fulfilled the requirements.”

Unfortunately history has shown that if something can happen, it almost certainly will.

The amendments to Regulations 5 and 6 in clause 115 also highlight that it is the Secretary of State alone who approves the release of patient confidential data for uses other than research. It is therefore vital to keep an eye out for any amendments that replace or remove the word “medical” in 5(1) and/or 6(2)(b) and/or the Schedule.

As this is a Care Bill, not a Health Bill, it may appear strange that the Secretary of State’s powers should remain limited to medical purposes. Is all of social care to be redefined as a “medical purpose”?

Assuming some sort of last minute amendment were to be laid in order to ‘fix’ this, then depending on the exact wording used, the last constraint could be removed from preventing any use of confidential patient data [1].

There are amendments that might look relatively benign, e.g. adding “and care” to “health professional” in Regulation 7(2) or a consequential amendment to DPA 69(1), adding a list of others – but anything that changed or removed “medical” or “medical purposes” should be scrutinised very carefully.

As the merging of health and social care systems continues, we feel these words are almost certain to be changed at some point – with intended and unintended consequences, and some potentially devastating effects – not least the corrosion of trust in NHS confidentiality.

When medConfidential refutes something, we provide proof or evidence. We don’t use weasel words or mere assertion, we provide you the links to check out for yourself that what we say is correct.

Following the front page story in the Guardian today, NHS patient data to be made available for sale to drug and insurance firms, NHS England have posted a terse but incredibly carefully-worded response on their website.

In it, NHS England’s Chief Data Officer, Dr Geraint Lewis says:

“It is vital, however, that this debate is based on facts, and that the complexities of how we handle different types of data are properly understood. Patients and their carers should know that no data will be made available for the purposes of selling or administering any kind of insurance and that the NHS and the HSCIC never profit from providing data to outside organisations.”

You will note that Dr Lewis has not – because he cannot – refute the fact that insurers will be able to get hold of patient information extracted by the care.data scheme. And there are plenty of ways an insurer could profit from care.data without “selling or administering” insurance – tuning its premiums, for instance.

NHS England’s own ongoing application to the Health and Social Care Information Centre (HSCIC) to massively expand the uses and users of care.data makes it quite clear that “Examples of additional customer organisations may include:

• Universities and other academic research organisations
• Commercial companies
• Think-tanks
• Medical charities
• Medical Royal Colleges
• Information intermediaries“

And the Information Governance assessment of this ‘care.data addendum’ quite clearly states, at the bottom of page 5:

“Access to such data can stimulate ground-breaking research, generate employment in the nation’s biotechnology industry, and enable insurance companies to accurately calculate actuarial risk so as to offer fair premiums to its customers.”

(We’ll leave it up to you to decide how “fair” the insurance companies are likely to be.)

And to Dr Lewis’ point about the NHS and HSCIC ‘not profiting’ from providing our data to companies outside the NHS, we can only say… why then do you publish a price list for accessing our medical information?

NHS England and HSCIC can call it ‘cost recovery’ or whatever they like; sophistry seems to be their standard approach. But most normal people’s understanding of the word ‘sell’ involves money changing hands in a transaction, which is clearly what’s happening here.

Whatever the value these extremely powerful bodies are putting on our medical information – and in this case it’s clearly not much – this is not the sort of behaviour that patients expect of the people and institutions that should be guardians of our data. Not by a long way.

Goodness only knows how NHS England’s new junk mail leaflet, Better information means better care (2MB PDF) got its plain English Crystal Mark. It is one of the most disingenuous pieces of literature in the history of the NHS, full of ambiguity and misdirection – surpassed only perhaps its predecessor leaflet, How information about you helps us to provide better care (343KB PDF).

What these leaflets are talking about is care.data, a new scheme that will extract confidential medical information from the GP-held records of every man woman and child in England.

If you want to know more about care.data right now, you can read Hampshire GP, Dr Neil Bhatia’s comprehensive explanation at www.care-data.info or check out how care.data came about in our section called ‘What’s the story?’

The newer junk mail leaflet, which is being pushed through letterboxes across England throughout January 2014, is designed to make you think nothing extraordinary is going on. It is. The leaflet, which many patients may never actually see, is a study in evasion and omission, failing to mention rather significant pieces of information like the name of the scheme itself – ‘caredata’ appears just once in the leaflet as part of a URL at the bottom of the last page; it doesn’t appear at all in the first leaflet – and, more crucially, the new leaflet doesn’t contain an opt out form.

That’s because this is about consent. Or rather it’s about manufacturing consent.

For if you don’t act and opt out of care.data in the next 8 weeks, confidential information from your and your family’s medical records will be uploaded, and once it leaves their systems your GP will have no say in what is done with it. It will be presumed that you have consented for this to happen, and for your medical records to be passed on to companies and organisations outside the NHS – all on the basis of a leaflet which you may not even have received, noticed, read or understood.

After all, it’s being sent as junk mail, not to you directly as a patient.

But if you did get a leaflet, got the sense you’re not comfortable with the rather vague information you are being given and decide it would probably be safer to opt out – it is – you are instructed to… “speak to your GP practice”. Wrong! You don’t have to speak to your GP, and you certainly don’t have to book an appointment – you can opt out of care.data via letter or send in a form, copies of which we provide.

NHS England’s leaflet campaign is a deliberate and shameful attempt to make it as awkward for you to opt out as it can. And if this is how they are (begrudgingly) going about ‘informing’ the public about care.data, can the scheme really be trusted? If it can, then what have they got to hide?

If there were ever any doubts that NHS England’s first care.data upload, planned for next March, is anything more than a toe in the door, recent developments should quash them. Speaking at the BCS Primary Health Care Specialist Group’s annual conference a couple of weeks ago, Geraint Lewis (Chief Data Officer at NHS England) said that the current data spec would not yield enough information to be of use to researchers. In other words, it’s going to need some significant expansion.

And now, recently-published minutes of the Information Advisory Group (IAG) show that before the programme has even started, the Health and Social Care Information Centre has already been back for more. In an addendum to the first care.data request, they have sought to expand the range of agencies with access to ‘potentially identifiable’ patient data. Currently this data is available to commissioning bodies. HSCIC now wants to include ‘research bodies, information intermediaries, companies, charities’… oh, and ‘others.’

The IGA that accompanies the application provides the following caveat:

‘This information governance assessment of the addendum is not classified in the summary sheet as either identifying or non-identifying because no assessment is made, or can reliably be made, of all of the possible additional disclosures of data to the wide variety of recipients that could result from this proposal’

Ah, so this is all a bit of a shot in the dark then.

The HSCIC’s application, which can be seen here, further suggests that they could avoid troubling the IAG further by in future deciding for themselves on a case-by-case basis who can have access.

The IAG has firmly knocked back the application and sent the HSCIC away to think about it. It’s worth reading the IAG minutes in full because underneath the specific issue of the care.data addendum, the small nuances in the wording reveal a welter of problems and irritations.

On the pages of this site you’ll find information about the planned extraction of medical records from GP surgeries. In particular we recommend that you read the whole of ‘What’s the Story?’ and follow up the links that we provide. All of these are to reputable sources, and mainly to NHS England’s own documents or those of their new Health and Social Care Information Centre.

Our aim has been to bring together the facts so that the public can understand what’s going on, and journalists can ensure that everything they write is based on the available evidence. We hope to save everyone the research leg-work that would otherwise be necessary in order to understand a dauntingly complex story.

Politicians and NHS England have repeatedly stressed that all patient information will be anonymised. Recently one or two journalists have been quick to pick up on this mantra. But if you read ‘What’s the Story?’ you will see that this is not true. What they really mean is that patient data will be anonymised unless there is a legal exemption that allows the use of identifiable information. NHS England has obtained just such an exemption.

But don’t simply take our word for it. Please take a bit of time to read the detailed information and if you think it isn’t accurate, let us know and send us all relevant links so that we can correct it where necessary.

If you’re new to this whole issue, there is a simplified FAQ sheet here but note that this doesn’t contain any links.

What exactly is going on at the NHS Health and Social Care Information Centre (HSCIC)? A story in the Guardian last Saturday, ‘£140 could buy private firms data on NHS patients’, seems to have prompted some edits to the HSCIC website. The page for the HSCIC’s Data Access Advisory Group (DAAG) used to say, for example:

The Data Access Advisory Group (DAAG) is an independent group hosted by the Health and Social Care Information Centre which considers applications for sensitive or identifiable data. – our emphasis, source: Google web cache from 11 May 2013

But the current DAAG page on the HSCIC website – which, according to the page metadata meta name=”DC.date.modified” content=”2013-05-21T16:59:14+01:00″ scheme=”W3CDTF”, was modified at 4:59pm on Tuesday 21 May – four days after the publication of the Guardian article – to read simply:

The Data Access Advisory Group (DAAG) is an independent group hosted by the Health and Social Care Information Centre that considers applications for sensitive data.

Other pages have also been changed in recent weeks, such as the one about the HSCIC’s Bespoke data extract services. The top section of this page currently reads:

What is the data extract service?

Customers can order bespoke patient-level extracts or tabulations of health and social care data.

The data we supply is normally anonymised or de-identified. We only provide identifiable data when there is a lawful basis to do so e.g. with patient consent, a statutory gateway or with s251 support.

This data can only be made available to those who meet HSCIC’s robust Information Governance standards to protect and control how data is managed.

We oblige anyone who is eligible and whom we agree to supply with data to enter into a Data Sharing Agreement. These Agreements regulate how the data is shared and used and also detail storage security requirements and restrictions on onward sharing or publication of this data. We also reserve the right to audit adherence to the Agreement. The Data Sharing Agreement specifically prevents customers from attempting to link data and re-identify individuals.

You can find out more about our services for researchers, including how we are working with the Clinical Practice Research Datalink (CPRD), in the Data Linkage Research section of this website.

As compared to what it said on 7 April 2013 [web.archive.org snapshot]:

What is the data extract service?

Organisations can order bespoke patient-level extracts or tabulations of health and social care data.

Data will be provided in a de-identified form and we will only provide identifiable data where there is a legal basis on which to do so e.g. the patient has consented. Researchers can access this service via the Clinical Practice Research Datalink (CPRD)

or on 20 March [web.archive.org snapshot]:

What is the data extract service?

Researchers and organisations can order bespoke patient-level extracts or tabulations of health and social care data.

And on all of these pages, if you scroll down a bit further, you come to a link that says: “How do I apply for access to sensitive or identifiable data?” The clear implication being that one can apply for access to identifiable data.

As far as medConfidential understands, HSCIC does provide identifiable patient data to third parties and that – on top of any other fees it may levy – it charges (or has charged) an additional £140 processing fee for doing so. This seems like peanuts for access to identifiable data on individual patients, whatever procedures someone has to jump through to get it. And with the Commissioning Board (‘NHS England’) applying for blanket Section 251 exemption to pass around identifiable data amongst a whole range of commissioning bodies medConfidential believes patients have every right to be concerned that what may up until now have been relatively constained amounts of identifiable data leaving HSCIC may be about to become a flood.

In the interests of fairness and transparency, we decided to write to the folks at HSCIC so they can explain what’s going on. Here’s the text of our letter:

To: Dr Mark Davies, Director of Clinical and Public Assurance & Chair of Data Access Advisory Group, NHS Health & Social Care Information Centre

24 May 2013

Release of identifiable patient data from HSCIC

Dear Dr Davies,

We are writing to you regarding the circumstances in which HSCIC provides patient data in identifiable form to third parties. It appears that the HSCIC website may have contained some errors and, while we are aware that things are still adapting post-April 1st, we would like to clarify some details of the procedures around the release of patient identifiable data.

We have, of course, read the DAAG Terms of Reference and other information published on the website. We understand that HSCIC does receive patient data in identifiable form from a variety of sources and that HSCIC does provide patient data in identifiable form to third parties – not least because the HSCIC website lists three instances in which it provides patient data in identifiable form: where there is “patient consent, a statutory gateway or with s251 support.”

We therefore ask:

1) Other than by patient consent, a statutory gateway, or Section 251, what are the lawful bases on which HSCIC will provide patient data to any third party in identifiable form? “Where there is a lawful basis to do so” is broad and non-specific; what we would like is a specific and comprehensive list, something that a member of the general public could understand.

2) If a person or organisation has a lawful basis for requesting identifiable data and they satisfy the DAAG’s requirements as regards information governance and the particular request for data, is it the case that the DAAG will approve the provision of identifiable data from HSCIC? If this is not the case, who is the Senior Responsible Officer for such a release and what is the process by which they make that decision?

3) Can you confirm that HSCIC charges all third parties a fee for the provision of data in identifiable form? If there are circumstances in which this fee would be waived, please would you list them.

If any of these questions are not clear, please contact us on coordinator@medconfidential.org

Thank you for your attention. We look forward to hearing from you in due course.

Your sincerely,

Phil Booth and Terri Dowty, medConfidential

medConfidential launched on Wednesday with a highly successful conference event, after working for nearly two months behind the scenes. We’ve now published audio and video.

This morning the Secretary of State for Health responded to the Caldicott report, confirming that there would be a patient opt-out on the sharing of health data, the details of which have yet to be finalised.

Continue reading →

Audio, presentations and coverage of medConfidential’s inaugural conference held on 24th April 2013. Thanks to everyone who came, especially to all our speakers and hard-working volunteers who helped ensure everything ran smoothly.

Sessions and speeches as per the programme:

An overview of current policy including the General Practice Extraction Service (GPES); online access to medical records; the single care plan; the ingredients of valid consent – Phil Booth and Terri Dowty, joint coordinators of medConfidential

Phil Booth – audio (MP3) |presentation (.ppt)
Terri Dowty – audio (MP3) |presentation (.ppt)

Online patient records: safety and privacy – Ross Anderson, Professor of Security Engineering at the University of Cambridge Computer Laboratory

Ross Anderson – audio (MP3) |presentation (.pptx)

The next step: Linking medical records, DNA and genetic information – Dr Helen Wallace, Director of Genewatch UK

Helen Wallace – audio (MP3) |presentation (.pptx)

NHS Confidentially and Patient Advice – Helen Wilkinson, Coordinator of TheBigOptOut Patient Advice Line

Helen Wilkinson – audio (MP3)

Our right to medical privacy – Shami Chakrabarti, Director of Liberty

Shami Chakrabarti – audio (MP3)

Plenary: feedback from workshops

Sue White, Ross Anderson, Ian Brown and Phil Booth – audio (MP3)

The workshops covered:

(1) The single care plan for children and its extension to adults – Sue White, Professor of Social Work (Children and Families) at Birmingham University + Terri Dowty

(2) The GP Extraction System and patient confidentiality – Dr John Cormack, GP and Professor Ross Anderson

(3) Keeping data safe and why ‘anonymisation’ isn’t the answer – Dr Ian Brown, Associate Director (Cyber Security Centre) and Senior Research Fellow of the Oxford Internet Institute + Sam Smith, Privacy International

(4) A brainstorming session to assess the potential risks for each sector and steps forward – Phil Booth

Online coverage of the conference, including some video:

Liveblog of the conference on Light Blue Touchpaper

Report by Shibley Rahman on the Socialist Healthcare Association’s website (3 videos)

A ‘hat-trick’ from TechEye.net:
UK’s ‘anonymous’ health records are wide open
Your genetic make up to be stored, without consent, for profit
Shami Chakrabarti lends support to new health privacy campaign