NHS Databases – The Big Opt Out Ross Anderson Cambridge University and Foundation for Information Policy Research

NHS Databases – NHS Databases – The Big Opt OutThe Big Opt Out

Ross AndersonRoss Anderson

Cambridge University and Cambridge University and Foundation for Information Policy Foundation for Information Policy

ResearchResearch

TheBigOptOut 29 Nov 2006

The Story so Far …The Story so Far …

1910 – struggle over who owns medical records 1910 – struggle over who owns medical records led to Lloyd George envelopeled to Lloyd George envelope

1992 – IM&T strategy ‘a single electronic health 1992 – IM&T strategy ‘a single electronic health record available to all throughout the NHS’record available to all throughout the NHS’

BMA pointed out safety, privacy problemsBMA pointed out safety, privacy problems John Major sets up the Caldicott Committee (to John Major sets up the Caldicott Committee (to

report back after the 1997 election)report back after the 1997 election) Caldicott documents many illegal information Caldicott documents many illegal information

flows; HSCA s60 allows SS to legalise themflows; HSCA s60 allows SS to legalise them


The Story so Far (2)The Story so Far (2)

‘‘Blair moment’ in 2002 – ‘Tony wants’Blair moment’ in 2002 – ‘Tony wants’ The 1992 vision of the big central The 1992 vision of the big central

database is dusted off – NPfIT, CfH,…database is dusted off – NPfIT, CfH,… Government really believes this is working Government really believes this is working

and they now plan to roll out the same and they now plan to roll out the same architecture to childcare, elder care, …architecture to childcare, elder care, …

What are the implications for clinical safety What are the implications for clinical safety and confidentiality?and confidentiality?


Issues of ScaleIssues of Scale

Blair philosophy is that data will be accessible Blair philosophy is that data will be accessible (MISC 31, ‘Information Sharing Vision’) … but …(MISC 31, ‘Information Sharing Vision’) … but …

You can have functionality, or security, or scale. You can have functionality, or security, or scale. With good engineering you can have any two!With good engineering you can have any two!

We can live with the risks of a receptionist We can live with the risks of a receptionist having access to the 6000 records in a practice having access to the 6000 records in a practice – but if 1,000,000 staff have access to – but if 1,000,000 staff have access to 60,000,000 records?60,000,000 records?

‘‘Sealed envelopes’ won’t work (official!)Sealed envelopes’ won’t work (official!) Secondary Uses Service will run unprotected for Secondary Uses Service will run unprotected for

years – with a hope of eventual pseudonymsyears – with a hope of eventual pseudonyms


Data quality issues…Data quality issues…


Helen Wilkinson’s caseHelen Wilkinson’s case

Helen is a practice manager in High WycombeHelen is a practice manager in High Wycombe She was wrongly listed as a patient of an alcohol She was wrongly listed as a patient of an alcohol

treatment centretreatment centre She demanded the data be corrected or She demanded the data be corrected or

removed – officials wouldn’t / couldn’tremoved – officials wouldn’t / couldn’t When her MP called an adjournment debate, When her MP called an adjournment debate,

Caroline Flint told Parliament it had been doneCaroline Flint told Parliament it had been done But it took several months after that (and the But it took several months after that (and the

story continues…)story continues…)


Extending NPfIT to Kids?Extending NPfIT to Kids?

Children Act 2004 provided powersChildren Act 2004 provided powers Information to be shared between schools, Information to be shared between schools,

police, social workers, probation, doctors…police, social workers, probation, doctors… The Children’s Index points to all services with The Children’s Index points to all services with

data on your childdata on your child So schoolteachers will know if a child is known So schoolteachers will know if a child is known

to social workers / policeto social workers / police Home Office systems will predict kids likely to Home Office systems will predict kids likely to

offendoffend IC study by FIPR – this is unsafe and illegalIC study by FIPR – this is unsafe and illegal


Opting OutOpting Out

There are at least three central NHS system There are at least three central NHS system projects from which you can opt outprojects from which you can opt out

The first is the Population Demographics Service The first is the Population Demographics Service – the NHS master phone book. Get stop-noted if – the NHS master phone book. Get stop-noted if you really want to be ex-directoryyou really want to be ex-directory

The second is the Secondary Uses Services, The second is the Secondary Uses Services, which collects hospital data. You can tell your which collects hospital data. You can tell your hospital you invoke your rights under Section 10 hospital you invoke your rights under Section 10 of the Data Protection Actof the Data Protection Act


Opting Out of UploadingOpting Out of Uploading

The Government plans to hoover up all The Government plans to hoover up all GP records early next yearGP records early next year

BMA view: consent neededBMA view: consent needed Medix poll last week: 51% of GPs will Medix poll last week: 51% of GPs will

refuse to upload data without patient refuse to upload data without patient consentconsent

Ministers are dithering!Ministers are dithering! What do patients think?What do patients think?


The Joseph Rowntree PollThe Joseph Rowntree Poll

In an ICM poll of 2,231 adults between 21-30 In an ICM poll of 2,231 adults between 21-30 October 2006, view asked on central records October 2006, view asked on central records database with no opt outdatabase with no opt out

strong supportstrong support 12%12%tend to supporttend to support 15%15%neitherneither 14%14%tend to opposetend to oppose 17%17%strongly opposestrongly oppose 36%36%don’t knowdon’t know 6%6%

Net opposition 53%Net opposition 53%


ConclusionsConclusions

It’s not just the ID card database – the It’s not just the ID card database – the government is trying to centralise most data held government is trying to centralise most data held on citizens by the public sectoron citizens by the public sector

This is unsafe and in some cases illegalThis is unsafe and in some cases illegal But we don’t have to wait for a change of But we don’t have to wait for a change of

Government or a European law case!Government or a European law case! You can opt out of having your medical records You can opt out of having your medical records

uploaded – with the support of many doctorsuploaded – with the support of many doctors The first step is to get the code ‘93C3’ on your The first step is to get the code ‘93C3’ on your

GP recordGP record

Documents

NHS Databases – The Big Opt Out Ross Anderson Cambridge University and Foundation for Information Policy Research