Category Archives: care.data

Big Pharma and care.data

Patients’ identifiable medical data will end up in the hands of large pharmaceutical companies, under the care.data initiative. With “Big Pharma” beholden to shareholders, and its abysmal record on transparency, is this another reason to consider opting out?

We are often told by those publicly defending the care.data programme (I’m thinking particularly of NHS Chief Data Officer Geraint Lewis, and NHS National Director for Patients and Information Tim Kelsey, who at least are prepared to engage with critics – although the latter has a habit of resorting to personal attacks at times) that patients’ identifiable/amber/pseudonymised data will not be made available to commercial organisations to use for their own purposes. So, we are told, it cannot be used for the purposes of selling or administering any kind of insurance, or for marketing purposes. As the pdf of FAQs, to which we are often referred (by Geraint in particular) says

Potentially identifiable data – these data do not include identifiers but may be considered identifiable (e.g. due to a patient in an area having a rare disease or a rare combination of characteristics). There are strict controls around the limited release of such data. For example, there must be a contract in place, the data are only released to approved organisations, and restricted to a specific purposes that will benefit the health and social care system
Let’s ignore for now the awkward question of how these restrictions can effectively be enforced. Let’s also ignore the fact that this data will not simply be “released” – organisations will pay for it, and a commercial organisation, with fiduciary obligations to its owners or shareholders, is not going to pay for something unless there is potential financial benefit.
What I wanted to highlight is that purposes that will benefit the health and social care system will generally boil down to two things: commissioning of services, and research. Regarding the latter, as the NHS Health Research Authority says this can take many forms, and be undertaken by many different bodies, but it will be no big revelation if I point out that vast amounts of research are conducted by, or under the control of, huge pharmaceutical companies – Big Pharma. Doctor and journalist Ben Goldacre has been campaigning for a number of years, following up the lead of others such as Iain Chalmers to expose the fact that an enormous amount of data and results from research – specifcally, admittedly, of clinical trials – is withheld by Big Pharma. This led to the setting-up of the AllTrials campaign. As Ben said, on the publication of a damning report by the Public Accounts Committee into the withholding of trial results for Tamiflu
[the] report is a complete vindication of AllTrials’ call for all the results, of all the trials, on all the uses of all currently prescribed treatments. None of the proposed new legislation or codes of conduct come anywhere close to this simple, vital ask. Industry has claimed it is on the verge of delivering transparency for over two decades. While obfuscating and delaying, ever more results have been withheld. Some in industry now claim that results from even a decade ago may be lost and inaccessible. This is both implausible and unacceptable…We cannot make informed decisions about which treatment is best when vitally important information is routinely and legally kept secret. Future generations will look back at this absurd situation in the same way that we look back on mediaeval bloodletting
This is the same industry which will be able to purchase patients’ identifiable medical data, uploaded from their GP records for research purposes. Will the NHS ever see the results of this research if, for instance, those results could have a potentially adverse effect on the companies’ share prices? Will there be any legal or contractual mechanisms in place to ensure that we don’t see similar obfuscating and delaying, and withholding of results?
Is it really the insurance and marketing companies we need to worry about?

Leave a comment

Filed under care.data, Confidentiality, data sharing, NHS, Privacy

The care.data leaflet campaign – legally necessary?

Readers of this blog [sometimes I imagine them1] may well be fed up with posts about care.data (see here, here and here). But this is my blog and I’ll cry if I want to. So…

Doyen of information rights bloggers, Tim Turner, has written in customary analytic detail on how the current NHS care.data leafleting campaign was not necessitated by data protection law, and on how, despite some indications to the contrary, GPs will not be in the Information Commissioner’s firing line if they fail adequately to inform patients about what will be happening to their medical data.

He’s right, of course: where a data controller is subject to a legal obligation to disclose personal data (other than under a contract) then it is not obliged, pace the otherwise very informative blogpost by the Information Commissioner’s Dawn Monaghan, to give data subjects a privacy, or fair processing notice.

(In passing, and in an attempt to outnerd the unoutnerdable, I would point out that Tim omits that, by virtue of The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000, if a data subject properly requests a privacy notice in circumstances where a data controller is subject to a legal obligation to disclose personal data (other than under a contract) and would, thus, otherwise not be required to issue one, the data controller must comply2.)

Tim says, though

The leaflet drop is no way to inform people about such a significant step, but I don’t think it is required

That appears to be true, under data protection law, but, under broader obligations imposed on the relevant authorities under Article 8 of the European Convention on Human Rights (ECHR), as incorporated in domestic law in the Human Rights Act 1998, it might not be so (and here, unlike with data protection law, we don’t have to consider the rigid controller/processor dichotomy in order to decide who the relevant, and liable, public authority is, and I would suggest that NHS England (as the “owner of the care.data programme” in Dawn Monaghan’s words) seems the obvious candidate, but GPs might also be caught).

In 1997 the European Court of Human Rights addressed the very-long-standing concept of the confidentiality of doctor-patient relations, in the context of personal medical data, in Z v Finland (1997) 25 EHRR 371, and said

the Court will take into account that the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention (art. 8). Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general…Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community

This, I think, nicely encapsulates why so many good and deep-thinking people have fundamental concerns about care.data.

Now, I am not a lawyer, let alone a human rights lawyer, but it does occur to me that a failure to inform patients about what would be happening with their confidential medical records when GP’s were required to upload them, and a failure to allow them to opt-out, would have potentially infringed patients’ Article 8 rights. We should not forget that, initially, there was no intention to inform patients at all (there had no attempt to inform patients about the similar upload of hospital medical data, which has been going on for over twenty years). It is, surely, possible therefore, that NHS England is not just “helping” GPs to inform patients without having any responsibility to do so (as Dawn Monaghan suggests), but that it recognises its potential vulnerability to an Article 8 challenge, and is trying to avoid or mitigate this. Whether the leaflets themselves, and the campaign to deliver them, are adequate to achieve this aim is another matter. As has been noted, the leaflet contains no opt out form, and there seem to be numerous examples of people (often vulnerable people, for instance in care homes, or refuges) who will have little or no chance of receiving a copy.

At the launch of the tireless MedConfidential campaign last year, Shami Chakrabarti, of Liberty, spoke passionately about the potential human rights vulnerabilities of the care.data programme. Notifying patients of what is proposed might not have been necessary under data protection law, but it is quite possible that the ECHR aspect of doing so was one of the things on which the Health and Social Care Information Centre (HSCIC) has been legally advised. Someone made an FOI request for this advice last year, and it is notable that HSCIC seem never to have completed their response to the request.

1I make no apologies for linking to one of Larkin’s most beautiful, but typically bleak and dystopian, pieces of prose, but I would add that it finishes “…These have I tried to remind of the excitement of jazz, and tell where it may still be found.”

2Unless the data controller does not have sufficient information about the individual in order readily to determine whether he is processing personal data about that individual, in which case the data controller shall send to the individual a written notice stating that he cannot provide the requisite information because of his inability to make that determination, and explaining the reasons for that inability

2 Comments

Filed under care.data, Confidentiality, Data Protection, data sharing, Europe, human rights, Information Commissioner, NHS, Privacy

care.data – what am I worried will happen?

I was invited today on twitter to say what I was worried will happen as a result of the care.data programme. I’ve written about this previously, and some of my concerns are laid out in those posts. But here’s a little list:

  • I am worried that even the most robust and secure data security measures can fail, or be overridden. Patients’ identifiable data could be compromised.
  • I am worried that there is a limit to how much users of the data could be restrained from making secondary, not-beneficial-to-patients, usage of data to which they are given access (Geraint Lewis, NHS Chief Data officer, was asked how, for instance, insurance companies would be prevented from doing this – he pointed to the Information Commissioner’s powers to impose Monetary Penalty Notices to a maximum of £500,000 for suitably serious contraventions of the Data Protection Act 1998. But a penalty for misuse of data will only be a net penalty if it outstrips profit from the usage.)
  • I am worried that some people will avoid seeking medical treatment, particularly for sensitive or serious ailments, if they in turn worry about who might have access to their data.
  • I am, in more general terms, worried about the lack of transparency that has surrounded the programme, and the lack of clear information. I am worried that, if the risks are so low and the benefits so high, why were initial attempts made to sneak this under the public’s radar?
  • I am worried that the amassing of and use of personal data in itself carries risks.
  • I am worried that I am wrong about all this, and that I am attacking a programme which will potentially deliver personal and societal benefits.

But, ultimately, I am not sure it is for me to say specifically what I am worried will happen. I don’t know specifically what will happen with a lot of things I worry about.

Surely it is for the proponents of care.data to say why I should be reassured. And I’m not.

4 Comments

Filed under care.data, Confidentiality, Data Protection, data sharing, Information Commissioner