‘Public should be consulted on NHS medical data-sharing scheme’

Plans to combine NHS patient records into a national database must be reconsidered by the government to ensure that people understand their privacy cannot be guaranteed, leading experts say.

The government’s care.data scheme involves the creation of a database that holds anonymised patient records and information on hospital admissions. It was due to start last year, but was postponed for six months amid concerns over consent and privacy.

The plan was launched as an opt-out scheme that assumed people were happy to have their records used for medical research and by life science companies unless they specifically opted out.

However, the NHS has disregarded tens of thousands of requests by patients to opt out of the health service’s system of sharing medical records. Officials admitted last month that not sharing the data would affect the treatment patients received, such as cancer screening services.

On Tuesday, an expert panel convened by the Nuffield Council on Bioethics said the public should be consulted on the best way to run the plan and whether consent through opting in was more appropriate.

It added that information leaflets describing care.data should stress that there was no way of ensuring that sensitive information from patients’ records would never be released into the public domain, either by hackers or from people abusing the system.

When care.data was launched, millions of homes received leaflets explaining the benefits of the plan. It recommended people contact their GP if they wished to opt out. But Prof Martin Richards, chair of the Nuffield working party on the ethics of big data said the leaflet “should state that anonymising patient records cannot guarantee privacy”.

In a report on the collection, linking and use of data in biomedical research and healthcare, published on Tuesday, the panel argues for prison sentences to punish people who intentionally leak information from patients’ records, whether the leaks cause harm or distress or not.

The panel conducted the review in light of a flurry of major projects that bring together medical and health data from huge numbers of patients, including care.data, the 100,000 genomes project, UK Biobank and the Scottish Informatics Programme.

“We now generate more health and biological data than ever before,” said Prof Richards. “This includes GP records, laboratory tests, clinical trials and health apps, and it has become cheaper to collect, store and analyse this data.”

He said the public had a strong interest in the benefits of using medical data to further knowledge and improve healthcare, but that they still had privacy concerns. “If we don’t get this right, we risk losing public trust in research, and ultimately missing out on the benefits this type of research can bring,” he added.

The report urged health authorities to track the use of patient data so they could provide people with complete audit trails of who used their medical data and for what reasons. People should also have a say in how their data will be used, the committee said.

Susan Wallace, a member of the panel, added: “Any data project should first take steps to find out how people expect their data to be used and engage with those expectations through a process of continued participation and review.”