This site is intended for health professionals only

Eight weeks to inform patients their data is going to be harvested, GPs warned

Exclusive GPs have eight weeks to inform all their patients that confidential data from their records will be shared outside the NHS, as a campaign begins to encourage patients to opt out of the programme.

Pulse has learnt that NHS England has now written to all practices in England informing them that they must inform their patients that their programme will begin extracting confidential information from GP records shortly.

It comes as the Information Commissioner prepares its final advice for practices on their responsibilities to inform patients that their data will be extracted if they decide not to opt-out of the programme.

Privacy campaigners have also started a drive this week to encourage patients to opt out of the extractions, with the thinktank 2020Health calling for an ‘opt-in’ system and distributing template opt out letters for patients to use.

Data from will be shared with commissioners, researchers and private companies in de-identified and identifiable forms. Health secretary Jeremy Hunt announced earlier this year that patients will be able to opt out of having their information extracted, but NHS England has ruled out a national publicity campaign and said the responsibility lies with individual GP practices.

Pulse reported last month that LMCs were considering opting all their patients out of the programme to give patients more time to make an informed decision, but NHS England said that the practices would be in breach of their statutory obligation to share data under the Health and Social Care Act.

The BMA has strongly advised practices against a boycott, because of the legal requirements placed on practices in the health act.

But just this week at the Conservative party conference in Manchester prominent Tory MPs raised questions about whether the Health and Social Care Act took precedence over the conditions in the Data Protection Act (DPA), saying posed an ‘enormous threat’ to patient privacy.

The Information Commissioners Office (ICO) has previously told Pulse that if GPs do not take reasonable steps to make patients aware then they could face legal action under the DPA. However, the ICO said this week it has not yet published its definitive advice on the topic and that discussions with key organisations and representative bodies are ‘ongoing’.

NHS England has confirmed that practices in the north of England were notified on 23 August that they had eight weeks to inform patients. Practices in London were notified on the 29 August, those in the south of England a week later on the 5 September and those in the midlands and east of England written to on the 12 September.

The letter sent by NHS England said: Upon receipt of this letter, you will have approximately eight weeks to make your patients aware before the Health and Social Care Information Centre (HSCIC) will begin extracting data via the GP Extraction Service (GPES) for those patients who have not objected.’

Practices were also provided with posters and leaflets jointly produced by the BMA and the RCGP.

Dr Grant Ingrams, former chair of the GPC’s ICT subcommittee and a GP in Coventry, said that there were real concerns that practices had no idea how they should be informing patients.

He said: ‘How much do you need to do to make patients aware? For Summary Care Records every household was sent a letter. I’ve not seen any information about this. The Government should be the ones telling the public they’re raking their data into a database. Using patient-identifiable data when the amount of knowledge within the public as a whole is so low, is not appropriate.’

He added that the programme could adversely affect the doctor-patient relationship. He said: ‘They may be angry at the doctor. You could be undermining patient care, inducing an increased risk. In future you may not have all the information you need.’

A BMA spokesperson said it was important NHS England supported practices in their efforts to make sure their patients are fully aware of the new care data programme. 

He said: ‘NHS England have stated that eight weeks is a minimum period that practices have to make their patients aware of the new arrangements and that no data will be extracted until awareness raising activities are complete. The BMA will be monitoring how this process progresses, especially NHS England’s plan for national awareness activities which are currently being formulated.’

A spokesperson from 2020Health said they were launching a campaign to halt the the programme and make it an ‘opt-in’ rather than an ‘opt out’ requirement.

She said: ‘We have heard reports that GPs making people aware of their personal information being harvested has simply amounted to a few notices in the GP practice. What about all those people who don’t happen to visit their GP between the time of the notice going up and the ‘extraction’ of their personal data?

‘Engagement of the public has been trifling and the “opt-out” approach is not the right way to treat our confidential information or retain confidence.’