The NHS gave GP data to more than 150 organisations during the rollout of the failed care.data scheme, despite the patients involved explicitly objecting to their records being shared, it has been revealed.
NHS Digital said that more than a third of the 150 groups have yet to comply with a request to ensure the information was deleted.
It told Pulse that they expect to be able to meet the requirements set out by the Information Commissioner’s Office to retrieve the information by 19 October, but declined to reveal which organisations were still holding out.
Pulse revealed last year that the NHS had been forced to ignore opt-outs registered by patients opposed to record sharing during the botched rollout of care.data.
This was because honouring the patients’ objections would have led to people missing out on vital screening services.
The ICO mandated NHS Digital (then called the Health and Social Care Information Centre) to ‘contact all customers who received data …including records for patients who had chosen to opt out, asking them to destroy any un-used data’.
It also required NHS Digital to ensure measures are put in place so that any patients affected by this incident are made aware that their personal data could have been shared with third parties against their wishes.
NHS Digital told Pulse they had ’employed a variety of methods’ to reach out to patients, including sending information materials to GPs to put on their websites and put up in their waiting rooms.
The update in the minutes of this month’s board meeting show that NHS Digital identified and wrote to 151 organisations that had received patient data – including 28 who were not using them for research studies – asking them to delete the data, but around one-third of those organisations have yet to comply.
The minutes state: ‘As at 23 August 2016 well over half have responded and arrangements are in hand to chase up [58] customers that have yet to respond.’
A spokesperson for NHS Digital told Pulse: ‘We take seriously our responsibilities to uphold patient’s choices about how their data is used. We have been working to ensure that we meet the requirements of the undertaking and have consulted with the ICO throughout about our work in this area. We remain on schedule to complete this work within the timescales outlined.
They added that since the minutes were published four organisations had confirmed the deletion of this data, and told Pulse that if the remaining organisations ‘fail to respond to our approaches before the deadline’ then they will review the issue with the ICO.
More than 1.2 million patients opted out of data sharing and NHS Digtal explained that information resources had been made available to practices to inform patients their data may have been shared despite their wishes.
NHS Digital first admitted it had been over-ruling patient’s opt outs in 2015, one year after the scheme had been ‘paused’, and opt outs only began to be honoured at the end of April this year.
