Category Archives: data sharing

February 1, 2014 · 10:01 am

Big Pharma and care.data

Patients’ identifiable medical data will end up in the hands of large pharmaceutical companies, under the care.data initiative. With “Big Pharma” beholden to shareholders, and its abysmal record on transparency, is this another reason to consider opting out?

We are often told by those publicly defending the care.data programme (I’m thinking particularly of NHS Chief Data Officer Geraint Lewis, and NHS National Director for Patients and Information Tim Kelsey, who at least are prepared to engage with critics – although the latter has a habit of resorting to personal attacks at times) that patients’ identifiable/amber/pseudonymised data will not be made available to commercial organisations to use for their own purposes. So, we are told, it cannot be used for the purposes of selling or administering any kind of insurance, or for marketing purposes. As the pdf of FAQs, to which we are often referred (by Geraint in particular) says

Potentially identifiable data – these data do not include identifiers but may be considered identifiable (e.g. due to a patient in an area having a rare disease or a rare combination of characteristics). There are strict controls around the limited release of such data. For example, there must be a contract in place, the data are only released to approved organisations, and restricted to a specific purposes that will benefit the health and social care system

Let’s ignore for now the awkward question of how these restrictions can effectively be enforced. Let’s also ignore the fact that this data will not simply be “released” – organisations will pay for it, and a commercial organisation, with fiduciary obligations to its owners or shareholders, is not going to pay for something unless there is potential financial benefit.

What I wanted to highlight is that purposes that will benefit the health and social care system will generally boil down to two things: commissioning of services, and research. Regarding the latter, as the NHS Health Research Authority says this can take many forms, and be undertaken by many different bodies, but it will be no big revelation if I point out that vast amounts of research are conducted by, or under the control of, huge pharmaceutical companies – Big Pharma. Doctor and journalist Ben Goldacre has been campaigning for a number of years, following up the lead of others such as Iain Chalmers to expose the fact that an enormous amount of data and results from research – specifcally, admittedly, of clinical trials – is withheld by Big Pharma. This led to the setting-up of the AllTrials campaign. As Ben said, on the publication of a damning report by the Public Accounts Committee into the withholding of trial results for Tamiflu

[the] report is a complete vindication of AllTrials’ call for all the results, of all the trials, on all the uses of all currently prescribed treatments. None of the proposed new legislation or codes of conduct come anywhere close to this simple, vital ask. Industry has claimed it is on the verge of delivering transparency for over two decades. While obfuscating and delaying, ever more results have been withheld. Some in industry now claim that results from even a decade ago may be lost and inaccessible. This is both implausible and unacceptable…We cannot make informed decisions about which treatment is best when vitally important information is routinely and legally kept secret. Future generations will look back at this absurd situation in the same way that we look back on mediaeval bloodletting

This is the same industry which will be able to purchase patients’ identifiable medical data, uploaded from their GP records for research purposes. Will the NHS ever see the results of this research if, for instance, those results could have a potentially adverse effect on the companies’ share prices? Will there be any legal or contractual mechanisms in place to ensure that we don’t see similar obfuscating and delaying, and withholding of results?

Is it really the insurance and marketing companies we need to worry about?

The care.data leaflet campaign – legally necessary?

Readers of this blog [sometimes I imagine them¹] may well be fed up with posts about care.data (see here, here and here). But this is my blog and I’ll cry if I want to. So…

Doyen of information rights bloggers, Tim Turner, has written in customary analytic detail on how the current NHS care.data leafleting campaign was not necessitated by data protection law, and on how, despite some indications to the contrary, GPs will not be in the Information Commissioner’s firing line if they fail adequately to inform patients about what will be happening to their medical data.

He’s right, of course: where a data controller is subject to a legal obligation to disclose personal data (other than under a contract) then it is not obliged, pace the otherwise very informative blogpost by the Information Commissioner’s Dawn Monaghan, to give data subjects a privacy, or fair processing notice.

(In passing, and in an attempt to outnerd the unoutnerdable, I would point out that Tim omits that, by virtue of The Data Protection (Conditions under Paragraph 3 of Part II of Schedule 1) Order 2000, if a data subject properly requests a privacy notice in circumstances where a data controller is subject to a legal obligation to disclose personal data (other than under a contract) and would, thus, otherwise not be required to issue one, the data controller must comply².)

Tim says, though

The leaflet drop is no way to inform people about such a significant step, but I don’t think it is required

That appears to be true, under data protection law, but, under broader obligations imposed on the relevant authorities under Article 8 of the European Convention on Human Rights (ECHR), as incorporated in domestic law in the Human Rights Act 1998, it might not be so (and here, unlike with data protection law, we don’t have to consider the rigid controller/processor dichotomy in order to decide who the relevant, and liable, public authority is, and I would suggest that NHS England (as the “owner of the care.data programme” in Dawn Monaghan’s words) seems the obvious candidate, but GPs might also be caught).

In 1997 the European Court of Human Rights addressed the very-long-standing concept of the confidentiality of doctor-patient relations, in the context of personal medical data, in Z v Finland (1997) 25 EHRR 371, and said

the Court will take into account that the protection of personal data, not least medical data, is of fundamental importance to a person’s enjoyment of his or her right to respect for private and family life as guaranteed by Article 8 of the Convention (art. 8). Respecting the confidentiality of health data is a vital principle in the legal systems of all the Contracting Parties to the Convention. It is crucial not only to respect the sense of privacy of a patient but also to preserve his or her confidence in the medical profession and in the health services in general…Without such protection, those in need of medical assistance may be deterred from revealing such information of a personal and intimate nature as may be necessary in order to receive appropriate treatment and, even, from seeking such assistance, thereby endangering their own health and, in the case of transmissible diseases, that of the community

This, I think, nicely encapsulates why so many good and deep-thinking people have fundamental concerns about care.data.

Now, I am not a lawyer, let alone a human rights lawyer, but it does occur to me that a failure to inform patients about what would be happening with their confidential medical records when GP’s were required to upload them, and a failure to allow them to opt-out, would have potentially infringed patients’ Article 8 rights. We should not forget that, initially, there was no intention to inform patients at all (there had no attempt to inform patients about the similar upload of hospital medical data, which has been going on for over twenty years). It is, surely, possible therefore, that NHS England is not just “helping” GPs to inform patients without having any responsibility to do so (as Dawn Monaghan suggests), but that it recognises its potential vulnerability to an Article 8 challenge, and is trying to avoid or mitigate this. Whether the leaflets themselves, and the campaign to deliver them, are adequate to achieve this aim is another matter. As has been noted, the leaflet contains no opt out form, and there seem to be numerous examples of people (often vulnerable people, for instance in care homes, or refuges) who will have little or no chance of receiving a copy.

At the launch of the tireless MedConfidential campaign last year, Shami Chakrabarti, of Liberty, spoke passionately about the potential human rights vulnerabilities of the care.data programme. Notifying patients of what is proposed might not have been necessary under data protection law, but it is quite possible that the ECHR aspect of doing so was one of the things on which the Health and Social Care Information Centre (HSCIC) has been legally advised. Someone made an FOI request for this advice last year, and it is notable that HSCIC seem never to have completed their response to the request.

¹I make no apologies for linking to one of Larkin’s most beautiful, but typically bleak and dystopian, pieces of prose, but I would add that it finishes “…These have I tried to remind of the excitement of jazz, and tell where it may still be found.”

²Unless the data controller does not have sufficient information about the individual in order readily to determine whether he is processing personal data about that individual, in which case the data controller shall send to the individual a written notice stating that he cannot provide the requisite information because of his inability to make that determination, and explaining the reasons for that inability

2 Comments

Filed under care.data, Confidentiality, Data Protection, data sharing, Europe, human rights, Information Commissioner, NHS, Privacy

Tagged as DPA, Human Rights, ICO

January 20, 2014 · 3:14 pm

care.data – what am I worried will happen?

I was invited today on twitter to say what I was worried will happen as a result of the care.data programme. I’ve written about this previously, and some of my concerns are laid out in those posts. But here’s a little list:

I am worried that even the most robust and secure data security measures can fail, or be overridden. Patients’ identifiable data could be compromised.
I am worried that there is a limit to how much users of the data could be restrained from making secondary, not-beneficial-to-patients, usage of data to which they are given access (Geraint Lewis, NHS Chief Data officer, was asked how, for instance, insurance companies would be prevented from doing this – he pointed to the Information Commissioner’s powers to impose Monetary Penalty Notices to a maximum of £500,000 for suitably serious contraventions of the Data Protection Act 1998. But a penalty for misuse of data will only be a net penalty if it outstrips profit from the usage.)
I am worried that some people will avoid seeking medical treatment, particularly for sensitive or serious ailments, if they in turn worry about who might have access to their data.
I am, in more general terms, worried about the lack of transparency that has surrounded the programme, and the lack of clear information. I am worried that, if the risks are so low and the benefits so high, why were initial attempts made to sneak this under the public’s radar?
I am worried that the amassing of and use of personal data in itself carries risks.
I am worried that I am wrong about all this, and that I am attacking a programme which will potentially deliver personal and societal benefits.

But, ultimately, I am not sure it is for me to say specifically what I am worried will happen. I don’t know specifically what will happen with a lot of things I worry about.

Surely it is for the proponents of care.data to say why I should be reassured. And I’m not.

4 Comments

Filed under care.data, Confidentiality, Data Protection, data sharing, Information Commissioner

Tagged as DPA, privacy

January 13, 2014 · 4:42 pm

Why I’ve opted-out of care.data

Last week, after months of (over)thinking about it, I sent my GP a letter, based on the excellent template by the tireless MedConfidential refusing consent for identifiable data from my electronic medical records to be transferred to the Health and Social Care Information Centre (HSCIC).

I won’t rehearse the eloquent arguments against the current care.data proposals that you can read on MedConfidential’s site, and elsewhere (for instance GP Neil Bhatia’s excellent site). Nor will I rehearse arguments in favour. I have written about the subject in the past, and I don’t want to add to the general clamour. What I do want to say is why I have opted-out:

I’ve been struck by the inaccuracy and disingenuousness of the information which is being given to us in support of care.data. We are told, for instance, that “Your date of birth, full postcode, NHS Number and gender rather than your name will be used to link your records in a secure system, managed by the HSCIC. Once this information has been linked, a new record will be created. This new record will not contain information that identifies you”. This is cleverly worded: it does not say (because it would not be true) that this data will be anonymised, but it certainly tries to give that impression.
I have, ever since I first became aware of this issue, noted that there has been a lack of openness on the part of proponents. This has manifested itself in many ways, and people should be aware that the current leafleting campaign (as flawed as it is – note that it is not personally addressed to individuals, but simply sent to households, and doesn’t contain a form enabling people to opt-out) would not have come about were it not for concerns raised about this lack of openness.
I’ve noted the emotive campaign launched by leading charities in support of the campaign. But I’ve also noted the response by MedConfidential which highlights that the charities’ campaign doesn’t draw attention to secondary usage of the information gathered, which could potentially be by pharmaceutical and other commerical companies, universities and other academic organisations, information intermediaries and think-tanks. On a general level, I do not think that amassing of personal data can ever be without potential risks and drawbacks, some of which include – the risk of breaches of data security, the risk of people failing to seek medical advice because of privacy fears, commercial use – and none of which are addressed in the charities’ campaign.
Finally, and, for me, crucially, if I fail to opt-out now, I’ve lost my chance – my data once uploaded cannot be deleted. However, opting out now does not preclude opting in in future. So, should I subsequently become convinced that societal and individual benefits from this amassing of electronic personal data outweigh my strong concerns about privacy and consent, I can change my mind in a way I couldn’t if I failed to opt out now.

13 Comments

Filed under Confidentiality, Data Protection, data sharing, Privacy

Tagged as DPA, privacy

October 10, 2013 · 8:55 am

Let’s Blame Data Protection – the Gove files

Thanks to Tim Turner, for letting me blog about the FOI request he made which gives rise to this piece

On the 12th September the Education Secretary, Michael Gove, in an op-ed piece in the Telegraph, sub-headed “No longer will the quality, policies and location of care homes be kept a secret” said

A year ago, when the first shocking cases of sexual exploitation in Rochdale were prosecuted, we set up expert groups to help us understand what we might do better…Was cost a factor? Did we need to spend more? There was a lack of clarity about costs. And – most worrying of all – there was a lack of the most basic information about where these homes existed, who was responsible for them, and how good they were….To my astonishment, when I tried to find out more, I was met with a wall of silence

And he was in doubt about where the blame lay (no guesses…)

The only responsible body with the information we needed was Ofsted, which registers children’s homes – yet Ofsted was prevented by “data protection” rules, “child protection” concerns and other bewildering regulations from sharing that data with us, or even with the police. Local authorities could only access information via a complex and time-consuming application process – and some simply did not bother…[so] we changed the absurd rules that prevented information being shared

This seemed a bit odd. Why on earth would “data protection” rules prevent disclosure of location, ownership and standards of children’s homes? I could understand that there were potentially child protection concerns in the too-broad-sharing of information about locations (and I don’t find that “bewildering”) but data protection rules, as laid out in the Data Protection Act 1998 (DPA), only apply to information relating to identifiable individuals. This seemd odd, and Tim Turner took it upon himself to delve deeper. He made a freedom of information request to the Department for Education, asking

1) Which ‘absurd’ rules was Mr. Gove referring to in the first
statement?

2) What changes were made that Mr. Gove referred to in the second
statement?

3) Mr Gove referred to ‘Data Protection’ rules. As part of the
process that he is describing, has any problem been identified with
the Data Protection Act?

Fair play to the DfE – they responded within the statutory timescales, explaining

Regulation 7(5) of the Care Standards Act 2000 (Registration) (England) Regulations 2010 …prohibited Ofsted from disclosing parts of its register of children’s homes to any body other than to a local authority where a home is located. Whatever the original intention behind this limitation, it represented a barrier preventing Ofsted from providing information about homes’ locations to local police forces, which have explicit responsibilities for safeguarding all children in their area…we introduced an amendment to Regulation 7 with effect from April 2013

But their response also revealed what had been very obvious all along: this had nothing to do with data protection rules:

the reference to “data protection” rules in Mr Gove’s article involved the Regulations discussed above, made under section 36 of the Care Standards Act 2000. His comments were not intended as a reference to the Data Protection Act 1998

This is disingenuous: “data protection” has a very clear and statutory context, and to extend it to more broadly mean “information sharing” is misleading and pointless. One could perhaps understand it if Gove had said this in an oral interview, but his piece will have been checked carefully before publication, and personally I am in no doubt that blaming data protection has a political dimension. The government is determined, for some right reasons, and some wrong ones, to make the sharing of public sector data more easy, and data protection does, sometimes – and rightly – present an obstacle to this, when the data in question is personal data and the sharing is potentially unfair or unlawful. Anything which associates “data protection” with a risk to child safety, serves to represent it as bureaucratic and dangerous, and serves the government agenda.

And the rather delicious irony of all this – as pointed out on twitter by Rich Greenhill – is that the “absurd rules” (the Care Standards Act 2000 (Registration) (England) Regulations 2010) criticised by Gove were made on 24 August 2010. And the Secretary of State who made these absurd rules was, of course, the Right Honourable Michael Gove MP.

How absurd.

An unshared perspective

Paul Gibbons, FOI Man, has blogged about data-sharing, questioning whether an over-cautious approach to sharing of health data is damaging. Paul says

What I’m increasingly worried about is what appears to be a widely held and instinctive view that any sharing of personal data – and even data that has been anonymised – is necessarily a “bad thing”.

I’ve got to say, in all the time I’ve worked in the field of information rights I’ve never come across anyone who actually thinks that, let alone articulates it (in my experience the only people who say it are those who seek to misrepresent it). The Data Protection Act 1998 (DPA) and EC Directive 95/46/EC to which it gives effect do not act as a default bar to sharing of data. There may be circumstances under which compliance with the law means that sharing of personal data cannot happen, but the converse is true – there will be times when sharing is lawful, necessary and proportionate.

Paul’s prime example of what he sees as (to adopt the title of his piece) “a disproportionate fear of ‘Big Brother’” preventing us from seeing the big picture” is the “predictable outcry” about the care:data programme, whereby the Health and Social Care Information Centre will, through the exercise of certain provisions in the Health and Social Care Act 2012, extract enormous amounts of health and social care information from local systems to centralised ones. The first step in this is the GP Extraction Service (GPES) whereby information relating to medical conditions, treatments and diagnosis, with each patient’s NHS number, date of birth, postcode, gender, ethnicity and other information will be uploaded routinely. The information will then be made available to a range of organisations, sometimes including private companies, sometimes in ostensibly anonymised, sometimes in identifiable, form, for a variety of purposes. This will happen to your medical records unless you opt-out (and if you think you’ve already done so, you probably haven’t – those who objected to the creation of a summary care record will have to go through another opt-out process). And this week we were informed that there will be no national campaign to alert patients to the GPES – the responsibility (and liability) will lie with GP practices themselves. (Anyone wanting to understand this complex and less-than-transparent process must read and follow the superb MedConfidential).

I accept that, on one view, this amassing of health and social care data could be seen as a good thing: as Paul suggests, medical research, for instance is a hugely important area. And the NHS Commissioning Board identifies the following desired outcomes from care:data

– support patients’ choice of service provider and treatment by making comparative data publicly available
– advance customer services, with confidence that services are planned around the patient
– promote greater transparency, for instance in support of local service planning
– improve outcomes, by monitoring against the Outcomes Frameworks
– increase accountability in the health service by making data more widely available
– drive economic growth through the effective use of linked data

But how realistic are these? And what are the attendant risks or detriments? Paul says

central medical records for all NHS patients…would mean that when you turned up at a hospital far from home, as I have done myself, doctors would have access to your medical records and history. Believe me, when you are in pain and desperate to be treated, the last thing that you want to do is to answer questions about your medical history

With great respect, the ideal of a centralised system whereby medics can provide emergency treatment to patients by accessing electronic records is never going to be more than a myth. Put another way – would Paul be happy trusting his life to the accuracy of an electronic record that might or might not say, for instance, whether he is allergic to aspirin? Treatment of patients is a matter of diagnosis, and emergency diagnoses will never be made solely, if at all, on the basis of records.

Security of information, and risks of identification of individuals are other key concerns. Paul says Daniel Barth-Jones identifies “deficiencies in [reidentification] studies” but I think what Barth-Jones is actually arguing is that the risks of reidentification are real, but they must be accurately reported and balanced against the likelihood of their happening.

But ultimately I have two major conceptual concerns about care:data and what it implies. The first is that, yes, I am instinctively distrusting of agglomeration of sensitive personal data in identifiable form in mass processing systems: history has taught us to be this way so I don’t see this, as Paul appears to, as a “fashionable” mistrust (and, for instance, the Joseph Rowntree Foundations’ exemplary Database State report is now over six years old). The second is that patient-medic confidentiality exists, and has existed for a very long time, for a reason: if patients are not certain that their intimate medical details are confidential, they might be reluctant to speak candidly to their doctor. In fact, they might not even visit their doctor at all.

3 Comments

Filed under Confidentiality, Data Protection, data sharing, human rights, Let's Blame Data Protection

July 30, 2013 · 5:22 pm

It’s still not fine

Last week I blogged about enforcement notices served on three Midlands police forces by the Information Commissioner (IC). I was surprised that the circumstances hadn’t merited stronger sanctions, in the form of monetary penalty notices (MPNs), and I tweeted to ask why.

As you can perhaps see, the IC’s office has kindly replied to my tweet. I had asked

I would really like to know why the IC did not see fit to issue Monetary Penalty Notices. Can you advise?

and their reply says

enforcement notices best means of improving compliance. Considered details of the case inc limited involvement of each force

I have to say I think this is a questionable response (although I take the point that a 140-character limit is restrictive).

Firstly, enforcement activities are not mutually exclusive – it is not uncommon for an enforcement notice and an MPN to be served in tandem on a data controller. thus, as recently as June this year, Glasgow City Council was served an MPN of £150,000 by the IC following the loss of, er, unencrypted laptops, and at the same time was served an enforcement notice requiring certain corrective actions to be undertaken.

Secondly, and I may be misinterpreting, but the reply seems to say that the “limited involvement of each force” was a determining factor in a decision not to serve an MPN. However, there were three data controllers involved. If each of them had a “limited” involvement, one is led to ask “wasn’t that the main problem?”. Derbyshire and Leicestershire both “did not carry out a risk assessment before they joined [the collaboration unit]…relying on the security measures taken by Nottinghamshire“, but those security measures were inadequate (lack of encryption, laptops not physically secured). Meanwhile, none of the forces properly monitored its officers while they were seconded.

It seems to me that the limited involvement of each of the forces might, instead of excusing it, have in fact been the key factor why the security breach happened.

Principle seven of the first schedule to the Data Protection Act 1998 (DPA) requires that

Appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data

Many many public (and private) sector data controllers are undertaking collaborative and partnership working, or are taking steps to do so. All responsible organisations are very aware, where they continue, either jointly or in common with other organisations, to determine the purposes for which and the manner in which any personal data are, or are to be, processed, that they remain a data controller, with the consequent responsibilities and liabilities. They are very aware of the IC’s Data Sharing Code of Practice.

And they are very aware that, if things go wrong with data-sharing, it will not normally be sufficient to point at a partner, and say “it was their fault”, or, even less, for all partners to shrug their shoulders and say, “that wasn’t our responsibility”.

Blogroll

Recent Posts

Follow Blog via Email

RSS Links

Privacy Notice