full article by Alicia Clegg in the FT

At the start of the pandemic, trainee GP Kaveri Jalundhwala was working on a hospital placement. By the end of March, she had become infected with Covid-19, which then developed into long Covid and forced her to pause her training. With stories emerging of how healthcare workers in makeshift masks and gowns — and sometimes no protection at all — were paying for failures to provide adequate personal protective equipment (PPE) with their health, Jalundhwala looked for a way to support her colleagues.  She joined Doctors’ Association UK (DAUK), a grassroots lobbying group. And rather than “just get angry at home”, Jalundhwala got involved with their “Protect the frontline” campaign. Its aims include to inform the public about conditions in the fight against Covid and press the government to give healthcare workers appropriate PPE and support.

The DAUK grew from doctors joining together to support a junior paediatrician, Hadiza Bawa-Garba. In 2015, Bawa-Garba was convicted of manslaughter by gross negligence after the death of six-year-old patient and was then struck off by the General Medical Council. But many medical professionals did not see a doctor who had failed, rather an overstretched colleague who was put in an unsafe situation and scapegoated. “Any one of us could be Bawa-Garba,” says Jalundhwala. It often feels that doctors are “a faceless number on a rota where [our] individual voice does not matter to the people who make decisions,” she adds. Bawa-Garba has since returned to medical practice, while the DAUK developed its “Learn not blame” campaign to improve the culture of the NHS so it can learn from mistakes “in a constructive and fair manner”.

When the pandemic hit, DAUK started its “Protect the frontline” campaign. As part of this, it broke the story of NHS staff being warned not to discuss PPE problems on social media or speak to the press. It also created an app that enables doctors and GPs to report on PPE supplies. In April 2020, DAUK also led calls for an independent public inquiry into healthcare worker deaths and PPE supplies, with its petition gathering more than 100,000 signatures. When this received no formal response from government, DAUK started legal proceedings with the Good Law Project.

“When something needs doing, we do not sit on it,” says Pushpo Hossain, who joined DAUK to amplify the voice of doctors working in the UK who qualified abroad.

In May, when a DAUK member heard about a plan to upload all NHS patients’ medical records to a central database that could be shared with third parties, the organisation joined forces with Foxglove, a digital rights campaign group, to help force a delay. “In less than a week we had decided to take legal action [later paused],” says Rosie Shire, a GP who led DAUK’s response to the plans. The scheme has now been postponed to allow time for more consultation with no new date for implementation.

Read the full piece by following the above link

The government wants to collect the confidential health records of every GP patient in England and put them into one huge new data pool. It says “third parties” will be able to access this pool, including commercial companies, but won’t say who or how.

• The scheme’s official name is GPDPR or ‘General Practice Data for Planning and Research.’ 
• It will take 55 million people’s cradle-to-grave health records and put them in a central database – to be used by many different parties, for many different purposes.
• This is new. Under today’s system, requests for GP data are made on a one-off basis. GPDPR is far bigger and broader. It puts 55m health records in a single place that updates in real time. In the government’s words, it will ‘collect [your data] once, [but] use [it] many times’.
• A similar scheme, ‘care.data’, was tried in 2013, only to collapse over widespread concerns over privacy and corporate access. We don’t want to repeat the same mistakes today.

What’s wrong with that – surely the NHS using data better is a good thing?

It isn’t just the NHS who will access data. You can’t pool the cradle-to-grave health records of all 55 million people in England without telling people and giving them a meaningful say in how the new system works. It’s undemocratic and could damage trust in the NHS.

• This huge change wasn’t explained to patients. Matt Hancock told Radio 4 that his aim was for patients to control their own data and “consent should be at the heart of it”. He also said he was “not against” writing to everyone in the country, or sending everyone a text message, like with the Covid vaccination programme, to inform them of the change.
• But this is the opposite of what’s happened so far. Instead, the change was posted on one NHS Digital website. How does that reach the 2-3 million over-65s who aren’t online, for example? 
• The government needs to tell us why it wants to build this new data pool – and what it plans to do with the data. It should urgently explain who the “third parties” are who will have access to our data, and what standards they will need to meet.
• Matt Hancock needs to explain what alternative models he has considered for managing NHS data research. For example, openSafely, the data platform developed by Ben Goldacre during the pandemic takes research queries to the data itself – instead of grabbing the entire GP record. This might solve some of the problems with maintaining public trust.

But NHS Digital says that “Data saves lives?”

No-one is opposed to using health data for research that saves lives. But the data can also be used for profit. The plan must benefit the NHS and, crucially, maintain the faith and trust of patients. 

• Of course, data can save lives. But it can also make people a lot of money – and those goals don’t always support one another.
• The government should be honest about this. Research shows that, compared to the NHS, people are less comfortable with private companies using their confidential health records to make a profit.
• Matt Hancock must set out in plain English on what terms companies could access this massive new pool of our GP data – and give people a choice.   

Isn’t this data anonymous?

This data is not anonymous. It is pseudonymous. This is a really important distinction and is practically and legally different to anonymous. 

• Government spokespeople have repeatedly mixed these up. It is pretty easy to identify people from pseudonymised data – often with only a few bits of information about you.
• The government says they may re-identify your data in certain circumstances – without fully explaining when they might do this.
• As for companies, identify someone from pseudonymised data is illegal in most cases. But the body who handle those offences, the Information Commissioner’s Office (ICO), is understaffed, underfunded, and unable to enforce against major breaches.

There must be safeguards in place already to protect this data?

The safeguards aren’t strong enough yet – there’s one expert body that doesn’t explain its decisions clearly, and the ICO hasn’t got the resources to police the law. And the government may be about to dilute the laws that protect your health data. 

• A body called IGARD considers requests for data access. The minutes of their meetings are online, as is a record of requests for data. But the records of their meetings aren’t easily understood by the average person – nor are the standards they judge private companies on.
• Watchdog group medConfidential has published a list showing lots of third parties have broken the rules when they used medical data. And the ICO, as we said, just hasn’t got the resources to follow up every time the law is broken.
• The government’s also considering weakening legal protections for your health data. 

Is it biased to refer to GPDPR as a “data grab”?

What would you call taking the personal information of 55 million people – without asking for permission, presenting an informed choice, or, until our case, giving fair warning at all? It doesn’t seem an exaggeration to call that a data grab.

• Millions of people still haven’t heard about this system. Originally, NHS Digital set a deadline to opt-out of June 23. We think the new deadline is August 25. If you haven’t opted-out by then your GP data will be gone forever and you can only prevent future data being shared. Does that seem like a reasonable and fair system to you?
• Again – where is the public information campaign? Matt Hancock admitted that a “proper national debate” is needed but has done little to create one. We know the government can text the nation, can address the nation daily at teatime on BBC One. Why haven’t they?
• It’s not too late. The government could repair damage by slowing down and making a much bigger effort to consult people. Our data is there for the asking, not the taking.

If giving private companies access to my data helps the NHS, what’s the problem?

 The question we always need to be asking is: who benefits? The collected data of the NHS is the most valuable resource of its kind in the world – but only because it has been created and paid for over decades by taxpayers and ordinary British people.

• Companies requesting access to health data tend to promise “innovation”. But there is evidence that using data in this way can make unfairness in healthcare worse, not better. 
• “Innovative” medicines are often priced too high for the NHS to buy them, so how does that benefit the NHS? What if instead, access to our data meant the NHS got the final product for free or a share of any financial gain? Or the product could be made open source, so everyone can benefit.
• Most of all – we need to make sure that introducing a major profit motive in our health service doesn’t undermine the core value of the NHS: a universal service free at the point of delivery, with care of patients at its heart.

The Department of Health and Social Care is rolling out a new way to collect patient’s data from their GP records. This is called General Practice Data for Planning and Research or GPDPR data collection. It replaces the current system of data extraction, known as General Practice Extraction Service (GPES), which is mainly used for calculating payments to GP practices. It requires each extract to be manually added to the system.

The proposed new system will run in real time and not require practices to add each search. The roll out date for GPDPR is 1^st September 2021; this has been delayed from 1^st July 2021 due to concerns raised by groups, including DAUK, about the process. More information here https://www.dauk.org/news/2021/06/04/dauks-dr-rosie-shire-on-nhs-data-government-faces-legal-challenge-over-nhs-data-sharing-plan/

When the GPDPR data collection goes live (1^st September), the GP records of all patients in England will be uploaded to a central NHS digital database. GPs are expected to inform all their patients about this data collection. If patients want to prevent their record being uploaded, they MUST opt out before 1^stSeptember 2021. After this date, they can opt out from any future data being collected about them, but they will not be able to remove any data that is already uploaded to NHS digital.

If you would like to read the full statement from NHS Digital, you can do here https://digital.nhs.uk/about-nhs-digital/corporate-information-and-documents/directions-and-data-provision-notices/data-provision-notices-dpns/general-practice-data-for-planning-and-research (please note, it appears that this document has not been fully updated with the new GPDPR roll out date of 1^st September)

How do patients opt out?

To opt out patients need to complete a Type 1 opt out form. Medconfidential website gives clear instructions about how to opt out and the form to complete. They also give a number to call to be sent a form in the post, for those without access to a printer. https://medconfidential.org/how-to-opt-out/

When do patients need to opt out by?

NHS Digital has now said that GP practices must set their own deadlines for when patients can opt out by. https://www.pulsetoday.co.uk/news/technology/nhs-digital-gave-gpdpr-opt-out-deadline-in-error-says-gps-must-set-own-dates/

The opt out codes must be on patient’s records by 1^st September 2021.

Can patients opt out online?

NO! To opt out of GP record sharing, the patient needs to complete a type-1 opt out form, and give it to their GP Practice.  This form is available online, on the above website. It needs to be completed either on a computer or by hand, and emailed or posted to the GP Practice.

What about the NHS app?

The NHS app does not allow patients to opt out of GPDPR. It does allow patients to opt out of National Data collection, which is different to GPDPR.

What do GP practices need to do?

Practices need to inform their patients about GPDPR and how to opt out. Some practices have sent text messages to patients with the details about GPDPR, and how to opt out. NHS digital has suggested a statement which practices can display on their websites and in newsletters to inform their patients. The key point is that patients understand what their data will be used for, and who will have access to their data if they don’t opt out before 1^st September 2021 (or sooner if deadline set to be earlier by the GP practice)

The NHS digtal statement can be found at https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/gp-privacy-notice

DAUK feels this statement does not clearly explain to patients what GPDPR is, and enable them to fully consent to their data being shared- or to opt out.

A clearer explanation about GPDPR and the implications of this can be found at https://www.foxglove.org.uk/news/the-nhs-data-grab-we-do-the-governments-job-and-explain-it-for-you

The opening paragraph indicates plainly what GPDPR actually is: 

“The government wants to collect the confidential health records of every GP patient in England and put them into one huge new data pool. It says “third parties” will be able to access this pool, including commercial companies, but won’t say who or how.”

When the practice receive the opt out forms, they need to add the form the patient’s records, and add the code below.

Can GPs opt out all our patients en-mass? 

While the Secretary of State’s Direction remains valid, you cannot do this. However, if the legal case of DAUK and others successfully challenges the Direction, this may change. We will keep you posted.

GPs are too busy to add all these forms and codes to patient records; what happens if we don’t do this?

Being over stretched isn’t a valid reason for failure to act in accordance with patients’ wishes. Under the UK GDPR you could be referred to the ICO and face a fine if you do not opt out patients who have given you their form.

Do Practices get funding this?

No. This directive has come from the Secretary of State, but there is no funding available to cover. GP Practices are expected to pay themselves for the time staff will spend processing forms and ensuring the opt-out code is added to patient records. This is one of DAUK’s concerns.