Care.data has been scrapped, but your health data could still be shared

MangoNic/Shutterstock.com

Following a review by Dame Fiona Caldicott, the UK government decided to pull the plug on care.data, a controversial NHS initiative to store all patient data on a single database. This may seem like a victory for data-privacy advocates, but NHS data-sharing initiatives are still being planned and the goalposts are being moved on patient consent.

A lot of NHS-related news was released on the day the Chilcot report was published – presumably in the hope it would be buried. Alongside a crucial statement from health secretary Jeremy Hunt about the junior doctors’ contracts, there were the two related items of the Caldicott report on medical data and consent and a statement by minister for life sciences, George Freeman, which announced the end of care.data.

Care.data was an initiative that aimed to add patient records from GPs’ surgeries with existing data already collected by the NHS data centre, HSCIC. The resulting single database could then be used for medical research, NHS planning and maybe even commercial exploitation. The 2012 Health and Social Care Act ensured that any data sharing would be legal, even in the absence of patient consent.

In April 2013, Hunt promised that patients would be allowed to opt out of their GP data going to HSCIC (“type 1” objection), and any of their data leaving HSCIC (“type 2” objection). These options were communicated to the public in a doormat leaflet.

Jeremy Hunt promised opt-outs.
Andy Rain/EPA

But GPs raised concerns about the clarity of the information in the leaflet. They also raised concerns about patient confidentiality. To add to the anti-care.data sentiment, stories of earlier dubious NHS data-sharing deals began to emerge. These issues and others ensured ongoing postponements of the launch of care.data.

Type 1 opt-outs came into effect, not that it mattered as the care.data upload of GP data to HSCIC never happened. About 700,000 patients chose the type 2 opt-out but, even though the opt-out was applicable immediately, it was disregarded by HSCIC until April 2016.

Caldicott review

Caldicott was asked to review NHS data handling, including consent and opt-outs of care.data. Caldicott’s much delayed report said that the government should “consider the future of the care.data programme”, but it didn’t go as far as to say it should be axed. So how and why did the report lead to the care.data programme being scrapped?

The answer lies in the recommendations made by Caldicott on opt-outs. They back-pedal significantly on the concessions made by Hunt in 2013. The easiest way for the government to recant Hunt’s concessions is to withdraw the care.data programme they are associated with, and start with a clean slate. To be fair, the report strongly recommends an extended public consultation, so the new model isn’t a done deal yet.

In Caldicott’s new proposals, medical records from GPs’ surgeries can be sent to HSCIC without patients’ consent. The report argues that HSCIC is a safe haven for all medical data.

Significant limitations on type 2 objections have also been proposed. For “legally mandatory” data collection for HSCIC, such as Hospital Episode Statistics (data on treatment in NHS hospitals), opt-outs won’t apply. Also, opt-outs won’t apply to any anonymised data passed on to HSCIC’s customers, such as NHS divisions and research organisations.

The new Caldicott consent model explicitly excludes the use of medical data for marketing and insurance purposes. But companies that do data analysis for the NHS are viewed as “inside the tent” of a partially privatised NHS and will not need patient consent to receive data.

Care.data is dead, long live care.data

The man who officially pulled the plug on care.data, George Freeman, makes it clear that despite the end of care.data, medical data sharing is still firmly on the table, stating that “the government and the health and care system remain absolutely committed to realising the benefits of sharing information”.

This also shows in the NHS’s plans for care.data successors, one of which appears to be a “single GP dataset” – basically, care.data without the opt-outs.

Caldicott and the government are taking a new negotiating position with GPs and patients on data sharing, in which the usefulness of the data takes the upper hand. The mechanism proposed for “consent” consists of providing information, and then granting patients a few limited opt-outs. As this does not sit well with the new European data protection law’s idea of consent (a “clear affirmative action”), we should expect further developments, both in the public debate and on the legal side.

Correction: On July 21, 2016, the sentence: “Type 1 opt-outs never came into effect as no data was sent from GPs’ surgeries to HSCIC.” was replaced with: “Type 1 opt-outs came into effect, not that it mattered as the care.data upload of GP data to HSCIC never happened.”

Eerke Boiten receives funding from the UK government for the Kent Academic Centre of Excellence in Cyber Security Research, as well as from the EU for an Innovative Training Network in Cyber Security.