NHS data sharing project ‘creates new set of risk for individuals’ - warns privacy expert

The data collection project by NHS Digital - known as the General Practice Data for Planning and Research - will involve records of 55 million NHS patients being pooled together into a single resource that will be available to academics and commercial third parties.

The scheme was originally set to begin on 1 July, but has now been pushed back by the Government to 1 September following privacy and transparency concerns.

Health minister Lord Bethell said the implementation date of the scheme would be pushed back to ensure “that it is as effective as possible”.

Speaking in Parliament, Lord Bethell told peers that the GP data programme “will strengthen the system and save lives”, but added: “That’s why we are taking some time to make sure that it is as effective as possible so the implementation date will now be September 1.

“We will use this time to talk to patients, doctors and to others to strengthen the plan, to build a trusted research environment and to ensure the data is accessed securely.”

‘A new set of risks for individuals’

Concerns over privacy is one of the key reasons the project has been delayed.

David Sygula, Senior Cybersecurity Analyst at CybelAngel, says that while there are benefits of data collection in healthcare, a project of the size the NHS is undertaking comes with risks.

He says: “An initiative like this could have been useful in better controlling the magnitude of the pandemic.

“However, data collection on this scale is creating a new set of risks for individuals, where their Personal Health Information (PHI) is exposed to third-party data breaches.”

Critics of the project have also warned that there needs to be more transparency around who data will be shared with.

The Government has stated that it will be made available to academic and commercial third parties, but Abbas Kanani, pharmacist at Chemist Click, says that patients need to be informed of exactly what data is being shared and who it is being shared with.

Mr Kanani says: “Using the term ‘third party’ organisations is not good enough.

“If patient confidentiality can be maintained, and the initiative will not put too much pressure on healthcare professionals, in principle, it seems like a good idea.

“However, this needs to be well thought out and structured to allow a smooth process.”

Despite concerns over privacy, NHS Digital said that data will be “safeguarded” and procedures will be in place to ensure this is the case when the project is launched.

A spokesperson for NHS Digital said: “The data will only be used for health and care planning and research purposes, by organisations which can show they have an appropriate legal basis and a legitimate need to use it.”

Details of the organisations who have accessed data will be able to be viewed on the NHS Digital website.

The data release register shows which organisations have accessed data at a particular time, and each time an organisation wants to request data for a new purpose, they have to go through the application process.

If an organisation had accessed data for one purpose and they wanted to use it for something else, then they would need to reapply for a specific purpose.

The spokesperson added: “We take our responsibility to safeguard patient data extremely seriously.

“Researchers wanting to access this data will need each request to be approved by the Independent Group Advising on the Release of Data (IGARD) and a GP Professional Advisory Group (PAG), with representatives from the British Medical Association and the Royal College of General Practitioners.”

GP records play an important part in research

An NHS Digital spokesperson said that patient data is already used every day “to plan and improve healthcare services, for research that results in better treatments, and to save lives.”

The National Data Guardian, Dr Nicola Byrne, also said “it is vital that data is used to improve health and care through research and planning,” explaining that “information in GP records has an important part to play in making sure that researchers and planners have the information that they need to answer questions such as where services are needed and what kind of treatments are most effective.”

Dr Byrne said that “public attitudes research demonstrates that patients and service users are supportive of health and care data being used if certain expectations are met,” including that the data delive­­­rs “a public benefit and that it is made clear to them what will and will not be done with the data, and what choices people have about its use.”

The project has now been delayed until 1 September in order to allow time for the Government to communicate more details on the project, and to give people time to opt out.