GP Patient Records & Privacy: Not Between These Four Walls

• Published date: 05 August 2021
• Subject Matter: Food, Drugs, Healthcare, Life Sciences, Privacy, Data Protection, Privacy Protection
• Law Firm: BCL Solicitors LLP
• Author: Mr Julian Hayes

'Treasure trove' and 'gold mine' are descriptions which jar when describing the sensitive health care data recorded by GPs in countless daily consultations up and down the country in the expectation of doctor-patient confidentiality. Yet, this is how some people perceive the patient records of 55 million citizens which the UK Government plans to make available to a variety of users in pseudonymised form in a scheme unveiled without fanfare in May 2021, formally known as the General Practice Data for Planning and Research. Supported by David Davis MP, an assortment of medical bodies, charities and privacy campaign groups have forced a Government rethink - at least for now.

In truth, anonymised datasets such as this have for years been available for research purposes and the potential healthcare benefits are manifold, including the treatment of cancers and the development of the world's first steroid treatment for Coronavirus sufferers. If access to the dataset was limited to philanthropic purposes, opposition to the scheme might have melted away. However, access to patient data is not always so altruistic. A recent survey found that sensitive patient data was increasingly shared with commercial organisations including management consultants, accountancy firms and marketing companies, with insights gained from health datasets sold on to other organisations who can then use it to price and lobby for regulatory approval of their drugs.

Lurking Doubts

With one estimate valuing the almost unique NHS dataset at '10 billion and the pandemic playing havoc with UK public finances, it might be tempting to put a 'for sale' sign over GP patient records. Ministers and NHS Digital, the healthcare sector's technology partner, insist this was not their intention. Yet, with a Government-commissioned task force recently urging GDPR reform to unlock the financial value of personal data, the Information Commissioner's ('ICO') job specification rewritten to include commercial and business acumen, and the NHS's data arm giving less than convincing assurances that patient information will not be used 'solely' for commercial purposes, lurking doubts remain about the motives underlying what some people see as an unprecedented 'data grab'.

Lacking Transparency

Fuelling suspicions, the scheme initially gave patients just six weeks' notice to opt out despite it being in...