This is the text of a letter that we wrote today to send to our Doctor's. Three weeks on from our story about this privacy breach from a supposedly "liberal" coalition government, I know many people who are opting out. You can too.
28th October 2013
Dear Doctor,
We are writing to give notice that we refuse consent for our identifiable information (and any information relating to our two children) to be transferred from your practice systems for any purpose other than our medical care.
As you are probably aware, on the direction of NHS England you can now be required to transfer patient-identifiable data from the electronic medical records that you hold to the Health and Social Care Information Centre (HSCIC), via the General Practice Extraction Service (GPES) or other means. This is to be done without seeking our explicit consent and for purposes other than our medical care.
There are substantial concerns about the privacy and confidentiality of any information transferred to HSCIC, not least because NHS England has been given legal exemptions to pass identifiable data gathered by HSCIC between itself and a range of regional processing centres, local area teams and commissioning bodies that came into force on April 1st 2013. We are also disturbed to note that HSCIC provides access to patient data, some in identifiable form, to a range of ‘customers’ including private companies.
We do not believe that these widely distributed systems with so many potential users and such a wide range of uses, some as yet undefined, can be regarded as secure. And no guarantees can be given as to the future re-identification of pseudonymised or de-identified data; indeed HSCIC admits this is a risk.
We cannot know what specific information our medical records might come to hold but we regard the entirety of our medical records, existing and future, as private and personal.
Please take whatever steps necessary to ensure our confidential personal information is not uploaded and record our dissent by whatever means possible.
This includes adding the ‘Dissent from secondary use of GP patient identifiable data’ code (Read v2: 9Nu0 or CVT3: XaZ89) to our records as well as the ‘Dissent from disclosure of personal confidential data by Health and Social Care Information Centre’ code (Read v2: 9Nu4 or CTV3: XaaVL).
We are aware of the implications of this request, we understand that it will not affect the care we receive and we would notify you should we change our mind.
We recognise the need for health care providers to be paid for services provided to us. We believe the limited information required for such purposes can be wholly anonymised by the provider, before it is released to the relevant commissioning authority. Please ensure that any of my information used for these purposes is treated in this way, and that any other providers are made aware of this mandate, e.g. by forwarding a copy of this letter along with my information when it is passed to them.
Further information for GPs can be found on the BMA website at:
http://bma.org.uk/practical-support-at-work/ethics/confidentiality-and-health-records/care-data
Yours sincerely,
28th October 2013
Dear Doctor,
We are writing to give notice that we refuse consent for our identifiable information (and any information relating to our two children) to be transferred from your practice systems for any purpose other than our medical care.
As you are probably aware, on the direction of NHS England you can now be required to transfer patient-identifiable data from the electronic medical records that you hold to the Health and Social Care Information Centre (HSCIC), via the General Practice Extraction Service (GPES) or other means. This is to be done without seeking our explicit consent and for purposes other than our medical care.
There are substantial concerns about the privacy and confidentiality of any information transferred to HSCIC, not least because NHS England has been given legal exemptions to pass identifiable data gathered by HSCIC between itself and a range of regional processing centres, local area teams and commissioning bodies that came into force on April 1st 2013. We are also disturbed to note that HSCIC provides access to patient data, some in identifiable form, to a range of ‘customers’ including private companies.
We do not believe that these widely distributed systems with so many potential users and such a wide range of uses, some as yet undefined, can be regarded as secure. And no guarantees can be given as to the future re-identification of pseudonymised or de-identified data; indeed HSCIC admits this is a risk.
We cannot know what specific information our medical records might come to hold but we regard the entirety of our medical records, existing and future, as private and personal.
Please take whatever steps necessary to ensure our confidential personal information is not uploaded and record our dissent by whatever means possible.
This includes adding the ‘Dissent from secondary use of GP patient identifiable data’ code (Read v2: 9Nu0 or CVT3: XaZ89) to our records as well as the ‘Dissent from disclosure of personal confidential data by Health and Social Care Information Centre’ code (Read v2: 9Nu4 or CTV3: XaaVL).
We are aware of the implications of this request, we understand that it will not affect the care we receive and we would notify you should we change our mind.
We recognise the need for health care providers to be paid for services provided to us. We believe the limited information required for such purposes can be wholly anonymised by the provider, before it is released to the relevant commissioning authority. Please ensure that any of my information used for these purposes is treated in this way, and that any other providers are made aware of this mandate, e.g. by forwarding a copy of this letter along with my information when it is passed to them.
Further information for GPs can be found on the BMA website at:
http://bma.org.uk/practical-support-at-work/ethics/confidentiality-and-health-records/care-data
Yours sincerely,
