Issue 39 October 2021 - Journal - Page 120
NHS medical records:
What is happening with patient data?
NHS Digital was due to change the way GPs stored patient data on the 1st
September, but this has recently been postponed. There were concerns that
patients had not been given enough time to consider the changes, there was
misinformation and lots of patients were completely unaware of the scheme.
The proposals are called the General Practice Data for Planning and Research
(‘GPDPR’) data collection. Under the scheme, for the first time ever, data that
general practitioners (‘GPs’) store on patients could be uploaded and stored on a
central database that NHS Digital control.
not setting a fixed start date for the collection of data
until a number of measures are in place.
What are they collecting?
NHS Digital are planning to collect all records
created up to 10 years ago. This will include data on
sex, ethnicity, sexual orientation, diagnoses, medications and information about a patient’s physical, mental and sexual health. It would not include clearly
identifiable information such as names or addresses.
1. Data can be deleted after it has been uploaded
so that patients can change their opt-out status at
any time. Under the old plan, patients had to register their opt-out before the 1st of September and
there was no way to delete data once it had been
Most of the records collected will be ‘pseudonymised’
which means personal data, which could be used to
identify patients (such as NHS numbers, date of birth
or postcodes) will be replaced or removed. This process doesn’t completely anonymise the data and privacy experts are concerned it will be possible for
patients to be reidentified by reverse engineering the
2. The backlog of opt-outs has been cleared.
3. A Trusted Research Environment has been
developed and implemented so that GP data can’t
be copied or shipped outside of the NHS without
4. They have comprehensively communicated and
educated GPs and patients about the scheme.
How are they collecting it?
The two different options for opting out are:
This is the second time the programme has been
pushed back. Jo Churchill made a similar announcement in June and the implementation was delayed
from the 1 July to 1 September. A similar scheme
called Care.Data was abandoned in 2016 following
very similar criticisms and this had also been delayed
several times. Interestingly, in the most recent announcement there has been no new date set for the
1. Type 1 opt-out: this prevents confidential informtion being shared outside your GP practice
for purposes other than your individual care.
This stops GP practices from sharing data to
NHS Digital and prevents them from collecting it
in the first place.
2. National data opt-out: this enables patients to
opt out from having their confidential patient information shared for reasons beyond their individual care. This allows NHS Digital to take the
data but blocks them from sharing it externally.
Why does NHS Digital want GP records?
NHS digital have said they will use the patient data to
support “research and analysis to help run and improve health and care services”. Patient data is very
useful to do things like develop new drugs, treat conditions and spot trends which is why third parties
would be interested in buying it. NHS digital have reassured the public multiple times the data is not for
sale. They are trying to mollify these concerns by introducing the ‘Trusted Research Environment’ and
being transparent about who will be accessing the
Changing the way patients could opt-out was one of
the reasons for delaying the implementation. Some
GPs felt NHS Digital were not obtaining sufficient
consent and were refusing to share their patients’
data. For consent to be valid it must be informed so
the patient understands what they are agreeing to.
This is why doctors explain about blood tests, surgeries and examinations before they happen. GPs have
raised concerns that they don’t fully understand the
risks and benefits of the GPDPR and therefore can’t
explain it to their patients to obtain consent.
This isn’t the first time there has been privacy
concerns about how the NHS handles our data. The
Royal Free NHS Trust have a relationship with
Google’s DeepMind Health (which was incorporated
into Google Health in 2019). In partnership they
Why has this been delayed?
The Parliamentary Under Secretary of State Jo
Churchill wrote to GPs and explained that they are
EXPERT WITNESS JOURNAL
O C TO B E R 2 0 2 1