England's controversial extraction of personal medical histories from GP systems is delayed for a second time

NHS Digital has again delayed plans for what has been called the biggest data grab in NHS history, introducing new caveats to the extraction of personal medical information. No new implementation date as been set. In the first significant policy shift since Matt Hancock left office as health secretary last month, primary care …

[Stuart Castle]

OK, I've said this before, and I'll say it again.

NHS Digital need to be totally transparent about this. They also need to establish limits on what is done with the data, and be open about what will be done. Even to the point of taking out adverts in the media. They also need to give people reasonable notice, so they can opt out for whatever reason they wish.

I would prefer something like this be opt in, but I can understand they may not get enough data this way,

[Dave 15]

Establish limits?

Oh hell, please tell me how I can control what YOU do with data you buy from me?

Please tell me how I ensure that your systems are hack proof and it wont leak anyway.

Please tell me how I ensure that MY systems are secure enough that when I have all these millions of records I wont get hacked or even ransomed.

[Robert Grant]

Re: Establish limits?

You seem to be arguing against GP systems in general; nothing you say is specific to research-based systems.

[Fonant]

Re: Establish limits?

I think they're commenting on the "all eggs in one basket" problem with a single central database.

[gandalfcn]

Re: Establish limits?

Which is a good argument against BoJo;s sell off.

[anothercynic]

Transparency? From an organisation that's tried multiple times to pull this kind of stunt and still attempts to persist? Are you kidding?

Given that some organisations that should *never have access to that data are lined up to get their hands on that data, NHS Digital is playing with fire. The longer they persist, the less likely they are to succeed because the GPs and their CCCGs are going to snap shut and say "bugger off and don't darken our doors again" sooner rather than later.

To see the GPs push back this hard is already encouraging from a data protection standpoint. It's clear that if they weren't clued up about what they could just happily hand over, they are now.

[Anonymous Coward]

CCGs will not push back on collection, they want easy access to it. Right now they need to sort out agreements with each and every practice that are members of that CCG, and while the big system providers do allow access at a bulk level it won't be as simple as what NHS Digital can provide.

As for handing over, as mentioned, they do this on a per practice level already for CCGs and other research / analysis organisations, the only difference being everything for the whole country isn't in one big pot.

[gandalfcn]

"an organisation that's tried multiple times to pull this kind of stunt " Isn't it the government's policy?

[Roland6]

>NHS Digital need to be totally transparent about this.

No, NHS Digital - trading name of the Health and Social Care Information Centre, needs to be moved wholly into the NHS. This avoids the entire problem. It also means the government no longer has to duck and dive to avoid scrutiny...

[MrReynolds2U]

UK GDPR (2021) is pretty clear on this. Informed consent is primarily an opt-in process.

They seem to be treating GDPR like it doesn't apply to them.

Also, why - given the stated reasons - would the data not be completely anonymised before upload?

[Anonymous Coward]

I think one of the issues is that "standard" anonymisation isn't good enough for health records particularly if you have a rare condition or combination of conditions. The fear then would be that the supposedly anonymous NHS Digital data could then be easily matched against other sources of data.

[scrubber]

Anonymous Data is Impossible

Pseudo-anonymous patient 014432 from postcode SW2 reported a lower back pain in July 2017. They then reported an irregular heartbeat in January 2019, the doctor concluded it was a genetic condition that could lead to heart attacks and angina.

Google Health notes that user [e-mail] searched for "lower back pain" in July 2017 and "racing heart" in January 2019 from an IP address located in SW2. Google (Alphabet) now knows that patient 014432 is Janet Crow from Acre Lane in Clapham, and from her gmail contacts and Facebook profile can see who her friends and family are and, based on their search history and given the genetic nature of her condition, knows not to insure members of her family without an increased premium and that they should not hire from that family due to higher likelihood of death in service.

Edit: How could I forget that Google Street View slurped all IP addresses and linked them to actual houses. So from the IP address Google know your real address and have a picture of your house linked to it, including any vehicles parked nearby.

[rg287]

Re: Anonymous Data is Impossible

Google (Alphabet) now knows that patient 014432 is Janet Crow

Correction - Google (Alphabet) now believes to a high degree of confidence that patient 014432 is Janet Crow...

The law of large numbers of course means that it's inevitable that Jimmy - also of SW2 - is obese with related heart problems (irregular heart beat) and has slipped a disc (lower back pain) and has searched for those terms recently.

Large scale data-correlation and de-anonymisation is a major problem, but arguably malgorithms doing it badly is an even bigger one.

Hell, even a "good" mechanism with 99.99% accuracy is going to result in thousands of people being on the end of automated decisions that are fundamentally unsound once you apply it to national populations.

[staringatclouds]

Re: Anonymous Data is Impossible

Lets call this what it is

Eugenics by algorithm

And before people say I'm overreacting, that's exactly what this ...

"Google (Alphabet) now knows that patient 014432 is Janet Crow from Acre Lane in Clapham, and from her gmail contacts and Facebook profile can see who her friends and family are and, based on their search history and given the genetic nature of her condition, knows not to insure members of her family without an increased premium and that they should not hire from that family due to higher likelihood of death in service."

... means

[cantankerous swineherd]

only sensible course of action is to assume nhsdigital are lying and/or acting in bad faith.

their get out of jail free card is that their basis for legal processing isn't consent...

[Anonymous Coward]

Why can’t it be opt-in?

Answer: because nobody would.

[Yet Another Anonymous coward]

Re: Why can’t it be opt-in?

Because the data would be useless, it would be like Facebook planning their capacity based on people who respond to Gartner questionaires

[scrubber]

Re: Why can’t it be opt-in?

Isn't that how government design their policies, based on people dumb enough to answer yougov polls and telephone questionnaires?

[gandalfcn]

Re: Why can’t it be opt-in?

No. “Johnson referred to the Telegraph as “my real boss”

[Anonymous Coward]

It would be good for El Rey to outline a position on why data might or might not be valuable.

For example, in Wales primary and secondary care patient data is kept in a single source that all systems talk to, so data is mastered well, shared well between clinicians in different trusts, and clean for analytics/discovery. Getting England to that state might be a better start than these short term grabs.

The article seems a little unbalanced from that perspective. Data privacy is important, but it's worth talking about the opportunity cost, I think.

[Adair]

Here's the keys to my house, feel free to have a good rummage through. What, you want to make a list? You'll only use it for legitimate purposes. Well, I guess that's okay, yeah, sure, go ahead.

What happens between me and my GP is nobody else's business without my explicit consent.

The the Govt. wants to aggregate NHS and GP patient data for statistical analysis pertaining to health-care, all well and good, but they can have the responsibility and social decency to do it through a really well worked out, well publicised and well tested system that does what it says on the tin, and only what it says on the tin; AND that anyone can easily opt out of, and stay opted out of, for no reason that they have to speak of.

[Dave314159ggggdffsdds]

You shouldn't have the option to opt out. Clearly there are any number of paranoid, selfish people like you who don't care about collecting vital life-saving information.

This is like vaccination. It isn't your choice, because your selfishness affects the whole of society.

[Ragarath]

I beg to differ.

A persons data belongs to them and only them unless they decide to share it. I could make all sorts of analogies about other data that you would not share like the contents of your house, your salary heck your entire schedule. All of these could save lives too you know, if you use the data correctly. They can also be used in other ways too nefarious as well as not, all without your knowledge.

Why should your data be any different than any other possession? If I want to borrow a friends car, I ask them nicely and they will either say yes or no. If it's a no I can't then just take the keys. That's called stealing and potentially carries jail time. Data should be no different.

[Anonymous Coward]

(somebody stole the title!)

"If I want to borrow a friends car, I ask them nicely and they will either say yes or no. If it's a no I can't then just take the keys. That's called stealing and potentially carries jail time. "

Not entirely correct in English law, maybe others too.

Too many "car thieves" (then often referred to as "joyriders") were getting away with it because the existing laws didn't cope well with "I was going to return it". So a specific new offence was created for motor vehicle "theft", under the name of"taking without the owners consent". (gross oversimplification)

https://en.wikipedia.org/wiki/Taking_without_owner%27s_consent

[Trigun]

I thoroughly disagree with you on the "you're being selfish" argument. Some kinds of data are very personal and I would say medical is one of *the* most personal. As such, everyone has the right to make their own decision and not be lambasted for not wanting their privacy invaded without proper consultation and by a default opt-out policy that many will not even know about or how to use.

As for the common good argument; There's a balancing act between personal good and common good and I think most people feel that personal data sharing without informed consent destroy that balance.

[gandalfcn]

What are you on?

[Doctor Syntax]

After all, he can't consider it confidential.

[Doctor Syntax]

"You shouldn't have the option to opt out."

Can we have the URL where you've published all your medical data?

[Anonymous Coward]

>and clean for analytics/discovery.

And for copying to Police DNA databases

And used to identify undocumented immigrants for deportation.

And used to track biological parents for support payments

And used to disqualify people for disability benefits

And that's before it's just sold to US insurance companies prior to privatisation.

[BenDwire]

That's an interesting list of uses. I'm obviously either getting more right-wing in my old age, or maybe more of a religious fanatic. Between this and the latest ID schemes we have all the makings of the book of Revelations "Mark Of The Beast"

As penance, I will start reading the Guardian and watching Love Island

/s (In case you're worried about my mental stability)

[Yet Another Anonymous coward]

Remember you have to think what an evil version of Priti Patel / Chief Inspector Savage would use it for.

It's not what it could be used for - it's what they think it will be used for.

I was pitching a database tool to the police force of a certain UK capital city 20 years ago. A senior plod (with lots of silver braid on his shoulders) was 'explaining' to me how this new DNA technology would give them a picture of the suspect from a sample at a crime scene. He had obviously been sold the idea by some consultant that DNA = everything about a person and so could generate a mug shot.

[Robbles]

erm - the evil version of Priti Patel *is* Priti Patel...

There is something odd with The Home Office being able to get any Home Secretary to go native immediately upon appointment to the position irrelevant of party affiliation / politics and promote very authoritarian / controlling / big-brother policies.

[Anonymous Coward]

I've always assumed their is something in the water supply at the Home Office that turns everyone into a rabid authoritarian.

[Anonymous Coward]

Nothing in the water, they just get a visit from MI5 / GCHQ on their first day and shown the dossier that is held about them. They will then soon fall in line.

[Anonymous Coward]

That's why legacy political parties have "Whips"

"a visit from MI5 / GCHQ on their first day "

[staringatclouds]

So given Priti's folder holds details of the information she gave to an unfriendly foreign power*

Why aren't MI5/GCHQ reining her in a bit ?

* You remember all those foreign 'holidays' she took & was subsequently sacked as a minister for before someone thought "the plebs will have forgotten by now lets make her a minister again"

[Ian Bush]

Yes, Priti Patel is evil She wants to kill people (https://www.indy100.com/news/priti-patel-resurfaced-clip-death-penalty-ian-hislop-question-time-video-home-secretary-9020006) unlike mini-Trump who merely colludes in trying to get them beaten up (https://www.theguardian.com/politics/2019/jul/14/black-eyes-boris-johnson-plot-attack-reporter-darius-guppy). Both liars though. And these are the people wanting to hand over our personal data ...

[Anonymous Coward]

Priti was on to something there: Executing innocent people to deter others is pure evil genius, People would be too scared to actually do anything at all!

[BloggsyMaloan]

>Priti was on to something there: Executing innocent people to

>deter others is pure evil genius, People would be too scared

>to actually do anything at all!

Can't help wondering whether she is innocent...

[Anonymous Coward]

Home Office being able to get any Home Secretary to go native immediately upon appointment

I think you mistake the effect for the cause (or the other way round). ALL the appointees considered for the appointment are already 'native' BEFORE one of them gets appointed. It's just that they always select the most natural, most native of the natives, and that cream of the cream glides into the post pefectly fit for their personality.

[oh christ]

Re: Home Office being able to get any Home Secretary to go native immediately upon appointment

Not to be forgotten is Sarah Wilkinson in charge of NHS Digital after being in charge of IT at the Home Office. While at the Home Office in 2017 she defended the use of data used from NHS databases to locate illegal immigrants in front of a parliamentary select committee.

[Doctor Syntax]

"There is something odd with The Home Office being able to get any Home Secretary to go native immediately upon appointment "

The former Home Sec who is currently Health Sec (something to reflect on) gave an account of how it was done in an interview with the Times. It was so effective he didn't even realise exactly what it was he was describing. OTOH some of them seem to start native.

[teebie]

Ok, so you have to imagine what Priti Patel's also evil twin would use it for.

[rg287]

As penance, I will start reading the Guardian and watching Love Island

I wouldn't impose Love Island on my worst enemy but as far as The Grauniad goes, seems like someone has had a word with Katharine Viner (formerly of Cosmopolitan...) and commissioned a bit more Rusbridger-style investigative journalism as part of the Pegasus Project.

Duncan Campbell (occasionally of these pages) had an article in yesterday

The Graun went a bit limp-wristed after Rusbridger left with Viner being a patsy for the spooks. Someone has either applied some leverage or gone around her to get back into proper journalism.

[ICL1900-G3]

Unusual set: Guardian reader & watches Love Island.

[Screwed]

A shame that much of Wales does not yet allow easy, online patient access to their own records.

At least in that sense, Wales is behind England.

[Dante Alighieri]

clinical use != research use

live shared data is available to us in England from multiple systems for real time clinical care.

This is something entirely different - I don't trust it one iota as a "senior healthcare professional"

And I have a personal test - if I won't have it done to me or my family, I won't do it to yours. And I use sharp objects on the UK public.

[Anonymous Coward]

Must be opt in

Things like this must be opt in, not opt out.

What's that Skip? They won't get enough data? Could that possibly be a sign that what they're attempting isn't welcome and should be abandoned?

[elsergiovolador]

Consequences

If they just grabbed the data anyway, then what would be the consequences?

Once you transfer the data to a 3rd party, it's game over. They may claim they deleted it, but there will always be someone with a thumb drive waiting for a right moment.

Government will issue an apology and that will be it.

[Yet Another Anonymous coward]

Re: Consequences

>If they just grabbed the data anyway, then what would be the consequences?

It only works once and screws the chance of future 'cooperation'

It works for police/immigration but not for well paying commercial customers.

If I'm an insurance company in the future looking for prime customers - having partial data from a grab 10 years ago with no updates isn't that much use to me.

[elsergiovolador]

Re: Consequences

10 years old data can still "paint a picture" about someone.

The next government depending on donations may play it at least two ways:

- the sky didn't fall after the "leak", but the research has benefitted massively, so we are going to let them get updates.

- we have improved the processes, so now only vetted companies (those with biggest donation) will have secure access

[Mishak]

"a downloadable poster for GP practices"

Yeah, because we've all been going there on a regular basis to read the posters. Not.

[Pascal Monett]

"they would not share data with the scheme"

Good on them.

All this data sharing shenanigans is just driving me nuts. Finally some people are taking a stand and thank God it's the doctors.

They took the Hippocratic Oath, not the Hypocratic Oath, and they're doing their job.

It may very well be that there can be a legitimate use and benefit from a centralized national health database, but the UK Government is not exactly in the best of positions when it comes to providing any sort of guarantee on how that data will be protected and managed.

Especially not if any US private company is involved.

[Anonymous Coward]

Re: "they would not share data with the scheme"

I'm sure any actual doctors reading will correct me if I'm wrong, but I don't think they actually do take the hippocratic oath.

[Dante Alighieri]

MBBS +ve

You are correct - a *very* small number of UK institutions do use a version of the Hippocratic oath - but most don't. I never did. And I've trained in several.

You might want to read it.

Primum non nocere : first do no harm

much of the the rest is about providing your teacher with a pension!

and not criticising colleagues

[keithpeter]

"[The LMC's letter] said NHS Digital should write to every patient telling them how their data would be used under the scheme and offering clear instructions about how to opt out."

Sounds like a starting point for an informed process about this. I've had two national letters from NHS (one for 'flu jab and one for COVID vaccination) so I conclude that the ability to contact all eligible patients is there - the mechanism works well.

I appreciate the utility of medical data for research purposes. Processing on a NHS controlled portal as opposed to wholesale exfiltration seems sensible, and the right to opt out at any time (opting out to include removal of historical data) seems to be the minimum baseline that could be asked for.

I still think that after the information campaign, data access should be opt in.

[Velv]

GDPDR v GDPR

Does anyone else think the General Practice Data for Planning and Research (GPDPR) was deliberately named to cause confusion and foster ignorance in the public, make them think its about Privacy (EU GDPR) when the truth is it exactly about the opposite?

[nematoad]

Re: GDPDR v GDPR

Yes.

A cunning plan that Baldrick would have been proud of.

[TimMaher]

Re: GDPDR v GDPR

Well caught up @Velv.

[Anonymous Coward]

Re: GDPDR v GDPR

but wait, there's more, I present to you GDPPR: https://digital.nhs.uk/coronavirus/gpes-data-for-pandemic-planning-and-research/guide-for-analysts-and-users-of-the-data

Act now and we'll throw in a free set of steak knives, worth $49.

[Anonymous Coward]

Re: GDPDR v GDPR

this was pure coincidence! Alternatively, a typo or two (e.g. as in 'Defence' in 'Ministry of Offense')

[Tim99]

Re: GDPDR v GDPR

"Alternatively, a typo or two (e.g. as in 'Defence' in 'Ministry of Offense Offence') FTFY

[Fruit and Nutcase]

Re: GDPDR v GDPR

GDPR - General Data Protection Regulation

GPDPR - General Practice Data Pimping and Remuneration

[nematoad]

Just ask first.

I can see that people here are pretty much in agreement with the idea that if you want to take someone else's private and intimate data you ask them first.

The trouble is we are dealing with NHSDigital and they seem to be of the same mind as the directors of Nominet and Icann not to mention the FAANGs in that what ever they can get away is fair game and allows them to make as much money for themselves as they can.

I had hoped that the GDPR would have put the brakes on this kind of thing but as far as I can see NHSDigital seems to think that because they are part of the respected NHS proper the rules do not apply to them.

Turds, leeches and the lowest form of life, I pray that someone with power comes in and puts a stop to their little schemes but I will not be holdiong my breath.

[Anonymous Coward]

Re: Just ask first.

Then like so many you do not understand GDPR. It does not mandate consent. Plenty of reasons to use for the reason for sharing the data.

[Oor Nonny-Muss]

On a personal level...

... Thank $DEITY I left Englandshire 15 years ago.

[Anonymous Coward]

The ICO is investigating that data leak.

and 3 years down the line they will write a letter...

[Fruit and Nutcase]

Bend Over

This won't hurt a bit

Says the government minister in charge of delivering patient data to their paymasters

[Lil Endian]

Trust? It Ain't Even Funny.

On 13 Jul, Vulture Dave Cartwright wrote an awesome article which was essentially promoting trust amongst peers: We're terrified of sharing information...

I love the concept, however my first thought was "Cambridge Five".

Within a week, Gareth Corfield's article regarding Hafnium (19 Jul) "Rumours were going around that a behind-closed-doors warning by Microsoft to security partners in late February was leaked, allowing criminals to abuse the zero-days just as patches were published."

So, security services and corporates are open to abuse of trust.

I'd love a world where all peoples are trustworthy, selfless and competent. But it ain't the case and it never will be. Not everyone has the same agenda, and some people are just self-serving bastards.

So, no thank you very much uk.gov - your track record is appalling and you garner no confidence.

Opt-In is a no-brainer.

[Anonymous Coward]

Re: Trust? It Ain't Even Funny.

> I'd love a world where all peoples are trustworthy, selfless and competent. But it ain't the case and it never will be. Not everyone has the same agenda, and some people are just self-serving bastards.

> So, no thank you very much uk.gov - your track record is appalling and you garner no confidence.

All this fuss over what NHS England/NHS Digital is *intending* to do.

I've been trying to get something done about HSCNI's (aka "NHS Northern Ireland") unlawful data sharing of patient data that has been occurring over the past 10 years. They picked "Consent" as the lawful basis and (ignoring ICO advice that "Consent" meant explicit consent) sent out leaflets to houses giving an opt-out deadline (I never received the letter). They have a Data Sharing Agreement (DSA) governing all the participant organisations that all participating orgs are required to sign yet no GP Practice ever signed it (so GPs then sharing data daily without a valid lawful basis). They decided to change lawful basis from "Consent" to "Public Task" in 2019 but never finished the DPIA allegedly intended to cover this change (its still draft and they have "promised" me it will be completed by Dec 2021) and can't have made that change as there is no completed/agreed/signed DSA version for "Public Task". The most recent DSA version is from 2016 so isn't GDPR/UK DPA 2018 compliant. They added new participants to the data sharing but never revised the DSA to include them nor get new and old participants to agree to the (non-existant) revised DSA. They finally published a (still draft) Privacy Notice for the data-sharing a little over 2 years after GDPR *required* them to do so (and only at my insistance). That's only the half of it.

Trust? What trust? In this case pretty much all the Health Service orgs here, as part of this, have consistently been breaking data protection law daily for the last 10 years and are continuing to do so - all the Trusts, all the GP Practices, Dentists, Pharmacists, Optometrists, etc.

Lindsay@TheRegister has had the relevant info to write about this for the past 2 months but no sign of an article appearing so far...

[Lil Endian]

Re: Trust? It Ain't Even Funny.

Is this (NI data sharing) originally government or HSCNI driven?

As we're dealing with slimy rat bastards that'll do anything they want, and notwithstanding respectable and ethical medical bodies, our hope of defence rests on "their" inability to roll out a project. It's even worse if they roll out an incomplete project.

[Anonymous Coward]

Re: Trust? It Ain't Even Funny.

> Is this (NI data sharing) originally government or HSCNI driven?

It was driven by HSCB (HSC Board) commissioning BSO (Business Services Organisation) to create and manage the ECS (2011 to some time in 2013/14) and NIECR (2013-present day) projects and their IT systems.

From their websites:

"The Health and Social Care Board (HSCB) is a statutory organisation. We arrange or ‘commission’ health and social care services for the population of Northern Ireland."

"The Business Services Organisation has been established to provide a broad range of regional businesses support functions and specialist professional services to the health and social care sector in Northern Ireland."

The NIECR is part of the E-Health and Care Strategy launched in 2016 by the then NI Health Minister.

[Vulture@C64]

Whatever the stated uses of the data, it's going to be misused. This is the only clear fact that will emerge from this debacle in years to come. How will a Tory government withstand the constant requests, accompanied by gifts of significant cash payments to MPs, at election time ? Boris Johnson would sell his soul to any passing devil - and has done - for a bag of gold coins and his cabinet and fellow MPs will do the same, they have no morals or scruples.

[Lil Endian]

I don't believe for a second it makes any difference which party is in power.

[Vulture@C64]

Not all Tory governments would behave so badly, the current one is a particularly bad example of government and nothing is beyond them. Would Labour do the same ? I doubt it.

[Nick Ryan]

Research Environment

Secondly, the external researchers would only access the data through a Trusted Research Environment whereby they execute queries on the data in situ, rather than moving it for analysis.

This point appears to have been missed. The Office for National Statistics (ONS) hold a great deal of personal data, Census, Labour Force Survey, Crime, and so much more. Access to this data is through their Secure Research Service (SRS) and in order to access this data one must be an Accredited Researched (I am one, hence why I know about this) and submit a project proposal listing the data analysis to be performed, the datasets required to do so and the outputs that will be generated. Once approved, all processing and manipulation of the data takes place within the SRS environment and when data is requested to be output, it is provided to the SRS staff who check it (and they really do check it, carefully) before the data is made available to take away.

Obviously, like anything else involving people and so on, there is scope for abuse and mistakes but it's a pretty solid process and much better than just giving the data away. Implementing something like this is a huge improvement compared to what the earlier NHS data grab was going to do: just hand the raw data over to private companies.

[Vulture@C64]

Re: Research Environment

That's one way to access the data for a genuine research purpose. Once the data is collected then it can be provided to any organisation via a backdoor, not every organisation will need to knock at the front door.

[Lil Endian]

Re: Research Environment

Yes, I saw this as entirely paradoxical, you may be able to correct me:

...access the data through [a web portal?]...in situ...

By in situ I'd take that to mean "on restricted and monitored premises" (to prevent unauthorised data exfiltration).

If it is through a portal then, well, who's heard of screen scraping?

[Nick Ryan]

Re: Research Environment

The ONS has secure rooms where one queries the data. Essentially it's a double remote desktop system through their provided PCs. There's no network access to anything else and cameras and such to enforce things. It wouldn't stop someone remembering the raw data and writing it down outside, however as an Accredited Researcher with them one of the things that I signed was personal responsibility: I am personally legally responsible for the access.

There are also remote access options available however I believe that this does depend on the data being accessed and the organisation requesting access. These have necessarily been more common since covid hit. The remote access is essentially a web based remote desktop session - wouldn't stop someone recording the screen remotely but the data would have to be scraped rather tediously.

[scrubber]

Never Tell the Truth to the State

"pointing towards the use of data analytics in the COVID-19 pandemic as evidence"

I don't think this means what you think it means.

Looks like the only option is to poison the well - we all need to go to our GPs with made up symptoms so that the AI cannot link anything with any degree of certainty. Not a good use of GPs' time or the inevitable NHS resources for pointless tests that will come from it, but it's the only option they have left us with.

[Lil Endian]

Re: Never Tell the Truth to the State

No down vote, but that's a terrible idea (...with made up symptoms...).

Better (IMHO) to lobby your GP for a stand against gratuitous data sharing (as seems to be gaining ground in England). If the result's not positive and proven then move GP or leave the GP and don't re-register. Leave them to help others that need their overstretched services. Use a walk-in centre when needed and available. If you have on-going medical issues and don't have the option of alternative GPs or a walk in centre, well, rock and a hard place - but better than wasting precious time.

If you report false symptoms and you need emergency care, you may find it fatal when treated for X and they don't use treatment Y (because of disinformation provided by you) and opt for treatment Z.

[Trigun]

Given the issues, both societal and legally, that loss of control or improper use of someone's personal data can lead to, one has to ask: Can the following guanatees be made?

1) that the "anonymised" data cannot be easily de-anonymised within the life time of the person

2) that the central database can never be hacked now or in the life time of anyone who's data is in it

3) that a law will never be changed or created within the life time of a person to allow their data to be de-anonymised

4) that the data will never be used for anything other than medical study

5) that the data will never be used to the detriment of the personal providing it

To be the answer is no to all oif the above, so my answer must also be no to sharing my medical data. If it was something less invasive and personal then perhaps answer would be different.

[Lil Endian]

I've little doubt you're asking rhetorically Trigun, but I'll play anyway ;)

1) that the "anonymised" data cannot be easily de-anonymised within the life time of the person

<1a> It's been declared that consensually granted data can be retracted on request, so the declared pseudo-anonymous data is traceable.

<1b> Given large enough data sets, anyone proficient in data manipulation can cross reference with a high enough degree of accuracy to negate even fully anonymised data.

2) that the central database can never be hacked now or in the life time of anyone who's data is in it

<2a> No known systems are infallible, so nope.

3) that a law will never be changed or created within the life time of a person to allow their data to be de-anonymised

<3a> Simply, no.

4) that the data will never be used for anything other than medical study

<4a> Due to <1b>, <2a> and <3a>, no, as control over the original data cannot be guaranteed.

5) that the data will never be used to the detriment of the personal providing it

<5a> No, due to <3a> and <4a>

Well, waddaya know, we agree after all! Have a beer on me --->

Just to pretend to play devil's advocate, I quote Dr. Walter Bishop "Leprechauns are possible!".

[Anonymous Coward]

Patient data being sold ? Already happened many years ago

Back in the mists of time when Pentium processor roamed the land, a U.K healthcare company hit upon a great idea. Doctors surgeries would get software / hardware / services for free and, in return, would handover their patient ( anonymous ) data. The data would then be sold by the U.K software company to other interested companies. This would then provide an income stream for the U.K healthcare company.

See here for more details https://en.wikipedia.org/wiki/Clinical_Practice_Research_Datalink

Now as GPs were getting something for free, they had zero concerns about doing this. Pre-GPDR though.

I do wonder if the Government offered a financial reward for sharing patient data how many GPs would suddenly change their minds about any privacy concerns.

[Nick Ryan]

Re: Patient data being sold ? Already happened many years ago

If the data was truly anonymous and not trackable back to a living individual then it'd be find under GDPR rules.

[Doctor Syntax]

"Former health secretary Hancock was said to be a passionate supporter of data sharing...r an affair that appeared to contravene COVID-19 restrictions was made public... The ICO is investigating that data leak."

Odd, isn't it? When it's someone else's data it's "sharing", whenit's his own it's a leak.

[steelpillow]

Oversight

This is patient medical data, which all doctors swear to keep confidential, right?

Exceptions are sometimes made for medical research purposes, provided the stats are properly anonymised or the patient gives their explicit consent, right?

Doctors are the ultimate administrators of those exceptions, right?

So why are this repository and its administration being specified by politicians and not by doctors?

[Nick Ryan]

Re: Oversight

So why are this repository and its administration being specified by politicians and not by doctors?

Cynically I suspect that very much it's not the politicians that doing the specifying, it's the organisations (likely US pharma) that are paying the politicians that are doing the specifying.

[Dante Alighieri]

for varying definitions of confidential

There are other duties that in some circumstances require disclosure [threats to life etc.]

And it is a loooong time since Doctors ran anything in the NHS

Anonymisation on a population level is impossible. I *can* find you

JFS&G : GMC pays for private healthcare for it's employees.

And we haven't been a profession for a looooooooong time - we don't manage ourselves - GMC is a QUANGO and it is about time the UK gov was honest enough to recognise this and pay from direct taxation. </rant>

had a couple....