Secret govt data grab. They can sell your medical records to anyone who can pay

[The Bald Eagle]

This is extremely disturbing and I can't understand how the govt is keeping this quiet.

I have copied the text of the lead article below and it makes very disturbing reading. However, to save you having to pick through the whole article I have provided an easy step by step guide that should get you sorted in less than 15 minutes.

====================================================================



Phil Booth sets out how people can protect their privacy following NHS Digital’s announcement that patients’ GP data will be shared

NHS patients’ GP records are the most detailed and sensitive medical records that exist, containing the history of events in an individual’s lifetime impacting their physical and mental health.

But, from 1 July as The Register has reported, NHS Digital, has announced that “data may be shared from the GP medical records about… any living patient registered at a GP practice in England when the collection started”.

NHS Digital – the health and social care system’s information and technology partner – will be able to take the following from GPs’ records: “Data about diagnoses, symptoms, observations, test results, medications, allergies, immunisations, referrals, recalls and appointments, including information about physical, mental and sexual health.” This will also include data about “staff who have treated patients”, and data “on sex, ethnicity and sexual orientation”, as well as other sensitive data.

Although NHS Digital states that patients’ data will be extracted from GP systems across England “from 1 July 2021”,  its privacy notice states that individuals have until 23 June 2021 to opt-out.

While its press release on the matter states that people can “opt-out at any time”, the privacy notice states: “NHS Digital will however still hold the patient data which was shared with us before you registered the Type 1 opt-out” – meaning that for anyone who has not opted-out by the time that their GP history is first extracted, the information taken will never be deleted.

Having collected millions of patients’ GP histories, their data will be “disseminated” – including into the secret ‘VIP lanes’ for GP data.

It is likely that the majority of the population will not be aware of any of this. It will not know that the Government has commanded NHS Digital to instruct their GP to hand over a copy of their lifelong medical history to be sold – because the Government has taken the decision not to tell anyone.

When a similar GP data grab was attempted before, junk mail leaflets were sent to households. That programme failed. This time, patients could and should have been written to, as millions of people have been throughout the Coronavirus pandemic.

If a member of the public did happen to find out about this programme, including the opt-out, they would be be forgiven for believing that NHS Digital would not sell their health and care data – because that is exactly what it states on its website, including in this “mythbusting” fact-check about social media posts:



Protecting Privacy

On its website, NHS Digital states that it “is publicly funded and we operate on a cost-recovery basis” and that it does not “charge for data” – only to cover the cost of processing and delivering its service.

Although it states that “there are lots of protections in place to make sure patient data is used securely and safely”, it is not doing the safest thing – which would be to not let its customers have copies of patients’ data at all.

Like the Office for National Statistics and Genomics England, NHS Digital does now have what is known as a ‘safe setting’ – a secure data processing facility with layers of rules, approvals, protections and monitoring. But the Government has not made it mandatory for patients’ GP data to only be accessed via this highly secure, heavily audited environment. And so, in all likelihood, NHS Digital’s customers will continue to buy copies.

NHS Digital does audit some (but not all) of its customers which receive copies of data. Several of these audits have revealed that, not only do organisations break the ‘protections’ in place, but that these do not stop them from getting data once they have been broken. Some of these protections are legal obligations, but audits have shown that one public body did not even conduct a legally-required data protection impact assessment.

This newly-acquired GP data will be disseminated in the same way as patients’ NHS data collected from other health and care settings already is. After the failure of a similar data grab in 2014, NHS England undertook that any subsequent collection of GP data would be in a safe setting only. However, that promised safeguard is now entirely missing.

The 2014 grab was stopped in the face of overwhelming protest at the flaws in the programme itself and how it was being communicated. Some may say that there is no point arguing with a Government that doesn’t listen and doesn’t seem to care – but if people do care, in this instance, they have choices.

To fully opt-out from having your NHS data used for purposes beyond your direct care is a two-step process:

1) If you have concerns and want to stop your and your family’s GP data being taken from your GP practice for purposes other than your direct care, you can do so by filling in and giving this ‘Type 1’ form to your GP practice. (This form allows you to include details for your children and dependants as well). This is the most urgent step; the deadline to get your form to your GP is 23 June 2021, according to NHS Digital.

2) If you want to stop your non-GP data, such as hospital or clinic treatments, being used/sold for purposes other than your direct care (for example, for “research and planning”) you should also do the following:

·         If you are opting-out just for yourself, use NHS Digital’s online National Data Opt-out process – this process only works for individuals aged 13 and over.

·         If you have children under 13, you need to fill in this form and email or post it to NHS Digital – this form works for both you and your children.

Make your choice, protect your records, and save your privacy.

https://bylinetimes.com/2021/05/19/the-government-wants-to-sell-your-gp-medical-records-heres-how-to-opt-out/

[The Bald Eagle]

EASY GUIDE TO OPTING OUT

Step 1 - Download and print off the attached form. Complete and sign the form and make sure it is with your GP by 21st June 2021. This will ensure that your GP data is not automatically transferred on 23rd June as planned by the government.

Step 2 - Click on this link ( https://www.nhs.uk/your-nhs-data-matters/manage-your-choice/ ) and follow the opt out process. This will ensure that your non-GP data (hospital records and treatments etc) is not transferred as planned by the government.

And that's it! You will have stopped this government from flogging off your personal, most intimate data to anyone who can afford to pay.

[The Bald Eagle]

New NHS patient data store delayed by two months

The creation of a central NHS digital database from GP records in England will be delayed by two months, the government has announced.

The system was due to begin on 1 July, but the date has now been pushed back to 1 September.

The NHS had been calling for a delay to allow patients more time to learn about the system.

The British Medical Association and the Royal College of GPs had also expressed concern.

Speaking in the House of Commons, Health Minister Jo Churchill said the GP data programme would "save lives".

However, she said the government was "absolutely determined to take people with us on this journey" and had therefore decided to push the implementation date back to the beginning of September.

She said ministers would use the extra time to "talk to doctors, patients and charities to strengthen the plan... and ensure data is accessed securely".

"Patients own their own data," she added.

Labour's shadow health minister Alex Norris welcomed the delay but argued that the "current plans to take data from GPs, assemble it in one place and sell it to unknown commercial interests for purposes unknown has no legitimacy."

He criticised the government for a lack of "public engagement" and said the plans had been "snuck out under the cover of darkness".

NHS Digital said that the data would only be accessible to organisations "which will legitimately use the data for healthcare planning and research purposes, and they will only get the specific data that is required".

It added that the information would never be used for insurance or marketing purposes, promoting or selling products or services, market research and advertising and any requests for data would be "scrutinised by NHS Digital against stringent criteria".


GP data has been used to identify which groups should get the Covid vaccine first

Under the proposed system - the General Practice Data for Planning and Research - information from surgeries in England will be added to an NHS Digital database.

The includes data from records created up to 10 years ago.

The collected data includes sex, ethnicity, sexual orientation, diagnoses, medications and information about a patients' physical, mental and sexual health.

It does not cover names and addresses - except for a postcode which is replaced by a unique code generated by de-identification software.

Simon Bolton, head of NHS Digital, said all collected data would be protected or pseudonymised before it leaves the GP "to ensure patients cannot be directly identified".

He also said patients would be able to opt out of sharing their data.

Patients can prevent their new data being shared at anytime, but would need to opt out before 1 September to stop past data being transferred to the new system.

During the pandemic, patient data was used to assess how effective certain treatments were and to identify which groups were most at risk from Covid.

GP data has also been used to identify disparities in care for individuals with learning disabilities and to improve services for diabetics.

'Trust'

Earlier this week, the British Medical Association and Royal College of General Practitioners expressed their concerns "about the lack of communication with the public".

In a joint letter, they urged NHS Digital to "take immediate action to run a public information campaign".

Welcoming the delay, Professor Martin Marshall, chair of the Royal College of GPs, said "appropriate use" of data was important for improving healthcare but added that any system should be "built around trust".

He said the NHS should communicate with "every patient… clearly articulating the benefits and risks of data sharing so that patients can make a genuinely informed decision about whether they are happy for their data to be shared - and if they are not, how they can opt out".

======================================================

Analysis by Chris Vallance, BBC Technology reporter

It was evident last week that NHS Digital wanted a delay to a programme that proposes to transfer information from the records of every GP patient in England to a central NHS database.

Doctors representatives were clear: patients needed more time to learn about the programme to extract data and the job of informing them couldn't be left to GPs busy with the pandemic and its aftermath.

Now the government have conceded that a delay is necessary after maintaining as late as Friday that none was needed.

It's news that will be greeted with a strong sense of déjà vu with those who remember the cancelled Care.data programme, a previous effort to collect centrally GP record data.

It foundered in part because of a lack of awareness among patients, in spite of a national information campaign.

Today the Information Commissioners Office told me "the success of any project will rely on people trusting and having confidence in how their personal data will be used".

The NHS will need to use the time this delay affords to rebuild just that: trust.

===============================================

Speaking to the BBC's Politics Live programme, Caroline Cake, chief executive of Health Data Research UK, said using data during the pandemic had helped find new Covid treatments and provide information on the impact of vaccines.

She said it was essential that all groups of society are "represented" within the new system.

https://www.bbc.co.uk/news/uk-politics-57400902

[scalyback]

I'm in France, can't really come back until the covid situation improves. The website won't let me access the page cos i'm abroad, how the hell can I stop this?
WHO THE HELL thought this was an ethical thing to do anyway?

[The Bald Eagle]

I'm in France, can't really come back until the covid situation improves. The website won't let me access the page cos i'm abroad, how the hell can I stop this?
WHO THE HELL thought this was an ethical thing to do anyway?

You can post your opt out form to your GP (they have extended the time for doing this until September).

As for the other thing you will need some technical advice I'm afraid, something I'm renowned for not having.

Oh, and as for the ethics of this, have you SEEN what this government have done lately?

[Coco]

You need to use a Virtual Private Network (VPN) service in order to convince the site you are trying to access that you are really in the UK. Here is a link that explains what you need.

[2b1ask1]

How has this been kept quiet???

[The Bald Eagle]

They tried this once before and it didn't work. I'm pleased to say the bastards have backed down again.          




The full letter is below, but here is the important bit:




Most importantly, I can confirm today that, while we are continuing to work on the infrastructure, and communication for the project, we are not setting a specific start date for the collection of data.

================================================

Here is the full letter



GP Data for Planning and Research: Letter from Parliamentary Under Secretary of State for Health and Social Care to general practices in England - 19 July 2021

In a letter to all GPs, 19 July 2021, Parliamentary Under Secretary of State Jo Churchill set out a new process for commencing data collection, moving away from a previously fixed date of 1 September.

General Practice Data for Planning and Research
Patient data from general practice has significantly contributed to the improvement of health and care services and treatments for many years. Patients rightly trust their GP to safeguard their data, a role that we know that all general practitioners take very seriously. This is why I am writing to share more information with you about how we are working to improve how this data is collected.

NHS Digital is making improvements to how data is collected from general practice, with a new framework for data extraction called the General Practice Data for Planning and Research (GPDPR) collection.

You will have seen the announcement to pause the collection of this data, to provide more time to engage with GPs, patients, health charities and others, and to strengthen the plan.

We are working in collaboration with a range of partners including the Royal College of General Practitioners (RCGP) and the British Medical Association (BMA). I want to reassure you that we have heard your concerns loud and clear and will continue to listen.

I am writing now to provide an update on the four key areas of work to strengthen the plan. We hope this will foster your trust in the system and provide a strong basis for you and your patients to participate in the scheme with confidence.

Most importantly, I can confirm today that, while we are continuing to work on the infrastructure, and communication for the project, we are not setting a specific start date for the collection of data. Instead, we commit to start uploading data only when we have the following in place:

the ability to delete data if patients choose to opt-out of sharing their GP data with NHS Digital, even if this is after their data has been uploaded
the backlog of opt-outs has been fully cleared
a Trusted Research Environment has been developed and implemented in NHS Digital
patients have been made more aware of the scheme through a campaign of engagement and communication
In this letter each of these adjustments are set out, all of which are critical to the success and impact of the programme, including through better understanding of the huge benefits the programme will have to the NHS and to our ability to provide the best and safest possible care for patients.

Opt-outs
We want to make the position around opt-out much simpler. While 1 September has been seen by some as a cut-off date for opt-out, after which data extraction would begin, I want to reassure you that this will not be the case and data extraction will not commence until we have met the tests.

We are introducing three changes to the opt-out system which mean that patients will be able to change their opt-out status at any time:

Patients do not need to register a Type 1 opt-out by 1 September to ensure their GP data will not be uploaded
NHS Digital will create the technical means to allow GP data that has previously been uploaded to the system via the GPDPR collection to be deleted when someone registers a Type 1 opt-out
The plan to retire Type 1 opt-outs will be deferred for at least 12 months while we get the new arrangements up and running, and will not be implemented without consultation with the RCGP, the BMA and the National Data Guardian
Together, these changes mean that patients can have confidence that they will have the ability to opt-in or opt-out of the system, and that the dataset will always reflect their current preference. And we will ensure it is easy for them to exercise the choice to optout.

Administrative workload
We have heard from many GPs and practices that there is concern about the administrative burden that Type 1 opt-outs have placed on you and your teams. We are in the process of working with colleagues across general practice to develop a way of simplifying and centralising the opt-out process in order to remove this burden on practices. This is still in development, but we will share further information with you in the coming weeks.

In the meantime, given the changes we have agreed to the opt-outs there is now no urgency to process Type 1 opt-outs specifically for GPDPR in order to get people opted out before September. We will keep you updated on timelines for when we expect the programme to go live.

We will also ensure that the NHS Digital Data Protection Impact Assessment (DPIA) reflecting these changes to the programme is published well before data collection commences. A template DPIA for practice use will also be made available in good time to allow practices to complete it.

Data Security and Governance
The Government has committed that access to GP data will only be via a Trusted Research Environment (TRE) and never copied or shipped outside the NHS secure environment, except where individuals have consented to their data being accessed e.g. written consent for a research study. This is intended to give both GPs and patients a very high degree of confidence that their data will be safe and their privacy protected.

The TRE will be built in line with best practice developed in projects, such as OpenSAFELY and the Office for National Statistics’ Secure Research Service.

We are also committed to adopting a transparent approach, including publishing who has run what query and used which bit of data. We are developing a TRE which will meet our specific needs and act as 'best in class'.

We commit to only begin the data collection once the TRE is in place. Further, we will ensure that the BMA, RCGP and the National Data Guardian have oversight of the proposed arrangements and are satisfied with them before data upload begins.

I can also confirm that the previously published Data Provision Notice for this collection has been withdrawn.

Once the data is collected, it will only be used for the purposes of improving health and care. Patient data is not for sale and will never be for sale.

Transparency, communications and engagement
There has been a great deal of concern regarding the lack of awareness amongst the healthcare system and patients. We recognise that we need to strengthen engagement, including opportunities for non-digital engagement and communication.

Since the programme has been paused, we have been developing an engagement and communications campaign, with the goal of ensuring that the healthcare system and patients are aware and understand what is planned, and can make informed choices. The public rightly look to and trust general practice - through a centrally driven communication campaign, with clear messages, we will seek to ensure that the introduction of this collection does not impose an additional burden on practices.

We are developing a communications strategy delivered through four phases.

Listening - where we listen to stakeholders and gather views on how best to communicate with the profession, patients and the public and give them the opportunity to inform the development of the programme in areas such as opt-outs, trusted research environments and other significant areas
Consultation - a series of events where we can explain the programme, listen and capture feedback and co-design the information campaign
Demonstration - show how feedback is being used to develop the programme and shape communications to the healthcare system and the public
Delivery - of an information campaign to inform the healthcare system and the public about changes to how their GP data is used, that utilises the first three phases to ensure the campaign is accessible, has wide reach and is effective

Data saves lives. The vaccine rollout for COVID-19 could not have been achieved without patient data. The discovery that the steroid Dexamethasone could save the lives of one third of the most vulnerable patients with COVID-19 – those on ventilators - could not have been made without patient data from GP practices in England. That insight has gone on to save a million lives around the globe. That is why this programme is so important.

The programme and I will be providing further information as the programme progresses. In the meantime, if you have any questions, you can contact the programme at enquiries@nhsdigital.nhs.uk.

The NHS Digital web pages also provide further information at https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research#additional-information-for-gp-practices.

Thank you for your continued support.

JO CHURCHILL
Parliamentary under Secretary of State for Primary Care and Health Promotion

About the General Practice Data for Planning and Research programme
NHS Digital is making improvements to how data is collected from general practice, this new framework for data extraction is called the General Practice Data for Planning and Research data collection (GPDPR). The goal of this new system is to:

reduce burden on GP practices in managing access to patient data and maintain compliance with relevant data protection legislation
improve protections through the consistent and rigorous review of all applications for access to patient data
make it easier for patients to understand how their health and care data is being used, including increasing use of Trusted Secure Environments that avoids data flowing outside the NHS
This new NHS Digital service will collect data from GP practices in England and will analyse, publish statistical data and provide safe, secure, lawful and appropriate access to GP data for health and social care purposes. This will include planning, commissioning, policy development, public health purposes (including COVID-19) and research.

NHS Digital is engaging with the British Medical Association (BMA), Royal College of General Practitioners (RCGP) and the National Data Guardian (NDG) to ensure relevant safeguards are in place for patients and GP practices.

Protecting patient data
All data will be pseudonymised and encrypted by your GP system suppliers on your behalf before it is transferred to NHS Digital. Access to GP data will only be via a Trusted Research Environment (TRE) and never copied or shipped outside the NHS secure environment, except where individuals have consented to their data being accessed, e.g. written consent for a research study.

As with the COVID-19 collection, access to the data will be through the NHS Digital Data Access Request Service (DARS) and will be subject to a robust approvals process, which includes oversight by the Independent Group Advising on Release of Data (IGARD) and a Professional Advisory Group, which is made up of representatives from the BMA and RCGP.

Embedding efficiency
Once fully established, this new collection will help to reduce the number of patient data flows for planning and research purposes currently managed by each GP practice. GPs and patients will be able to clearly see how patient data is being used to run and improve health and care services from the information provided by NHS Digital.

GP payments
We are committed to ensuring continuity of data flows to support accurate and timely payments to General Practice. The existing General Practice Extraction Service (GPES) will continue to operate for GP payment purposes until the new arrangements are agreed, tested and then approved for managed transition to the GPDPR service in consultation with GP professional representatives.


https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/secretary-of-state-letter-to-general-practice