Concerns over plan to boost pharma by releasing NHS data Earlier this week the Government announced proposals (40-page / 2.1MB PDF) to change the NHS Constitution so that information stored about patients would be automatically shared with life sciences researchers via a new anonymised database unless patients elect for their details not to be included. While welcomed by the life …
This post has been deleted by its author
I have worked on large medical projects as legal and ethical advisor. You perhaps don't understand that any medical research is a partnership between many groups, and some of those groups are private companies. Whether they are IT suppliers, pharmaceutical/medical devices manufacturers, external laboratories, or whatever, somewhere there is private money, with its own set of interests - with profit fairly high on the list. The trick is to make sure that the data remains ultimately in the control of the people with most to lose - generally the doctors, with sufficient legal and ethical backup and technical controls to back them up - and make it clear at each step that the data do not belong to the project, but to the individual. Keep banging away at this, making it clear that the data is held in trust for the donors, and you will be surprised how effective it is. Self-policing becomes the norm.
Yes, there are problems with some aspects (on the projects I've worked on, the biggest is "What happens to the data when the project funding runs out?"). The point is, it is possible to use personal information en masse for good, even involving the private sector. However, there needs to be a mechanism for making sure that the people who have the data are sufficiently invested in keeping it safe. Personally, I'd create a truly non-Governmental organisation with an independent board of governors made up of doctors, representatives of the public, and some representatives of other concerned bodies (private industry, government), with absolute power over access to the data (this has worked quite well with the UK Biobank, for instance). Oh, and I'd put me in charge of it, obviously!
...if any patient's personal data is compromised in any way whatsoever by sloppy security, bad administration or crappy processes then EVERYONE in the chain from the person who released it right back up to David Cameron should be held fully responsible, fined heavily and sacked immediately. And THAT should be written into the document in BIG RED BOLD TEXT as well.
In principle it's a great idea to make use of the vast amount of data. It could help us all. But to be worthwhile it can't really be anonymous. For the data to actually be useful, surely researchers will need as much of it as possible.
They're going to want a postcode attached to see if location affects the disease a population gets or it's eventual outcome.
They're going to want to know age and sex as that has a huge bearing on what you get and if you survive it.
They're going to want to know ethnicity as some groups have much higher incidence of some problems than others.
Number of kids I've had may change my odds of some cancers
The medical history of a patient's close relatives is important to see how that changes the likelihood of getting a disease (breast cancer for example)
So if you know my medical history, age, sex, location, ethnicity, number of kids, and can link my to my family's medical history, just how anonymous is my record? It isn't. So why pretend real research can be done with anything other than the full details, but with the patient name and address crossed out.
So to do this much needed research we have to find someone we can trust with the raw, unexpurgated information about us all.
Ah. Any suggestions?
(Posted as anonymous, but we all know it's not really).
Disclosure: I have worked on large medical research projects as legal and ethical advisor. I have also worked on projects looking purely at privacy in research.
There isn't a functional way to get around the problems you mention. For the information to be effective, the only thing that can be missing is your name - that is the only thing that is irrelevant to finding out health information. Everything else - weight, height, sex, sexuality, DoB, location, occupation, genetic information, amount/method/destination of travel, illnesses, etc, may be relevant when included in a big enough pool (e.g. all NHS patients), and analysed in enough depth.
Virtually to a person, medical researchers are trustworthy - they are driven by finding a cure/treatment for whatever it is that has floated their boat. The individuals that have supplied the data don't really exist for them - the data are all that matter. And, as I mentioned in a reply above, there is *no*major medical research being done without the involvement of multiple partners, including private companies - IT companies, pharmaceutical/medical instrument manufacturers, external laboratories. The way I tend to deal with the privacy problem is to make those those with the most to lose responsible for it - usually the doctors. Only certain combinations of information can be released at a time - this makes it much more difficult to put together a picture of any individual - and to named researchers only. No ability to download the entire database, and access to raw data only on specific machines with no USB connectivity. But above all, indoctrination that the information is held in trust - it doesn't belong to the researchers, it belongs to the individual. They have been granted permission to use the data in a way that will benefit people, and it would be a betrayal of that trust to misuse it. You would perhaps be astounded how effective that simple mantra is.
However, the questions tend to arise after a certain breakthrough has been made: what if it has been discovered that you are in a category that has been discovered to be at serious risk of developing something nasty - let's say one of the dementias - for which a treatment has just been found? Do you want to be able to be informed of that? If so, how is that information going to get back to you? Is it a breach of confidentiality if you get a letter from your GP suggesting that you make an appointment to discuss some health issues, or is it a breach of duty if you don't?
OK, the chances of anyone having read this far are rapidly approaching zero, so I'll stop.
I've been suggesting this for ages along with asking why the NHS doesn't research and sell it's own drugs. It seems like a fairly reasonable bargain between patient and state to say "We treat you for free but your data is available to research new drugs and treatments to pay for it". Other countries have made substantial amounts of money by allowing access to national health data.
I haven't seen anything on how much we are asking for it though.
"We treat you for free"???? - Can I have my NHS related NI contributions back then please. Just because there isn't a direct link between service and payment it doesn't mean it isn't there. You'll be telling me that when an advertiser tells you 'buy product A & get B free' that you are not paying for B in with product A.
Plus does anyone really trust the govenrment to stop there. Someone will say - we can get more money if we just ...
My bet is that it will be managed in the same way as the DVLA data, anyone who fills in a form & pays the fee can access it. Anyone who claims to have a connection with a car park can now get all the registration details, including registered keeper, just by typing in a registration number.
Are you happy that these people really have your privacy as a priority?
You see Portillo that's my data there, about me and the nasty diseases I managed to catch as a spotty, stupid, hormone driven teenager. That's my meteoric rise up the obesity charts as I settled down and into an easy life or beer, chips and TV, before heading back down to a sensible weight. That's my records about the orifices I've had inspected in the name of finding what nasty little thing has decided to grow inside me this decade!
So why don't you first go ask BUPA for all their data, and I mean ALL their data including you lot in the house and all your boardroom, networked mates and when they've all had their data pawed and poured over, then I might think about supplying mine until then BUGGER OFF!
""The public must be assured that the release of data is controlled by robust processes and legal and ethical oversight in which the patients themselves are involved"
This one phrase, uttered by someone in Government, or someone representing someone in Government is a cast-iron guarantee that my personal data is not safe.
This post has been deleted by its author
I just don't get it.
The people in the study are the ones that need to be contacted if Pharma thinks it needs more information.
An intermediary service is required, similar to PayPal, that allows Pharma to get back to the original data holder, IE patient, without direct information.
Pharma case study Number contact Number <-> intermediary contact org <-> person being studied
In this way Pharma can ask plainly if they may contact them directly or vice versa.
Maybe, if they weren't so hyped on not sharing a few bucks with these people and put together an independent contract paid between them selves, they might get somewhere with this issue.
Don't tobacco companies do this all the time with lawyers ?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
