Thousands of patients have had their confidential GP records shared, despite opting not to have their data shared for research purposes, the Government has admitted.
In a written statement to parliament, health minister Jackie Doyle-Price said GP system provider TPP failed to send 150,000 patients’ type 2 opt-out preferences to NHS Digital.
The opt-out mean patients do not want NHS Digital to share their GP records for reasons other than their care.
However, in failing to send these objections to NHS Digital, ‘data for these patients has been used in clinical audit and research’.
The error affected patients who opted out of sharing their data between March 2015 and June 2018, with their data used against their will between April 2016 and June 2018.
This comes after the Government decided to axe its flagship care.data GP-record sharing scheme in 2016 - more than two years after it was shelved over concerns about the use of patient data and the 'opt-out' model used for the project.
Ms Doyle-Price said: ‘An error occurred when 150,000 Type 2 objections set between March 2015 and June 2018 in GP practices running TPP’s system were not sent to NHS Digital.
‘As a result, these objections were not upheld by NHS Digital in its data disseminations between April 2016, when the NHS Digital process for enabling them to be upheld was introduced, and 26 June 2018.
She added that NHS Digital made the Department of Health and Social Care aware of the error on 28 June and it has since been corrected.
Nic Fox, director of primary and social care technology at NHS Digital, said: ‘We apologise unreservedly for this issue, which has been caused by a coding error by a GP system supplier (TPP) and means that some people’s data preferences have not been upheld when we have disseminated data.
‘The TPP coding error meant that we did not receive these preferences and so have not been able to apply them to our data.
Mr Fox also said that this issue would not be able to occur using the new National Data Opt-out, as it ‘puts the individual in direct control of their data sharing preferences’.
NHS England began inviting patients last month to opt-out of GP record sharing for research and planning purposes as part of the National Data Opt-out, which replaces type 2 objections.
Dr John Parry, clinical director at TPP, said: ‘TPP and NHS Digital have worked together to resolve this problem swiftly.
NHS England announced last month that GPs in three areas of England will be expected to share patient data with social care as well as hospitals in the next two years.
The Department of Health and Social Care set out its plans for data-sharing last year, outlining a system for anoymising and extracting data from GP practices.
Who is the data controller in this instance?
If one of my patients now does a SAR and asks if their data has been used against their will when they had specifically denied consent for it to be used in the sway, is the individual GP practice responsible (as the data controller)..?
...and what happens when the national press get wind of this?
Are we all going to be inundated with patients asking if their data has been used without their consent?
Isn’t it an irony that while we are still have serious concerns of care.data which originally carried an arguably ‘noble’ initiatives , people seem to have no worries about how these Smartphone-GP-apps for NHS (not to even mention private , payable consultantions)will jeopardise patient confidentiality. I would argue that a video-GP consultation (clearly can be easily recorded )through a GP smartphone app constitutes an essential medical record , alongside patient’s details, and hence , a ‘Bigger Data’.
This incident involving TPP and NHS Digital certainly have not set a right track record for the sake of trust and confidence of handling and protecting this Bigger Data.
Why would anyone trust this bunch of incompetents with their confidential information. Positive permission from patients for the use of their data should be the default position.
While electronic patient record in NHS involves an system provider and NHS Digital , the NHS GP smartphone app is provided by another private company? And what is the protection against the actual smartphone company accessing these Bigger Data??
Surley on the basis of the NHS digital must now be the data controller!No the mere GPs.
I'm on Emis and my patients have been using an app and Patient.info website to access their data (which I actively discourage), book appointments and request repeat prescriptions for at least a couple of years. Surely there is something similar on SystmOne and Vision. Do we really not need yet another one??
Where is Paul Cundy when you need a decent quote?