NHS DIGITAL is looking to centralise digital records from across England into a single database, which will be shared with researchers and commercial partners.
You have until June 23, 2021 to opt-out of your NHS data being shared with researchers and companies outside of the national health service. Privacy campaigners have raised serious concerns about plans from NHS Digital, which will see the medical histories of more than 55 million patients in England imported into a new database, including mental and sexual health data, criminal records, and more sensitive information. Not included in the database will be patient’s full addresses, any images or videos from consultations, or legally restricted data such as IVF treatment or gender reassignment.
The deadline applies to those who live in England and are registered with a GP clinic. NHS Digital, which runs the country’s healthcare IT systems, says a new centralised database is needed because the current system used by GP surgeries, known as General Practice Extraction, is over a decade old.
So, what’s happening with all of this patient data being collected and shared?
The information will be made available to academics and commercial third parties, privacy campaigners have claimed. The records will purportedly be used for research and planning, with NHS Digital claiming that records “decide what new health and care services are required in a local area, informs clinical guidance and policy, and supports researching and developing cures for serious illnesses, such as heart disease, diabetes, and cancer.”
NHS Digital shares a list of who it shares its data with, which is updated each month, although campaigners say it can be extremely difficult to find out who sees the data due to the NHS’ “opaque” commercial relationships. For its part, the NHS says that patient data is never used for insurance or marketing purposes, promoting or selling products or services, market research, or advertising.
According to the NHS, personal medical records will be anonymised to keep your identity secret. However, the code to unscramble the anonymised data will be held by the NHS and will be used to reveal the identity whenever there is “a valid legal reason”.
Privacy campaigners claim overall plans are “legally problematic” and that patients have not been given enough time to opt out of the new policy.
Digital rights campaigners Foxglove have questioned the legality of the move in a letter sent to the Department of Health and Social Care. Solicitor Rosa Curling wrote in the letter, “Very few members of the public will be aware that the new processing is imminent, directly affecting their personal medical data.”
To remove yourself from the database, you’ll need to fill out a form and submit it to your GP. If you don’t do this before the deadline, your medical records will become a permanent feature of the NHS Digital database. Opting out after June 23 will still work, but will only apply to future data – any historic data will still be available to researchers, academic and commercial partners of the NHS. You can find the form required to opt out here.
Advocacy group MedConfidential, a privacy-focused group that has been pivotal to raising the alarm about the impending deadline, told the Financial Times: “They’re trying to sneak it out, they are giving you six weeks nominally and if you do not act based on web pages on the NHS digital site and some YouTube videos and a few tweets, your entire GP history could have been scraped, never to be deleted.”
This isn’t the first time the NHS has attempted to bring together GP records from patients across the country into a central database. Back in 2013, the Care.data programme was sold as a way to centralise digital health records, however, the project was abandoned three years later over privacy complaints.
The UK’s data regulator is believed to be producing an impact assessment, focusing on data protection, around the current plans from the NHS..