{"id":865,"date":"2021-07-06T08:43:47","date_gmt":"2021-07-06T07:43:47","guid":{"rendered":"https:\/\/dauk.org\/big-brothers-big-data-grab-gps-caught-up-in-patient-records-controversy\/"},"modified":"2021-07-06T08:43:47","modified_gmt":"2021-07-06T07:43:47","slug":"big-brothers-big-data-grab-gps-caught-up-in-patient-records-controversy","status":"publish","type":"post","link":"https:\/\/dauk.org\/big-brothers-big-data-grab-gps-caught-up-in-patient-records-controversy\/","title":{"rendered":"Big Brother\u2019s big data grab: GPs caught up in patient records controversy"},"content":{"rendered":"\n
\"\"<\/figure>\n\n\n\n

A new system for extracting patient records has been postponed until the autumn, but GP anxieties about privacy, data security and liability remain, find Nicola Merrifield<\/em> and Awil Mohamoud<\/em><\/strong><\/h2>\n\n\n\n

As a former home secretary, Sajid Javid may know more than most about sensitivities around the state and people\u2019s right to privacy. And \u2013 while not top of his to-do list \u2013 the NHS\u2019s new GP patient data-sharing scheme has stoked the public\u2019s fears.<\/p>\n\n\n\n

The latest NHS scheme will see patient records extracted from practices, pseudonymised by the GP IT system and sent to NHS Digital, which will pass the packaged data to interested third parties. And it has serious implications for GPs. <\/p>\n\n\n\n

Under the scheme \u2013 named \u2018General Practice Data for Planning and Research<\/a>\u2019, or GPDPR \u2013 it is up to practices to notify all their patients about the plans. On 1 September, NHS Digital will extract all patient data from GP records, except for patients who have opted out and whose opt-outs have been processed by GPs. Future data will then be extracted routinely, until a patient opts out. <\/p>\n\n\n\n

This will, of course, be a significant burden for GPs at a time when they are already facing huge workload. But workload is only part of the problem. GPs are still unclear about their obligations, and a case led by campaigning organisation Doctors\u2019 Association UK<\/a> (DAUK) is currently going through the court to establish the scheme\u2019s legal basis.<\/p>\n\n\n\n

But perhaps the biggest effect of the scheme \u2013 or, more accurately, the publicity around it \u2013 will be on the GP-patient relationship.  There are even suggestions that patients will be less willing to come forward with health concerns due to worries about privacy.<\/p>\n\n\n\n

All this is set to come in over the summer. But there has already been a level of drama not normally associated with the subject of data processing. <\/p>\n\n\n\n

Rocky start<\/strong><\/p>\n\n\n\n

The scheme started to pique the public interest in early June (after being reported in Pulse<\/a>, of course). <\/p>\n\n\n\n

Media reports focused on campaigners\u2019 warnings that it would potentially make sensitive patient data available to private firms.  <\/p>\n\n\n\n

This includes patients\u2019 full history, not just any future changes to their records. This means it goes further than the previous controversial scheme, care.data<\/a> \u2013 which itself was completely ditched in 2016 after becoming too toxic due to accusations of the NHS selling off the data to private companies. <\/p>\n\n\n\n

Originally, GPs were given just over a month to inform patients about the scheme and warn them they had until 23 June to opt out.<\/p>\n\n\n\n

As the protests grew, the BMA and RCGP called for a delay<\/a> to implementation due to the tight deadline, alongside fears of the data being sold to private companies. Meanwhile a group of organisations, including DAUK, threatened legal actio<\/a>n unless the deadline for opting out was extended and \u2018meaningful patient consent\u2019 obtained.<\/p>\n\n\n\n

On 8 June, the Government duly announced a delay to the data extraction until September<\/a>. Health minister Jo Churchill told the House of Commons the extra time would be used to \u2018talk to patients, doctors, health charities and others to strengthen the plan, build a trusted research environment and ensure data is accessed securely\u2019.<\/p>\n\n\n\n

A few days later, it was announced that then health secretary Matt Hancock had roped in former RCGP chair Professor Helen Stokes-Lampard<\/a> to advise on the rollout.  <\/p>\n\n\n\n

Privacy concerns<\/strong><\/p>\n\n\n\n

The purpose of the scheme has been somewhat lost in the media outcry. NHS Digital says it is intended to extract patient data for \u2018better planning of healthcare services and use in medical research\u2019.<\/p>\n\n\n\n

The system will be \u2018more efficient\u2019 at extracting data than the General Practice Extraction Service<\/a> (GPES) process it replaces, NHS Digital insists. During the pandemic GPES has allowed regular patient data extraction to help plan treatments and monitor the effects of Covid-19, with data that can be shared with third parties. <\/p>\n\n\n\n

Under GPDPR, the data will be pseudonymised \u2013 meaning information that could directly identify a patient, such as NHS number or date of birth, is replaced with unique codes \u2013 but NHS Digital says it could reverse this and identify patients \u2018in certain circumstances, and where there is a valid legal reason\u2019.<\/p>\n\n\n\n

However, it says the GPDPR data will only be shared with organisations that \u2018meet strict criteria to use it for local, regional, and national planning, policy development, commissioning, public health, and research purposes\u2019.<\/p>\n\n\n\n

But Phil Booth, coordinator of data confidentiality advocacy group MedConfidential<\/a>, warns NHS Digital\u2019s privacy statement is too wide and that questions remain about who will have access to the information. Furthermore, he says GPDPR is \u2018far bigger\u2019 than care.data because it takes all a person\u2019s primary care medical history.<\/p>\n\n\n\n

\u2018Care.data was only prospective\u2026 it would have collected data going forward. This is people\u2019s entire coded GP history on first upload and then daily thereafter for changes. It\u2019s far bigger than care.data.\u2019 <\/p>\n\n\n\n

Warrington GP  and GP adviser at DAUK Dr Rosie Shire agrees: \u2018There will be some people who have heard vaguely that the Government is going to share this data with third parties.\u2019<\/p>\n\n\n\n

If the Government does not clearly explain the system to the public, patients could accuse GPs of betraying their trust by handing over their data. It may also make them wary of frank conversations about their health, warns Dr Shire.<\/p>\n\n\n\n

\u2018The name \u201cGP\u201d is in the title of the new system and it implies we are complicit in this. I would worry it would affect the relationship.\u2019<\/p>\n\n\n\n

She adds: \u2018We want this done in the right way so patients can trust us as GPs and don\u2019t feel they\u2019ve got to hide stuff from us in case in gets in their record and gets uploaded.\u2019<\/p>\n\n\n\n

Legal risks for GPs<\/strong> <\/p>\n\n\n\n

It seems unlikely that GPs, as the data controllers, would be held liable under data protection laws if a patient felt their record had been used illegally, or their privacy or confidentiality breached. <\/p>\n\n\n\n

Cori Crider, director of legal firm Foxglove<\/a>, which is working with DAUK on the legal challenge against the secretary of state over the scheme, tells Pulse: \u2018Everything turns on whether the secretary of state\u2019s direction to GPs to hand off the data is lawful. If it\u2019s [found to be] lawful, then suddenly NHS Digital will be the controller of the data, and if there is any downstream misuse they are going to be on the hook, rather than GPs.\u2019 <\/p>\n\n\n\n

But that may not stop patients trying to sue practices if things go wrong.<\/p>\n\n\n\n

Nathalie Moreno, a data protection and cyber security partner at law firm Addleshaw Goddard<\/a>, warns: \u2018It might be difficult to identify who made the mistake \u2013 was it the GP, a system failure? Is it clearly NHS Digital\u2019s responsibility or the GP supplier\u2019s responsibility?<\/p>\n\n\n\n

\u2018In any case, the principle from [a data regulations] perspective means if anything goes wrong\u2026 the patient doesn\u2019t need to know who caused the mistake. They are entitled to sue both the GP practice and NHS Digital.\u2019<\/p>\n\n\n\n

Despite the risks, unless the court finds the Government\u2019s request for data to be unlawful in the DAUK case, GPs must comply<\/a>. The BMA has confirmed GPs are contractually required to take part.<\/p>\n\n\n\n

Opting out<\/strong><\/p>\n\n\n\n

GPs\u2019 major role in this will be around opt-outs. They will have to opt patients out who request it. Patients can only opt out of having their historical health record data extracted on 1 September by filling in a Type-1 opt-out form<\/a> and sending it to their GP practice.<\/p>\n\n\n\n

They will be able to opt out after that, but this will only apply to future data \u2013 their historical data will already have been extracted and will be retained.<\/p>\n\n\n\n

Before the recent delay, NHS Digital imposed a deadline for patients to opt out a week before the data were extracted, giving GPs a bit of time to process any opt-outs. However, following the delay, NHS Digital removed a deadline for patients, leaving GPs to determine the cut-off point to ensure opt-outs can be processed in time.<\/p>\n\n\n\n

The BMA is not happy about this. GPC England executive team IT lead Dr Farah Jameel says: \u2018The public needs a clear deadline for opting out, with clear instructions on how to do this if they wish. <\/p>\n\n\n\n

\u2018We have been urging the Government and NHS Digital to consider making the process of opting out simpler, and in effect remove any additional burden [that] large volumes of Type 1 opt-outs could place on already under-pressure general practice.  <\/p>\n\n\n\n

\u2018NHS Digital must also make clear to patients what will happen to their data if they do not opt out before the deadline, and how long this data will be stored for, as well explaining why it cannot be retrospectively deleted should patients subsequently decide to opt out.\u2019<\/p>\n\n\n\n

Hampshire GP and data privacy campaigner Dr Neil Bhatia says: \u2018There is always the risk that GPs are going to suddenly end up with a whole load of forms right at the last minute.\u2019 <\/p>\n\n\n\n

As the deadline will now be in GPs\u2019 hands, patients could be \u2018very angry\u2019 if their opt-out requests aren\u2019t registered in time, as \u2018there is no way back\u2019, he says. \u2018It is not good for the relationship with our patients if this happens.\u2019<\/p>\n","protected":false},"excerpt":{"rendered":"

A new system for extracting patient records has been postponed until the autumn, but GP anxieties about privacy, data security and liability remain, find Nicola Merrifield and Awil…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[65,59],"tags":[38,435,524,301,426,537,543],"class_list":["post-865","post","type-post","status-publish","format-standard","hentry","category-dauk-news","category-general-practice","tag-dauk","tag-dauk-news","tag-dauk_gp","tag-dauks-gp-committee","tag-dr-rosie-shire","tag-nhs-data-grab","tag-the-pulse"],"_links":{"self":[{"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/posts\/865","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/comments?post=865"}],"version-history":[{"count":0,"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/posts\/865\/revisions"}],"wp:attachment":[{"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/media?parent=865"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/categories?post=865"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dauk.org\/wp-json\/wp\/v2\/tags?post=865"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}