The relationship of confidentiality between doctor and patient may be ending. From next year, our medical records are likely to be seen by many more people, in addition to our GP, hospital doctor or nurse, and potentially used in different ways, including by private companies aiming to increase their profits, without our consent being required.
Early in 2014, all 22m households in England are to receive a leaflet on the "care.data" programme, being run by an offshoot of NHS England, the Health and Social Care Information Centre (HSCIC). Its role is to harness information in patient records to use in planning, commissioning and improving health services, in line with a pledge by David Cameron to open up the use of patient information to NHS planners and commercial companies. A large part of the remit is to sell "aggregate" patient information to the private sector. The General Practice Extraction Service will start to download details of patients' conditions, treatment and medical histories from GP-held records and build a central database, unless patients opt out.
There are growing concerns that the use of patient data has the potential to damage the relationship between patient and doctor. Some critics fear that many patients will be more reluctant to have an open discussion with their GP or consultant if they suspect that information could be shared with outside bodies, within the NHS and the private sector and be stored for future use, without their consent.
At a press briefing, Dr Mark Davies, medical director of the HSCIC, said the question of who owned medical records was a legal grey area, but that "ethically and philosophically" they were owned by patients. However, in a recent letter to Stephen Dorrell, chairman of the all-party Commons health committee, the information commissioner, Christopher Graham, says that "technically, medical records are owned by the secretary of state for health". He then adds: "However, in data protection terms, the issue is not one of ownership but of control over the information contained in the record."
The first phase of the programme will join up patients' GP and hospital care records, a huge task in itself. Its long-term goal is to merge medical and social care records, opening up another area of concern. Sue White, professor of social work at Birmingham University, said this could cause many women with mental health issues or problems with domestic violence to withhold information from their GP if they think it could be passed on to social services, potentially affecting their medical care.
"Many women are already reluctant to be completely open with their GP as they don't trust the system, and if this scheme goes ahead, there will be a risk that some women will not be open with their doctor, as they will think it is not completely confidential," White added. "So a woman facing domestic violence may not tell their doctor about it – I certainly wouldn't if I was in that position."
The HSCIC, which claims its IT safeguards will ensure there is no breach of confidentiality of patient records, aims to make data available in three formats: identifiable data, containing identifiers such as date of birth and postcode, but only where there is a legal basis or with patient consent; potentially identifiable data, containing a unique "pseudonym" for each person but no "real world" identifiers; and non-identifiable or aggregated data.
Phil Booth, a co-founder of MedConfidential, a campaign group on data privacy, said: "Many IT experts say it will be possible to re-identify this so-called pseudonymised patient data if you know how to go about it, and this is what many commercial companies want – to be able to identify groups and types of patients, and use that data for marketing."In addition, around 800,000 NHS employees can already access a certain level of patient data with their NHS swipe cards, so how many of these people will be able to access this pseudonymised data? This is all being done quietly behind the scenes and patients need to know more about how their data will be used before they give their consent to their records being used in the care.data programme."
