10 ms·

English medical records are about to be given away. As GPs, we’re fighting back

205 points by Symbiote 5y ago

shric 5y ago
Australia had similar with https://www.myhealthrecord.gov.au/ https://www.myhealthrecord.gov.au/ a few years ago. At the time you had to opt out iirc. At least apparently you can opt out at any time and your records will be permanently deleted.
Silhouette 5y ago
They're at it again. This one seems like another care.data only possibly worse. For those who would like to opt out, see here: https://medconfidential.org/how-to-opt-out/ https://medconfidential.org/how-to-opt-out/ Note that if you haven't previously opted out from similar plans for data sharing, you'll probably need to opt out of two separate systems this time, one for sharing your GP records and one for sharing records from other sources like hospitals. The deadline for notifying your GP surgery to avoid data starting to leak appears to be 23 June. Also note that in some situations, for example if you want to opt young children or vulnerable adults you care for out of these systems as well, you may be in print-and-post territory even if you could opt yourself out using an online system.
- deleted 5y ago
  [deleted]
- insomniacity 5y ago
  Fortunately you can do the edge cases via email: https://medconfidential.org/how-to-opt-out/ https://medconfidential.org/how-to-opt-out/
Symbiote 5y ago
For anyone (like me) who is no longer resident in England, you can find your NHS number with [1], then use it (plus a UK VPN) to opt out here [2]. As I understand it, [2] covers hospital data etc, but not GP data, which is the recent data grab and the subject of the article. I have written to the GP I was last registered at to see if they still hold any data on me, and whether they were intending to share it without my consent. I attached the opt-out form [4] anyway. [3] says on "Minimum length of retention of GP records" that "Electronic patient records (EPRs) must not be destroyed, or deleted, for the foreseeable future.", and paper ones are kept until 10 years after death. [1] https://www.nhs.uk/nhs-services/online-services/find-nhs-number/ https://www.nhs.uk/nhs-services/online-services/find-nhs-num... [2] https://your-data-matters.service.nhs.uk/ https://your-data-matters.service.nhs.uk/ [3] https://www.bma.org.uk/advice-and-support/ethics/confidentiality-and-health-records/retention-of-health-records https://www.bma.org.uk/advice-and-support/ethics/confidentia... [4] https://medconfidential.org/how-to-opt-out/ https://medconfidential.org/how-to-opt-out/
- nicoburns 5y ago
  Ah, amazing. I had lost my NHS number, and had no idea how to retrieve it. Thanks for the link!
- justinclift 5y ago
  Well, that's interesting. Going to the opt-out link (your-data-matters.service.nhs.uk), gives this: Sorry, you cannot see this page This might be because: * you're outside of the UK and this service is only available in the UK I guess people outside the UK aren't considered allowed to manage their data. :(
  - bArray 5y ago
    I made a point of emailing them about this (and suggest you do so too) - I'm not sure it is legal to prevent me from managing my data, despite living outside the UK. I understand they want to prevent foreign actors from misusing the service, but this is not it. As if making it opt-out isn't bad enough, for some, they can't even opt-out. What a s*t show this entire process has been. What's the betting that this data is being sold for 'research' to raise a few more pounds to combat the coming economic crash?
  - arthem 5y ago
    If you are outside the UK then you can download the PDF version of the form and email it to (enquiries@nhsdigital.nhs.uk) after completion. (https://www.nhs.uk/your-nhs-data-matters/manage-your-choice/other-ways-to-manage-your-choice/ https://www.nhs.uk/your-nhs-data-matters/manage-your-choice/...)
    - justinclift 5y ago
      Yeah, I emailed them too (yesterday). No response back, at least not so far. :(
- adwf 5y ago
  Slightly more complicated than that. The National Opt-out [2] does not prevent NHS digital from accumulating your records in a central database (in pseudonymous form - not anonymous). It only prevents them from sharing your record with others - for now... The type 1 opt-out with your GP should prevent your records from even being sent to NHS Digital at all. The difficulty with this one is that it's a paper form only and has to be handed to the GP by the 23rd, there is no web service to opt out of this. NHS Digital have also hinted that they will be trying to remove the type 1 at some point in the future.
abz10 5y ago
I’m guessing the primary use of this data will be for US pharmaceutical companies to find out exactly how much the UK market is worth so they know how much they can pay lobbyists to put pressure on Uk-US trade negotiations.
- Silhouette 5y ago
  That seems rather uncharitable. The primary use of the data almost certainly will be what it's claimed to be, helping various legitimate research groups to do their research and helping various legitimate organisations within or supporting the NHS to make sensible plans. The real problem is the inherent risk that other uses will also be made of the data, legally or otherwise. Compliance with the rules for using this sort of data properly and securely has not historically been 100%, and this is Pandora's box. If anything ever seriously breaches, that's game over for the privacy of tens of millions of people, for life. It's also being done very quickly, very quietly, potentially illegally, and on an opt-out basis, which should be reason enough for us to be extremely sceptical about the whole process even without the doctors here raising questions about the medical ethics involved from a professional perspective.
  - wolverine876 5y ago
    > The primary use of the data almost certainly will be what it's claimed to be What is that based on? It's plausible, but so are many things that turn out to be false (and which contradict each other). How do you know?
- Zenst 5y ago
  No as they can already get that from drug sales figures via the distribution suppliers like https://www.alliance-healthcare.co.uk/pharmacy-solutions/wholesale-distributors https://www.alliance-healthcare.co.uk/pharmacy-solutions/who... and few other players in the market who do all the logistics of supplying drugs to hospitals and pharmacies. I worked at Unichem (now alliance-healtcare) upon the system that would produce that data that other companies would buy. No patient specific - just volume of drugs for area's and with that, still happens today.
627467 5y ago
The fact that GPs are acting as some kind of custodians for this data isn't it also the same problem? This data should belong to their owners: the patients.
- Silhouette 5y ago
  There are quite a few problems with that in the case of medical records. Some of this information may be urgently needed at a time when the patient is not capable of giving informed consent for its disclosure or does not have it immediately available. Some of the information may be vital to the future healthcare of the patient and would cause serious harm to them if it were lost. And in more of a more morally grey area, some information might be harmful to the patient if they had it. For example, consider the implications of bluntly disclosing various mental health diagnoses to someone who doesn't fully understand what they mean and whose condition means they won't necessarily respond rationally or beneficially to the information. In this case, having the records kept locally by exactly one organisation that is run by medical professionals who are bound by strong professional ethics seems like a reasonable policy.
  - psychlops 5y ago
    Let's not forget that there are quite a few problems with other people and organizations taking default ownership of patients data. No system will be perfect and because there are a marginal cases where it fails shouldn't therefore push responsibility to "professionals".
  - pjc50 5y ago
    I don't think the NHS actually has the right to keep information from you simply on the "might be harmful" rationale, but I don't think that particular data protection fight has happened yet.
    - Silhouette 5y ago
      My instinct has always said that transparency should prevail on this kind of issue. However, as it happens, I have previously discussed this exact subject with multiple friends who work in clinical healthcare roles, and I have to acknowledge that they have almost invariably disagreed with my instinct. Given that I'm fairly sure some of them have personally treated people with serious mental health problems, I tend to defer to their expertise on this one. I don't know what the law actually is (and perhaps none of us do since as you say the issue doesn't seem to have been tested yet) but if the medical experts are almost universally of the same opinion then I probably know what the law should be.
Dah00n 5y ago
Is this possible because of Brexit or is it just more unlawful data collection in the UK? If I (in Denmark) switch GP my new GP can't see my journals without me filling out a form to allow it and hospitals definitely can't access them no matter what as it is two independent systems.
- chrisseaton 5y ago
  > is it just more unlawful data collection in the UK? What makes you think any of this is 'unlawful'?
  - Silhouette 5y ago
    It's surely on shaky ground. The GDPR rules are still the main ones that will apply at present, and those require stronger protections by default for sensitive types of personal data such as health data. A massive data lake like this with such a generic purpose and an opt-out permission scheme is obviously not in the spirit of those protections. For it to be permitted by the letter of the law, the government will have to rely on one or more of the specific provisions relating to public health or the like, and given that even those still have quite a lot of specific compliance requirements, it's not immediately obvious to me which one(s) would allow something as broad as this. Obviously under our political system the government can legally do whatever it wants if it can get a law through Parliament to say so, but to achieve that they'd have to be open about what they're doing and convince enough MPs and Lords that it's justified.
    - mosafet 5y ago
      I had a check and it looks like the law was passed in 2012[1]. They say that gave them a legal responsibility to hold clinical information, combined with instruction from government that should be enough for this to fall under another basis in GDPR without consent being required. Not saying it's right, especially with the risk of the data being shared further once they hold it, but it'd probably be difficult to challenge. [1] https://digital.nhs.uk/about-nhs-digital/our-work/keeping-patient-data-safe/how-we-look-after-your-health-and-care-information/nhs-digital-s-legal-right-to-collect-information https://digital.nhs.uk/about-nhs-digital/our-work/keeping-pa...
Camas 5y ago
NHS response to this and similar allegations Collecting GP data - advice for the public: https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/advice-for-the-public https://digital.nhs.uk/data-and-information/data-collections...
- wiz21c 5y ago
  From the page : "You can opt out of sharing your data" No no no triple no. Don't opt me in. Full stop. I'll opt in if I want to. 99% of people just don't get it enough to opt out. So please, take a default that protects people first.
  - chrisseaton 5y ago
    > So please, take a default that protects people first. Their argument is that having high-quality data to plan healthcare is protecting people. If people want the state to manage and pay for your healthcare, the state needs information to plan that for everyone. You can already 'opt out' entirely by purchasing your own healthcare if you aren't prepared to contribute.
    - throwaway3699 5y ago
      > If people want the state to manage and pay for your healthcare, the state needs information to plan that for everyone. You can already 'opt out' entirely by purchasing your own healthcare if you aren't prepared to contribute. This is literally going against the underlying principles of the NHS. There is no 'transaction' going on here. I already contribute to the NHS through my taxes.
      - chrisseaton 5y ago
        > This is literally going against the underlying principles of the NHS. Bizarre claim. The underlying principle of the NHS is socialised healthcare. Opting out of contributing to allow the NHS to plan for everyone's healthcare is the opposite of being social. > There is no 'transaction' going on here. I already contribute to the NHS through my taxes. Seems self-contradictory?
dkarp 5y ago
As someone who works in HealthTech in the UK, I can see why NHS Digital sees a need for this. We really should be enjoying the benefits of a centralised National Health Service in this country, but the divide and conquer management strategy gives individual GP practices and Hospitals (run by NHS Trusts) a lot of independence. That independence extends to IT systems, meaning you have various patient record systems in use around the country and a set of standards and APIs mandated to allow them to communicate. I would personally prefer those patient records to be on software provided and administered by a technical organisation with the expertise to understand the security risks involved and working full time on that problem. Hospitals and GPs could then get on with treating patients rather than having to employ their staff to figure out the tech side. So why isn't NHS Digital doing that instead? I expect most people actually believe the NHS already have their medical records, and in a sense they do, it just has many different custodians all around the system.
- cik 5y ago
  This is more or less how it works in Israel. The EMR is owned and controlled by the state. Four private HMOs compete (in the literal sense) to provide services as efficiently and high quality as possible, according to their government licenses. It marries the public sector ability to build giant-ass systems for its citizens, with the private sector's ability to compete. Moving here from Canada I'm beyond shocked how much more efficient, higher quality, and cheaper this system is. I could never go back now. For example: the second I get a prescription it's available in 100% of the pharmacies in the country (that carry my drug). All I have to do is walk in to the one I want, swipe y card, and ya'ala done. I can even check on an app what pharmacies have said drug in stock, and plot a route there.
  - chaosite 5y ago
    You're right, but less, rather than more. 1. 4 HMOs total, not hundreds. That's a big difference, it's still pretty centralized. 2. The HMOs actually compete on very little, mostly customer service. They are heavily regulated and have to provide services to a spec that's spelled out by the government, including pricing. 3. These 4 HMOs are mostly historic in origin; starting a new one would probably need to be initiated by the government. 4. For example, your example of (digital) prescriptions being filled by any pharmacy: that's an regulation codified in law. And while 100% of pharmacies can fill it, only those with an arrangement with your HMO will give you the subsidized price.
thinkingemote 5y ago
Apparently, there is no retroactive opting out. If you opt out after the 23 June, only new data after your opt out date will be excluded. Everything before can and will be sold, shared, etc
butterzone 5y ago
If you swap out private insurance companies for NHS (due to differences in funding), this is similar to the path the US is on right now. Within the next 1-3 years private insurance companies will know even more about your health than any single provider, and will use this more detailed insight to improve how they model, risk, and determine benefits for you in their favor. The people in charge of the funding fueling healthcare want to use data to improve their control of the money.
- wolverine876 5y ago
  How is that happening? Under what program(s) or law(s) or regulation(s)?
FridayoLeary 5y ago
My perception of the NHS is that it is currently swamped in paperwork. I'm not sure why we are paying highly qualified doctors to spend huge amounts of time filling in endless documents in triplicate. Does anyone know if this digitization will have any effect.
- Silhouette 5y ago
  If you want to look at the bigger picture, possibly the most fundamental problem we have in England is that there aren't enough doctors. Despite the capacity problems and delays at GP surgeries that most of us have experienced at some point, there has been a downward trend in the full-time-equivalent GPs per capita in England over the past decade or so. https://fullfact.org/health/gp-numbers-or-down/ https://fullfact.org/health/gp-numbers-or-down/ It's also likely that the decreasing availability of GP appointments is causing an increase in people turning up at major A&E centres instead, where it may cost far more to treat them for a non-urgent condition that a GP could have dealt with instead if one had been available within a reasonable period. Just to add to the pressure, we also have a population that is living longer, so GPs may increasingly be helping the elderly to manage multiple conditions as well. Reducing non-clinical overheads for doctors that take time away from patient care is certainly important, but the bottom line is that our society needs more doctors or the quality of healthcare will continue to decline.
- chrisseaton 5y ago
  > Does anyone know if this digitization will have any effect. The article isn't about digitisation. Medical records are already digitised. > filling in endless documents in triplicate Which documents do you think they're still filling out manually? Let alone in triplicate?
atc 5y ago
ML has so much potential to help us in healthcare. We don't need this Guardian low-level analysis scuppering progress in this area because they drop the dirty word of "private" or "profit". Yes, it needs careful regulation and management on all sides, and a mechanism where patients own their data, but I welcome datasharing in healthcare.
motohagiography 5y ago
My issue with it is central data repositories create a kind of secret surveillance para-bureaucracy with no individual accountability. What is frustrating is efforts like this are trying to squeeze the toothpaste out of the tube, and I suspect before current techs we have today like differntial privacy and tokenization make anonymous sharing and analysis viable. Medical researchers are people like anyone, they aren't some kind of preisthood, and they are going to leak and share the data and use it for political purposes as their opportunities and incentives change. The technical controls researchers actively resist are basic corporate controls as simple as identifying everyone who logs in to view the datasets with their real names, background checks on people with admin credentials on personal health databases, probabilistic watermarking and dating cuts of datasets shared with researchers so that any leaks can be traced back to a specific accountable people to contain it, and requiring a public record and accounting of the research and projects they were using the data for, using synthesized data in technical test environments and not real health information. These are basic corporate controls that aren't part of the research culture. Some places may have them, but I wouldn't be surprised if the organizations conspire to neglect their processes. The benefits they say are for using ML for research and it will cure all manner of diseases and detect others early. This sounds great, but what is missing are legal consequences for exploiting people via their data. People aren't managed livestock, so the prestige of a few researchers needs to be balanced with the quality of the society these new data powers create. If your worst political enemy is an exception to the principle of the confidentiality of this data, then you aren't suited to access it, and to be allowed to do so compromises the whole system for everyone. A test people could use for privacy is whether you would be ok with the activist groups operating in universities, communist party of china, and their federal police force having secret legal access to health records, and if they aren't, what rules do we need to compensate? Inadmissability of data in any of these data sets in legal proceedings seems like one useful control. Personal penalties for abuse and leaking of this data would be another. Licensing and professional regulation of individuals who administer systems that process personal information that has been obtained without explicit consent of individual data subjects seems complex, but I could see some version of it happening in the next 20 years. Without these additional controls, it's just a data grab, and these GP's are right and in fact brave to resist it.
amelius 5y ago
If this was 30 years ago, there would be no corporations involved directly, but the entire analysis of these records would be done in government institutions or academic hospitals. Corporations would only be there to provide the hardware and basic software such as OSes. Can we please get a law that any crowdsourced data and all derivative works belongs to the public? And can corporations please go back to their role of building products that aid in research, such as computer hardware and software? Combining "building software and hardware" and "needing to look at data" is a source of trouble. Your software can look at the data, but not you. We'll run the software.
Ntrails 5y ago
Can someone actually explain what the actual flaw in the proposed anonymisation of the data is? This sounds a lot like people are in complete dismissal of the potential benefits of a countries worth of aggregated health data to research.
- Silhouette 5y ago
  Firstly, to be strictly accurate, the data here will not be anonymous, only pseudonymous. But in any case, we are talking about a long list of often very specific observations for almost everyone included in the data set. The chances of even supposedly anonymised data with that much detail being subject to reidentification are quite high, and there are plenty of organisations that might be able to infer enough to do it, by comparing against other data sets they already hold.
  - kapuasuite 5y ago
    What’s the actual cost/benefit here?
    - Silhouette 5y ago
      There is no way to know, because it's impossible to quantify either the expected costs or the expected benefits. On the benefit side, there is simply no way to know what good things could come from giving the right person easier access to this data. Maybe the only thing between us and a cure for ten different types of cancer is a one-week number crunching exercise by the right university research group. Maybe we'll go twenty years and no big advances will result that wouldn't have happened anyway. On the cost side, as ever with privacy, most of the real damage in the event of a breach isn't likely to be directly financial. What is the cost to a 20-year-old struggling with their identity if information about their sexual health leaks and betrays their situation to their friends and family before they want to be open about it? How many jobs might be lost by women in their 30s or 40s because someone at the potential employer discovered they'd been having treatments that could be related to pregnancy or fertility in recent years and took steps to avoid hiring someone who might need maternity leave soon? What might happen to your ability to get health or travel insurance ten or twenty years from now if you ask your doctor today about a symptom that is probably nothing but could be a sign of a serious condition? Or to your children's ability to get insurance in the future, if you ask about a symptom that could relate to a hereditary condition? How many people, fearing the answer to these kinds of questions if their health records are shared, might not ask the doctor about something potentially important at all? How often will that conversation that never happens prove to have devastating consequences because a serious condition then went undiagnosed and untreated? A chilling effect on doctor consultations alone could easily cost many thousands of lives. Just look at the big drop in the number of urgent referrals for people with potential cancer symptoms since the COVID restrictions have meant relatively few people are seeing their GP in person. The only thing we really know is that this is probably a one-way trip. Once Pandora's box is open, it is unlikely it will ever be closed again. And we're being asked (or not, apparently) to take that trip based on vague, hypothetical future benefits, without any reference to the potential dangers, even though there have been quite a few examples of confidentiality breaches arising from sharing this kind of data in the past. I suppose a cynic might say the actual cost/benefit right now is therefore infinite, because in the absence of better arguments and data about the benefits, it's prudent to assume a division by zero.
raspyberr 5y ago
The point of this move is to remove a burden from GPs. They'll no longer have to worry about securely handing over data to third parties. Each GP does it in a different way with different levels of skill. This thing will make NHS Digital the first point of contact for third parties to get to the data rather than GPs. The article seems to stress that your data will now be up for sale to corporations but this is already happening to GPs.
Havoc 5y ago
And of course the opt out is fkin broken. Just kicks out an error message for me. Well played data collection crew!

205 points by Symbiote 5y ago

Australia had similar with https://www.myhealthrecord.gov.au/ https://www.myhealthrecord.gov.au/ a few years ago. At the time you had to opt out iirc. At least apparently you can opt out at any time and your records will be permanently deleted.

Silhouette 5y ago

They're at it again. This one seems like another care.data only possibly worse. For those who would like to opt out, see here: https://medconfidential.org/how-to-opt-out/ https://medconfidential.org/how-to-opt-out/ Note that if you haven't previously opted out from similar plans for data sharing, you'll probably need to opt out of two separate systems this time, one for sharing your GP records and one for sharing records from other sources like hospitals. The deadline for notifying your GP surgery to avoid data starting to leak appears to be 23 June. Also note that in some situations, for example if you want to opt young children or vulnerable adults you care for out of these systems as well, you may be in print-and-post territory even if you could opt yourself out using an online system.

deleted 5y ago
[deleted]
insomniacity 5y ago
Fortunately you can do the edge cases via email: https://medconfidential.org/how-to-opt-out/ https://medconfidential.org/how-to-opt-out/

Symbiote 5y ago

For anyone (like me) who is no longer resident in England, you can find your NHS number with [1], then use it (plus a UK VPN) to opt out here [2]. As I understand it, [2] covers hospital data etc, but not GP data, which is the recent data grab and the subject of the article. I have written to the GP I was last registered at to see if they still hold any data on me, and whether they were intending to share it without my consent. I attached the opt-out form [4] anyway. [3] says on "Minimum length of retention of GP records" that "Electronic patient records (EPRs) must not be destroyed, or deleted, for the foreseeable future.", and paper ones are kept until 10 years after death. [1] https://www.nhs.uk/nhs-services/online-services/find-nhs-number/ https://www.nhs.uk/nhs-services/online-services/find-nhs-num... [2] https://your-data-matters.service.nhs.uk/ https://your-data-matters.service.nhs.uk/ [3] https://www.bma.org.uk/advice-and-support/ethics/confidentiality-and-health-records/retention-of-health-records https://www.bma.org.uk/advice-and-support/ethics/confidentia... [4] https://medconfidential.org/how-to-opt-out/ https://medconfidential.org/how-to-opt-out/

nicoburns 5y ago
Ah, amazing. I had lost my NHS number, and had no idea how to retrieve it. Thanks for the link!
justinclift 5y ago
Well, that's interesting. Going to the opt-out link (your-data-matters.service.nhs.uk), gives this: Sorry, you cannot see this page This might be because: * you're outside of the UK and this service is only available in the UK I guess people outside the UK aren't considered allowed to manage their data. :(
- bArray 5y ago
  I made a point of emailing them about this (and suggest you do so too) - I'm not sure it is legal to prevent me from managing my data, despite living outside the UK. I understand they want to prevent foreign actors from misusing the service, but this is not it. As if making it opt-out isn't bad enough, for some, they can't even opt-out. What a s*t show this entire process has been. What's the betting that this data is being sold for 'research' to raise a few more pounds to combat the coming economic crash?
- arthem 5y ago
  If you are outside the UK then you can download the PDF version of the form and email it to (enquiries@nhsdigital.nhs.uk) after completion. (https://www.nhs.uk/your-nhs-data-matters/manage-your-choice/other-ways-to-manage-your-choice/ https://www.nhs.uk/your-nhs-data-matters/manage-your-choice/...)
  - justinclift 5y ago
    Yeah, I emailed them too (yesterday). No response back, at least not so far. :(
adwf 5y ago
Slightly more complicated than that. The National Opt-out [2] does not prevent NHS digital from accumulating your records in a central database (in pseudonymous form - not anonymous). It only prevents them from sharing your record with others - for now... The type 1 opt-out with your GP should prevent your records from even being sent to NHS Digital at all. The difficulty with this one is that it's a paper form only and has to be handed to the GP by the 23rd, there is no web service to opt out of this. NHS Digital have also hinted that they will be trying to remove the type 1 at some point in the future.

abz10 5y ago

I’m guessing the primary use of this data will be for US pharmaceutical companies to find out exactly how much the UK market is worth so they know how much they can pay lobbyists to put pressure on Uk-US trade negotiations.

Silhouette 5y ago
That seems rather uncharitable. The primary use of the data almost certainly will be what it's claimed to be, helping various legitimate research groups to do their research and helping various legitimate organisations within or supporting the NHS to make sensible plans. The real problem is the inherent risk that other uses will also be made of the data, legally or otherwise. Compliance with the rules for using this sort of data properly and securely has not historically been 100%, and this is Pandora's box. If anything ever seriously breaches, that's game over for the privacy of tens of millions of people, for life. It's also being done very quickly, very quietly, potentially illegally, and on an opt-out basis, which should be reason enough for us to be extremely sceptical about the whole process even without the doctors here raising questions about the medical ethics involved from a professional perspective.
- wolverine876 5y ago
  > The primary use of the data almost certainly will be what it's claimed to be What is that based on? It's plausible, but so are many things that turn out to be false (and which contradict each other). How do you know?
Zenst 5y ago
No as they can already get that from drug sales figures via the distribution suppliers like https://www.alliance-healthcare.co.uk/pharmacy-solutions/wholesale-distributors https://www.alliance-healthcare.co.uk/pharmacy-solutions/who... and few other players in the market who do all the logistics of supplying drugs to hospitals and pharmacies. I worked at Unichem (now alliance-healtcare) upon the system that would produce that data that other companies would buy. No patient specific - just volume of drugs for area's and with that, still happens today.

627467 5y ago

The fact that GPs are acting as some kind of custodians for this data isn't it also the same problem? This data should belong to their owners: the patients.

Silhouette 5y ago
There are quite a few problems with that in the case of medical records. Some of this information may be urgently needed at a time when the patient is not capable of giving informed consent for its disclosure or does not have it immediately available. Some of the information may be vital to the future healthcare of the patient and would cause serious harm to them if it were lost. And in more of a more morally grey area, some information might be harmful to the patient if they had it. For example, consider the implications of bluntly disclosing various mental health diagnoses to someone who doesn't fully understand what they mean and whose condition means they won't necessarily respond rationally or beneficially to the information. In this case, having the records kept locally by exactly one organisation that is run by medical professionals who are bound by strong professional ethics seems like a reasonable policy.
- psychlops 5y ago
  Let's not forget that there are quite a few problems with other people and organizations taking default ownership of patients data. No system will be perfect and because there are a marginal cases where it fails shouldn't therefore push responsibility to "professionals".
- pjc50 5y ago
  I don't think the NHS actually has the right to keep information from you simply on the "might be harmful" rationale, but I don't think that particular data protection fight has happened yet.
  - Silhouette 5y ago
    My instinct has always said that transparency should prevail on this kind of issue. However, as it happens, I have previously discussed this exact subject with multiple friends who work in clinical healthcare roles, and I have to acknowledge that they have almost invariably disagreed with my instinct. Given that I'm fairly sure some of them have personally treated people with serious mental health problems, I tend to defer to their expertise on this one. I don't know what the law actually is (and perhaps none of us do since as you say the issue doesn't seem to have been tested yet) but if the medical experts are almost universally of the same opinion then I probably know what the law should be.

Dah00n 5y ago

Is this possible because of Brexit or is it just more unlawful data collection in the UK? If I (in Denmark) switch GP my new GP can't see my journals without me filling out a form to allow it and hospitals definitely can't access them no matter what as it is two independent systems.

chrisseaton 5y ago
> is it just more unlawful data collection in the UK? What makes you think any of this is 'unlawful'?
- Silhouette 5y ago
  It's surely on shaky ground. The GDPR rules are still the main ones that will apply at present, and those require stronger protections by default for sensitive types of personal data such as health data. A massive data lake like this with such a generic purpose and an opt-out permission scheme is obviously not in the spirit of those protections. For it to be permitted by the letter of the law, the government will have to rely on one or more of the specific provisions relating to public health or the like, and given that even those still have quite a lot of specific compliance requirements, it's not immediately obvious to me which one(s) would allow something as broad as this. Obviously under our political system the government can legally do whatever it wants if it can get a law through Parliament to say so, but to achieve that they'd have to be open about what they're doing and convince enough MPs and Lords that it's justified.
  - mosafet 5y ago
    I had a check and it looks like the law was passed in 2012[1]. They say that gave them a legal responsibility to hold clinical information, combined with instruction from government that should be enough for this to fall under another basis in GDPR without consent being required. Not saying it's right, especially with the risk of the data being shared further once they hold it, but it'd probably be difficult to challenge. [1] https://digital.nhs.uk/about-nhs-digital/our-work/keeping-patient-data-safe/how-we-look-after-your-health-and-care-information/nhs-digital-s-legal-right-to-collect-information https://digital.nhs.uk/about-nhs-digital/our-work/keeping-pa...

Camas 5y ago

NHS response to this and similar allegations Collecting GP data - advice for the public: https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/advice-for-the-public https://digital.nhs.uk/data-and-information/data-collections...

wiz21c 5y ago
From the page : "You can opt out of sharing your data" No no no triple no. Don't opt me in. Full stop. I'll opt in if I want to. 99% of people just don't get it enough to opt out. So please, take a default that protects people first.
- chrisseaton 5y ago
  > So please, take a default that protects people first. Their argument is that having high-quality data to plan healthcare is protecting people. If people want the state to manage and pay for your healthcare, the state needs information to plan that for everyone. You can already 'opt out' entirely by purchasing your own healthcare if you aren't prepared to contribute.
  - throwaway3699 5y ago
    > If people want the state to manage and pay for your healthcare, the state needs information to plan that for everyone. You can already 'opt out' entirely by purchasing your own healthcare if you aren't prepared to contribute. This is literally going against the underlying principles of the NHS. There is no 'transaction' going on here. I already contribute to the NHS through my taxes.
    - chrisseaton 5y ago
      > This is literally going against the underlying principles of the NHS. Bizarre claim. The underlying principle of the NHS is socialised healthcare. Opting out of contributing to allow the NHS to plan for everyone's healthcare is the opposite of being social. > There is no 'transaction' going on here. I already contribute to the NHS through my taxes. Seems self-contradictory?

dkarp 5y ago

As someone who works in HealthTech in the UK, I can see why NHS Digital sees a need for this. We really should be enjoying the benefits of a centralised National Health Service in this country, but the divide and conquer management strategy gives individual GP practices and Hospitals (run by NHS Trusts) a lot of independence. That independence extends to IT systems, meaning you have various patient record systems in use around the country and a set of standards and APIs mandated to allow them to communicate. I would personally prefer those patient records to be on software provided and administered by a technical organisation with the expertise to understand the security risks involved and working full time on that problem. Hospitals and GPs could then get on with treating patients rather than having to employ their staff to figure out the tech side. So why isn't NHS Digital doing that instead? I expect most people actually believe the NHS already have their medical records, and in a sense they do, it just has many different custodians all around the system.

cik 5y ago
This is more or less how it works in Israel. The EMR is owned and controlled by the state. Four private HMOs compete (in the literal sense) to provide services as efficiently and high quality as possible, according to their government licenses. It marries the public sector ability to build giant-ass systems for its citizens, with the private sector's ability to compete. Moving here from Canada I'm beyond shocked how much more efficient, higher quality, and cheaper this system is. I could never go back now. For example: the second I get a prescription it's available in 100% of the pharmacies in the country (that carry my drug). All I have to do is walk in to the one I want, swipe y card, and ya'ala done. I can even check on an app what pharmacies have said drug in stock, and plot a route there.
- chaosite 5y ago
  You're right, but less, rather than more. 1. 4 HMOs total, not hundreds. That's a big difference, it's still pretty centralized. 2. The HMOs actually compete on very little, mostly customer service. They are heavily regulated and have to provide services to a spec that's spelled out by the government, including pricing. 3. These 4 HMOs are mostly historic in origin; starting a new one would probably need to be initiated by the government. 4. For example, your example of (digital) prescriptions being filled by any pharmacy: that's an regulation codified in law. And while 100% of pharmacies can fill it, only those with an arrangement with your HMO will give you the subsidized price.

thinkingemote 5y ago

Apparently, there is no retroactive opting out. If you opt out after the 23 June, only new data after your opt out date will be excluded. Everything before can and will be sold, shared, etc

butterzone 5y ago

If you swap out private insurance companies for NHS (due to differences in funding), this is similar to the path the US is on right now. Within the next 1-3 years private insurance companies will know even more about your health than any single provider, and will use this more detailed insight to improve how they model, risk, and determine benefits for you in their favor. The people in charge of the funding fueling healthcare want to use data to improve their control of the money.

wolverine876 5y ago
How is that happening? Under what program(s) or law(s) or regulation(s)?

FridayoLeary 5y ago

My perception of the NHS is that it is currently swamped in paperwork. I'm not sure why we are paying highly qualified doctors to spend huge amounts of time filling in endless documents in triplicate. Does anyone know if this digitization will have any effect.

Silhouette 5y ago
If you want to look at the bigger picture, possibly the most fundamental problem we have in England is that there aren't enough doctors. Despite the capacity problems and delays at GP surgeries that most of us have experienced at some point, there has been a downward trend in the full-time-equivalent GPs per capita in England over the past decade or so. https://fullfact.org/health/gp-numbers-or-down/ https://fullfact.org/health/gp-numbers-or-down/ It's also likely that the decreasing availability of GP appointments is causing an increase in people turning up at major A&E centres instead, where it may cost far more to treat them for a non-urgent condition that a GP could have dealt with instead if one had been available within a reasonable period. Just to add to the pressure, we also have a population that is living longer, so GPs may increasingly be helping the elderly to manage multiple conditions as well. Reducing non-clinical overheads for doctors that take time away from patient care is certainly important, but the bottom line is that our society needs more doctors or the quality of healthcare will continue to decline.
chrisseaton 5y ago
> Does anyone know if this digitization will have any effect. The article isn't about digitisation. Medical records are already digitised. > filling in endless documents in triplicate Which documents do you think they're still filling out manually? Let alone in triplicate?

atc 5y ago

ML has so much potential to help us in healthcare. We don't need this Guardian low-level analysis scuppering progress in this area because they drop the dirty word of "private" or "profit". Yes, it needs careful regulation and management on all sides, and a mechanism where patients own their data, but I welcome datasharing in healthcare.

motohagiography 5y ago

My issue with it is central data repositories create a kind of secret surveillance para-bureaucracy with no individual accountability. What is frustrating is efforts like this are trying to squeeze the toothpaste out of the tube, and I suspect before current techs we have today like differntial privacy and tokenization make anonymous sharing and analysis viable. Medical researchers are people like anyone, they aren't some kind of preisthood, and they are going to leak and share the data and use it for political purposes as their opportunities and incentives change. The technical controls researchers actively resist are basic corporate controls as simple as identifying everyone who logs in to view the datasets with their real names, background checks on people with admin credentials on personal health databases, probabilistic watermarking and dating cuts of datasets shared with researchers so that any leaks can be traced back to a specific accountable people to contain it, and requiring a public record and accounting of the research and projects they were using the data for, using synthesized data in technical test environments and not real health information. These are basic corporate controls that aren't part of the research culture. Some places may have them, but I wouldn't be surprised if the organizations conspire to neglect their processes. The benefits they say are for using ML for research and it will cure all manner of diseases and detect others early. This sounds great, but what is missing are legal consequences for exploiting people via their data. People aren't managed livestock, so the prestige of a few researchers needs to be balanced with the quality of the society these new data powers create. If your worst political enemy is an exception to the principle of the confidentiality of this data, then you aren't suited to access it, and to be allowed to do so compromises the whole system for everyone. A test people could use for privacy is whether you would be ok with the activist groups operating in universities, communist party of china, and their federal police force having secret legal access to health records, and if they aren't, what rules do we need to compensate? Inadmissability of data in any of these data sets in legal proceedings seems like one useful control. Personal penalties for abuse and leaking of this data would be another. Licensing and professional regulation of individuals who administer systems that process personal information that has been obtained without explicit consent of individual data subjects seems complex, but I could see some version of it happening in the next 20 years. Without these additional controls, it's just a data grab, and these GP's are right and in fact brave to resist it.

amelius 5y ago

If this was 30 years ago, there would be no corporations involved directly, but the entire analysis of these records would be done in government institutions or academic hospitals. Corporations would only be there to provide the hardware and basic software such as OSes. Can we please get a law that any crowdsourced data and all derivative works belongs to the public? And can corporations please go back to their role of building products that aid in research, such as computer hardware and software? Combining "building software and hardware" and "needing to look at data" is a source of trouble. Your software can look at the data, but not you. We'll run the software.

Ntrails 5y ago

Can someone actually explain what the actual flaw in the proposed anonymisation of the data is? This sounds a lot like people are in complete dismissal of the potential benefits of a countries worth of aggregated health data to research.

Silhouette 5y ago
Firstly, to be strictly accurate, the data here will not be anonymous, only pseudonymous. But in any case, we are talking about a long list of often very specific observations for almost everyone included in the data set. The chances of even supposedly anonymised data with that much detail being subject to reidentification are quite high, and there are plenty of organisations that might be able to infer enough to do it, by comparing against other data sets they already hold.
- kapuasuite 5y ago
  What’s the actual cost/benefit here?
  - Silhouette 5y ago
    There is no way to know, because it's impossible to quantify either the expected costs or the expected benefits. On the benefit side, there is simply no way to know what good things could come from giving the right person easier access to this data. Maybe the only thing between us and a cure for ten different types of cancer is a one-week number crunching exercise by the right university research group. Maybe we'll go twenty years and no big advances will result that wouldn't have happened anyway. On the cost side, as ever with privacy, most of the real damage in the event of a breach isn't likely to be directly financial. What is the cost to a 20-year-old struggling with their identity if information about their sexual health leaks and betrays their situation to their friends and family before they want to be open about it? How many jobs might be lost by women in their 30s or 40s because someone at the potential employer discovered they'd been having treatments that could be related to pregnancy or fertility in recent years and took steps to avoid hiring someone who might need maternity leave soon? What might happen to your ability to get health or travel insurance ten or twenty years from now if you ask your doctor today about a symptom that is probably nothing but could be a sign of a serious condition? Or to your children's ability to get insurance in the future, if you ask about a symptom that could relate to a hereditary condition? How many people, fearing the answer to these kinds of questions if their health records are shared, might not ask the doctor about something potentially important at all? How often will that conversation that never happens prove to have devastating consequences because a serious condition then went undiagnosed and untreated? A chilling effect on doctor consultations alone could easily cost many thousands of lives. Just look at the big drop in the number of urgent referrals for people with potential cancer symptoms since the COVID restrictions have meant relatively few people are seeing their GP in person. The only thing we really know is that this is probably a one-way trip. Once Pandora's box is open, it is unlikely it will ever be closed again. And we're being asked (or not, apparently) to take that trip based on vague, hypothetical future benefits, without any reference to the potential dangers, even though there have been quite a few examples of confidentiality breaches arising from sharing this kind of data in the past. I suppose a cynic might say the actual cost/benefit right now is therefore infinite, because in the absence of better arguments and data about the benefits, it's prudent to assume a division by zero.

raspyberr 5y ago

The point of this move is to remove a burden from GPs. They'll no longer have to worry about securely handing over data to third parties. Each GP does it in a different way with different levels of skill. This thing will make NHS Digital the first point of contact for third parties to get to the data rather than GPs. The article seems to stress that your data will now be up for sale to corporations but this is already happening to GPs.

Havoc 5y ago

And of course the opt out is fkin broken. Just kicks out an error message for me. Well played data collection crew!