Freedom of information requests raise questions over the level of anonymity of patient data shared with private partners
A claim by the Department of Health that patient data shared with private firms for medical research would be anonymised has been challenged by privacy campaigners.
The prime minister said last week that plans to share records and other NHS data would make it easier to develop and test new drugs and treatments. The DH says all necessary safeguards would be in place to ensure protection of patients' details.
But Ethics and Genetics, a social and technology campaign group, says freedom of information requests show that under certain circumstances data anonymity would not always be guaranteed.
Data accessed under the secondary uses service, which is jointly delivered by the NHS Information Centre and Connecting for Health (CfH), for the NHS and its partners, is not always anonymised.
The CfH states on its website that the service only provides access to "anonymous patient-based data" for purposes other than direct clinical care, such as healthcare planning, commissioning services, public health and national policy development. However, this is at odds with the health department's FoI disclosure.
When asked whether the data accessed under the service was always anonymised, the DH said it was "not always accessed in an anonymised format." Access to identifiable information is, however, limited to those circumstances where legal permission has been granted by the secretary of state for health under the 2002 NHS control of patient information regulations.
The department said that there were instances where data was accessed after it had been pseudonymised. Although the information is protected – through NHS smart cards and pass codes – and access only given to relevant data by authorised organisations, pseudonymised data is not the same as anonymised information, and there are ways of making identifiable links.
"If requested 'de-pseudonymisation' would only be undertaken on a record-by-record basis and would require approval of the NHS information governance department," the DH said.
In a separate FoI request, the DH was asked how many times section 251 of the NHS Act 2006 has been used over the last three years. The section grants the use of patient's identifiable data without consent, but also has to be approved. The department revealed that it was granted 42 times in 2008-09, 36 in 2009-10 and 54 times in 2010-11.
Ethics and Genetics says the government needs to make a clear distinction between anonymised and pseudonymised data.
Nick Pickles, director of privacy campaign group, Big Brother Watch, said there was a need for more information about how patients' health data was currently being used and how it would be used under the new proposals. He said a lack of detail was an "unnecessary concern".
"The safeguards in place need to be robust and clearly communicated," he said. "The long-term risk to privacy of patients' identities and their health details being connected cannot be quantified, so these plans should be implemented with absolute care."
The government has repeatedly said that it is committed to protecting patient privacy, but argues that it makes sense to utilise the substantial amount of medical information that the NHS generates.
It also hopes that opening up patient information further will lead to patients getting faster access to new treatments and Britain's life sciences sector will become a world leader.
NHS patient data glossary
Connecting for Health
Part of the Department of Health and formed in 2005. It is responsible for delivering the national programme for IT and has responsibility for the procurement and management of the contractual and technical delivery of the secondary uses service.
The NHS Information Centre for health and social care
England's central source of health and social care information. It has overall responsibility for delivering the secondary uses service to users, commissioners and providers of NHS funded care.
Section 251 of the NHS Act 2006 allows the use of patient identifiable data without the subjects' consent. It effectively provides "relief" from the common law duty of confidentiality, which requires patient identifiable data only to be used with consent.
Part of the NHS Care Records Service, which aims to create an electronic care record for all of England's patients. Initial plans aimed to have the Spine as a central electronic database. The secondary uses service is one part of the spine.
This article is published by Guardian Professional. Join the Guardian healthcare network to receive regular emails and exclusive offers.
Read the complete post at http://www.guardian.co.uk/healthcare-network/2011/dec/12/nhs-patient-data-anonymity
Dec 12 2011, 05:57 AM
Healthcare Network | guardian.co.uk