Patient records to be made available to the private sector and other researchers

[Zetetic]

Why would GP system manufacturers want to do that? (Think there's three left in England?) EMIS co-runs the QResearch database, for example, so they're not exactly neutral.

[olliebean]

Come to think of it, why is this opt-out in the first place? I thought GDPR meant this sort of thing had to be opt-in these days?

[Zetetic]

There are various lawful bases for processing data under GDPR[nb]/conditions in the context of special category data, which all this is.[/nb].

You can launder a lot of processing, so long as you actually do it in a public university. Edit: Which is arguably why it's been so attractive to build these things up - because you can't sell the actual data on, private companies have to fund staff time.

(This is something of a matter of debate, with some people trying to argue that various groups have been acting unlawfully since 2018. A further complication is that GDPR established that pseudonymisation didn't stop data being personal data.)

[Pinball]

https://medconfidential.org/how-to-opt-out

[Midas]

Has NHS Digital clarified until which date people will now be able to opt-out (presumably 23 August)? Wonder how effectively this 2 month delay will be spent...

[olliebean]

The calculation is probably along the lines of: "Everyone will be so busy with the third wave of Covid by then, we can slide this in under the radar like we originally planned."

[Pinball]

Sign the petition!

https://www.change.org/p/the-department-for-health-and-social-care-stop-the-share-of-nhs-data-and-paid-access-without-informed-consent

[olliebean]

Sign the petition!

https://www.change.org/p/the-department-for-health-and-social-care-stop-the-share-of-nhs-data-and-paid-access-without-informed-consent

10 years' worth of YOUR NHS data will be collected for a "wide variety of research and analysis to help run and improve health and care services".

Only 10 years' worth? I hadn't realised this. The only thing they've got on me from the past 10 years is my Covid vaccination details.

[Pinball]

The non-consensual data grab has been postponed to 1st September:

https://medconfidential.org/news

IMO it should be opt-in and require our informed consent, the first step of which is for the government to bother to inform the UK populace of this. The NHS doesn't own us, nor does the government, and it's our data and private information they wish to profit from. Even as we speak, directorships, contracts and companies are being set up to make money from us.

[Zetetic]

IMO it should be opt-in and require our informed consent, the first step of which is for the government to bother to inform the UK populace of this.

English populace, surely?

it's our data and private information they wish to profit from.

The data in question belongs to and is controlled by private contractors called "GPs". It happens to be your "personal data".

[TrenterPercenter]

The non-consensual data grab has been postponed to 1st September:

https://medconfidential.org/news

IMO it should be opt-in and require our informed consent, the first step of which is for the government to bother to inform the UK populace of this. The NHS doesn't own us, nor does the government, and it's our data and private information they wish to profit from. Even as we speak, directorships, contracts and companies are being set up to make money from us.

Not sure why I'm bothering again but...

Good to be cautious but some things to consider (again);

It's good that they extended the opt-out timeframe - informing the public is important for opting out; a feasible timescale would be decided by ethics and informed by all the groups mentioned before that are part of the NHS (and parts that have regularly taken on the government).

Opt out procedures are legal; they occur all of the time. GDPR and ethics boards across the world accept them as reasonable under certain circumstances.  NHS Digital are not doing anything wrong or unethical; they've literally been give ethical approval for doing it - this is because the data is not as incredible as some of you seem to think it is; it isn't being sold to insurance companies any third party "sale" needs to be vetted as to their usage.  The data isn't personal to individuals; the best you could hope for is wholesale geographical trends of health and engagement with primary care.....which is exactly the kind of data you need to improve outcomes especially for disadvantaged communities.  I'm saying this because I understand what this means practically, not because I work for NHS Digital or whatever other paranoia belief people have cooked up here.

Also, people keep going on about health insurance, why is everyone suddenly so concerned about protecting what is essentially private healthcare; why not target a private insurance providers ability to add pre-existing conditions as a term of service; this data if used in the way people seem sure it will be (despite it clearly not being able to be used for this) would allow insurers to up peoples premiums if they live in certain areas..........something that they do already; or in this other world where they can identify you; this practically amounts to us saying we want to support those people that lie about their health to private insurers; I mean it is a worthy Robin Hood-esque sense of duty, robbing the rich to give to the poor people that can afford private healthcare insurance and are already contributing to destroying the concept of universal healthcare, but fine if people want to die on that hill be my guest; just quite ironically I think being informed about what this actually means is important.

Saying things like "the NHS doesn't control us" is down right chilling; and absolutely has more in common with rightwing conspiracy theorists and anti-NHS privateers than anything else.  No the NHS doesn't control you it fucking keeps you and people that would never be able to access private insurance or healthcare alive; it isn't personalised to you and if you want to go down the route of saying "I want to opt-out of paying my taxes then" be my guest and join the ranks of the rest of the rightwing self-interested paranoid not so silent-majority.  It's frankly ridiculous your data in the main is going to improve the universal healthcare you have in this country; this isn't some "patronising" emotional trick being pulled on you it's just the other side of things that needs to be considered when inadvertently worrying about how your data will be used to identify you and stop you being able to get one over in your bets with an insurance company (see it's really easy to just exaggerate and be economical with what is being said).

Yes; data is a concern; but it is not identifiable; this question about anonymity sure is a technical one but for all intents and purposes you are anonymous to any third party; this is an anally retentive view of the process one which is being fixated on at the cost of everything else.  It's always a cost benefit analysis which is incredible hard to do if you are adamant that something is completely immoral or unacceptable from the start.

Fuck it post.

[TrenterPercenter]

Edit glitch.

[olliebean]

It's good that they extended the opt-out timeframe - informing the public is important for opting out; a feasible timescale would be decided by ethics and informed by all the groups mentioned before that are part of the NHS (and parts that have regularly taken on the government).

Interesting; previously you were saying it was fine and everyone had in fact been informed. FTR, I still haven't seen or heard any official notification of this (the fact that it's on some web page that you won't bother to look for unless you already know about it doesn't count) - I'll be waiting with interest to see if they get around to that before the new deadline. I suspect it's being left up to GPs to inform their patients directly (or not).

[TrenterPercenter]

Interesting; previously you were saying it was fine and everyone had in fact been informed.

No I did not say that at any point.  In fact I said this some time back; which predicted the now response of ethics reviewing everything again.

There is a very good claim to ethics that the public does not know enough about opting out if someone actually bothered to do that work rather than repeating newspaper headlines that are just designed to get you anxious so you click on them to read them (an quite ironically give them your data in most cases).

[Pinball]

Interesting; previously you were saying it was fine and everyone had in fact been informed. FTR, I still haven't seen or heard any official notification of this (the fact that it's on some web page that you won't bother to look for unless you already know about it doesn't count) - I'll be waiting with interest to see if they get around to that before the new deadline. I suspect it's being left up to GPs to inform their patients directly (or not).

The last big NHS Digital cockup (which was canned) was care.data in 2014, when they did send out information to the public, albeit in Royal Mail junk mail so a lot of people threw it out without realising.

https://www.bbc.co.uk/news/health-26259101

This time they aren't even bothering to tell the public, the diametric opposite of informed consent. I take the point about opt out being legal, but the issue is that they haven't told people about it, so how can you opt out? Obviously one hopes previous opt outs will remain in place, but I'm assuming not. I only found out about the latest proposed Orwellian nightmare because I'm on the Med Confidential email list.

IMO this should require informed consent opt-in.

[Zetetic]

Obviously one hopes previous opt outs will remain in place, but I'm assuming not.

Third-party extractions are already ignoring Type 1 opt-outs.

[Zetetic]

Interesting to consider what NHS Digital already have with personal identifiers:
- Already have pretty much any interaction with non-GP services (inpatients, outpatients, IAPT, CMHTs...) and what diagnoses and procedures/interventions you had done during it
- Dispensing data (so they might not know why you're getting sertraline, but they know you're getting it)

(They also already get some GP data with personal identifiers.)

Trying to think what else I might be missing, and what they can't already infer about you. Co-morbidities and findings that don't/didn't have (NHS-funded) treatment/referral outcomes, I guess. (And some interesting edge-cases like the gap between prescriptions and dispensing, and advice to obtain OTC medication or similar.)

[Zetetic]

Easy access to GP data would arguably be a lot more valuable in NHS Wales and NHS Scotland, thanks to the lack of usable data from services that the English NHS put a lot more effort into collecting data from (often for bad-ish reasons, but still).

[olliebean]

Interesting; previously you were saying it was fine and everyone had in fact been informed.

No I did not say that at any point.

Here's what you said, that I was thinking of (emphasis mine):

Everyone is given the right to opt-out and has been informed (as to what has been deemed sufficient by an ethics board) about this.

[TrenterPercenter]

Everyone is given the right to opt-out and has been informed (as to what has been deemed sufficient by an ethics board) about this.

Also that comment it is quite clearly in relation to the text immediately above, that you chose to omit, which shows I am talking about opt out procedures in general ffs.

here is the text above;

You are allowed; and always have been allowed to use non-consent procedures for certain types of data i.e. if the data is low risk to an individual; the data is de-identified/de-personalised to the individual; the data is a in the "public interest" (something called public task - hence why selling it to people for purely commercial reasons disqualifies it)...and a few other things.

Everyone is given the right to opt-out and has been informed (as to what has been deemed sufficient by an ethics board) about this.

Do you think this is a good advert for informing people and being honest and upfront?

[Pinball]

In what ways has NHS Digital informed the GBP about this latest incantation?

[TrenterPercenter]

In what ways has NHS Digital informed the GBP about this latest incantation?

Well I don't know (other than putting it on their website) which is why I think it is worth investigating.  In order to secure ethical approval they would have needed to explain their opt out procedure; how opt outs can be enacted and how people would be informed of their ability to opt out.  That should be publicly accessible information agreed on by a ethics board the HRA to be exact.

Much better for any concerned about this to look there than taking secondhand information from outlets whose intentions are unclear.  Despite olliebeans misrepresentation I was concerned about this very thing earlier in the thread.

What you can't do however is treat this as "informed consent" this isn't informed consent; it is an opt out procedure. You can disagree about whether it should be or not but this is a different argument with different points to be made, you can't flip between two very different procedures as if they are the same thing (it's why you see them as diametrically opposed; well that is mainly because they are in lots of way diametrically opposed procedures).

It's an opt out procedure which means it has to uphold a schedule of considerations but providing informed consent obviously isn't one of them.  They will need to, as reasonably possible, provide information on how to opt out should someone wish.  It could be that the ethics committee said due to the long time period from when it was first announced this was sufficient for them just to have it on their website - I don't think that is the case rather that is just an example of the risk assessments, arguments and recommendations an ethic boards might make.  It could be that NHS Digital said/or were told they would communicate this to GP practices with instructions to disseminate to patients there (would make sense as they have email address etc..) but as mentioned Covid happened which has turned everything on it's head. 

The thing is to deal with what the ethic board said/allow/recommended rather than engaging in a lot of paranoia around your personal identifiable data being sold to private insurance companies and you can do nothing about it because it is all a big conspiracy, all of which isn't true.  Risk is what informs ethics and the data is very low risk that keeps getting forgotten in all the mission creep[nb]Yes there is concern that re-identification could happen but this is just a risk the same as anything else anyone could lie cheat etc..that is when it becomes a criminal matter not an ethics one[/nb].

[Zetetic]

One of the things that mostly strikes me as lazy is the lack of arrangements to retrospectively remove your data upon request. This is eminently technically possible, extremely so in NHS Digital's setup where they aren't enforcing strict organisational barriers to pseudonymisation keys.

[olliebean]

Also that comment it is quite clearly in relation to the text immediately above, that you chose to omit, which shows I am talking about opt out procedures in general ffs.

Apologies, it seems I misunderstood what you were saying at the time. If I understand you now, your point was that for the general case, certain uses of data are allowed provided "Everyone is given the right to opt-out and has been informed (as to what has been deemed sufficient by an ethics board) about this" - is that right?

[TrenterPercenter]

One of the things that mostly strikes me as lazy is the lack of arrangements to retrospectively remove your data upon request. This is eminently technically possible, extremely so in NHS Digital's setup where they aren't enforcing strict organisational barriers to pseudonymisation keys.

So your data has been pseudonymised i.e. identifiable data has been coded with a key to unlock that identifiable data held at NHS Digital.  A research group buys your pseudonymised data as they want to investigate future bladder problems in patients prescribed x drug.  They recode the data for their means and assign new completely random study IDs they share this dataset with other researchers working with them and proceed to carry out a national level analysis on drug x vs appointments for bladder problems.  This is a success they find that after a certain age drug x is associated with bladder infections.  They publish these results.

You suddenly want to retrospectively remove your data; you data is now in pile of other non-identifiable data it is potentially linked via an original spreadsheet that has NHS Digital pseudonymised code on it but other researchers that were working on their own spreadsheets may not have access to it; may have left their positions or didn't code accurately.  Also your data is contained in a journal article that has been published and downloaded 5000 times internationally.  Drug x company requests the data; the raw coded data is made available to them.

It cannot be retrospectively removed it is virtually impossible without root and branch deletion.

This is a nuance of your data.  Your data can anonymously contribute to something; and that is what is happening. One of the main problems with this thread has been to simultaneously underestimate and not fully understand the early important step of de-identification, overestimating "the tech" involved (beyond NHS Digitals de-identification software and some APIs there isn't much to it) and the use of this data, largely discussing it as still being identifiable when it isn't.  The arguments about anonymity vs pseudonymised are also largely theoretical.  In theory if you were the only Chinese person at GP practice your data could be identified to you from your demographics but what researchers are looking for practices with one Chinese person doing? the identifiability of the individual is in another sense random (down to local populations) - the question is what is the realistic, reasonable risk regarding this? what kind of study just wants to identify and collect data on these quirks of population distribution.

[bakabaka]

The thing is to deal with what the ethic board said/allow/recommended rather than engaging in a lot of paranoia around your personal identifiable data being sold to private insurance companies and you can do nothing about it because it is all a big conspiracy, all of which isn't true.

Trenter - why then do medical research companies like the one I described above keep insisting on de-anonymised data? If they aren't selling the data to private insurance companies, what value does it have that is worth breaking the law for?

I'm trying to get some useful information from this thread as I have a meeting tomorrow with another research project that may well be funded by the same company. As a patient representative, it would be useful to know what the real driving forces are over this; so little of the debate is nuanced.

[TrenterPercenter]

Apologies, it seems I misunderstood what you were saying at the time. If I understand you now, your point was that for the general case, certain uses of data are allowed provided "Everyone is given the right to opt-out and has been informed (as to what has been deemed sufficient by an ethics board) about this" - is that right?

misunderstood or mislead? or lied? or is it only researchers that are the only ones that aren't allowed to make mistakes? I being purposely pedantic here.

I was saying that in order to get ethical approval the ethics board will have considered the risks of the data; that assessment includes what the data is and what procedures are in place for handling the data including opt outs.  If we consider an "opt out" procedure it is a basic consideration to think how can someone might opt out which involves how does someone hear about their opportunity to opt out. If you are doing some debate guy schtick about "everybody is given the right" understand that this always in regards to what is deemed reasonable; the real world doesn't work in the realm of internet discussions and obsessive sticklers for the sanctity of words; it will be what is reasonable and balance between the advantages vs risks (which is why going on about it all as being identifiable and "the holy grail" for insurance companies is really misleading and confusing considering what it is).

The ethics board would have asked and what are you doing to allow people to opt out?

And NHS Digital might have said something like "we will advertise this on our website, inform all GP practices of our intentions and request they communicate this to their patients (maybe there are provided flyers in GP surgeries?) and carry out press releases to major newspapers.  The ethics board might have said ok we think this is a reasonable process.  I saying finding out what they actually did is key and that any information campaign was going to suffer over the last 2 years.  This needs to be considered, not blindingly agreed with, but added into the mix and considered against the quite paranoid and angry accusations of intention to mislead into conspiracies with the government to sell your data to insurance companies to people being tracked individually.

I mean just basic a consideration of how in this age paranoia around data that this might actually get out of hand and be a bad thing would be nice.

There are also two separate issues regarding personal moral usage of data that keep getting muddled into one.

Are you identifiable? (I will be personally targeted by insurance companies)
What is your non-identifiable data contributing to (my data will contribute to insurance companies doing x)

[TrenterPercenter]

Trenter - why then do medical research companies like the one I described above keep insisting on de-anonymised data? If they aren't selling the data to private insurance companies, what value does it have that is worth breaking the law for?

I'm trying to get some useful information from this thread as I have a meeting tomorrow with another research project that may well be funded by the same company. As a patient representative, it would be useful to know what the real driving forces are over this; so little of the debate is nuanced.

Hi bakabaka I'm sorry I haven't been following the thread all the way through; could you give me some more details/point me to the post, I can give you a better answer then.

[Zetetic]

So your data has been pseudonymised i.e. identifiable data has been coded with a key to unlock that identifiable data held at NHS Digital.  A research group buys your pseudonymised data as they want to investigate future bladder problems in patients prescribed x drug.  They recode the data for their means and assign new completely random study IDs they share this dataset with other researchers working with them and proceed to carry out a national level analysis on drug x vs appointments for bladder problems.  This is a success they find that after a certain age drug x is associated with bladder infections.  They publish these results.

You suddenly want to retrospectively remove your data; you data is now in pile of other non-identifiable data it is potentially linked via an original spreadsheet that has NHS Digital pseudonymised code on it but other researchers that were working on their own spreadsheets may not have access to it; may have left their positions or didn't code accurately.  Also your data is contained in a journal article that has been published and downloaded 5000 times internationally.  Drug x company requests the data; the raw coded data is made available to them.

1. "What?!?! You want me to rewrite all my journal articles?!?!" is absurd.
2. TRE service should mean that relatively few third party users are extracting individual-level data from NHS Digital, so the "What?!?! How are you going to delete it from all the copies that we've spewed into the world?!?!" is point-missing at best.

Don't treat me like an imbecile.

[bakabaka]

Hi bakabaka I'm sorry I haven't been following the thread all the way through; could you give me some more details/point me to the post, I can give you a better answer then.

Well, that and the fact that the first time I was patient rep. the American research (and medical insurance) company who wanted to join the project insisted that the data be de-anonymised but wouldn't give a reason why. When we pointed out that this would be illegal they pushed again but finally accepted we wouldn't be persuaded. But when the contract finally came through, it was back in there and in the end they backed out, delaying the whole project by a year.

They're a start-up medical research company with funding from various larger companies in 'Big Pharma'. They did seem determined to get the data, which implied to me that there was a market for it. The fact that the de-anonymised data would have no relevance to the research just added to that feeling.