NHS GP data grab: Royal College of General Practitioners urges health body to communicate better

The UK's Royal College of GPs (RCGP) has written to NHS Digital to call for better communication with the public about their rights in opting out of what has been dubbed the "biggest data grab in NHS history." The professional body, which runs GP accreditation in the UK, said it supported the principle of improved sharing of …

[Trigun]

The trouble is with this kind of thing is that once the data is out of your (and the GPs) hands then it's out and there's no going back. Bit like giving your details to social media sites.

[Andy The Hat]

Right to opt out

So let's take that statement at face value and say "all patients have a right to opt out".

How does the 80 year old with no internet access fit into this model and how do they even know this is happening?

A right to opt out should be explicitly given *before* data is taken, not by making an assumption that the person would give their consent if they were told about it ... I wonder whether "selling a persons medical history", through statute or not, is a breach of Human Rights Act rights to individual privacy?

This is personal data of the most delicate kind which is supposedly "anonymised". Somehow I'm not sure I believe removing a name, dob and address is sufficient for that to be the case. Researchers want to know important basic information - where the patient was from, what age they were when a condition was seen, what medication/care was given and what the outcomes were. Already that gives approximate location, age, medication history (easily cross referenced back to NHS prescription records), hospital care and outcomes (easily cross referenced back to hospital admission records ...). Are these NHS records being made available? If so "anonymisation" is a complete fallacy.

[AMBxx]

Re: Right to opt out

Keep shouting this very loudly.

Your patient data is not anonymous. Each of us has a unique transaction history. You only need to know a few of those transactions to identify a patient.

I did some work for a company that does scans for the NHS. This was around the time that David Beckham was being scanned for his metatarsal. Wouldn't have taken much to find that in the data. If that had been part of his NHS data, it would have been trivial to have his entire medical history.

[Gene Cash]

Re: Right to opt out

In the US, a single dental x-ray is sufficient to identify someone. That's a common process used to identify bodies. So I don't see how any level of anonymization could be done.

[Anonymous Coward]

Re: Right to opt out

> In the US, a single dental x-ray is sufficient to identify someone.

Only if you have their decomposing skull in your hands after digging it out of a shallow grave.

Or you actually saying that the x-ray machine id stamps each image?

[Yet Another Anonymous coward]

Re: Right to opt out

>How does the 80 year old with no internet access fit into this model and how do they even know this is happening?

The doctor will write to them, in doctor's handwriting explaining the options to them in latin.

[Ben Tasker]

Re: Right to opt out

> This is personal data of the most delicate kind which is supposedly "anonymised".

It's worse than even that.

They intend to psuedonymise it, not anonymise. Your data will be allocated an identifier.

Under certain circumstances they may reverse this and link back to you. For example, if researchers are looking for people with "x" in order to ask them to participate in a clinical trial.

So, it's being shipped *explicitly* with the ability to be re-associated, all but guaranteeing that at some point they'll fuck up and it'll all get reassociated by accident.

[Roland6]

Re: Right to opt out

>"all patients have a right to opt out"

"The RCGP and the BMA, the UK doctors' union, have been working with the NHS on planning the new collection of data over the past three years through their Joint GP IT Committee. "

So even before the UK had left the EU, the Government and others had decided to ride roughshod over GDPR and the requirement for a positive opt in...

[EnviableOne]

Re: Right to opt out

I have been trying to tell them this all through the process.

an opt-out is not compatible with GDPR

The ICO will force them to roll it all back exactly as happened with Care.data and the link-up with DeepMind

[Roland6]

Re: Right to opt out

>The ICO will force them to roll it all back

Have the ICO actually done anything yet? I ask as I've not seen them mentioned in any of the reports to date. The ICO needs to act before June 23rd, otherwise it will be bolting the door after the horse has bolted, something UK governments have shown themselves to be quite good at...

[steelpillow]

Isn't there a law against that?

"NHS Digital, the non-departmental public body, which designs, develops and operates national IT and data services, has said it would "not approve requests for data where the purpose is for marketing... including promoting or selling products or services, market research or advertising.""

"However, data available on the NHS Digital website already shows firms are using hospital patient data for this purpose."

[Roland6]

Re: Isn't there a law against that?

Note the omission of any mention of permitting (US?) businesses looking at the data with the intent of offering privatised NHS services...

[cantankerous swineherd]

general practitioners have been recruited as government spies.

[Yet Another Anonymous coward]

Thank goodness, at least you know you want get a knock on the door out of hours.

I quite like the idea of a Stasi that are only available 10-4 and have a 2 year waiting list for interrogating you and don't do house calls

[Anonymous Coward]

Opt out here

There are two ways to opt out, apparently:

General Practice Data for Planning and Research (GPDPR)

[Ben Tasker]

Re: Opt out here

> There are two ways to opt out, apparently:

No, they're two different things.

- The type 1 stops the slurp - your data doesn't leave your GP.

- The national data optout still allows the central slurp, but prevents it being provided - in a non-anonymised form - to third parties.

Really, you probably want to do both. If you only do the National Data opt-out, then NHS Digital will still slurp and hold your data.