This site is intended for health professionals only

At the heart of general practice since 1960

pul jul aug2020 cover 80x101px
Read the latest issue online

Independents' Day

GPs held responsible for patient complaints over NHS data-sharing project, says ICO

Exclusive GPs are responsible for any patient who complains they were not informed about how data from their records will be shared, despite a publicity campaign being launched this week by NHS England, says the Information Commissioner’s Office.

The ICO said as ‘data controller’, GPs were still responsible for ensuring patients were aware their data would be used inside and outside the NHS if they did not opt out, despite NHS England sending a leaflet to all households in England about their flagship campaign.

It comes as some campaigners complained the leaflets being sent to households are ‘inadequate’ and do not contain ‘fundamental information’ that patients should know.

NHS England bowed to confidentiality concerns and announced a £2m publicity campaign to inform patients about their plans to extract and share patient data last year. The leaflet directs patients to ‘speak to their GP practice’ if they have any concerns. will see the Health and Social Care Information Centre (HSCIC) routinely extracting identifiable patient data from GP practices and hospitals. It will then be shared with other sections of the NHS and potentially other third parties in pseudonymised form - and if certain conditions are met and approval is given, may even be shared in an identifiable form.

Leaflets will be delivered in four waves across different regions, starting with the North this week, followed by the Midlands and East, the South and London in subsequent weeks. Patients will have at least one month to read the leaflet and to register an objection with their practice, if they choose to opt out of sharing their data before the first planned extraction of data beginning in March.

NHS England says most patients will be able to access enough information from the leaflets and through an accompanying telephone helpline, but says GPs will need to ‘proactively’ provide advice if patients ask for further information.

The Information Commissioner’s Office concurs with this advice, saying that it would carry out a full assessment of the publicity campaign in time, but that GPs were still responsible.

A spokesperson from the Information Commissioner’s Office told Pulse: ‘Our understanding is the leaflet is part of a broad communications campaign to inform patients about We will be reviewing the campaign at the end of the process to ensure the data is being processed in line with the Data Protection Act.

‘As to responsibility: as the initial data controller the GPs are responsible for informing patients so they are informed about the process.

‘Once the data has been transferred to HSCIC they then become the data controller. So if a patient complains they weren’t informed about the process it’s the GPs responsibility, if the itself is unfairly or unlawfully handled then it is the responsibility of HSCIC.’

Professor Julia Hippisley-Cox, a GP in Nottingham and a member of the NHS Health Research Authority’s Confidentiality Advisory Group – the body who advise on whether applications to access patient data without consent should be approved - said although GPs should be ‘encouraged’ by the NHS England campaign, it did not take the place of their responsibility to inform patients.

She said: ‘The ICO seems to be saying though that it remains the responsibility of the practice to ensure all patients are aware so practices need to be imaginative on how to communicate efficiently.’

She added: ‘In my view, this is the possibly biggest ever culture change in general practice as the trust between GPs and our patients is sacrosanct and necessary for delivery of safe patient care. So we need to rethink how we best protect patient confidentiality and public trust in doctors for the benefit of everyone.’

But Dr Neil Bhatia, a GP in Yateley, Hampshire, who campaigns widely on the issue of, said the NHS England campaign was not sufficient and that the leaflet should have had an opt-out form.

He said: ‘As expected, the leaflet is inadequate and does not address fundamental information that patients should know.’

He added: ‘I don’t think GPs can easily send out alternative information to thousands in the timescale, though they can make it easily available with handouts, posters and website links.’

A spokesperson for NHS England told Pulse that: ‘The leaflet ‘Better Information Means Better Care’ incorporates feedback we have received from a range of stakeholders. The leaflet sets out the broad range of potential purposes of the data [… and] also sets out the potential recipients of the data, including those outside the NHS – even though the current permissions only allow the data to be used by commissioner.’

A programme update published in November confirmed that early extractions would begin in March with a full rollout by May, the update also flagged up that clinicians’ lack of confidence in the scheme’s was a chief concern.

Related images

  • Computer Keyboard IT hand 330x330

Readers' comments (19)

  • The only surprise in this is my GP colleagues being surprised by this news!

    DPA quite clearly puts the responsibility on our laps and ICO is only telling us what we know. Governmental departments are contradicting each other and if a problem arose, they will both deny responsibilities. If you have a strong CCG/federation this may be the time to start blanked opting out to cover ourselves.

    Unsuitable or offensive? Report this comment

  • Bye and thanks for all the fish

    This is madness.
    Either Jeremy Hunt needs to come out with a statement confirming what we are doing; posters in waiting rooms, notices on repeat prescriptions and web sites plus NHS Englands leaflet drop IS enough to satisfy our responsibilities as data controllers or the BMA needs to take strong action on our behalf without further delay

    Unsuitable or offensive? Report this comment

  • Dont worry! According to The Daily Mail its our fault that the weather is stormy, England cricketers cant bat, the NHS has no money , and we caused the World banking crisis in 2008. Not worth losing sleep over

    Unsuitable or offensive? Report this comment

  • This is quite clearly a damned if you do and a damned if you don’t. The only viable option left now is to look into your medical soul and let it tell you what you already know. The GP Patient interaction is to be kept confidential. No ifs, no buts. Mass update opt out is the only way. Yes you are damned but think of the headlines. “GP done for keeping mum”. Whole life sentence perhaps? TFIC

    Unsuitable or offensive? Report this comment

  • Patient should be given access to their own FULL records - it makes fascinating (and sometimes fictional reading), GPs and the NHS have a very perverse relationship with the DPA (although the ICO is very effective, in my experience), so patients should always state their requests in writing and keep a copy of such correspondence. The NHS can run rings around patients when it comes to access to their records.

    Unsuitable or offensive? Report this comment

  • The leaflet is a joke, makes no distinction between or any other form of data sharing, and does not mention the word anywhere. Another total waste of millions of pounds.
    And how can we be held responsible for informing the public about something we oppose and have absolutely no control over whatsoever?? Next thing we will be held liable when our patients commit an illegal act for not pro-actively informing them it was illegal before they did it I suppose.

    Unsuitable or offensive? Report this comment

  • Patients should opt in not opt out, I wonder how long it will be before NHS England sells our information on eBay?

    I have no faith in the NHS or its promise to maintain patient confidentiality!

    Unsuitable or offensive? Report this comment

  • Let common sense prevail

    I don't agree that patients should opt in rather than opt out. My view is that no identifiable data should be uploaded at all. Unidentified data is sufficient for research purposes. That way we can confidently wear our Caldicott Guardian badges, and the scientists get the useful data they need.

    Unsuitable or offensive? Report this comment

  • I agree with the sentiments of other comments, we should "Opt out" all patients and inform them of the action, they can then opt in if they so desire.

    If there is no consent for the NHS/HSCIC to upload the data, how can the ICO blame GP's?

    Unsuitable or offensive? Report this comment

View results 10 results per page20 results per page

Have your say