call +44 20 7096 1079
January 23, 2014 | Peter Bradwell

What's happening to your medical records and how you can opt out

The NHS has been going through some fairly radical changes. This will affect who can see your medical records and what they can do with them.


Where your records will be stored, the people deciding who has access to them, the reasons people can access them - all of these things are affected by what's happening.

And it is happening now.

You have the opportunity to opt out of your medical records being used in this way. But you have to actively opt out. If you don't want your medical records to be part of the new system from the start you need to opt out soon.

If you're just looking for details about how to do that, I'd suggest heading over to medConfidential, who have produced information about what the changes mean and a guide to opting out with forms for doing so

There's also lots of really useful information up on Dr Neil Bhatia's site and information on how to opt out, again with an opt out form (in pdf format), should you decide that's what you want to do.

More on what is happening to your records

The NHS are making some big changes to how very sensitive information about us is handled - information about which many people feel understandably protective and worried.

The story about what is happening is fairly long. But most simply put, your medical records, in identifiable form, will be extracted from GP surgeries. They will be held centrally and then made available, in certain circumstances, to a variety of people and institutions from university researchers to think tanks and businesses. The data will be available in different forms for different purposes - sometimes 'anonymised', sometimes 'pseudonymised', sometimes identifiable. There will be various conditions that those wishing to apply for access to the data must meet.

medConfidential say this will "fundamentally alter the concept of doctor-patient confidentiality" - which sounds fair, if only because now there are many more people involved in deciding who can access your medical records, and more people who can potentially do so. 

If you'd like to read NHS England's explanation of what's happening and why they think this is a good idea, read their information page, the patient FAQ and the article written by their Chief Data Officer.

Like medConfidential, lots of people have become extremely concerned about the way these changes are happening. The issues include how much of an informed choice people can make, the faith placed in 'anonymisation' techniques, and who will be able to access records and for what purposes.

What choice do we have?

One of the most pressing issues is whether we have a proper choice about whether our records are part of the new system. 

Well, you can opt out. If you don't do anything, your data will be uploaded to the new system. NHS England say you can change your mind later.

(Update: Phil from medConfidential has pointed out that whilst they say you can change your mind, once your data has been uploaded to HSCIC it will never be deleted and will always be available for subsequent matching on its systems.)

Of course you can only opt out of something that you know is happening. So the opt out approach relies on people knowing what is going on, and having some way of telling the health service what decision they have taken. That places a responsibility on the NHS to provide people with clear and comprehensive information, and to try to make sure people see it.

The NHS fell short of the mark here. Their approach looks like it is more about selling the idea and minimising opt outs than helping people come to informed decisions.

They are sending leaflets, supposedly to every household in the county, with an overview of the benefits of sharing more information. The leaflet is also available as a pdf from the NHS website, with more detail on an information page. Dr Geraint Lewis, the NHS England Chief Data Officer, has posted an article explaining more about how the new system will work and its benefits. There's an FAQ pdf too, which gives a little more detail. 

The leaflet and website read more like a sales pitch for the new system, and are both light on specifics. The leaflet also implies people need to make appointments with the GP surgery to discuss options for opting out - however this is not true. An appointment is not necessary. 

medConfidential and Dr Neil Bhatia have both pointed out some of the shortcomings with the leaflet and information campaign - some of the things that it doesn't mention or explain properly. 

It has been left to medConfidential, Dr Bhatia and others to provide people with clear, detailed and comprehensive explanations about what is happening, and to make it absolutely clear how people can opt out of the scheme. Following the pressure they have applied, it seems the NHS is trying to up their game.  

medConfidential and Dr Bhatia also raise extremely important questions about other aspects of the system, including the problems with a reliance on anonymisation, and concerns about who will have access to identifiable information and for what purposes (see medConfidential's explanation of how paid for access to information will work.)

Here's some more useful articles with information and opinion about what's going on:

1. An editorial from last week in Nature, criticising how 'people's right to opt out has been greatly downplayed.' 

2. The Guardian this week reported on concerns about access that insurance and drug companies. 

3. Jane Fae on openDemocracy, arguing that we're in danger of sleepwalking into a big information grab. 

4. Ross Anderson on opting out - he notes that "if you don't opt out your kids in the next few weeks the same will happen to their data, and they will not be able to get their data deleted even if they decide they prefer privacy once they come of age." 

5. Jon Baines, of InformationRightsandWrongs.com, on why he's worried about the new system and has opted out. 

6. Roy Lilley, giving a run down of what he sees is happening and why the Department of Health could have run the opt out better 

7. An article about an Early Day Motion tabled by MP Roger Godsiff in the House of Commons, following news that 2,400 people have called the customer hotline with concerns about the system since January 6th. 

Of course there are benefits to various innovative uses of medical data. And it's obvious that there are ways to improve how health related information is used. 

But with such fundamental reforms patients should be at the heart of the system, and reforms should be happening with their consent. 

Whatever you think of the merits of the new system, it's hard to escape the conclusion that the way the transition has been handled so far is below standard. Looking at how patients' attitudes and opinions are being built in to this process, it seems the NHS are trying to minimise how many people opt out because they are institutionally so convinced of the benefits of greater data sharing.

This is probably counterproductive, too.  It will surely, for some people, raise doubts about the principles and motivations guiding future decisions about how their medical data will be used. 

If you want to opt out, you can use the forms that medConfidential and Dr Bhatia have made available. You can change your mind at a later date.

More background to relevant NHS changes

As mentioned above, medConfidential have produced a helpful guide to what's happening, including information about changes to the NHS and who is in charge of overseeing the use of health records.  

The King's Fund have produced an explanation of what's happening to the NHS in the form of an animated video, which is helpful for background on what the NHS is going through. 

google plusdeliciousdiggfacebookgooglelinkedinstumbleupontwitteremail


Comments (2)

  1. ANF:
    Jan 28, 2014 at 09:41 AM

    I'd like to point out that, in addition to the issues of control and doctor-patient confidentiality, this approach to data collection is, in the eyes of the ICO, in breach of the Data Protection Act 1998 and therefore illegal:

    http://ico.org.uk/for_organisations/data_protection/the_guide/conditions_for_processing

    The Act states that one of the key conditions that must be met, prior to an organisation undertaking any processing of your data (by themselves or through a third-party) is that:


    “the individual has consented to their personal data being collected and used in the manner and for the purposes in question.

    Consent is not defined in the Data Protection Act. However, the European Data Protection Directive (to which the Act gives effect) defines an individual’s consent as:

    “…any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”.


    The fact that an individual must “signify” their agreement means that there must be some active communication between the parties. An individual may “signify” agreement other than in writing, but organisations should not infer consent if an individual does not respond to a communication – for example, from a customer’s failure to return a form or respond to a leaflet.”

    This is exactly the approach the Government has taken with care.data, and is exactly the reason why this project needs to be flipped to Opt-In. Perhaps if the Government were to pass on some of the £2800 per month each private organisation will be paying per dataset of Person Identifiable Data, to the data subjects, they may get a greater takeup than SCR did!

  2. Hwntw Jones:
    Feb 05, 2014 at 04:23 PM

    I'm concerned about this myself. As a follower of ORG from West of Offa's dyke, I was wondering if anyone knows whether this sort of business is being discussed in Wales.



This thread has been closed from taking new comments.