Care.data is a forthcoming extract of patient data commissioned by NHS England. The intention of the scheme is to make increased use of the information in medical records in order to improve the quality of care for patients. The service is one of the first initiatives to use the powers of the Health and Social Care Act 2012 (HSCA), which allows the Health and Social Care Information Centre (HSCIC), in certain circumstances, to extract confidential from GP practices without seeking patient consent.
The BMA supports the use of data for appropriate secondary uses but also recognises the importance of confidentiality. Our priority in negotiations has been of information governance safeguards and allowing patients to maintain control of the data held in their medical records. The BMA therefore negotiated the right for patients to be able to object to the disclosure of their confidential information from the GP practice.
Practices will have received an email from the HSCIC including GP guidance and FAQs and a separate information pack containing patient information and materials. They have been advised to undertake patient awareness raising activities, such as displaying the poster, making the leaflet available and providing information on the practice website (see FAQ 6). These activities will help ensure that patients are aware of the scheme and their right to object. The BMA and NHS England have also used this opportunity to make patients aware of the existing ways in which the health service uses information from medical records for secondary uses e.g. research.
The BMA has received concerns from practices and LMCs about the level of patient awareness, and whether an eight week period of activity undertaken by the practice will be sufficient in informing all patients of the extract. Some practices have suggested applying the objection code to all of their patients’ records and removing the code once patients have provided explicit consent.
The BMA would strongly advise practices against doing this because the HSCA creates a statutory obligation for GP practices to disclose the data to the HSCIC. In addition, it is a patient’s right to object, not that of the practice. As the law creates a legal obligation to disclose data, consent is not required. GP practices must meet their legal obligations under the HSCA, as well as their obligations under the Data Protection Act (DPA) to undertake fair processing (see FAQ 15).
The GPC has been in regular contact with NHS England and have been advised that they will be providing further information about awareness raising activities. Practices should therefore be reassured that they will not be solely responsible for making patients aware of care.data and they will be informed before any extractions take place. The GP guidance and FAQs have outlined the steps practices should take their patients aware of the extract. NHS England has been working with the Information Commissioner so that there is clarity about what GPs have to do in order to meet the fair processing component of the DPA. It has also been confirmed that data will not be extracted until the awareness raising activities have taken place.
The guidance and FAQs for GPs are available here.
Further information for patients and GPs, including a GP practice toolkit, are also available on the NHS England website.