This site is intended for health professionals only

GPs held responsible for patient complaints over NHS data-sharing project, says ICO

Exclusive GPs are responsible for any patient who complains they were not informed about how data from their records will be shared, despite a publicity campaign being launched this week by NHS England, says the Information Commissioner’s Office.

The ICO said as ‘data controller’, GPs were still responsible for ensuring patients were aware their data would be used inside and outside the NHS if they did not opt out, despite NHS England sending a leaflet to all households in England about their flagship campaign.

It comes as some campaigners complained the leaflets being sent to households are ‘inadequate’ and do not contain ‘fundamental information’ that patients should know.

NHS England bowed to confidentiality concerns and announced a £2m publicity campaign to inform patients about their plans to extract and share patient data last year. The leaflet directs patients to ‘speak to their GP practice’ if they have any concerns. will see the Health and Social Care Information Centre (HSCIC) routinely extracting identifiable patient data from GP practices and hospitals. It will then be shared with other sections of the NHS and potentially other third parties in pseudonymised form – and if certain conditions are met and approval is given, may even be shared in an identifiable form.

Leaflets will be delivered in four waves across different regions, starting with the North this week, followed by the Midlands and East, the South and London in subsequent weeks. Patients will have at least one month to read the leaflet and to register an objection with their practice, if they choose to opt out of sharing their data before the first planned extraction of data beginning in March.

NHS England says most patients will be able to access enough information from the leaflets and through an accompanying telephone helpline, but says GPs will need to ‘proactively’ provide advice if patients ask for further information.

The Information Commissioner’s Office concurs with this advice, saying that it would carry out a full assessment of the publicity campaign in time, but that GPs were still responsible.

A spokesperson from the Information Commissioner’s Office told Pulse: ‘Our understanding is the leaflet is part of a broad communications campaign to inform patients about We will be reviewing the campaign at the end of the process to ensure the data is being processed in line with the Data Protection Act.

‘As to responsibility: as the initial data controller the GPs are responsible for informing patients so they are informed about the process.

‘Once the data has been transferred to HSCIC they then become the data controller. So if a patient complains they weren’t informed about the process it’s the GPs responsibility, if the itself is unfairly or unlawfully handled then it is the responsibility of HSCIC.’

Professor Julia Hippisley-Cox, a GP in Nottingham and a member of the NHS Health Research Authority’s Confidentiality Advisory Group – the body who advise on whether applications to access patient data without consent should be approved – said although GPs should be ‘encouraged’ by the NHS England campaign, it did not take the place of their responsibility to inform patients.

She said: ‘The ICO seems to be saying though that it remains the responsibility of the practice to ensure all patients are aware so practices need to be imaginative on how to communicate efficiently.’

She added: ‘In my view, this is the possibly biggest ever culture change in general practice as the trust between GPs and our patients is sacrosanct and necessary for delivery of safe patient care. So we need to rethink how we best protect patient confidentiality and public trust in doctors for the benefit of everyone.’

But Dr Neil Bhatia, a GP in Yateley, Hampshire, who campaigns widely on the issue of, said the NHS England campaign was not sufficient and that the leaflet should have had an opt-out form.

He said: ‘As expected, the leaflet is inadequate and does not address fundamental information that patients should know.’

He added: ‘I don’t think GPs can easily send out alternative information to thousands in the timescale, though they can make it easily available with handouts, posters and website links.’

A spokesperson for NHS England told Pulse that: ‘The leaflet ‘Better Information Means Better Care’ incorporates feedback we have received from a range of stakeholders. The leaflet sets out the broad range of potential purposes of the data [… and] also sets out the potential recipients of the data, including those outside the NHS – even though the current permissions only allow the data to be used by commissioner.’

A programme update published in November confirmed that early extractions would begin in March with a full rollout by May, the update also flagged up that clinicians’ lack of confidence in the scheme’s was a chief concern.