5 ms·

No it isn't. U.S. health data can be sold if it is de-identified or with a patient's permission.

by rpedela 13y ago

tansey 13y ago
But this data is not de-identified. They explicitly list prices for data with confidential, patient-identifying information.
- rpedela 13y ago
  "This would be straight up illegal in the US due to HIPAA, which guarantees a patient's right to privacy." That is a blanket statement which is false. Some of what NHS is providing would be illegal in the U.S. Some of it is actually legal. I am mostly responding to the blanket statement.
- vilhelm_s 13y ago
  The main page, http://www.hscic.gov.uk/dles http://www.hscic.gov.uk/dles , states > The data we supply is normally pseudonymised. We only provide identifiable data when there is a lawful basis to do so i.e. with patient consent, approval under section 251 of the NHS Act 2006 which enables The Health Service (Control of Patient Information) Regulations 2002, or where appropriate statutory regulation is in place. This "About Section 251" page, http://webarchive.nationalarchives.gov.uk/20130513181011/http://www.nigb.nhs.uk/s251/abouts251/index_html http://webarchive.nationalarchives.gov.uk/20130513181011/htt... , states > Section 251 came about because it was recognised that there were essential activities of the NHS, and important medical research, that required use of identifiable patient information but because patient consent had not been obtained to use people's personal and confidential information for these other purposes, there was no secure basis in law for these uses. [NB. There are a few exceptions where there is a legal basis for disclosure e.g. reporting of notifiable diseases]. Section 251 was established to provide a secure legal basis for disclosure of confidential patient information for medical purposes, where it was not possible to use anonymised information and where seeking consent was not practicable, having regard to the cost and technology available.
  - pbhjpbhj 13y ago
    >"and where seeking consent was not practicable," // As they have your contact details and next of kin details then seeking consent must be quite practicable. I expect them mean "commercially financially viable". Those people the NHS can't simply look up a phone number for (from doctor's surgery records) and ask (or ask their guardian/parent) must be in the few hundreds [of those they have sufficient medical information for to be used in a scientific study].
    - vilhelm_s 13y ago
      I guess that's what it says, practicable with regard to cost. To look at one random example, the first study on the list of approvals in 2013 was the "ETPOS: European Transfusion Practice and Outcome Survey". Apparently they took data from 10,000 patients who had blood transfusions and tried to see if there was any correlations between practices such as "ratio of red blood cells to other blood component therapy, such as plasma and platelets" and health outcomes. I guess it was deemed that phoning each of the patients was impractical.
      - pbhjpbhj 13y ago
        Robot Dialer: The NHS wish to sell your medical data for use in a study of people who had blood transfusions. Press 1 to accept, 2 to refuse, 3 to speak to an agent. Robot Dialer: You pressed 1 to accept; can we use your data for future studies? Press 1 to accept, 2 to refuse, 3 to speak to an agent. Robot Dialer: You pressed 2, can we contact you to ask about using your data in specific studies in the future? Press 1 to accept, 2 to refuse, 3 to speak to an agent. Umpteen marketing companies appear to be able to afford to do this sort of calling (yes even though it's against the law for them to contact me as I'm on the no-call database [which wouldn't apply to the NHS]). If it's too costly then the studies can hardly be worthwhile? Remember the NHS wasted £10 Billion on a single IT project over the last 10 years. What would this auto-dialer have cost? £10k in "management", couple of thousand in IT staff and set-up (join study NHS numbers with main database ID table and contact info tables, select phone numbers; set-up dialer script, test, initiate) maybe £500 in direct call costs. They most likely already have systems in place to do auto-dialed calls for disease outbreaks [UK Environment Agency use one for flood warnings].
pessimizer 13y ago
Does "Your NHS number Your date of birth Your postcode Your gender and ethnicity Your medical diagnoses (including cancer and mental health) and any complications Your referrals to specialists Your prescriptions Your family history Your vaccinations and screening tests Your blood test results Your body mass index (height/weight) Your smoking/alcohol habits" seem 'de-identified'?
- rpedela 13y ago
  That sort of data can be included in de-identified health data in the U.S. if it can be shown statistically that the individual cannot be re-identified.
  - pessimizer 13y ago
    How exactly would you 'de-identify' a NHS number?
    - rpedela 13y ago
      Since that number is meaningless in the U.S., I guess you wouldn't care.
      - lostlogin 13y ago
        My New Zealand address is meaningless in the US unless you want to find my house. I see patient numbers on things displayed from time to time and wince - interesting case studies etc. I most certainly could find out who the person is. A distinct pathology is probably enough to identify someone in New Zealand if you tried hard enough.
    - Angostura 13y ago
      The data available won't include that those personal identifiers. At time of extraction, the patient record in the database is assigned a new unique identifier which has nothing to do with the NHS number.
  - 13y ago

No it isn't. U.S. health data can be sold if it is de-identified or with a patient's permission.

by rpedela 13y ago

No it isn't. U.S. health data can be sold if it is de-identified or with a patient's permission.

But this data is not de-identified. They explicitly list prices for data with confidential, patient-identifying information.

rpedela 13y ago
"This would be straight up illegal in the US due to HIPAA, which guarantees a patient's right to privacy." That is a blanket statement which is false. Some of what NHS is providing would be illegal in the U.S. Some of it is actually legal. I am mostly responding to the blanket statement.
vilhelm_s 13y ago
The main page, http://www.hscic.gov.uk/dles http://www.hscic.gov.uk/dles , states > The data we supply is normally pseudonymised. We only provide identifiable data when there is a lawful basis to do so i.e. with patient consent, approval under section 251 of the NHS Act 2006 which enables The Health Service (Control of Patient Information) Regulations 2002, or where appropriate statutory regulation is in place. This "About Section 251" page, http://webarchive.nationalarchives.gov.uk/20130513181011/http://www.nigb.nhs.uk/s251/abouts251/index_html http://webarchive.nationalarchives.gov.uk/20130513181011/htt... , states > Section 251 came about because it was recognised that there were essential activities of the NHS, and important medical research, that required use of identifiable patient information but because patient consent had not been obtained to use people's personal and confidential information for these other purposes, there was no secure basis in law for these uses. [NB. There are a few exceptions where there is a legal basis for disclosure e.g. reporting of notifiable diseases]. Section 251 was established to provide a secure legal basis for disclosure of confidential patient information for medical purposes, where it was not possible to use anonymised information and where seeking consent was not practicable, having regard to the cost and technology available.
- pbhjpbhj 13y ago
  >"and where seeking consent was not practicable," // As they have your contact details and next of kin details then seeking consent must be quite practicable. I expect them mean "commercially financially viable". Those people the NHS can't simply look up a phone number for (from doctor's surgery records) and ask (or ask their guardian/parent) must be in the few hundreds [of those they have sufficient medical information for to be used in a scientific study].
  - vilhelm_s 13y ago
    I guess that's what it says, practicable with regard to cost. To look at one random example, the first study on the list of approvals in 2013 was the "ETPOS: European Transfusion Practice and Outcome Survey". Apparently they took data from 10,000 patients who had blood transfusions and tried to see if there was any correlations between practices such as "ratio of red blood cells to other blood component therapy, such as plasma and platelets" and health outcomes. I guess it was deemed that phoning each of the patients was impractical.
    - pbhjpbhj 13y ago
      Robot Dialer: The NHS wish to sell your medical data for use in a study of people who had blood transfusions. Press 1 to accept, 2 to refuse, 3 to speak to an agent. Robot Dialer: You pressed 1 to accept; can we use your data for future studies? Press 1 to accept, 2 to refuse, 3 to speak to an agent. Robot Dialer: You pressed 2, can we contact you to ask about using your data in specific studies in the future? Press 1 to accept, 2 to refuse, 3 to speak to an agent. Umpteen marketing companies appear to be able to afford to do this sort of calling (yes even though it's against the law for them to contact me as I'm on the no-call database [which wouldn't apply to the NHS]). If it's too costly then the studies can hardly be worthwhile? Remember the NHS wasted £10 Billion on a single IT project over the last 10 years. What would this auto-dialer have cost? £10k in "management", couple of thousand in IT staff and set-up (join study NHS numbers with main database ID table and contact info tables, select phone numbers; set-up dialer script, test, initiate) maybe £500 in direct call costs. They most likely already have systems in place to do auto-dialed calls for disease outbreaks [UK Environment Agency use one for flood warnings].

pessimizer 13y ago

Does "Your NHS number Your date of birth Your postcode Your gender and ethnicity Your medical diagnoses (including cancer and mental health) and any complications Your referrals to specialists Your prescriptions Your family history Your vaccinations and screening tests Your blood test results Your body mass index (height/weight) Your smoking/alcohol habits" seem 'de-identified'?

rpedela 13y ago
That sort of data can be included in de-identified health data in the U.S. if it can be shown statistically that the individual cannot be re-identified.
- pessimizer 13y ago
  How exactly would you 'de-identify' a NHS number?
  - rpedela 13y ago
    Since that number is meaningless in the U.S., I guess you wouldn't care.
    - lostlogin 13y ago
      My New Zealand address is meaningless in the US unless you want to find my house. I see patient numbers on things displayed from time to time and wince - interesting case studies etc. I most certainly could find out who the person is. A distinct pathology is probably enough to identify someone in New Zealand if you tried hard enough.
  - Angostura 13y ago
    The data available won't include that those personal identifiers. At time of extraction, the patient record in the database is assigned a new unique identifier which has nothing to do with the NHS number.
- 13y ago