This site is intended for health professionals only

At the heart of general practice since 1960

pul jul aug2020 cover 80x101px
Read the latest issue online

Independents' Day

Thousands of practices unaware they could be 'in breach of data rules'

Exclusive Thousands of GP practices may inadvertently be in breach of data protection legislation after activating a record-sharing feature in their IT system, Pulse has learnt.

The Information Commissioner’s Office has told Pulse that it has 'data protection compliance concerns' about SystmOne’s enhanced data sharing function that allows hospitals, care homes and community services to access GP records and leave their own notes.

The ICO is currently investigating concerns that GPs are unable to tell patients who is able to see their data, and so are unable to fulfill their duties as data controllers after activating the data-sharing function, as urged by many CCGs.

An ICO spokesperson told Pulse: ‘We do have data protection compliance concerns about SystmOne’s enhanced data sharing function. We have made these clear to TPP and NHS Digital and we are in discussions with them about how these are resolved.’

Some 2,700 practices currently run SystmOne and Pulse understands the GPC has been raising the issue for more than a year. GPC deputy chair Dr Richard Vautrey said: 'We know that the ICO has had serious concerns and this is why TPP are having to address that situation.'

In information released last week, SystmOne’s provider TPP said it was ‘making amendments’ to the record audit function – currently available for practices – to let patients see who has accessed their record. TPP added that their data sharing model had full approval when it was first rolled out, and it is ‘committed to supporting the sharing of data across the NHS for direct care’.

A TPP spokesperson told Pulse: ‘NHS Digital and TPP are aware that the ICO have raised concerns about TPP's enhanced data sharing model. TPP, along with NHS Digital, are in discussions with the ICO about how these concerns can be addressed.’

What is enhanced data sharing?

GP practices as data controllers of the patient record have a ‘fair processing’ duty under the Data Protection Act and this is particularly important with sensitive health information. This requires that patients are informed of any privacy risks from sharing or changes in how their data is used and who has access.

But the enhanced data sharing function under SystmOne does not currently allow this level of scrutiny. It allows community services, hospitals, child health services, A&E and urgent care organisations, hospices, care homes, offender health care providers, pharmacies and social care providers access to records, but does not let patients see who has accessed their record.

NHS England’s director of Patient Online services Dr Masood Nazir wrote to GPs and IT leads last May saying currently ‘it is not possible to restrict default sharing out from the GP system to a group of local organisations and it is therefore not possible to meet the requirements of the Data Protection Act.' He added: ‘This means that local GPs are unable to meet their data controller requirements'.

Privacy groups say this means – through no fault of their own - GPs have put patient privacy ‘needlessly at risk’. Phil Booth, medConfidential coordinator told Pulse: ‘Failures of this sort are exactly why patients must be able to see which organisations have accessed their medical records.'

Pulse asked NHS England why, when they had concerns last May, they have not acted and a spokesperson told Pulse it takes data security ‘very seriously’ and 'In keeping with good governance practice, once the issue was identified, a solution was agreed and is now being implemented.’



Readers' comments (6)

  • This is a disaster we have been struggling with data sharing to get mental Heath and community systems linked up to primary care. The last thing we need is reasons not to share.

    Unsuitable or offensive? Report this comment

  • Knowledge is Porridge

    Balance of risk and harm. "Safest" to share nothing, yet every day we see harm due to lack of information availability.
    The real issue here is removing threat of litigation for when there are problems.

    Unsuitable or offensive? Report this comment

  • Cobblers

    The last sentence from NHSE says it all. If the concerns on data sharing were known in May 2016 they clearly didn't take it "very seriously" and even if they did and as they say a solution was agreed, does it take 10 months to implement?

    If GPs had been this lackadaisical would they not be for the GMC high jump? Why cannot those in NHS admin posts who foul up be in front of the beak too? A sort of General (NHS) Admin Council. It would concentrate minds.

    Unsuitable or offensive? Report this comment

  • "Safest" to share nothing

    That's not what Caldicott2 says!

    Unsuitable or offensive? Report this comment

  • The real issue is letting patient control who sees their personal medical data. That's not so unreasonable is it?

    Unsuitable or offensive? Report this comment

  • so who is at fault here ?- thousands of GPs, the law or TP? the idea of each practice having to have a Caldecott guardian who is the protector of patient electronic records is out of date and needs a radical review.

    Unsuitable or offensive? Report this comment

Have your say