An official review has suggested that a copy of patient records should be used for data sharing purposes, with the Government taking the data controller role.
This body of copied records could then be used for extracting data for research and other purposes, under GPDPR, the government-ordered review of patient health data said.
Under the proposals, GPs would still maintain their role as data controller of the original patient record.
The review, led by professor of evidence-based medicine at the University of Oxford Professor Ben Goldacre, said this would work using shared secure analytics platforms called Trusted Research Environments (TREs), which should become ‘the norm of all analysis of NHS patient records data’.
The Government’s response to the review will be incorporated in the forthcoming Health and Social Care Data Strategy, which will set out how health data will be used.
A draft version was published in June 2021, with the final version expected in spring 2022.
Professor Goldacre’s review recommended that the Government should ‘address the problem of 160 trusts and 6,500 GPs all acting as separate data controllers’.
It said: ‘The current requirement to obtain permission separately from each organisation for each act of data sharing is a substantial practical barrier to better harmonisation, and better access.
‘It is driven by the current legal reality that each organisation is the Data Controller for the records they hold. Two options may help to make this more manageable, subject to detailed legal and policy evaluation, and public and professional consultation.’
The report listed these options as:
- ‘one national organisation acting as data controller for a copy of all NHS patients’ records’ in a in ‘a Trusted Research Environment (TRE)’
- via an ‘approvals pool’, where ‘trusts and GPs can nominate a single entity to review and approve requests on their behalf’
TREs should then ‘become the norm for all analysis of NHS patient records data by academics, NHS analysts and innovators, wherever there is any privacy risk to patients, unless those patients have consented to their data flowing elsewhere’, the report added.
A TRE is a ‘secure environment that researchers enter in order to work on the data remotely, rather than downloading it onto their own local machine’, the report further explained.
Hampshire GP and data autonomy advocate Dr Neil Bhatia told Management in Practice’s sister title Pulse: ‘TREs represent the safest way of providing access to medical data to researchers and analysts.
‘But TREs must then become the only route for secondary uses of GP medical data. All other current pathways – the lawful, CAG approved ones and the unlawful ones “piggybacking” on shared care records – will need to stop. TREs (which may include GPDPR) must be the route for population health management, not individual ICS projects scattered across England.
‘The report stressed the need to uphold confidentiality and privacy, and that includes respecting the patient’s right to object (before and after their information is transferred to the TRE) and in so doing having their information deleted from the TRE.’
He added that patients must know what is happening, and how their information is being used, ‘which is everything that GPs and the BMA voiced with the hapeless launch of GPDPR’.
‘Trust is hard earned but easily lost, and care.data and GPDPR showed that,’ Dr Bhatia said.
Former chair of GPC GP IT subcommittee and co-chair joint GP IT committee Dr Grant Ingrams told Pulse: ‘The body that looks at [patient record data extractions], has got to, for GP services, be GP-based. It’s got to have representations from the joint GP IT committee to have any confidence in it.’
Health secretary Sajid Javid said: ‘As we move forwards, millions of patients could benefit from the more efficient use of health data, through boosting innovation and ensuring the NHS can continue to offer cutting-edge care, saving lives.
‘I want to thank Professor Ben Goldacre, his team, and all those who contributed to this review – this work, alongside our upcoming data strategy, will help to transform the NHS on our road to recovery.’
Meanwhile, NHS Digital has extended the deadline for the national data opt-out policy to 31 July 2022, due to GPs focusing on the Covid response.
The deadline had most recently been set as 31 March 2022.
In May last year, NHS Digital announced it would be rolling out a ‘new and improved’ GP data collection system from 1 July 2021 called General Practice Data for Planning and Research (GPDPR), with patients wanting to opt out having to do so by 23 June 2021.
The NHS Digital webpage has now been updated to say: ‘GP practices must comply with the national data opt-out policy by 31 July 2022.
‘This deadline has been extended repeatedly from the original compliance deadline of 31 March 2020 to allow health and care organisations to focus on the response to the coronavirus pandemic.’
When the GPDPR scheme gathered public interest in early June 2021, media reports focused on campaigners’ warnings that it would potentially make sensitive patient data available to private firms.
This includes patients’ full history, not just any future changes to their records. This means it goes further than the previous controversial scheme, care.data – which was completely ditched in 2016 after becoming too toxic due to accusations of the NHS selling off the data to private companies.
In July, the Government delayed the scheme again, and health minister Jo Churchill said data would now only be gathered once three tests had been met.
Patients can opt out of NHS Digital’s GP data extraction, meaning their confidential patient information will not be used for research and planning, by filling in a type-1 opt-out form and sending it to their GP practice via post or email by the deadline.
Patients can also register a less stringent opt-out, called a ‘national data opt-out’. This means NHS Digital can extract the information but not share it with any other organisations, except for the purpose of the patient’s own care.
It can also be shared in exceptional circumstances, including ‘where there is a legal requirement or where it is in the public interest to do so, such as helping to manage contagious diseases like coronavirus’.
Any opt outs after the deadline will stop NHS Digital from extracting further data but it will retain data already extracted.
The UK’s data guardian previously said GPs must be fully engaged with the scheme.
This story was initially published on our sister title Pulse.
