Category Archives: News

PRESS RELEASE: Information Commissioner inactive on medical privacy

For immediate release – Monday 3 March 2014

Today, in same the building as the NHS Expo in Manchester, the Information Commissioner, Christopher Graham, is expected to continue to ignore the many breaches of Data Protection law emerging from the NHS Health and Social Care Information Centre (HSCIC). With NHS England claiming that the Data Protection Act will fully protect patients, the DPA’s public guardian is ignoring the tannoy calling him to emergencies.

Full hospital histories – with only some of the most identifying pieces of information swapped with nicknames or pseudonyms – have been sold to and shared with insurers [1] and pharmaceutical company marketers [2] for purposes including social media marketing [3]. There is a clear intention to begin sharing this and other patient data with countries outside the EEA, such as the US [4].

The HSCIC uses the fig leaf of the Information Commissioner’s ‘Anonymisation Code of Practice’ [5] as the only protection for a mandatory, full population dataset [6]; an error the ICO says could cause a “very high” degree of “embarrassment or anxiety”.

medConfidential [7] today called on the Information Commissioner to clarify that his ‘Anonymisation Code of Practice’ cannot apply to patient-level medical records of an entire population.

Phil Booth, coordinator of medConfidential, said:

“47 million people don’t have a clue that their hospital history has been used to target ads on Twitter and Facebook. We have an Information Commissioner struggling with Microsoft Encarta in a Wikipedia world.

“With population scale health data, techniques suggested in the ICO’s Code of Practice would include changing the type of disease that you were diagnosed with, which would obviously make the data meaningless.

“The ICO closed a public consultation on updating the Code in light of how it was being used since it was published last year. We call on the Information Commissioner to reopen the consultation, to give the public a chance to comment now people are beginning to get the picture of how their data has been used.”

—

Notes for editors

1) See, e.g. ‘Hospital records of all NHS patients sold to insurers’, Telegraph, 23/2/14: http://www.telegraph.co.uk/health/healthnews/10656893/Hospital-records-of-all-NHS-patients-sold-to-insurers.html

2) See http://www.beaconconsulting.co.uk/ which says:

“Because we hold a large set of historic HES data, Beacon is able to:

– Rapidly check patient numbers so clients can assess project feasibility;
– Start data extraction and analysis as soon as a project’s scope is agreed

We have worked with marketers, market researchers, business intelligence professionals, new product planners and market access teams at many leading pharmaceutical companies across a broad range of therapy areas.”

3) See http://www.beacon-dodsworth.co.uk/site/data/hospital-episode-statistics for a description of how HES data may be used by pharmaceutical companies “to improve [their] social marketing / media awareness campaigns”

4) See Professor Ross Anderson’s letter to the Health Select Committee, following up on misleading statements by NHS England and HSCIC to the Committee in last week’s evidence session: http://www.cl.cam.ac.uk/~rja14/Papers/dorrell-caredata.pdf

5) The ICO’s Anonymisation Code of Practice states: “although there may be no obvious motivation for trying to identify the individual that a particular patient ’episode’ relates to, the degree of embarrassment or anxiety that re-identification could cause could be very high. Therefore, the anonymisation techniques used to protect data should reflect this.” – http://ico.org.uk/for_organisations/data_protection/topic_guides/anonymisation

6) Hospital Episode Statistics (HES) http://www.hscic.gov.uk/hes are derived from a mandatory monthly collection of identifiable patient-level data from all NHS hospitals, by something called the Secondary Uses Service (SUS) http://www.hscic.gov.uk/sus

7) medConfidential campaigns for confidentiality and consent in health and social care, seeking to ensure that every flow of data into, across and out of the NHS and care system is consensual, safe and transparent. Founded in January 2013, medConfidential is an independent, non-partisan organisation working with patients and medics, service users and care professionals. Opt out forms and letters available here: www.medconfidential.org/how-to-opt-out/

For further information or for immediate or future interview, please contact Phil Booth, coordinator of medConfidential, on 07974 230 839 or phil@medconfidential.org

Fleur Fisher, former Head of Ethics for the BMA and member of medConfidential’s Board of Trustees, will be at the ICO conference and available for comment in Manchester today.

– ends –

PRESS RELEASE: What will the raft of new care.data legislation actually achieve?

For immediate release – Saturday 1st March 2014

Responding to the announcement that the Secretary of State for Health is to legislate on the care.data scheme [1] in an attempt to appease some of the concerns that have been raised about it, Phil Booth, coordinator of medConfidential [2], said:

 “medConfidential is glad to see the Secretary of State is taking the care.data debacle seriously. We’ll be watching closely to see if the small print of these legislative measures matches up to the headlines. At this point patient trust really won’t bear any more spin.”

On the statement that NHS data will only be released to organisations which have abided by data protection rules, Phil Booth said:

“A ‘one strike and you’re out’ approach to the abuse and misuse of patient data, if rigorously enforced, could be a game-changer. The fines that the courts and the Information Commissioner can hand out are peanuts in comparison to the turnover of some of the companies that will still be getting access to patient data.”

On the statement that respecting patient opt-outs will be made a statutory requirement, Phil Booth said:

“Jeremy Hunt is absolutely right to put patient opt-outs on a statutory footing, especially after some of the shenanigans that NHS England has tried to pull [3]. But every patient needs to be written to in person about their right to opt out – and be given the form and other easy ways of exercising it, this time.”

On other measures, Phil Booth said:

“We are less convinced by claims that legislation will prevent patient-level data being released when there is “not a clear health or care benefit for people”. The whole care.data scheme is engineered to pass around data for ‘secondary purposes’, not for direct care. We don’t believe it is helpful for the government to continue to conflate the future benefits of research use with things like the administrative and monitoring purposes of commissioning.”

“Putting the Confidentiality Advisory Group on a statutory footing may be a step in the right direction, but only if its remit is expanded to cover every release of patient-level data. Otherwise, the Information Centre that we now know has been selling patient data for years could still be open for business without effective, independent oversight and transparency [4].”

“Legislating for protections that are already in place, such as requiring “ethical reasons” from researchers who are already bound by strong professional ethical codes, or binding the scheme to ‘anonymisation’ practices that aren’t even as tough as the highest standards used elsewhere in government feels a bit like window dressing. More meaningful would be a move to put the powers that have permitted NHS England to cause this mess back under full, democratic scrutiny.”

—

Notes for editors

1) See, e.g. http://www.telegraph.co.uk/health/10669295/NHS-legally-barred-from-selling-patient-data-for-commercial-use.html

2) medConfidential campaigns for confidentiality and consent in health and social care, seeking to ensure that every flow of data into, across and out of the NHS and care system is consensual, safe and transparent. Founded in January 2013, medConfidential is an independent, non-partisan organisation working with patients and medics, service users and care professionals. Opt out forms and letters available here: www.medconfidential.org/how-to-opt-out/

3) See http://medconfidential.org/2014/opt-out-fixed-for-now/ for an explanation of how the opt-out – which could potentially have been meaningless – had to be fixed over the last fortnight.

4) The Confidentiality Advisory Group (CAG) deals with requests for the use of patient-identifiable data without consent, using what is known as Regulation 5 or Section 251 support. The decision to release sensitive patient-level ‘pseudonymised’ data has been the job of the 4 person, non-independent Data Access Advisory Group (DAAG) at HSCIC. Patient-level data that HSCIC classes as ‘non-sensitive’ – a term many patients may dispute – has in the past been released without submission to any sort of oversight body, and such releases have not been published or reported. This would include the data sold to actuarial companies, as reported in http://www.telegraph.co.uk/health/healthnews/10656893/Hospital-records-of-all-NHS-patients-sold-to-insurers.html

For further information or for immediate or future interview, please contact Phil Booth, coordinator of medConfidential, on 07974 230 839 or phil@medconfidential.org

– ends –

Opt out fixed… for now

On 7th February, GP magazine Pulse reported that “Patients who have opted out of the [care.data] scheme will still have their records sent to the HSCIC stripped of identifiers” – see 4th paragraph from bottom of this article. This confirmed something buried on page 9 of NHS England’s care.data Privacy Impact Assessment [PDF], which states:

Where patients have objected to the flow of their personal confidential data from the general practice record, the HSCIC will receive clinical data without any identifiers attached (i.e. anonymised data).

So the intention was to extract information from the medical records of people who had opted out, just without their NHS number, postcode, date of birth and gender attached.

This is not what any reasonable person would understand by opt out – if you opt out, no information from your medical record should leave your GP practice.

We immediately got to work, engaging with the Secretary of State and Department of Health and HSCIC amongst others. By the middle of the following week it was clear that the opt outs were going to have to be fixed, in ways we were invited to put to the Secretary of State for Health in a letter. By Friday 14th we were pretty sure that they would be fixed, but no-one seemed willing to confirm this – maybe because to do so would confirm that NHS England had been caught misleading the public.

Things moved on rapidly the following Monday with the launch of the first online opt out, faxyourgp.com, following on from critical statements by the Royal College of General Practitioners, British Medical Association and the Information Commissioner’s Office, clear signals that 38Degrees and SumOfUs supporters might opt out en masse – not to mention the fact that medConfidential had over the previous 4 weeks served out over 300,000 opt out forms and letters. And we instructed Leigh Day Solicitors to write a ‘letter before action’ to NHS England, i.e. we began a legal challenge based on misleading information in its junk mail leaflet.

On Tuesday 18th we received a letter from Dr Mark Davies, the outgoing Director of Clinical and Public Assurance at HSCIC, confirming the way in which the opt out codes would work. His letter ended: “This proposal will be considered by the GPES Independent Advisory Group (IAG) in February for their confirmation” – thus confirming that the opt outs had changed. This wasn’t an outright admission that the public had been deceived, but it clearly shows that the opt outs were not set up to work as patients would expect at the point we intervened.

And then later that afternoon, bowing to serious pressure, NHS England announced a second six month delay – while allowing themselves the possibility of uploading patient data from some ‘pilot’ practices before September.

Without fanfare that same afternoon, a new web page was published on the HSCIC website. You will probably want to read this – it’s a public document, clearly explaining the operation of the opt out codes:

http://www.hscic.gov.uk/article/3915/what-we-will-collect-from-gp-records-under-caredata

Hopefully from this point on, this page will be where any further changes to the process are published.

BUT…

You will note that the HSCIC page says, “Currently, no other data relating to those who have made this objection will be extracted from their GP record in relation to care.data”

“Currently”? Are they intending to change how the opt out codes work all over again? We sincerely hope not!

Following yesterday’s evidence session on care.data before the Health Select Committee we shall be writing to the Committee to ask that they (i.e. Parliament) ensure that the final few loose ends are tied up.

So our advice remains as follows; if you have any concerns – and the performance of Tim Kelsey (NHS England), Max Jones (HSCIC) and the Under-Secretary of State for Health in front of the Committee yesterday was less than confidence-inspiring – then opt out now. And don’t forget your kids!

If NHS England manages to convince you that they’ve got things right by September, you can always opt back in. But if you’re in one of the proposed ‘pilot’ practices (no, we don’t know where they are yet) and you don’t find out that you are until after your data has been uploaded, you may regret delaying taking action.

PRESS RELEASE: medConfidential responds to announcement of a 6 month delay to care.data uploads

For immediate release – Tuesday, 18 February 2014

In response to the announcement by Tim Kelsey that NHS England will be postponing the uploading of confidential patient data under the care.data scheme for 6 months [1], Phil Booth, coordinator of medConfidential [2] said:

“Finally, officials at NHS England have seen reason. To upload millions of patients’ confidential data without providing full and proper information or seeking consent would have been the largest breach of confidence in NHS history.

“It still could be, if NHS England does not now write to each patient in England individually by name, explaining the risks it has acknowledged as well as the claimed benefits. And this time they’d better not forget to include an opt out form.

“This delay will mean nothing if the care.data programme is not overhauled to provide patients with a clear and constantly updated picture of exactly who will have access to their data, why and what for. The entire scheme could do with a radical dose of transparency.”

– ends –

Notes for editors

1)      See, e.g. http://www.bbc.co.uk/news/health-26239532

2)    medConfidential campaigns for confidentiality and consent in health and social care. Our goal is to see that every flow of data into, within and out of the NHS is consensual, safe and transparent. Founded in January 2013 in response to the imminent and serious threat posed by radical changes in the way patient health information is to be collected and passed on, medConfidential is an independent, non-partisan organisation working with patients and medics, service users and care professionals. Opt out forms and letters available here: www.medconfidential.org/how-to-opt-out/

For further information or for immediate or future interview, please contact Phil Booth, coordinator of medConfidential, on 07974 230 839 or phil@medconfidential.org 

Keep My Secrets

A short film to make you think:

It’s not right to take things without permission.

So why does the government think it’s OK to suck up confidential information to a giant new central database from the medical records of every man, woman and child in England? Or to sell our data to private companies or maybe even let the police have access?

And why does the arms-length body in charge of the NHS in England think a junk mail leaflet is sufficient ‘notice’ to start extracting 50 million people’s most private information from their GP? That’s not permission.

Opt out NOW… and don’t forget your children!

Video produced by WPL
Thanks to Martin Gibbs (teacher) and the girls of Torquay Girls’ Grammar School
Simon Lambros ‘Journeying’ from Audio Network with permission

formFix: help protect your GP from NHS England’s data protection fines

[This blog post now has its own page in the ‘For patients’ section.]

While brave GPs are being bullied into handing over your family’s medical records, we’re hearing from a growing stream of people that their GP practice hasn’t even known what to do when they asked or went in to opt out of care.data.

We’ve been sent scans and photos of Summary Care Record opt out forms that people have been given, forms for opting out of local data sharing arrangements, and who knows what. We can point individual patients who contact us at the right form, but that doesn’t help everyone else in the practice.

If you have gone to your GP practice and they haven’t clearly understood and acted upon your request to opt out of care.data, you can let us know which practice it was through our new tool:

http://formFix.medConfidential.org

Just enter your postcode, tell us which surgery, and we’ll send them some details.

The formFix site is not for you to opt out online, but it lets us know where the confusion is and helps us to help GPs avoid breaching the Data Protection Act because of the impossible position NHS England has put them in.

NHS England has no way of knowing this information, so blithely continues assuring people that everything is fine. This should provide some data on how badly their communications campaign is actually going on the ground, for the next time Tim Kelsey joins us on the radio.

It would really help if you told friends and family who live in different parts of England – care.data does not affect Scotland, Wales or Northern Ireland – about this; send them the link, Tweet it, post it on Facebook.

Spread the word.

HSCIC Board papers

The Board of the Health and Social Care Information Centre (HSCIC) rather unhelpfully publishes all of its documents within a single zip file, which makes them very hard to google. From November 2014, original documents are available on gov.UK. For your convenience and to assist HSCIC in its drive to become transparent, here is a copy of all of the Board papers, expanded:

June 2015 papers are provided as a published PDF (not zipped)

April 2015

March 2015:

28 January 2015:

27 November 2014

From November 2014 onwards, it seems the interesting material is all in “part 2” of the meeting,  in secret.

3rd September 2014

There was no August 2014 meeting

2 July 2014

4 June 2014

14 May 2014

 

03 April 2014

05 March 2014

 

05 February 2014

15 January 2014

4 December 2013

23 October 2013

September 2013

29 August 2013

19 June 2013

30 May 2013

26 April 2013

3 April 2013

 

PRESS RELEASE: NHS England “not clear enough” to patients about opt out

For immediate release – Tuesday, 4th Feb 2014

Tim Kelsey, NHS England Director of Patients and Information, this morning admitted that NHS England had ‘not been clear enough’ [1] about patients’ right to opt out of the new ‘care.data’ scheme.

The scheme will extract identifiable medical information from the GP-held record of every man, woman and child in England, store and process it in a central database and pass it in various forms to companies and organisations inside and outside the NHS [2].

medConfidential [3] today called on the Information Commissioner to rule that NHS England’s public communications campaign – involving a mail drop of 26 million junk mail leaflets, media stories and engagement with charities and community organisations – was a failure, and to halt the monthly extraction of confidential patient information from GP systems scheduled to begin in March.

Phil Booth, coordinator of medConfidential, said:

“Millions of people still don’t have a clue that their family’s medical records are about to be uploaded in identifiable form to a body they’ve never heard of, to be used for things other than their medical care – including being passed to companies outside the NHS.

“Now the head of the whole scheme has admitted they haven’t been clear enough about what patients must do to opt out, the game is up. No-one, least of all the Information Commissioner, can reasonably claim that patients have been properly notified. These uploads cannot go ahead with so many patients still being kept in the dark.”

—

Notes for editors

1) BBC Radio 4 Today, 4/2/14: http://www.bbc.co.uk/programmes/p01rmpdy (Timecode 10:54)

Tim Kelsey: I think, that, maybe we haven’t been clear enough about the opt-out. I agree with that. Let me be absolutely clear now, that people who don’t trust the NHS to manage their data securely now have a new right, to opt out of this scheme.  To be honest, all they need to do is contact their GP to opt out.

2) In its application to extend the types of organisations who can apply for access to care.data, NHS England wrote: “This addendum proposes that applications may be considered by the HSCIC from all organisations, subject to their eligibility as determined through the HSCIC’s governance processes. Such organisations may include research bodies, information intermediaries, companies, charities, and others.” – care.data Addendum Papers, http://bit.ly/1cVvXAL

3) medConfidential campaigns for confidentiality and consent in health and social care. It was founded in January 2013 in response to the imminent and serious threat posed by radical changes in the way patient health information is to be collected and passed on. medConfidential is an independent, non-partisan organisation working with patients and medics, service users and care professionals. Opt out forms and letters: www.medconfidential.org/how-to-opt-out/

For further information or for immediate or future interview, please contact Phil Booth, coordinator of medConfidential, on 07974 230 839 or phil@medconfidential.org 

– ends –

Section 251 to be amended

Buried deep in the new Care Bill is the first amendment we recall seeing to what is commonly referred to as ‘Section 251’ – the power of the Secretary of State to set aside the common law duty of confidentiality in order that identifiable patient information can be passed on without individuals’ consent.

The history is hellishly convoluted but Section 251 of the NHS Act 2006 re-enacted Section 60 of the Health and Social Care Act 2001, drawing on powers in the Health Service (Control of Patient Information) Regulations 2002. Officials now seem to want to drop “Section 251” and use “Regulation 5” instead, but they are basically referring to the same thing.

The restructuring of the NHS under the Health and Social Care Act 2012 has already caused quite a few problems, for which Section 251 exemptions were used to paper over the cracks.

But now we see in Clause 115 of the Care Bill 2013-14, entitled ‘Approval for processing confidential patient information’, amendments to Regulation 5 of the Health Service (Control of Patient Information) Regulations 2002 which would make it read as follows: [changes in red]

Approval for processing information [why drop the words “confidential” and “patient” from the title of the Regulation?]

5. (1)  Subject to regulation 7, confidential patient information may be processed for medical purposes in the circumstances set out in the Schedule to these Regulations provided that the processing has been approved—

(a)    in the case of medical research, by the Health Research Authority, and

(b)   in any other case, by the Secretary of State.

(2) The Health Research Authority may not give an approval under paragraph (1)(a) unless a research ethics committee has approved the medical research concerned.

(3) The Health Research Authority shall put in place and operate a system for reviewing decisions it makes under paragraph (1)(a).

And Regulation 6 would change as follows:

Registration

6.  (1)  Where an approval granted by the Health Research Authority or the Secretary of State under regulation 5 permits the transfer of confidential patient information between persons who may determine the purposes for which, and the manner in which, the information may be processed, it or he shall record in a register the name and address of each of those persons together with the particulars specified in paragraph (2).

(2) The following particulars are specified for inclusion in each entry in the register—

(a)    a description of the confidential patient information to which the approval relates;

(b)   the medical purposes for which the information may be processed;

(c)    the provisions in the Schedule to these Regulations under which the information may be processed; and

(d)   such other particulars as the Health Research Authority or (as the case may be) the Secretary of State may consider appropriate to enter in the register.

(3) The Health Research Authority shall retain the particulars of each entry it records in the register, and the Secretary of State shall retain the particulars of each entry he records in the register, for so long as confidential patient information may be processed under an approval and for not less than 12 months after the termination of an approval.

(4) The Health Research Authority shall, in such manner and to such extent as it considers appropriate, publish entries it records in the register; and the Secretary of State shall, in such manner and to such extent as he considers appropriate, publish entries he records in the register.

While paragraph 6(4) may represent a relatively minor change from the old wording, which was “in such manner and to the extent to which he considers it appropriate”, both wordings mean that the register(s) will not necessarily be published in full. This means that in some instances – how many we would never know – there may be no public record of the setting aside of the common law duty of confidentiality for identifiable patient data to be used.

The main effect of clause 155 of the Care Bill is that approval for research access to patient confidential data – i.e. identifiable information about patients or from patients’ medical records – will essentially be made arms-length, a role of the Health Research Authority (HRA).

The Secretary of State meanwhile splits off a separate register of non-research ‘customers’ for patient data, which he may or may not decide to publish in full. (N.B. The Confidentiality Advisory Group (CAG) at HRA split the register of approved applications into research and non-research categories at its latest publication.)

Paragraph 5(2) of the amended Regulations may tend to weaken ethical approval with regard to confidentiality: as drafted, any HRA-recognised research ethics committee would suffice for approval, so HRA CAG could be cut out of the equation altogether.

For example, an potential customer could come to the HRA and say, “Our own ethics committee that has been recognised by you [under clause 112 of the Care Bill] has passed this already. Under Regulation 5(2) this doesn’t need to go past CAG – they’re busy enough already with all those other care.data related applications. All we need is the green light from you, as we’ve fulfilled the requirements.”

Unfortunately history has shown that if something can happen, it almost certainly will.

The amendments to Regulations 5 and 6 in clause 115 also highlight that it is the Secretary of State alone who approves the release of patient confidential data for uses other than research. It is therefore vital to keep an eye out for any amendments that replace or remove the word “medical” in 5(1) and/or 6(2)(b) and/or the Schedule.

As this is a Care Bill, not a Health Bill, it may appear strange that the Secretary of State’s powers should remain limited to medical purposes. Is all of social care to be redefined as a “medical purpose”?

Assuming some sort of last minute amendment were to be laid in order to ‘fix’ this, then depending on the exact wording used, the last constraint could be removed from preventing any use of confidential patient data [1].

There are amendments that might look relatively benign, e.g. adding “and care” to “health professional” in Regulation 7(2) or a consequential amendment to DPA 69(1), adding a list of others – but anything that changed or removed “medical” or “medical purposes” should be scrutinised very carefully.

As the merging of health and social care systems continues, we feel these words are almost certain to be changed at some point – with intended and unintended consequences, and some potentially devastating effects – not least the corrosion of trust in NHS confidentiality.


[1] In much the same way as NHS England’s care.data addendum, ostensibly to extend access to patient data for researchers, will in matter of fact open it up to all organisations while simultaneously broadening the uses to which patient data could be put – including for non-research purposes.

Furthermore, while some of the information extracted from GP-held patient records under the care.data programme is intended to be passed on in ‘pseudonymised’ – i.e. potentially re-identifiable – form, the clear intention is for Section 251 / Regulation 5 approval to be used to pass on other patient information in identifiable form – which should make Clause 115’s amendments to Regulations 5 and 6 of particular interest.

 

Refuting NHS England’s response to Guardian story “NHS patient data to be made available for sale”

When medConfidential refutes something, we provide proof or evidence. We don’t use weasel words or mere assertion, we provide you the links to check out for yourself that what we say is correct.

Following the front page story in the Guardian today, NHS patient data to be made available for sale to drug and insurance firms, NHS England have posted a terse but incredibly carefully-worded response on their website.

In it, NHS England’s Chief Data Officer, Dr Geraint Lewis says:

“It is vital, however, that this debate is based on facts, and that the complexities of how we handle different types of data are properly understood. Patients and their carers should know that no data will be made available for the purposes of selling or administering any kind of insurance and that the NHS and the HSCIC never profit from providing data to outside organisations.”

You will note that Dr Lewis has not – because he cannot – refute the fact that insurers will be able to get hold of patient information extracted by the care.data scheme. And there are plenty of ways an insurer could profit from care.data without “selling or administering” insurance – tuning its premiums, for instance.

NHS England’s own ongoing application to the Health and Social Care Information Centre (HSCIC) to massively expand the uses and users of care.data makes it quite clear that “Examples of additional customer organisations may include:

  • Universities and other academic research organisations
  • Commercial companies
  • Think-tanks
  • Medical charities
  • Medical Royal Colleges
  • Information intermediaries“

And the Information Governance assessment of this ‘care.data addendum’ quite clearly states, at the bottom of page 5:

“Access to such data can stimulate ground-breaking research, generate employment in the nation’s biotechnology industry, and enable insurance companies to accurately calculate actuarial risk so as to offer fair premiums to its customers.”

(We’ll leave it up to you to decide how “fair” the insurance companies are likely to be.)

And to Dr Lewis’ point about the NHS and HSCIC ‘not profiting’ from providing our data to companies outside the NHS, we can only say… why then do you publish a price list for accessing our medical information?

NHS England and HSCIC can call it ‘cost recovery’ or whatever they like; sophistry seems to be their standard approach. But most normal people’s understanding of the word ‘sell’ involves money changing hands in a transaction, which is clearly what’s happening here.

Whatever the value these extremely powerful bodies are putting on our medical information – and in this case it’s clearly not much – this is not the sort of behaviour that patients expect of the people and institutions that should be guardians of our data. Not by a long way.