Data wars
The plan by NHS England to upgrade its patient data system is eminently sensible. Without accurate data, the NHS is flying blind and has no chance of delivering the highest quality care and spotting unsafe care, and the opportunities to use the data for research to benefit patients are potentially huge. So why has it met with such opposition?
The simplest answer is that the government and NHS England aren’t universally trusted to keep such large volumes of confidential medical information safe or not to sell it off for commercial gain. The government promised no major top down reorganization of the NHS and then imposed the largest in its history, leading many to conclude the resultant chaos is simply a Trojan horse for privatization. Selling patient data – identifiable or not – onto private companies just amplifies the mistrust even if it is claimed to be for patient benefit.
The default option is ‘opt in’ (you have to tell your GP if you don’t want your data to be used) but the choice is ‘all or nothing’ – you can’t select where your data might end up but have to trust the NHS to make decisions in your best interests without consulting you. However, the fear that insurance companies will get hold of the data is a red herring since patients who have health insurance have to fully disclose all their medical details directly to the insurer, and any inaccuracy (deliberate or not) can nullify their policy.
NHS England is however very keen to collaborate with the private sector. Tim Kelsey, the NHS England director for patients and information, came from the private data-mining company Dr Foster and Kingsley Manning, founder and managing director of health and information consultancy firm Newchurch, has been appointed chair of the Health and Social Care Information Centre (HSCIC), which NHS England has trusted to oversee the ‘care.data’ program. HSCIC’s new chief executive Andy Williams has worked for IBM, Alcatel-Lucent and CSC.
Most patients haven’t got a clue what care.data or the HSCIC is, and the leaflet destined to drop on your doorstep is very simplistic. Kelsey recently went on Radio 4 to promise there was ‘no risk of patients of confidential information being identified as a result of care.data…. Can I be categorical? No one who uses this data will know who you are.’ Alas, there is no such thing as zero risk and it is possible (though probably illegal) to re-identify patients from some of the data.
Three types of data are collected – anonymous or aggregated (green) data, pseudonymised (amber) data and personal confidential (red) data. Green data is published free of charge for all to see, and allows anonymous comparisons of how different diseases are managed in different parts of the country. (e.g. your chances of having a limb amputation if you have diabetes varies widely across the NHS). For very rare conditions, it might be possible to deduce who the patients in a particularly area are because there aren’t many of them, so the HSCIC shouldn’t publish these.
For pseudonymised (amber) data, patient’s identifiers (e.g. date of birth, postcode, NHS number) are replaced them with a meaningless pseudonym that bears no relationship to their identity. Amber data is very useful because it tracks how individual patients interact with the different parts of the NHS and social care over time. However, it is theoretically possible for analysts to re-identify individuals within amber data by linking them to other data sets. The HSCIC shouldn’t publish amber data, but such hospital data is already made available to universities and private companies under a legal contract ‘to approved analysts for approved purposes’. The contract stipulates how the data must be stored and protected, and how the data must be destroyed afterwards. But that of course doesn’t guarantee it will happen in all cases.
Red data does identify you and the HSCIC may pass it on in a public health emergency such as an epidemic when legally required to do so. It is proposed that such data may also be made available ‘to an organisation that has obtained the patient’s explicit consent or has been granted legal approval by the Secretary of State for Health or the Health Research Authority following independent advice from the Confidentiality Advisory Group (CAG).’ The CAG members are here1 and you can decide if you trust them to override confidentiality when the research benefit warrants it and it is not possible to use information that does not identify patients.
The NHS has been keeping hospital data safe for 25 years and it’s important to complete the data by linking it to care provided outside hospital. However, to state that there is ‘no risk’ that patients will be identified is simply wrong, particularly as applications to access the data from a wide variety of interested parties are likely to increase dramatically. It would have been far better to argue that the potential benefits vastly outweigh the risks. And bullying GPs into releasing their patients’ data as required by the Health Act when they have yet to be convinced it is safe to do so is simply wrong. GPs have been ordered to release pseudonymous information to the HSCIC for sorting, and some are worried about breaches of confidentiality. It would have been far more sensible to give patients easy access to their own data first so they can decide if they wish to pass it on.
A bigger issue for an NHS already swimming with data is whether it will be used to benefit patients. From the Bristol heart scandal to Mid Staffs, the NHS has shown itself incapable of acting swiftly on outlying data to protect patients from avoidable harm, and keeping data ‘in house’ has often meant burying scandals. Independent analysis and scrutiny of what the NHS is up to is no bad thing. As for drug companies, MD has no objection to his data going to them provided they have signed up to www.alltrials.net and agree to publish all of their clinical trials. The hallmark of any safe data system is publishing disappointing or distressing data even if it is politically or commercially embarrassing. The bottom line? No more dirty secrets in the NHS.
There is ‘a dedicated patient information line’ about care.data on 0300 456 3531. Or you can try to talk to your GP
1 http://www.hra.nhs.uk/about-the-hra/our-committees/section-251/cag-members/
Another Bristol Inquiry
NHS clinical director Brice Keogh ordered an inquiry into the safety of child heart surgery in Bristol last week, based on concerns raised by a group of parents about the care of their children – but failed to say whether the current service is safe for babies having operations now.
If he has concerns, he must surely suspend surgery now pending an urgent independent investigation, or he must state publicly that the service is no less safe than other UK units. To do neither has caused enormous stress to the parents of those babies currently due for surgery who may – or may not – be at unacceptable risk.
Bristol’s current ‘outcome’ figures are comparable to any other NHS unit but due to the failure to reorganise heart surgery after the initial scandal exposed in the Eye in 1992, every NHS unit is now struggling to recruit enough qualified staff, particularly nurses, to cope with the increase in surgery. Keogh must sort this out urgently.
Update: On the day of publication of Private Eye, NHS England issues a safety statement about child heart surgery in Bristol now.
http://www.england.nhs.uk/2014/02/19/childrens-heart-surgery/
You can also hear me interview Miss Bryony Strachan, Clinical Chair of the Division of Women’s and Children’s Services at University Hospitals Bristol NHS Foundation Trust, and Professor of Paediatric Cardiology Rob Tulloh here, between 10.05 And 10.30 AM. They talk openly and at length about the safety of the unit and the complexities of the work they do.
http://www.bbc.co.uk/programmes/p001d79q
What concerns me is the disconnect between the outcome figures for Bristol, which are within the range of the other units, and the very worrying experiences of some parents. In my view, there needs to be a swift investigation by independent clinical and human factors experts that is published in full. And until child heart surgery is sensibly recognised in the NHS, most units will continue to struggle with understaffing and suboptimal supervision and training. Parents can in theory choose to go to another unit if they have concerns about their local one, but this is not without additional stress and difficulty. Far better to ensure all NHS units are safe and up to standard, and to publish real time patient/parent experiences alongside retrospective death rates which remain a fairly crude way of judging quality of care.